Privacy Model & Data Flow

# On Client Device
class MyClient(NumPyClient):
    def fit(self, parameters, config):
        # 1. Receive global model parameters
        model.set_weights(parameters)
        
        # 2. Train on LOCAL data (never transmitted)
        model.fit(
            x_train,  # STAYS ON DEVICE
            y_train,  # STAYS ON DEVICE
            epochs=5
        )
        
        # 3. Return ONLY model updates
        return (
            model.get_weights(),  # Transmitted: model parameters
            len(x_train),         # Transmitted: dataset size
            {"loss": 0.5}          # Transmitted: metrics
        )

from syft_flwr import bootstrap

bootstrap(
    flwr_project_dir="./project",
    aggregator="[email protected]",
    datasites=["[email protected]"],
    transport="syftbox"
)

# Encryption enabled by default
# Keys auto-generated on first run

export SYFT_FLWR_ENCRYPTION_ENABLED=false
python main.py

~/.syftbox/datasites/{email}/
├── public/
│   └── x3dh/
│       ├── identity_key.pub      # Public identity key
│       ├── signed_prekey.pub     # Public signed prekey
│       └── onetime_prekeys/      # Public one-time prekeys
│           ├── prekey_001.pub
│           └── prekey_002.pub
│
└── private/
    └── x3dh/
        ├── identity_key.priv     # Private identity key
        ├── signed_prekey.priv    # Private signed prekey
        └── onetime_prekeys/      # Private one-time prekeys
            ├── prekey_001.priv
            └── prekey_002.priv

# src/syft_flwr/utils.py
from syft_crypto.x3dh_bootstrap import ensure_bootstrap

def setup_client(app_name: str, project_dir: Optional[Path] = None):
    client = create_client(project_dir=project_dir)
    
    encryption_enabled = os.environ.get("SYFT_FLWR_ENCRYPTION_ENABLED", "true").lower() != "false"
    
    if encryption_enabled and not isinstance(client, SyftP2PClient):
        # Generate keys if they don't exist
        client = ensure_bootstrap(client)
        logger.info("🔐 End-to-end encryption is ENABLED")
    
    return client, encryption_enabled, f"flwr/{app_name}"

# src/syft_flwr/fl_orchestrator/syft_grid.py
def _send_encrypted_message(self, msg_bytes: bytes, dest_datasite: str, msg: Message):
    # Base64 encode for encrypted transmission
    encoded_body = base64.b64encode(msg_bytes).decode("utf-8")
    
    # Send with encrypt=True
    future_id = self._rpc.send(
        to_email=dest_datasite,
        app_name=self.app_name,
        endpoint="messages",
        body=encoded_body.encode("utf-8"),
        encrypt=True  # Triggers X3DH encryption
    )
    
    logger.debug(f"🔐 Pushed ENCRYPTED message to {dest_datasite}")
    return future_id

# src/syft_flwr/fl_orchestrator/flower_client.py
class RequestProcessor:
    def decode_request_body(self, request_body: Union[bytes, str]) -> bytes:
        if not self.message_handler.encryption_enabled:
            return request_body
        
        # Decode base64
        if isinstance(request_body, bytes):
            request_body_str = request_body.decode("utf-8")
        else:
            request_body_str = request_body
        
        decoded = base64.b64decode(request_body_str)
        logger.debug("🔓 Decoded base64 message")
        return decoded

# src/syft_flwr/rpc/p2p_file_rpc.py
def send(self, to_email: str, app_name: str, endpoint: str, 
         body: bytes, encrypt: bool = False) -> str:
    if encrypt:
        logger.warning(
            "Encryption not supported in P2PFileRpc, sending unencrypted"
        )
    
    # Write plaintext to Google Drive
    # Relies on Google's transport security (HTTPS)
    self._gdrive_io.write_to_outbox(...)

