Federated Differential Privacy

The epsilon parameter quantifies the privacy loss allowed during training. A lower epsilon (e.g., ε=0.1) provides stronger privacy but adds more noise, while higher values (ε=8) preserve utility at the cost of weaker guarantees. This budget is consumed across training rounds—once exhausted, no further queries are permitted on that data partition.

• ε < 1: Strong privacy for high-sensitivity clinical data
• 1 ≤ ε ≤ 4: Balanced utility-privacy tradeoff
• ε > 4: Weaker guarantees, higher model accuracy

The delta parameter represents the probability that the privacy guarantee fails entirely. In (ε, δ)-differential privacy, δ bounds the chance of catastrophic leakage. For healthcare applications, δ must be cryptographically small—typically less than the inverse of the dataset size—to ensure no single record can be reconstructed.

• δ < 1/n² where n = number of patient records
• Ensures negligible risk of total privacy breach
• Often set to 10⁻⁶ or smaller in clinical deployments

Global sensitivity measures the maximum impact any single patient record can have on a model update. This value determines how much noise must be added—higher sensitivity requires more noise. In federated settings, clipping gradients to a fixed L2-norm bound constrains sensitivity, preventing outlier records from disproportionately influencing the global model.

• L2-norm clipping: Bounds individual gradient contributions
• Sensitivity = 2C / n where C is the clipping threshold
• Critical for balancing utility and privacy

The Gaussian mechanism adds calibrated random noise drawn from a normal distribution to model updates before aggregation. The noise scale is proportional to sensitivity / epsilon, ensuring the output distribution is nearly identical whether or not any single patient's data was included. This provides the formal (ε, δ)-differential privacy guarantee.

• Noise ~ N(0, σ²) where σ = (sensitivity · √(2·ln(1.25/δ))) / ε
• Preserves statistical utility while masking individual contributions
• Compatible with secure aggregation protocols

Differential privacy guarantees compose across multiple training rounds. The total privacy cost is bounded by the sum of epsilons (basic composition) or a tighter bound via advanced composition theorems. This forces careful budgeting: each federated round consumes a portion of the total allowable privacy loss.

• Sequential composition: ε_total = ε₁ + ε₂ + ... + ε_k
• Advanced composition: Tighter bounds using moment accountant
• Requires privacy accountants to track cumulative spend

Local DP adds noise on each client device before transmission, protecting against untrusted aggregators. Central DP adds noise at the server after collecting updates, offering better utility but requiring a trusted aggregator. Federated systems often use distributed DP—a hybrid where noise is split across clients using secure aggregation.

• Local DP: Maximum privacy, lower accuracy
• Central DP: Higher accuracy, requires trust
• Distributed DP: Balances both via secure multi-party computation

A finite, quantifiable resource representing the total allowable leakage of private information over a series of queries or training rounds. The epsilon (ε) parameter strictly controls this budget—lower epsilon values provide stronger privacy guarantees by injecting more noise, while higher values permit greater accuracy at the cost of reduced protection.

• Composition theorems track cumulative privacy loss across multiple training rounds
• Once the budget is exhausted, no further queries on the dataset are permitted
• Typical healthcare deployments target ε values between 1 and 8
• Moments Accountant: A technique for tighter privacy loss tracking in deep learning

A privacy breach where an adversary exploits access to a trained model's parameters or outputs to reconstruct sensitive features or raw samples from the original private training dataset. In healthcare, this could mean reconstructing identifiable patient faces from diagnostic models.

• Gradient inversion recovers training images from shared gradients
• Differential privacy provides provable resistance against such reconstruction
• Attack success correlates directly with model overfitting
• Demonstrates why sharing raw model updates without noise is dangerous

A privacy audit technique that determines whether a specific individual's health record was included in the training dataset of a model. Attackers train shadow models to recognize statistical differences in model confidence between members and non-members.

• Exposes sensitive patient associations (e.g., "was this person in a cancer study?")
• Differential privacy provides a mathematical bound on membership inference advantage
• Used as a standard benchmark for evaluating privacy-preserving ML systems
• HIPAA and GDPR consider membership disclosure a reportable breach

An architectural principle enforcing that only the statistically necessary information is extracted or transmitted from a local clinical dataset. This reduces the attack surface and aligns with GDPR's Article 5(1)(c) requirement.

• Local differential privacy applies noise before data leaves the device
• Reduces compliance burden by never centralizing raw patient records
• Pairs with federated learning to ensure only model updates—not data—move
• Shifts the paradigm from "collect then protect" to "protect by not collecting"