PaperlayerView exact revision on arXiv

Source-linked AI summary

Privacy-Preserving Over-the-Air Federated Learning over Cell-Free Massive MIMO System with User-Centric Clustering

Manobendu Sarker, Soumaya Cherkaoui

arXiv:2610.37424v1cs.ITcs.SYeess.SYmath.IT

TL;DR

Wireless federated learning must aggregate updates over bandwidth-limited uplinks while protecting gradients whose perturbation can reduce learning quality. This paper jointly optimizes clustering, transmit power, and artificial noise for cell-free OTA learning under ergodic privacy constraints. It identifies thermal noise as a privacy resource and reports improved outcomes across privacy regimes.

  • Problem

    Wireless FL must exchange high-dimensional updates over bandwidth-limited uplinks, while protecting gradients without allowing artificial noise to degrade learning quality.

    Source: §I · p. 1

  • Method

    The framework jointly designs AP–UE clustering, transmit powers, and artificial-noise variances under ergodic privacy constraints, using alternating optimization with DC power allocation and greedy clustering.

    Source: §V · p. 7, §VII · p. 12

  • Results

    Strict-budget evaluations show a transition from random-chance to convergent training; at κ=1.0 with ε=10, objective reductions exceed 82% relative to all baselines.

    Source: 2) Impact of Conservative Privacy… · p. 10

  • Takeaways & Limitations

    Under privacy-limited conditions, the design reduces transmit power and AP–UE link utilization to substitute inherent channel noise for artificial perturbation.

    Source: §VII · p. 12

Abstract

from arXiv · show

This paper investigates cross-layer design for differentially private federated learning over cell-free massive MIMO networks with over-the-air (OTA) aggregation. Distributed access points (APs) collaboratively serve user equipments (UEs) through user-centric clustering, where clipped local model updates are perturbed with Gaussian noise and simultaneously transmitted over a shared uplink for OTA averaging at a central processing unit. Exploiting channel hardening, we show that thermal noise inherent in wireless reception can act as a privacy-masking resource, reducing or even eliminating the need for artificial noise. Based on this observation, we formulate a joint optimization problem over AP-UE associations, UE transmit powers, and artificial noise variances to minimize aggregation variance subject to per-UE zero-concentrated differential privacy constraints derived from an ergodic privacy accounting framework. Analysis reveals a regime-dependent structure: stringent privacy requirements favor low transmit powers and sparse AP associations to exploit thermal noise for privacy, whereas relaxed requirements favor larger clusters to improve aggregation quality. The resulting mixed-integer nonconvex problem is solved via alternating optimization combining difference-of-convex power allocation and greedy coordinate-descent clustering. Numerical results show up to 89% lower aggregation variance than conventional baselines and enable 97% test accuracy on MNIST with consistent gains on CIFAR-10. Under strict privacy budgets, competing schemes remain near random-chance performance, while under relaxed budgets they continue to lag significantly behind the proposed design.

I. INTRODUCTION

The section frames wireless federated learning as a communication and privacy challenge, then motivates a user-centric cell-free OTA design that couples differential privacy with physical-layer resources.

I. INTRODUCTION

  • OTA-FL shares time-frequency resources through analog superposition, but transmitted gradients remain vulnerable to inference and Gaussian perturbation can degrade learning quality.The section identifies communication efficiency and learning fidelity as a central tension.Source: §I · p. 1
  • No cited framework jointly optimizes user-centric AP–UE clustering, uplink power, and per-UE differential-privacy noise in scalable cell-free OTA-FL.Prior designs either retain single-cell alignment limits, use digital transmission, or omit DP from cell-free OTA resource allocation.Source: §I · p. 2

A. Motivation and Contributions

  • The proposed framework couples physical-layer allocation with differential-privacy constraints through ergodic calibration supported by channel hardening.Its contributions include a variance-based design objective and joint optimization of clustering, transmit powers, and artificial-noise variances.Source: A. Motivation and Contributions · p. 2

II. SYSTEM MODEL

  • The system assumes full participation by all UEs in every communication round.It models a UC cell-free network with distributed APs cooperatively serving devices.Source: §I · p. 1, §II · p. 3

A. UC Clustering and Channel Model

  • Each UE is served by a dynamically selected subset of APs, represented by binary AP–UE association variables.The association design respects per-AP UE-load and per-UE AP-count limits.Source: A. UC Clustering and Channel Model · p. 3

B. Local Computation and DP

UEs clip and perturb local updates before transmission, while distributed APs combine uplink signals for OTA aggregation. The section models the resulting distortion and thermal noise, including a lower-bound proxy with distinct privacy and convergence implications.

