PaperlayerView exact revision on arXiv

Source-linked AI summary

Federated Learning with Differential Privacy: Algorithms and Performance Analysis

Kang Wei, Jun Li, Ming Ding, Chuan Ma, Howard H. Yang, Farokhi Farhad, Shi Jin, Tony Q. S. Quek, H. Vincent Poor

arXiv:1911.00222v2cs.LGcs.NI

TL;DR

The paper addresses information leakage from federated-learning parameters despite local data retention. It proposes NbAFL, which adds client-side noise before aggregation, proves privacy and convergence properties, and evaluates them with simulations. The analysis also covers random client scheduling and identifies privacy–convergence tradeoffs and optimal participation choices.

  • Problem

    Federated learning can still divulge private information through uploaded parameters, while prior DP-based FL work lacked uploading-stage protection and detailed theoretical convergence analysis.

  • Method

    NbAFL adds artificial noise to clients’ trained parameters before server aggregation and derives differential-privacy and convergence bounds, including for K-random scheduling.

  • Results

    The analysis proves privacy under suitable noise variances and identifies tradeoffs among privacy, convergence, client count, aggregation rounds, and K; simulations agree with the theoretical results.

  • Takeaways & Limitations

    The bounds and scheduling analysis support designing privacy-preserving FL architectures for different tradeoff requirements between convergence performance and privacy levels.

Abstract

from arXiv · show

In this paper, to effectively prevent information leakage, we propose a novel framework based on the concept of differential privacy (DP), in which artificial noises are added to the parameters at the clients side before aggregating, namely, noising before model aggregation FL (NbAFL). First, we prove that the NbAFL can satisfy DP under distinct protection levels by properly adapting different variances of artificial noises. Then we develop a theoretical convergence bound of the loss function of the trained FL model in the NbAFL. Specifically, the theoretical bound reveals the following three key properties: 1) There is a tradeoff between the convergence performance and privacy protection levels, i.e., a better convergence performance leads to a lower protection level; 2) Given a fixed privacy protection level, increasing the number $N$ of overall clients participating in FL can improve the convergence performance; 3) There is an optimal number of maximum aggregation times (communication rounds) in terms of convergence performance for a given protection level. Furthermore, we propose a $K$-random scheduling strategy, where $K$ ($1<K<N$) clients are randomly selected from the $N$ overall clients to participate in each aggregation. We also develop the corresponding convergence bound of the loss function in this case and the $K$-random scheduling strategy can also retain the above three properties. Moreover, we find that there is an optimal $K$ that achieves the best convergence performance at a fixed privacy level. Evaluations demonstrate that our theoretical results are consistent with simulations, thereby facilitating the designs on various privacy-preserving FL algorithms with different tradeoff requirements on convergence performance and privacy levels.

I. INTRODUCTION

Federated learning keeps data local but can still leak private information through uploaded model parameters. This paper proposes a differentially private FL framework and analyzes its privacy–convergence tradeoffs theoretically and empirically.

  • Motivation: Federated learning trains on clients’ local data without exchanging personal datasets, but uploaded parameters can still reveal private information.The paper notes that adversaries may infer information from parameter differences or intermediate client models.
  • Related Work: Existing differentially private FL studies address privacy–convergence tradeoffs but lack protection during parameter uploading and detailed theoretical convergence analysis.Prior approaches were reported mainly through simulations and did not fully analyze privacy, convergence performance, and convergence rate.
  • Contributions: NbAFL adds artificial noise to each client’s trained parameters before uploading them for server aggregation.The framework is designed to prevent information leakage while preserving the FL aggregation workflow.
  • Contributions: The paper proves that NbAFL can satisfy differential privacy under suitable Gaussian-noise variances and derives a convergence bound for its loss function.The analysis also specifies server-side noise for downlink protection under the stated exposure model.
  • Convergence Analysis: The convergence analysis identifies tradeoffs involving privacy level, client count, and aggregation rounds, including an optimal number of rounds for a fixed protection level.Relaxing privacy protection by increasing ǫ reduces artificial-noise variance and improves convergence performance.
  • Client Scheduling: The proposed K-random scheduling strategy retains the three convergence properties and has an optimal K for fixed privacy, with simulations consistent with the theory.K clients are randomly selected from N clients in each aggregation.

C. Differential Privacy

This section defines differential privacy for federated learning and develops the noise mechanisms and sensitivity conditions used to protect both uplink and downlink communications. It motivates noising before aggregation and derives server-side noise requirements for global privacy.

