PaperlayerView exact revision on arXiv

Source-linked AI summary

An Adaptive Gradient Clipping and Noise Injection Mechanism for Differentially Private Federated Learning

Wenjing Wei, Alla Jammine, Farid Nait-Abdesselam

arXiv:2608.15153v1cs.CRcs.LG

TL;DR

Static clipping in differentially private federated learning may not fit changing, layer-specific gradient distributions. DDP-SA-adaptive uses round-wise, layer-wise median-based clipping with calibrated noise and improves efficiency and accuracy while preserving stronger privacy guarantees than static DDP-SA.

  • Problem

    Static global clipping may overclip informative gradients or add unnecessarily large noise because gradient scales vary across rounds and layers.

  • Method

    DDP-SA-adaptive sets each client’s round-wise, layer-wise clipping thresholds from median per-sample gradient norms and calibrates Laplace noise within secure aggregation.

  • Results

    6.81% fewer communication rounds than static DDP-SA, alongside significantly improved training efficiency, model accuracy, and privacy guarantees on a federated regression task.

  • Takeaways & Limitations

    The results support adaptive clipping and noise calibration as a more effective privacy-utility-efficiency approach than static DDP-SA within the evaluated federated regression setting.

Abstract

from arXiv · show

Differentially private federated learning must balance privacy protection against model accuracy and training efficiency. Static gradient clipping applies a fixed threshold throughout training and across model layers, which can cause excessive clipping when the threshold is too small or unnecessarily large noise when it is too large. This paper presents DDP-SA-adaptive, an adaptive gradient clipping and noise adding mechanism for differentially private federated learning with secure aggregation. At each communication round, every client determines a separate clipping threshold for each model layer from the median of its per-sample gradient norms. The resulting layer-wise thresholds adapt to the evolving gradient distributions and calibrate the Laplace noise added before the updates are encoded and secret-shared among intermediate aggregation servers. We evaluate the proposed mechanism on a federated regression task in terms of efficiency, accuracy, privacy, convergence, clipping norm, and noise magnitude. Compared with the static DDP-SA baseline, DDP-SA-adaptive reduces the number of communication rounds by 6.81%, total training time by 19.21%, and average per-round training time by 13.33%, leading to improved training efficiency. It also reduces test loss by 98.74% and increases test R2 by 3.41%, leading to improved model accuracy. To attain R2 = 0.99, the adaptive mechanism operates with a privacy budget of approximately epsilon = 0.1, compared with epsilon = 0.4 for static DDP-SA, thus providing stronger privacy protection and achieving stronger privacy guarantees. These results demonstrate that round-wise, layer-wise adaptation can improve the privacy-accuracy-efficiency trade-off of differentially private federated learning.

I. INTRODUCTION · II. RELATED WORK

Federated learning avoids centralizing raw data but shared updates remain vulnerable to inference attacks, motivating differential privacy and secure aggregation. DDP-SA-adaptive addresses static sensitivity control by using local, round-wise, layer-wise median-based clipping with calibrated Laplace noise within the existing secure aggregation workflow.

  • I. INTRODUCTION: Federated learning keeps raw data decentralized, yet shared parameters or gradients can leak sensitive information through membership, attribute, gradient inversion, reconstruction, and sample-recovery attacks.
  • I. INTRODUCTION: Differential privacy adds calibrated noise to client updates, while secure aggregation reveals only their sum; DP improves protection but larger noise can reduce accuracy, and MPC adds communication and computation costs.
  • I. INTRODUCTION: Fixed clipping thresholds can over-clip informative gradients or inflate sensitivity and noise, while a global threshold cannot accommodate different gradient-norm scales across layers.
  • I. INTRODUCTION: DDP-SA-adaptive sets each client’s clipping threshold separately for every layer and communication round using the median of current per-sample gradient norms.
  • I. INTRODUCTION: The mechanism couples adaptive thresholds with Laplace noise and per-round, per-layer privacy-budget allocation so noise scale tracks local sensitivity without changing secure aggregation.
  • II. RELATED WORK: Prior adaptive clipping and noise methods generally target central or local DP pipelines where servers observe individual noisy updates, not distributed DP followed by secure aggregation.
  • II. RELATED WORK: Cryptographic defenses include MPC secure aggregation, homomorphic encryption, and hybrid DP-secure computation schemes; DDP-SA combines client-side Laplace perturbation with threshold additive secret sharing.
  • II. RELATED WORK: DDP-SA-adaptive embeds local round-wise, layer-wise median clipping and calibrated Laplace noise into DDP-SA, while encoded noisy updates remain secret-shared for secure aggregation.

III. METHOD OF RESEARCH · A. System Model and Threat Model

The method extends the three-layer DDP-SA architecture with round-wise, layer-wise median-based clipping and calibrated Laplace noise. It protects private client updates through full-threshold additive secret sharing under a semi-honest adversary model.

