Source-linked AI summary
Federated Learning of Gboard Language Models with Differential Privacy
Zheng Xu, Yanxiang Zhang, Galen Andrew, Christopher A. Choquette-Choo, Peter Kairouz, H. Brendan McMahan, Jesse Rosenstock, Yuanbo Zhang
TL;DR
Cross-device federated learning cannot ensure uniform client sampling, complicating formal privacy guarantees for production language models. The paper applies DP-FTRL and complementary training strategies, and reports more than twenty Gboard LMs trained and launched with formal DP guarantees.
Problem
Cross-device FL systems cannot ensure uniform client sampling, limiting the use of sampling-based amplification to obtain strong formal DP guarantees.
Source: §1 · p. 2Method
The paper applies DP-FTRL in federated training and develops adaptive clipping, client-participation strategies, and pretraining for production Gboard LMs.
Source: §1 · p. 2Results
More than twenty Gboard LMs were trained and launched with formal DP guarantees for NWP, SC, and OTF features.
Source: §4 · p. 11Takeaways & Limitations
All Gboard next-word-prediction neural LMs now have DP guarantees, and future Gboard neural-LM launches will require them.
Source: §1 · p. 3SecAgg training requires a challenging large report goal and remains notably slower.
Source: §2.4 · p. 9
Abstract
from arXiv · showhide
We train language models (LMs) with federated learning (FL) and differential privacy (DP) in the Google Keyboard (Gboard). We apply the DP-Follow-the-Regularized-Leader (DP-FTRL)~\citep{kairouz21b} algorithm to achieve meaningfully formal DP guarantees without requiring uniform sampling of client devices. To provide favorable privacy-utility trade-offs, we introduce a new client participation criterion and discuss the implication of its configuration in large scale systems. We show how quantile-based clip estimation~\citep{andrew2019differentially} can be combined with DP-FTRL to adaptively choose the clip norm during training or reduce the hyperparameter tuning in preparation for training. With the help of pretraining on public data, we train and deploy more than twenty Gboard LMs that achieve high utility and $\rho-$zCDP privacy guarantees with $\rho \in (0.2, 2)$, with two models additionally trained with secure aggregation~\citep{bonawitz2017practical}. We are happy to announce that all the next word prediction neural network LMs in Gboard now have DP guarantees, and all future launches of Gboard neural network LMs will require DP guarantees. We summarize our experience and provide concrete suggestions on DP training for practitioners.
1 Introduction
The introduction describes Gboard language-model features and the challenge of providing formal differential privacy in cross-device federated learning without uniform client sampling. It presents DP-FTRL training strategies and the deployment of more than twenty Gboard models with formal DP guarantees.
1 Introduction
- Gboard LMs support NWP, inline Smart Compose suggestions, and On-The-Fly rescoring of candidate words during typing.NWP suggests a word after one is committed; SC can offer longer suggestions per character when confidence is high; OTF re-ranks candidates before commitment.Source: §1 · p. 1
- SC is a downstream task that reuses NWP language models without retraining.Source: §1 · p. 1
- DP-FTRL supports strong privacy and utility without uniform client sampling, which cross-device systems cannot guarantee because participation depends on local device criteria.Eligible devices may need to be charging and connected to an unmetered network.Source: §1 · p. 2
- The paper introduces adaptive clipping for DP-FTRL, studies client participation and system configuration, and applies pretraining to improve privacy and utility.The authors describe pretraining on user data as, to their knowledge, the first such application to training a DP model.Source: §1 · p. 2
- More than twenty Gboard LMs were trained and launched with formal DP guarantees for NWP, SC, and OTF, and future neural-LM launches will require DP.Two models were additionally trained with secure aggregation.Source: §1 · p. 3
2 DP FL in Practice
The section develops practical DP-FTRL training choices for Gboard LMs, combining adaptive clipping, client-participation controls, public pretraining, and secure aggregation. It concludes with a production-oriented workflow for balancing privacy, utility, and system constraints.
2.1 DP-FTRL and adaptive clipping
- Adaptive clipping in DP-FTRL tracks a private quantile estimate and activates its clip norm at tree restarts, but restarts inflate model noise and complicate privacy accounting.Fixed clipping is more robust in large-report-goal experiments; for en-GB NWP, the adaptive estimate stabilized at 5 and its accuracy eventually caught up.Source: §2.1 · pp. 3–4
2.2 DP parameters and system configuration
- For fixed rounds, larger report goals and MinS can strengthen privacy, but population size and the report goal constrain achievable separation.With report goal 6500 and a population around 10^6, MinS must be below 153 rounds, making strong guarantees difficult over 3000 rounds.Source: §2.2 · pp. 5–6, Figure 4 · p. 5
- Across more than three Gboard tasks, report goal 6500 with noise multiplier 7 had similar or slightly better final utility than report goal 500 with noise multiplier 0.54, and larger goals sped early learning.A client timer can increase MinS, but system factors make it difficult to optimize the timer period.Source: §2.2 · p. 6
2.3 Public pretraining
- ∼1000 fewer rounds are needed to reach a utility threshold with public pretraining at the same noise multiplier, which improves privacy guarantees.The production models use separate input and output embeddings and pretrain on half of C4; shared embeddings make fine-tuning challenging, and further pretraining can have diminishing returns.Source: §2.3 · p. 6
2.4 Combining with secure aggregation
- SecAgg limits the server to aggregate updates; clipped client updates are scaled, rotated, discretized, securely summed, and sensitivity-adjusted for DP-FTRL accounting.The analysis is for central DP with an honest-but-curious server, and the accounting uses the inflated sensitivity rather than the original clip norm.Source: §2.4 · pp. 6–9
- SecAgg training remains notably slower, and its large report-goal requirement challenges practical system configuration.The authors identify communication compression, methods to reduce report goals, and embedding compression as possible future improvements.Source: §2.4 · p. 9
2.5 Recommended strategies and practices
- The recommended workflow pretrains when possible, selects privacy and utility targets through public-data experiments, configures report goal and MinS, then applies adaptive clipping or SecAgg as appropriate.If adaptive clipping fails, the authors recommend tuning its quantile and server learning rate in smaller-report-goal runs, then fixing the clip norm for larger-report-goal training.Source: §2.5 · p. 9
3 Deploying DP LMs
The deployed DP language models show strong utility across several Gboard tasks and formal privacy guarantees. Results also illustrate how training duration and client participation configuration affect privacy and downstream Smart Compose performance.