  • DP foundations: (ε, δ)-DP bounds how distinguishable outputs can be on neighboring datasets, with larger ε indicating greater privacy-violation risk.The Gaussian mechanism adds noise calibrated to sensitivity, ε, and δ.
  • NbAFL privacy mechanism: NbAFL adds calibrated perturbations at clients and, when required, at the server to satisfy a global (ε, δ)-DP requirement across uplink and downlink channels.Client parameters are clipped before local sensitivity and noise scales are determined.
  • Uplink privacy: For uplink privacy, Gaussian noise is scaled to local sensitivity and the number L of parameter exposures, reflecting repeated releases from each client.The local sensitivity depends on the clipping threshold C and minimum local dataset size m.
  • Sensitivity after aggregation: Using equal client weights, pi = 1/N, minimizes the sensitivity associated with aggregation and supports the privacy calibration of the downlink mechanism.The paper identifies equal local-dataset weights as the ideal condition for small global sensitivity after aggregation.
  • Downlink privacy: Downlink privacy requires additional server noise because aggregated parameters are broadcast over T rounds and may expose individual-client information.Theorem 1 relates the required noise variance to aggregation times T, participating clients N, and uplink exposures L.

B. Proposed NbAFL

NbAFL perturbs client parameters before upload, aggregates the noised parameters, and adds theorem-calibrated server noise before broadcasting. This workflow is designed to reduce inference risk from both uploaded and aggregated parameters.

  • Client-side noising: Each client adds noise to its trained and clipped parameters before uploading them for server aggregation.The algorithm repeats local training, clipping, perturbation, and upload during each aggregation round.
  • Server aggregation and broadcast: The server aggregates the noised local parameters with different weights, adds downlink noise according to Theorem 1, and broadcasts the resulting global parameters.Clients use the received global parameters for local testing and the next training round until T aggregations are completed.
  • Privacy rationale: Local perturbations make it difficult to infer an individual client’s information from uploaded parameters, while broadcast aggregation remains a privacy threat addressed by server-side noise.The paper explicitly distinguishes privacy risks on uploaded parameters from those arising after aggregation.

IV. CONVERGENCE ANALYSIS ON NBAFL

The NbAFL convergence analysis derives expected loss-increment and global convergence bounds under differential privacy, showing how noise, privacy, client count, and aggregation rounds interact. The results identify tradeoffs in privacy–utility tuning and an optimal aggregation horizon.

  • Assumptions: The analysis assumes convex, Polyak–Łojasiewicz, Lipschitz, smoothness, and bounded gradient-divergence properties for local and global loss functions.These assumptions support the expected-increment and convergence-bound derivations.
  • Expected loss increment: Artificial noise increases the expected loss difference between consecutive aggregations, potentially deteriorating convergence performance.The analysis links this effect to the noise variance σA and the loss-increment bound.
  • Convergence bound: Theorem 2 gives an upper bound on the gap between the achieved loss after T aggregations and the minimum loss under required protection level ǫ.The bound is derived under the global (ǫ, δ)-DP requirement.
  • Aggregation rounds: As T increases, one term in the convergence bound decreases while another increases, creating a tradeoff in selecting aggregation rounds.Under the stated conditions, the bound can be convex in T.
  • Privacy–utility tradeoff: Increasing ǫ improves convergence performance because it relaxes privacy protection and reduces artificial-noise variance.The expected gap between achieved and minimum loss is a decreasing function of ǫ.
  • Client population: A larger number of clients N improves iterative convergence performance because it lowers the variance of artificial noises.This conclusion is stated for the analyzed NbAFL setting.
  • Aggregation rounds: There is an optimal maximum aggregation time T for given ǫ and N because additional iterations can help when noise is small but hurt when noise variance grows.The paper characterizes this as a tradeoff between iteration benefits and privacy-induced noise.

V. K-CLIENT RANDOM SCHEDULING POLICY

The paper extends NbAFL to K-random scheduling, where K of N clients participate in each aggregation, and derives corresponding privacy and convergence analyses. The bound retains the main privacy–utility relationships and implies an optimal client-selection size.