  • III. METHOD OF RESEARCH: DDP-SA-adaptive replaces static clipping with round-wise, layer-wise median-based clipping and correspondingly calibrated Laplace noise.The architecture retains clients, intermediate servers, and a parameter server.
  • A. System Model and Threat Model: The system comprises n clients, m intermediate servers, and one parameter server, with each client retaining a private local dataset.The global model has L parameterized layers, and raw samples are never uploaded.
  • A. System Model and Threat Model: The total training population is N = Pn i=1 Ni samples aggregated across client-local datasets.Client Ci holds Ni samples in dataset Di.
  • A. System Model and Threat Model: At each round, clients privatize local updates with calibrated Laplace noise, encode them at fixed precision, and split them into m additive shares.This intermediate-server layer enables secure aggregation through full-threshold additive secret sharing.
  • A. System Model and Threat Model: Intermediate servers sum their received shares and forward partial aggregates, while the parameter server reconstructs the global aggregate and broadcasts updated parameters.The parameter server collects all m partial sums before updating the model.
  • A. System Model and Threat Model: The protocol assumes semi-honest participants, authenticated channels, and an adversary corrupting at most f < m intermediate servers.Under full-threshold ASS, any strict subset of shares is information-theoretically independent of the secret.

B. Problem Setup · C. Adaptive Layer-wise Clipping

DDP-SA-adaptive addresses the limitations of static global clipping by selecting separate, round- and layer-specific thresholds from clients’ per-sample gradient norms. Applying these thresholds independently across layers produces adaptive clipping norms that typically decrease as training progresses.

  • B. Problem Setup: At round t, each client receives the current model and computes per-sample gradients for every local sample and model layer.
  • B. Problem Setup: Static DDP-SA applies one fixed clipping threshold to the entire gradient vector in every round.
  • B. Problem Setup: If the static threshold is too small, informative gradients are over-clipped; if too large, sensitivity is overestimated and Laplace noise becomes unnecessarily large.
  • B. Problem Setup: Because gradient norm scales differ across layers, one global threshold cannot appropriately match every layer.
  • C. Adaptive Layer-wise Clipping: For each client, round, and layer, DDP-SA-adaptive uses the multiset of per-sample ℓ1 gradient norms to define an adaptive clipping threshold.
  • C. Adaptive Layer-wise Clipping: Each per-sample gradient is clipped using its corresponding layer-wise threshold, after which the client forms the layer-wise summed gradient.
  • C. Adaptive Layer-wise Clipping: Applying the procedure independently to every layer yields layer-wise thresholds that typically decrease as training progresses and gradient magnitudes contract.

D. Adaptive Noise Injection and Secure Aggregation

The mechanism allocates privacy budget across communication rounds and layers, injects layer-wise Laplace noise after clipping, and securely aggregates encoded client updates through intermediate servers. Compared with static DDP-SA, only clipping and noise calibration change; the encoding and secure-aggregation workflow remains unchanged.

  • Privacy budget allocation: The total privacy budget is divided equally across T rounds, then uniformly across model layers.The per-round allocation is ϵ_t = ϵ_total/T.
  • Adaptive noise injection: After clipping, each client adds independent Laplace noise to every layer’s summed gradient and averages by local sample size.The noise mechanism is described as the standard Laplace mechanism with layer-specific sensitivity.
  • Encoding: Clients concatenate layer-wise noisy updates into one vector and encode it using fixed-precision scaling factor SF = 10^dn.The encoded vector is prepared for secure aggregation after local noise injection.
  • Secure aggregation: Encoded updates are secret-shared among m intermediate servers, which sum shares and send partial aggregates to the parameter server for reconstruction.The parameter server decodes by dividing by SF before updating the global model.
  • Comparison with static DDP-SA: Relative to static DDP-SA, only clipping and noise calibration change, while encoding and secure aggregation remain unchanged.The complete procedure is summarized in Algorithm 1.

E. Privacy Analysis

The privacy analysis establishes a per-round and multi-round differential privacy bound, while secure aggregation adds no privacy loss and protects individual client updates from the parameter server.

  • At most ϵ_t-DP is guaranteed across layers within one round under basic composition.
  • Over T rounds, the local mechanism inherits the same multi-round privacy bound as static DDP-SA under the chosen composition theorem.
  • Secure aggregation introduces no additional privacy loss because it is deterministic post-processing of already privatized updates, while preventing the PS from observing individual client updates.

IV. PERFORMANCE EVALUATION

The performance evaluation compares DDP-SA-adaptive with static DDP-SA and a No-Private baseline across efficiency, accuracy, privacy, convergence, clipping norms, and noise magnitude. The procedure runs for T communication rounds with uniform per-round privacy allocation and secure aggregation through intermediate servers.

  • Evaluation scope: The evaluation compares DDP-SA-adaptive, static DDP-SA, and a No-Private baseline across six performance dimensions.These dimensions are efficiency, accuracy, privacy, convergence, clipping norms, and noise magnitude.
  • Round-wise procedure: Each training round broadcasts the current global model parameters to all clients and allocates ϵ_total/T privacy budget.Clients process layers in parallel after receiving the broadcast model.
  • Secure aggregation: Clients encode their privatized updates, secret-share them among intermediate servers, and send the shares for aggregation.Servers sum received shares and forward aggregated gradients to the parameter server.