# Syft-Flwr transmits model weights
weights = model.get_weights()

# Sophisticated adversary might infer training data characteristics
# Mitigation: Use differential privacy (not built into Syft-Flwr)

# List all messages sent to a client
ls -lh ~/.syftbox/datasites/[email protected]/app_data/my_fl_app/rpc/messages/

# Output:
# -rw-r--r-- 1 user user 2.3M Mar 02 10:15 a1b2c3d4.request
# -rw-r--r-- 1 user user 2.4M Mar 02 10:16 a1b2c3d4.response
# -rw-r--r-- 1 user user 2.3M Mar 02 11:20 e5f6g7h8.request
# -rw-r--r-- 1 user user 2.4M Mar 02 11:21 e5f6g7h8.response

from pathlib import Path
from syft_flwr.serde import bytes_to_flower_message

# Read message file
msg_path = Path("~/.syftbox/datasites/[email protected]/app_data/my_fl_app/rpc/messages/a1b2c3d4.request").expanduser()
msg_bytes = msg_path.read_bytes()

# Deserialize
message = bytes_to_flower_message(msg_bytes)

print(f"Message type: {message.metadata.message_type}")
print(f"From node: {message.metadata.src_node_id}")
print(f"To node: {message.metadata.dst_node_id}")
print(f"Round: {message.metadata.group_id}")

from syft_crypto import EncryptedPayload, decrypt_message
from syft_core import Client

# Read encrypted message
msg_bytes = msg_path.read_bytes()

# Parse as encrypted payload
encrypted = EncryptedPayload.model_validate_json(msg_bytes.decode())

print(f"Encrypted by: {encrypted.sender}")
print(f"Encrypted for: {encrypted.recipient}")
print(f"Key exchange: X3DH")

# Decrypt (requires recipient's private key)
client = Client.load()
plaintext = decrypt_message(encrypted, client=client)
message = bytes_to_flower_message(plaintext)

# Encryption status is always logged
logger.info("🔐 End-to-end encryption is ENABLED for FL messages")
logger.warning("⚠️ End-to-end encryption is DISABLED for FL messages")

# Message transmission is logged
logger.debug("🔐 Pushed ENCRYPTED message to [email protected], size 2.3 MB")
logger.debug("📤 Pushed PLAINTEXT message to [email protected], size 2.3 MB")

# Decryption is logged
logger.debug("🔓 Successfully decrypted message")
logger.debug("📥 Received PLAINTEXT message")

# Development: encryption optional
export SYFT_FLWR_ENCRYPTION_ENABLED=false

# Production: encryption required
unset SYFT_FLWR_ENCRYPTION_ENABLED  # Defaults to true

# Backup old keys
mv ~/.syftbox/datasites/[email protected]/private/x3dh ~/.syftbox/datasites/[email protected]/private/x3dh.backup

# Generate new keys on next run
python main.py  # Auto-generates new keys

class PrivacyAwareClient(NumPyClient):
    def fit(self, parameters, config):
        model.set_weights(parameters)
        model.fit(x_train, y_train, epochs=5)
        
        # Only return aggregated metrics
        return (
            model.get_weights(),
            len(x_train),  # OK: dataset size
            {"loss": avg_loss}  # OK: aggregated metric
            # DON'T return: per-sample losses, gradients, embeddings
        )

# Only allow known participants
bootstrap(
    flwr_project_dir="./project",
    aggregator="[email protected]",
    datasites=[
        "[email protected]",
        "[email protected]"
    ],
    transport="syftbox"
)

# Server-side validation
class SecureStrategy(FedAvg):
    def aggregate_fit(self, server_round, results, failures):
        # Check for suspiciously large updates
        for client_proxy, fit_res in results:
            weights = parameters_to_ndarrays(fit_res.parameters)
            total_size = sum(w.nbytes for w in weights)
            
            if total_size > 100_000_000:  # 100 MB
                logger.warning(f"Client {client_proxy.cid} sent large update: {total_size/1e6:.1f} MB")
        
        return super().aggregate_fit(server_round, results, failures)

from opacus import PrivacyEngine

class DPClient(NumPyClient):
    def fit(self, parameters, config):
        model.set_weights(parameters)
        
        # Attach privacy engine
        privacy_engine = PrivacyEngine()
        model, optimizer, train_loader = privacy_engine.make_private(
            module=model,
            optimizer=optimizer,
            data_loader=train_loader,
            noise_multiplier=1.1,
            max_grad_norm=1.0,
        )
        
        # Train with DP guarantees
        model.fit(train_loader, epochs=5)
        
        epsilon = privacy_engine.get_epsilon(delta=1e-5)
        logger.info(f"Privacy budget: ε={epsilon:.2f}")
        
        return model.get_weights(), len(train_loader.dataset), {"epsilon": epsilon}