  • Scheduling policy: K-random scheduling selects K clients, with 1 < K < N, to participate in each aggregation.The setting considers partial client participation rather than all-client aggregation.
  • Privacy guarantee: Scheduled clients add uplink Gaussian noise with scale σU = cL∆sU/ǫ to satisfy global (ǫ, δ)-DP.The uplink scale is equivalent to the all-clients selection case because each client considers its own uplink privacy.
  • Privacy guarantee: The downlink noise standard deviation is recalculated as a function of the number of selected clients K.Lemma 4 provides the DP guarantee for K-random scheduling.
  • Convergence analysis: Theorem 3 gives a convergence upper bound after T aggregation times for protection level ǫ and selected-client count K.The bound relates convergence under K-random scheduling to privacy and participation parameters.
  • Convergence analysis: An optimal K between 0 and N can achieve the best convergence performance, making K-random scheduling superior to all-client participation in the analyzed setting.This conclusion follows from the convergence bound at a fixed protection level.

VI. SIMULATION RESULTS

The simulations evaluate NbAFL on MNIST while varying privacy protection levels, clients, aggregation rounds, and selected clients. The supplied figure passages document comparisons of training loss and training accuracy across three protection levels for 50 clients.

  • Experimental design: The experiments use an MLP and real-world federated datasets while varying ǫ, N, T, and K to characterize NbAFL convergence.The supplied experiment description identifies these four varied factors.
  • Experimental setup: The MNIST experiment uses 60000 training examples, 10000 testing examples, and a one-hidden-layer MLP with 256 hidden units.The model uses ReLU units, softmax over 10 classes, and cross-entropy loss.
  • Training loss: Figure 2 compares training loss for 50 clients at protection levels ǫ = 50, ǫ = 60, and ǫ = 100.The caption specifies the compared protection levels and client count.
  • Training accuracy: Figure 3 compares training accuracy for 50 clients at protection levels ǫ = 50, ǫ = 60, and ǫ = 100.The caption specifies the compared protection levels and client count.

A. Performance Evaluation on Protection Levels

The evaluation examines how privacy levels, client participation, aggregation rounds, and random scheduling affect NbAFL convergence. Results support the theoretical tradeoffs and identify optimal settings for aggregation times and chosen clients.

  • Number of clients N: More participating clients improve convergence because they enlarge the global training data and reduce additive-noise standard deviation after aggregation.The experiments compare N = 50, 60, 80, and 100 at ǫ = 60.
  • Maximum aggregation times T: A lower privacy level produces larger convergence gains because it reduces additive-noise standard deviation and improves the quality of aggregated parameters.Theoretical bounds use ǫ = 50, 60, and 100; experiments compare theoretical and experimental results at ǫ = 60 and 100.
  • Maximum aggregation times T: For a fixed ǫ, the loss is convex in maximum aggregation times, and an optimal number of rounds increases nearly with ǫ.Theoretical and experimental results are compared for NbAFL with 50 clients.
  • Number of chosen clients K: An optimal K exists because random scheduling trades enhanced privacy protection against including larger global training datasets in each update.For a given protection level, K-random scheduling achieves a better tradeoff than normal selection.
  • Overall evaluation: Theoretical convergence results are consistent with simulations across the evaluated privacy, client-count, aggregation-time, and scheduling settings.The paper reports extensive simulation confirmation of its analysis.

APPENDIX A PROOF OF LEMMA 1

The proof establishes privacy-noise relationships for uplink and downlink communication in the NbAFL framework. It uses sensitivity bounds and Gaussian-mechanism noise scales to derive the required protection guarantees.

  • Noise calibration: Uplink client noise is calibrated as σU = cL∆sU/ǫ under the Gaussian mechanism.The calibration follows the linear relation between ǫ and σU.
  • Noise calibration: Each client uses independently identically distributed local noise, consistent with the same global (ǫ, δ)-DP requirement.The local noise vectors are sampled from a common distribution.
  • Downlink sensitivity: Setting pi = 1/N reduces downlink sensitivity during aggregation.The passage links this choice to obtaining a small sensitivity ∆sD.
  • Downlink sensitivity: Downlink server noise is calibrated as σA = cT∆sD/ǫ, with ∆sD = 2C/mN.The scale is derived from the downlink sensitivity under the Gaussian mechanism.

APPENDIX D PROOF OF LEMMA 3

The proof analyzes the noisy aggregation update used in NbAFL under convexity-related conditions. It combines the update relation with inequalities governing local subproblems and parameter deviations.

