  As a decentralized model training method, federated learning is designed to
integrate the isolated data islands and protect data privacy. Recent studies,
however, have demonstrated that the Generative Adversarial Network (GAN) based
attacks can be used in federated learning to learn the distribution of the
victim's private dataset and accordingly reconstruct human-distinguishable
images. In this paper, we exploit defenses against GAN-based attacks in
federated learning, and propose a framework, Anti-GAN, to prevent attackers
from learning the real distribution of the victim's data. The core idea of
Anti-GAN is to corrupt the visual features of the victim's private training
images, such that the images restored by the attacker are indistinguishable to
human eyes. Specifically, in Anti-GAN, the victim first projects the personal
dataset onto a GAN's generator, then mixes the fake images generated by the
generator with the real images to obtain the training dataset, which will be
fed into the federated model for training. We redesign the structure of the
victim's GAN to encourage it to learn the classification features (instead of
the visual features) of the real images. We further introduce an unsupervised
task to the GAN model for obfuscating the visual features of the generated
images. The experiments demonstrate that Anti-GAN can effectively prevent the
attacker from learning the distribution of the private images, meanwhile
causing little harm to the accuracy of the federated model.