A/B test metrics
- A/B utility measures include Picked Rate, Accuracy, Trigger Rate, Word Modified Ratio, and Words Per Minute.Word Modified Ratio improves when it decreases; the privacy accounting uses zCDP, which can be converted to (ϵ, δ)-DP.Source: §3 · p. 9
Experimental setup
- Final deployment training used DP-FTRL with a fixed clip and large report goal after public-data pretraining and adaptive-clip tuning with report goal 500.The reported final-model configuration uses report goal 6,500 and noise multiplier 7; the tuning stage estimates the clip norm and tunes server learning rate.Source: §3 · pp. 10–11
Result analysis
- DP NWP models significantly improve utility over prior N-gram models in five European languages and match or slightly exceed strong non-private models on en-US, pt-BR, and en-IN.Tables 1–2 report live A/B tests of DP NWP and OTF models; the analysis also reports successful SecAgg use on en-US and es-ES, with slower training.Source: Table 1 · p. 10, Table 2 · p. 10, §3 · p. 11
Privacy guarantees
- All NWP and OTF models achieve smaller zCDP bounds than the zCDP > 2.6 used by the US Census Bureau.The privacy guarantees are device-level zCDP; the paper adopts zero-one device neighboring and does not account for the privacy cost of modest hyperparameter tuning.Source: §3 · pp. 9, 11
Result analysis
- 0.81 to 0.35 zCDP: es-ES NWP slightly improves PRate and Acc after 1,900 pretrained rounds; SC trigger-rate gains are 4.23% at 1,240 and 9.51% at 1,900.At round 1,240, the model already has similar NWP utility and a strong privacy guarantee, while SC utility continues improving with training.Source: §3 · p. 11
4 Concluding remarks
The paper reports a production strategy for training Gboard language models with federated learning and differential privacy, including adaptive clipping and pretraining. More than twenty models have been trained and launched with formal DP guarantees, and Gboard requires DP for future neural language-model launches.
Concluding remarks
- The paper identifies system and algorithm co-design as important for practical differential privacy, alongside challenges in federated-learning tuning and opportunities to improve scalability and stability.Its strategy discusses adaptive clipping, DP-FTRL, client participation, pretraining, and secure aggregation.Source: §4 · p. 11
- More than twenty Gboard language models with formal DP guarantees were trained and launched for NWP, SC, and OTF, with en-US and es-ES NWP models also using SecAgg.Source: §4 · p. 11
- Gboard is requiring DP for all future training and launches of its language models.Source: §4 · p. 11
A Reporting privacy guarantees
The section specifies the scope and accounting of Gboard’s formal DP guarantees. It reports device-level guarantees, their conversion to (ϵ, δ)-DP, and exclusions around tuning and checkpoint selection.
A Reporting privacy guarantees
- The central DP guarantee assumes the service provider correctly implements the mechanism.The paper adopts a zero-out adjacency definition: neighboring datasets differ by adding or removing one client, and an absent client’s update is replaced by a zero vector.Source: A Reporting privacy guarantees · pp. 14–15
- The guarantee covers well-behaved clients in one training run, but excludes hyperparameter tuning and final-checkpoint selection using evaluation metrics or A/B testing.Public multilingual C4 data is used for pretraining.Source: A Reporting privacy guarantees · p. 15
- Only the final model checkpoint is released for production, while the guarantee also covers the full sequence of privatized gradients and intermediate models.The gradients include those sent to participating devices.Source: A Reporting privacy guarantees · p. 15
- The privacy unit is the device: for a user with one device this corresponds to user-level DP, while shared-device and multi-device cases have different implications.The guarantee is stronger than user-level DP for devices shared by multiple users and weaker for a user whose multiple participating devices are treated separately; group privacy can yield a user-level guarantee.Source: A Reporting privacy guarantees · p. 15
- Clients are limited in participation, with a minimum number of rounds separating consecutive participations for each client.The system enforces participation limits with a client-side timer.Source: A Reporting privacy guarantees · p. 15
- ρ-zCDP guarantees span ρ ∈ (0.2, 2); at δ = 10^-10, ρ = 0.25 maps to ϵ = 4.49 and ρ = 1.86 to ϵ = 13.69.PLD accounting is used for the conversion to (ϵ, δ)-DP.Source: A Reporting privacy guarantees · p. 15
- Core implementation code and key portions of the cross-device FL system are open sourced.Source: A Reporting privacy guarantees · p. 15