Privacy-Preserving Federated Learning

Differential privacy is a rigorous mathematical framework that quantifies and bounds the privacy loss from an individual's participation in data analysis. In federated learning, it is typically applied at the client level, ensuring the model cannot reveal whether any specific device/user contributed to training.

• Core Mechanism: Adds calibrated random noise (e.g., Gaussian, Laplace) to model updates or aggregated statistics.
• Key Parameters: Governed by epsilon (ε), which measures privacy loss (lower is stronger), and delta (δ), a small probability of the guarantee failing.
• Application: Algorithms like DP-FedAvg clip local client updates to bound sensitivity, then add noise before aggregation.

Secure Multi-Party Computation is a cryptographic protocol that allows multiple parties to jointly compute a function over their private inputs without revealing those inputs to each other. In federated learning, SMPC enables secure aggregation of model updates.

• How it Works: Client updates are secretly shared or encrypted. The server performs computations on these encrypted shares to obtain the aggregated model without ever decrypting any individual contribution.
• Privacy Guarantee: Provides information-theoretic or cryptographic security against curious servers and other clients.
• Trade-off: Introduces significant communication and computational overhead compared to non-cryptographic methods.

Homomorphic Encryption allows computations to be performed directly on encrypted data, producing an encrypted result that, when decrypted, matches the result of operations on the plaintext. It enables a federated learning server to aggregate encrypted client updates.

• Process: Clients encrypt their model updates locally and send the ciphertexts to the server. The server adds the ciphertexts homomorphically and returns the encrypted sum to a trusted party for decryption, or uses functional decryption.
• Strength: Offers a very strong cryptographic privacy guarantee, as the server only ever handles encrypted data.
• Limitation: Fully Homomorphic Encryption (FHE) is computationally intensive, making Partially Homomorphic Encryption (supporting only addition or multiplication) more practical for federated aggregation.

Local Differential Privacy is a model where each data owner perturbs their own data with a differentially private mechanism before sending it to an untrusted curator (server). It provides a strong, client-side privacy guarantee without needing to trust the central server.

• Client Control: Privacy is enforced at the source. The server receives only noised data, making breaches less consequential.
• Typical Mechanisms: Includes randomized response for categorical data and adding calibrated noise to numerical values.
• Use Case: Suitable for high-trust scenarios where even the aggregated statistics must be protected from the server, often at the cost of higher noise per client and reduced utility compared to central DP.

Secure Aggregation is a specific cryptographic protocol designed for federated learning that allows a server to compute the sum of client-held vectors (model updates) without learning any individual vector. It is a practical instantiation of SMPC for this sum operation.

• Protocol Flow: 1) Clients mask their updates with pairwise secret keys. 2) They send masked updates. 3) The server sums all masked updates. 4) Through cryptographic design, the masks cancel out, revealing only the aggregate sum.
• Robustness: Modern protocols can handle client dropouts during the round without compromising privacy or correctness.
• Benefit: Enables the use of DP with trusted server by ensuring the server only sees the noised aggregate, not individual noised updates.

In practice, hybrid approaches combine multiple techniques to balance privacy, utility, and efficiency. The most common combination pairs Differential Privacy with Secure Aggregation.

• DP + Secure Aggregation: Clients add DP noise to their clipped updates, then use secure aggregation to send them. This protects individual contributions from the server and provides a formal DP guarantee against any other party with access to the final aggregate.
• LDP + Shuffling: Local DP can be combined with a trusted shuffler that anonymizes client reports. This enables privacy amplification, where the effective privacy guarantee (ε) is stronger than the local guarantee applied by each client.
• Choice of Technique: Depends on the threat model (untrusted server vs. untrusted clients), desired privacy guarantee (cryptographic vs. statistical), and system constraints (communication, compute).

Banks and financial institutions can collaboratively build more accurate fraud detection models without exposing transaction details of their customers. Each bank trains on its own transaction logs. Techniques like secure multi-party computation (SMPC) or homomorphic encryption can be combined with federated averaging to compute a global model. This protects commercial data and client financial privacy while improving the system's ability to detect novel, cross-institutional fraud patterns.

Multiple factories or industrial plants can improve predictive maintenance models for machinery (e.g., turbines, assembly robots) by pooling insights from sensor data. Each plant's operational data, a critical intellectual property asset, remains on-premise. Federated learning aggregates failure pattern learnings, enabling all participants to benefit from a broader dataset. Differential privacy prevents inferring the specific operational conditions or failure rates of any single participant.

Retailers with physical and digital storefronts can build personalized recommendation models while keeping individual customer purchase histories decentralized. On-device learning can occur on a user's phone based on in-app behavior. Alternatively, store servers can train on local transaction data. A global model is built via federated averaging with secure aggregation, ensuring no single retailer's customer data or market basket insights are exposed to others, preserving competitive advantage.

The specific application of differential privacy where the protected entity is an entire client (device or user) in a federated learning system. The guarantee ensures that the released aggregated model does not reveal whether any single client participated in the training.

• Mechanism: Achieved by having each client clip their local model update to bound its sensitivity and add calibrated Gaussian noise before sending it to the server.
• Formal Guarantee: Provides a quantifiable (ε, δ)-DP guarantee against inference of client participation.
• Key Algorithm: DP-FedAvg (Differentially Private Federated Averaging) is the standard algorithm implementing this concept.

A secure, isolated area within a main processor (e.g., Intel SGX, ARM TrustZone) that guarantees confidentiality and integrity for code and data executing inside it. In federated learning, a TEE on the aggregation server can act as a trusted third party.

• Workflow: Clients send their encrypted updates to the server, which are decrypted and processed only inside the secure TEE for aggregation. The final model is then re-encrypted before leaving the TEE.
• Advantage: Reduces the need for heavy cryptography during computation, shifting trust to hardware-based isolation.
• Risk: Relies on the security of the specific hardware implementation and its attestation mechanisms.

The creation of artificial datasets that mimic the statistical properties of real, sensitive data without containing any actual private records. In a federated context, synthetic data can be generated locally on devices and shared for centralized training, or used to augment local datasets for better personalized federated learning.

• Privacy Link: When combined with differential privacy, the data generation process itself can be made private, providing a formal guarantee that the synthetic data does not leak information about the original training samples.
• Benefit: Enables data sharing and model debugging in scenarios where even model updates (gradients) are too sensitive to expose.