B. Local Computation and DP

  • UEs apply an ℓ2 clipping bound and add independent Gaussian noise to local updates, with a per-UE artificial-noise variance allocation.This clip-and-perturb mechanism is described as supporting sample-level differential privacy.Source: B. Local Computation and DP · p. 3

C. Scalable OTA Aggregation

  • APs locally combine uplink signals and forward scalar statistics, allowing the CPU to form an approximate average with residual physical-layer distortions.The distortion model accounts for multi-UE interference, channel-estimation error, and thermal noise.Source: C. Scalable OTA Aggregation · pp. 3–4
  • The expected thermal-noise proxy omits nonnegative cross-UE terms, making it a safe underestimate for privacy credit but potentially optimistic for convergence performance.This dual-use limitation follows from the lower-bound construction.Source: C. Scalable OTA Aggregation · p. 4
  • The analysis assumes full UE participation and static large-scale design variables; numerical evaluation uses orthogonal pilots with τp=N.Partial participation, dynamic adaptation, pilot reuse, and fronthaul capacity constraints are left for future work.Source: C. Scalable OTA Aggregation · p. 4

III. PRIVACY AND LEARNING PRELIMINARIES

The section develops an ergodic privacy-accounting proxy that credits expected thermal noise alongside artificial Gaussian noise. Channel hardening governs how closely instantaneous noise follows that expectation, while clipping and robustness choices constrain the design.

A. Privacy Accounting and Ergodic Design Proxy

  • Channel-hardening quality βk governs noise concentration; the cumulative failure bound over T rounds is T/(ξ^2βk), with failure probability scaling as O(1/M).For small M or sparse AP associations, concentration failures may remain non-negligible.Source: A. Privacy Accounting and Ergodic… · pp. 4–5
  • The zCDP accounting converts each UE’s target (εk, δ)-DP guarantee into a per-round privacy budget over T rounds.The per-round accounting assumes identical privacy allocations across rounds.Source: A. Privacy Accounting and Ergodic… · p. 4
  • Privacy accounting excludes data-dependent interference and conservatively credits only the UE’s own artificial noise and shared physical thermal noise.Source: A. Privacy Accounting and Ergodic… · pp. 4–5
  • The expected thermal-noise variance Σ(A, p) yields an ergodic zCDP design guarantee, not a strict realization-wise (ε, δ)-DP theorem.Source: A. Privacy Accounting and Ergodic… · p. 5
  • The robustness factor κ reduces credited thermal noise and requires additional artificial noise, with smaller κ strengthening privacy calibration against fading excursions.κ = 1 is the ergodic limit.Source: A. Privacy Accounting and Ergodic… · p. 5
  • Clipping threshold C trades lower required DP noise, proportional to C^2, against increased systematic learning bias when C is smaller.Source: A. Privacy Accounting and Ergodic… · p. 5

B. Learning Model and Utility Surrogate

The learning analysis uses a variance-based convergence bound to motivate the cross-layer utility surrogate. It fixes the clipping threshold and treats clipping bias as independent of physical-layer design variables.

B. Learning Model and Utility Surrogate

  • Under the stated smoothness, gradient-variance, heterogeneity, and clipping assumptions, Proposition 1 bounds the average squared gradient norm for single-step SGD rounds.The result assumes ηg ≤ 1/Ls and τ = 1.Source: B. Learning Model and Utility Surrogate · p. 5
  • With clipping threshold C fixed, its possible bias-dependent convergence term is independent of (A, p, σ2), so minimizing Varagg remains the cross-layer design objective.The formulation isolates communication-privacy coupling by fixing C.Source: B. Learning Model and Utility Surrogate · p. 5
  • Minimizing Varagg reduces the convergence noise floor because that floor is proportional to Lsηg Varagg.The cross-layer surrogate scales this variance objective for unit consistency with locally injected noise.Source: B. Learning Model and Utility Surrogate · p. 5

IV. PROBLEM FORMULATION

The formulation jointly chooses clustering, UE powers, and artificial-noise variances to minimize a cross-layer surrogate under privacy and physical-layer constraints. Its reduced objective exposes a regime in which thermal noise can substitute for artificial privacy noise.