A. Experimental Setup

The experiments evaluated federated linear regression using synthetic data split into training, validation, and test sets. DDP-SA-adaptive was compared with static DDP-SA under matched conditions, using different optimizers and clipping strategies.

  • Implementation and data: Experiments used PyTorch 1.4.0 and PySyft 0.2.9 on GitHub Codespaces with 16 cores, 64GB RAM, and 128GB storage.
  • Implementation and data: A 10000 × 2 uniformly sampled array generated labels y = x1+x2+1 for a federated linear regression task.
  • Implementation and data: The data were divided into training, validation, and test sets using a 60%, 20%, and 20% split, respectively.
  • Training configuration: No-Private used SGD at learning rate 0.1, while DDP-SA and DDP-SA-adaptive used Adam at learning rate 0.001.
  • Training configuration: Static DDP-SA used a fixed clipping threshold, whereas DDP-SA-adaptive used round-wise, layer-wise median-based clipping, with results averaged over multiple runs.

B. Efficiency Analysis

DDP-SA-adaptive improves federated learning efficiency over static DDP-SA by converging in fewer communication rounds, while both methods upload the same number of parameters per client per round.

  • Communication cost: 6.81% fewer communication rounds are required by DDP-SA-adaptive than by static DDP-SA, with convergence in 2270 versus 2436 rounds.No-Private converges in 2082 rounds.
  • Communication cost: 9 parameters are uploaded per client per round by both DDP-SA and DDP-SA-adaptive.Communication cost is measured by convergence rounds and parameters uploaded per client per round.

C. Accuracy Analysis · D. Analysis of Privacy Protection Strength · E. Analysis of Convergence, Clipping Norm, and Noise Magnitude

DDP-SA-adaptive improves accuracy and privacy protection while converging efficiently through round-wise, median-based adaptive clipping and noise injection. Its clipping norms and smoothed noise magnitudes decline during training, reducing late-stage update distortion without changing secure aggregation.

  • C. Accuracy Analysis: 98.74% lower test loss and 3.41% higher test R2 distinguish DDP-SA-adaptive from static DDP-SA, reaching 6.9354 × 10−5 and R2 = 0.9996.Static DDP-SA records test loss 0.0055 and R2 = 0.9666, while the adaptive method approaches the No-Private baseline.
  • D. Analysis of Privacy Protection Strength: DDP-SA-adaptive remains close to R2 ≈1 across privacy budgets ϵ ∈[0.1, 0.6], whereas static DDP-SA degrades markedly under tight budgets.Smaller ϵ corresponds to stronger privacy protection.
  • D. Analysis of Privacy Protection Strength: ϵ ≈0.1 lets DDP-SA-adaptive reach R2 = 0.99, compared with ϵ ≈0.4 for static DDP-SA, providing stronger privacy protection for the same accuracy goal.The adaptive method meets the target at the smallest reported budget.
  • E. Analysis of Convergence, Clipping Norm, and Noise Magnitude: 1135 practical rounds to convergence place DDP-SA-adaptive between No-Private at 1041 rounds and DDP-SA at 1218 rounds.The adaptive curve also attains a lower train loss at convergence.
  • E. Analysis of Convergence, Clipping Norm, and Noise Magnitude: The median-based clipping norm of client Bob decreases rapidly over rounds as gradient magnitudes contract.DDP-SA-adaptive uses the median norms of unclipped samples’ gradients in the current training round as the clipping norm.
  • E. Analysis of Convergence, Clipping Norm, and Noise Magnitude: The injected Laplace noise follows the declining clipping-norm trend, while raw noise samples fluctuate locally.The Laplace scale is proportional to ∆(l)t.
  • E. Analysis of Convergence, Clipping Norm, and Noise Magnitude: EMA-smoothed noise trajectories with EMA = 0.99 decline steadily, so late-stage updates are less distorted and convergence improves.This behavior is illustrated for gradients of Bob’s weights w1 and w2.
  • E. Analysis of Convergence, Clipping Norm, and Noise Magnitude: Adaptive clipping and noise injection reduce update distortion without changing the secure aggregation workflow as training loss decreases.The mechanism uses current-round median norms of unclipped sample gradients, while predicted labels move closer to true labels.

V. CONCLUSION

DDP-SA-adaptive replaces static clipping with round-wise, layer-wise median-based thresholds and calibrated Laplace noise within secure aggregation. Experiments show improved efficiency, accuracy, and privacy guarantees, with decreasing clipping norms and noise magnitudes supporting faster convergence.

  • Conclusion: DDP-SA-adaptive uses round-wise, layer-wise medians of per-sample gradient norms to set clipping thresholds and calibrate Laplace noise.It preserves fixed-precision encoding and additive secret sharing for secure aggregation.
  • Conclusion: Experiments show significantly improved training efficiency, model accuracy, and privacy guarantees compared with the original DDP-SA.The evaluation uses a federated regression task.
  • Conclusion: Clipping norms and noise magnitudes decrease as training progresses, supporting faster convergence and higher final accuracy.The conclusion attributes the observed efficiency and accuracy gains to these declining quantities.
Loading 2608.15153v1…