  • Noisy aggregation: The (t + 1)-th aggregation explicitly includes artificial noise added by both clients and the server.This noisy aggregation relation is the starting point for the convergence analysis.
  • Convergence inequalities: The proof combines the aggregation relation with the expectations of global and local loss gradients.It uses F(ew(t)) = E{Fi(ew(t))} and ∇F(ew(t)) = E{∇Fi(ew(t))}.
  • Convergence inequalities: Under µ-convexity, the local objective Ji(w; ew(t)) satisfies the condition required for the subsequent bound.The proof assumes µ = µ − ρ > 0.
  • Convergence inequalities: The argument then applies inequalities and the triangle inequality to bound the noisy update in the convex case.The proof references inequalities (46)–(49) before obtaining the convex-case result.

APPENDIX E PROOF OF THEOREM 2

The proof of Theorem 2 applies the Polyak-Lojasiewicz condition and recursively bounds expected loss relative to the optimum. It also incorporates the independent additive-noise moments and the downlink noise scale.

  • Assumption: The proof assumes that F satisfies the Polyak-Lojasiewicz inequality with positive parameter l.This condition supplies the inequality used in the theorem’s loss analysis.
  • Expected loss bound: Subtracting E{F(w∗)} expresses the analysis in terms of expected loss above the optimum.Here F(w∗) is the loss corresponding to optimal parameters w∗.
  • Expected loss bound: Independent additive-noise distributions allow the proof to use time-invariant first and second expected noise moments.The moments are defined identically for 0 ≤ t ≤ T.
  • Boundary condition: The theorem’s derivation considers T > L/N after excluding the special case where σD = 0.The condition is introduced after noting the special case associated with T = L/N.
  • Final bound: The proof substitutes the downlink noise scale and sets ∆sD = 1/N and F(w(0)) − F(w∗) = Θ to obtain the final bound.The substitution uses σA = ∆sDT c/ǫ.

APPENDIX F PROOF OF LEMMA 4

The proof derives client-side Gaussian-noise conditions for satisfying differential privacy under global downlink protection, using sampling, sensitivity, aggregation, and privacy parameters. It treats separate parameter regimes and concludes after establishing the required inequalities.

  • Privacy setup: The sampling parameter q is defined as K/N, representing each client’s server-selection probability in an aggregation.The proof also introduces sequences of model states and outcomes for the privacy analysis.
  • Privacy setup: The proof analyzes global (ε, δ)-DP in downlink channels through the standard deviation σA of aggregated Gaussian noise.Neighboring datasets and additive-noise independence are used in the derivation.
  • Noise conditions: The required noise scale is obtained by bounding the privacy quantity by ε and imposing conditions involving ε and the aggregation count T.The derivation explicitly states that ε and T must satisfy additional constraints.
  • Noise conditions: When bε/T lies in (0, 1), setting σA = c∆sDT/bε allows the resulting inequality to be solved for the noise requirement.A separate expression is also given for the regime bε/T > 1 after adjusting c.
  • Conclusion: The argument concludes by deriving the server-side additive noise scale from client-side Gaussian noises and completing the proof.The final steps connect client noise to the aggregated server noise.

APPENDIX G PROOF OF THEOREM 3

The proof establishes a convergence inequality for K-random scheduling by combining Lipschitz continuity, sensitivity control, independent additive noise, and recursive bounds. It then applies the resulting relations to expected loss differences and completes the theorem.

  • K-random scheduling: Under K-random scheduling, the proof considers aggregated parameters and uses the β-Lipschitz properties of Fi(·) and F(·).The scheduling analysis sets the relevant client-data contribution to 1/K to obtain small sensitivity ∆sD.
  • Regularity and noise: The proof invokes β as the Lipschitz continuity constant of F and uses independence between successive noise terms in the convergence analysis.The independence assumption supports the subsequent recursive treatment.
  • Expected loss bound: Combining prior inequalities yields a bound on the expected loss difference E{F(ev(t+1)) − F(ev(t))}.The proof explicitly takes expectation of the one-step loss change before applying later conditions.
  • Expected loss bound: For Θ > 0 and initial gap f(v(0)) − f(w∗) = Θ, the proof derives a corresponding convergence relation.The initial optimality gap is introduced as a condition for the bound.
  • Recursive conclusion: Choosing the penalty parameter µ so that α2 < 0 and applying the earlier inequality produces the final recursive convergence bound.The proof defines Q = 1 + 2lα2 before substitution and concludes after applying the bound recursively.
Loading 1911.00222v2…