Differential Privacy in Federated Learning (DP-FedAvg)

Before aggregation, each client bounds the L2 norm of individual per-sample gradients to a fixed threshold C. This limits the sensitivity of the update—the maximum influence any single data point can have on the model. Without clipping, an outlier data point could dominate the gradient, leaking information. The clipped gradient is then noised, ensuring the contribution is both bounded and private.

After clipping, calibrated Gaussian noise is added to the sum of clipped gradients on each client. The noise scale σ is derived from the privacy budget ε and the clipping threshold. This mechanism satisfies (ε, δ)-differential privacy, where δ bounds the probability of a catastrophic privacy failure. The noise masks the contribution of any single record, making the aggregated update statistically indistinguishable from one computed without that record.

DP-FedAvg uses a moments accountant to track cumulative privacy loss across communication rounds. Each round consumes a portion of the total ε budget. The accountant provides a tight bound on the overall privacy guarantee, enabling a precise privacy-utility trade-off. Training halts when the budget is exhausted, preventing unbounded leakage over time. This is critical for compliance with regulations like GDPR's data minimization principle.

DP-FedAvg is often combined with secure aggregation protocols using Shamir's secret sharing or homomorphic encryption. The server receives only the encrypted, noised sum of updates and cannot inspect individual client contributions. This dual-layer defense—cryptographic hiding plus statistical noise—protects against an honest-but-curious server that might attempt gradient leakage attacks to reconstruct training samples from raw updates.

DP-FedAvg supports two distinct granularities of protection. Record-level DP protects individual training examples within a client's local dataset. Client-level DP protects the entire participation of a user or device, ensuring the model update does not reveal whether a specific client contributed at all. Client-level DP is achieved by clipping and noising the entire local model update rather than per-example gradients, providing stronger guarantees for cross-device FL.

When only a random subset of clients participates in each round, privacy amplification by subsampling occurs. The probability that any specific record is included in a round is reduced, which multiplicatively strengthens the privacy guarantee. The moments accountant captures this amplification, allowing a smaller effective ε for the same noise scale. This makes DP-FedAvg practical at scale, where thousands of clients exist but only hundreds are sampled per round.

A preprocessing step that bounds the L2 norm of individual per-sample gradients before noise is added. Clipping limits the maximum sensitivity of the query, which directly determines the scale of noise required for a given epsilon. Without clipping, a single outlier data point could require infinite noise to mask. The clipping threshold is a critical hyperparameter balancing privacy and utility.

The fundamental tension in DP-FedAvg between model accuracy and privacy guarantees. Adding noise to satisfy differential privacy inevitably degrades model performance. This trade-off is governed by:

• Epsilon value: Lower epsilon increases privacy but reduces accuracy
• Number of clients: More clients can offset noise through statistical averaging
• Dataset size: Larger local datasets allow tighter clipping with less utility loss