Differentially Private Federated Learning

DP-FL provides a user-level privacy guarantee, ensuring that the presence or absence of an entire local dataset from a specific client is indistinguishable in the final model. This is a stronger protection than record-level DP, achieved by bounding the influence of any single client's model update through gradient clipping and Gaussian noise injection before aggregation.

The standard algorithm extends Federated Averaging (FedAvg) with differential privacy. In each round:

• The server sends the global model to selected clients.
• Clients compute model updates on local data.
• Updates are clipped to a fixed L2 norm bound S.
• Calibrated Gaussian noise scaled to S and the privacy parameters (ε, δ) is added.
• Noisy updates are aggregated via secure summation.

DP-FL leverages privacy amplification by subsampling. In each training round, only a random subset of clients is selected to participate. Because an adversary cannot know if a specific client contributed to any given round, the effective privacy loss is significantly lower than if all clients participated every round. This is a critical factor in achieving tight ε bounds.

DP-FL typically operates under a central differential privacy trust model, where clients trust the aggregation server to add noise correctly and discard raw updates. This contrasts with Local Differential Privacy (LDP), where noise is added on-device. Central DP-FL achieves much higher utility for the same privacy budget because noise is added to the aggregated signal, not individual records.

Tracking cumulative privacy loss across multiple rounds of federated training is non-trivial. DP-FL uses advanced composition theorems like the Moments Accountant or Rényi Differential Privacy (RDP) to provide tight bounds on the total (ε, δ) consumed. The accountant converts per-round noise scales and sampling rates into a final, interpretable privacy guarantee.

The core tension in DP-FL is balancing model accuracy against the privacy budget ε. Key levers include:

• Noise multiplier: Higher noise improves privacy but degrades accuracy.
• Clipping threshold: Lower clipping reduces sensitivity but discards information.
• Number of clients per round: More clients improve the signal-to-noise ratio.
• Total training rounds: More rounds consume more privacy budget but may improve convergence.

Differentially Private Stochastic Gradient Descent is the fundamental algorithm that makes private deep learning possible. It operates by:

• Per-example gradient clipping: Bounding the L2 norm of each individual client's gradient update to a fixed threshold C to limit sensitivity.
• Noise injection: Adding calibrated Gaussian noise to the aggregated, clipped gradients before applying the model update.
• Privacy accounting: Tracking cumulative privacy loss using a Moments Accountant to ensure the total ε budget is not exceeded across communication rounds.

A phenomenon where randomly selecting a subset of clients to participate in each federated round amplifies the privacy guarantee. Because an adversary cannot know if a specific client's data was included in a training step, the effective privacy loss is significantly lower than processing the full cohort. This is often quantified using Rényi Differential Privacy (RDP) accounting, which provides tighter composition bounds than standard strong composition theorems when combined with Poisson sampling.

A sophisticated privacy accounting technique that tracks higher-order moments of the privacy loss random variable. Unlike basic composition theorems that sum ε values linearly, the Moments Accountant:

• Computes the log of the moment-generating function of the privacy loss.
• Provides tight, non-trivial bounds on the total privacy budget (ε, δ) consumed during iterative training.
• Is essential for DP-FedAvg, as naive composition would overestimate privacy loss and require prohibitive amounts of noise.

In federated learning, the relevant privacy granularity is user-level privacy, which protects all data points belonging to a single client. This is a stronger guarantee than example-level privacy, which only protects individual records. Achieving user-level DP requires bounding the total contribution of a user across all training steps. Techniques include:

• User-level gradient clipping: Clipping the sum of a user's gradients.
• Group privacy: Inflating ε by the number of examples per user if only example-level mechanisms are applied.

Secure Multi-Party Computation (SMPC) protocols are often combined with DP-FedAvg to protect gradients in transit. In this architecture:

• Clients encrypt their clipped, noise-perturbed updates before sending them to the server.
• The server computes the aggregated model update without ever decrypting individual client contributions.
• This provides a dual layer of defense: cryptographic security during transmission and differential privacy against inference from the published global model.

An alternative trust model where noise is added on the client device before any data or gradient leaves the user's control. This protects against a malicious aggregation server. The trade-off is utility: LDP introduces significantly more noise than the central model because each client must independently randomize its contribution. Common mechanisms include:

• Randomized Response for categorical data.
• Laplace or Gaussian mechanisms applied locally to gradient vectors before transmission.