IV. PROBLEM FORMULATION

  • The objective minimizes U(A, p, σ2) to improve gradient recovery fidelity at the CPU and accelerate FL convergence.Source: §IV · p. 6
  • The design enforces per-UE privacy, nonnegative artificial-noise variance, UE power limits, AP and UE association limits, and binary AP–UE assignments.Source: §IV · p. 6
  • In the fully privacy-limited regime, the objective drives transmit powers down until N^2Σ(A, p) reaches the strictest privacy threshold or a lower power bound activates.Uniform power reduction increases the thermal-noise proxy while leaving the interference proxy unchanged.Source: §IV · p. 6
  • At that operating point, inherent thermal noise replaces part of the required artificial privacy noise while transmit energy is reduced.Source: §IV · p. 6
  • Because Σ(A, p) couples all UEs’ powers, the power-allocation subproblem must be solved jointly rather than per UE.Under homogeneous privacy targets, the boundary is N^2Σ(A, p) = Θ.Source: §IV · p. 6

V. PROPOSED CROSS-LAYER OPTIMIZATION FRAMEWORK

The proposed solver addresses the mixed-integer nonconvex design by alternating between power allocation and clustering updates.

V. PROPOSED CROSS-LAYER OPTIMIZATION FRAMEWORK

  • The reduced design is mixed-integer and nonconvex because clustering and power variables are tightly coupled, with an additional nonsmooth maximum operator.Source: §V · p. 7
  • Alternating optimization decouples the design into a difference-of-convex power-allocation subproblem and a greedy clustering update.Source: §V · p. 7
  • The framework uses these two tractable blocks to tackle the coupled cross-layer problem.Source: §V · p. 7

A. Power Allocation Subproblem

The power subproblem is recast in the log domain as a difference-of-convex objective and solved by CCP, while clustering is updated through greedy coordinate descent over binary AP–UE links.

A. Power Allocation Subproblem

  • Log-domain power variables expose a difference-of-convex objective, whose concave component is linearized at each CCP iteration.For fixed clustering, the effective gains and CSI-error proxies are deterministic; the power subproblem is convex at each CCP iteration.Source: A. Power Allocation Subproblem · p. 7
  • Each CCP subproblem is convex and solvable in polynomial time, and sequential solves descend toward a stationary point of the nonconvex power-allocation space.The convexity follows from the epigraph constraint and convex objective terms.Source: A. Power Allocation Subproblem · p. 7

B. Clustering Subproblem

  • With powers fixed, greedy coordinate descent tests feasible single-link AP additions and removals directly on the binary association matrix.A modification is accepted when it reduces the utility surrogate; a sweep costs O(N^2L).Source: B. Clustering Subproblem · pp. 7–8

C. Algorithm Summary and Complexity Analysis

The alternating procedure starts from proximity-based clustering and alternates CCP power updates with greedy clustering updates. Its objective values converge, but the terminal operating point is only blockwise locally optimal.

C. Algorithm Summary and Complexity Analysis

  • The procedure initializes with proximity-based clustering and calibrates uniform initial powers to the privacy-noise regime boundary to accelerate the CCP loop.The full procedure is detailed in Algorithm 1.Source: C. Algorithm Summary and Complexity… · p. 8
  • Algorithm 1 generates a monotonically non-increasing, bounded-below objective sequence and therefore converges.The CCP power step descends, while clustering accepts only objective-reducing or objective-preserving modifications.Source: C. Algorithm Summary and Complexity… · p. 8
  • The terminal point is blockwise locally optimal for CCP power updates and greedy single-link modifications, not guaranteed globally optimal.The mixed-integer nonconvex problem means the solution should be interpreted as a locally optimized operating point.Source: C. Algorithm Summary and Complexity… · p. 8

1) Computational Complexity:

The optimized objective changes sharply across privacy regimes: artificial noise dominates under stringent privacy, while physical-layer distortions govern once the privacy threshold can be met without it. The reported simulations use a specified cell-free deployment and the alternating optimizer converges in a few outer iterations.

1) Computational Complexity:

  • Each AO iteration costs O(IccpN^3 + NL), combining CCP interior-point power solves with a greedy clustering pass.The CCP subproblem has N variables and O(N) constraints; the clustering pass evaluates at most O(NL) candidate modifications per sweep.Source: 1) Computational Complexity · p. 8

A. Simulation Setup

  • The simulation uses 36 APs with four antennas each and 20 single-antenna UEs in a 500 m square coverage area.UE powers range from 1 to 200 mW, and privacy budgets are swept from ε = 0.5 to 100.Source: A. Simulation Setup · p. 8

1) Objective Decomposition Across Privacy Regimes:

  • The AO algorithm converges within three to five outer iterations across tested privacy budgets.The optimized objective spans over four orders of magnitude from ε = 0.5 to ε = 100.Source: 1) Objective Decomposition Across… · pp. 8–9
  • At ε = 10, artificial DP noise is eliminated; for ε ≥10, interference contributes 61% to 71% and thermal noise 29% to 39% of the objective.At ε = 2, artificial DP noise accounts for 98.5% of the objective, and at ε = 0.5 it exceeds 99.9%.Source: 1) Objective Decomposition Across… · p. 9, Figure 1 · p. 9

2) Optimal Physical-Layer Configuration:

The optimizer changes its physical-layer configuration with the privacy budget: strict privacy favors one AP and minimum UE power, while relaxed privacy favors larger clusters. It targets the thermal-noise privacy boundary, with hardening and robustness results qualifying the ergodic design.

2) Optimal Physical-Layer Configuration:

  • For ε ≤5, every UE uses one serving AP and minimum power Pmin = 1 mW; as ε rises, mean serving APs grow from 1.5 at ε = 10 to 5.8 at ε = 100.Transmit power reaches only 1.37 mW at ε = 50 and 1.32 mW at ε = 100; in the noise-limited regime, Lmax = 1 to 5 captures over 85% of achievable clustering gain.Source: 2) Optimal Physical-Layer Configuration · p. 9, Figure 2 · p. 9

3) Privacy-Noise Boundary Targeting:

  • At ε = 10, the expected thermal-noise floor reaches Θk and eliminates artificial noise; beyond the boundary, AP diversity is allocated to reduce interference.This boundary alignment is an ergodic design property, with instantaneous fluctuations governed by channel-hardening concentration.Source: 3) Privacy-Noise Boundary Targeting · p. 9

1) Hardening Concentration:

  • With M = 4, single-AP service gives βk = 4 and vacuous Chebyshev bounds; expanding clusters improves concentration for well-positioned UEs but leaves the worst UE at βk = 4.0.The bounds are conservative and do not provide formal realization-wise certificates at this antenna count.Source: 1) Hardening Concentration · p. 10, Table II · p. 10

2) Impact of Conservative Privacy Crediting:

  • At κ = 0.75, re-injected artificial noise accounts for over 99% of the objective increase relative to κ = 1, while the physical-layer configuration remains essentially unchanged.The comparison is at ε = 10.Source: 2) Impact of Conservative Privacy… · p. 10, Table III · p. 10
  • At κ = 0.50 and ε = 10, the optimized objective U⋆ = 866.8 remains below all reported baseline values, and the solver retains the same outer-iteration count across tested κ values.The framework at κ = 1.0 with ε = 10 achieves reductions exceeding 82% relative to all baselines.Source: 2) Impact of Conservative Privacy… · p. 10

D. Baseline Comparison

The proposed design jointly adapts clustering, transmit power, and artificial noise, and its learning and objective results outperform the supplied baselines across tested privacy budgets. Its operating regime depends on privacy requirements, while the FL validation is limited to one topology and random seed.

D. Baseline Comparison

  • At ε = 10, the proposed scheme reduces the objective by 82.8% over Privacy-Unaware, 82.8% over Fixed-Cluster, and 83.1% over Naive-DP; at ε = 50, reductions are 86.8% and 89.1% over Privacy-Unaware and Naive-DP.The proposed scheme has the lowest objective at every tested ε; Fig. 4 plots objective against privacy budget.Source: D. Baseline Comparison · p. 11, Figure 4 · p. 11
  • At ε = 1, all six schemes have objectives within 2.1% of one another because the DP noise floor overwhelms physical-layer contributions; at higher ε, joint optimization gains become pronounced.The baselines isolate individual components: for example, Fixed-Cluster optimizes power with proximity-based associations, while Equal-Power fixes UEs at Pmax.Source: D. Baseline Comparison · pp. 10–11

E. FL Training Validation

  • On MNIST at ε = 10, Proposed reaches 96.89% after 200 rounds versus baselines near 12.7%; on CIFAR-10 at ε = 50, it reaches 47.71% versus 10.78%, 10.74%, and 10.74%.The CIFAR-10 result is 36.93 percentage points above the strongest baseline.Source: E. FL Training Validation · pp. 11–12, Figure 5 · p. 11, Figure 6 · p. 12
  • At ε = 2, all four schemes produce 11.36% accuracy, and the proposed design still has per-coordinate NSR exceeding 10^6, preventing gradient signal from surviving aggregation.For ε ∈ {10, 50}, the proposed method reaches a regime with σ²⋆ₖ ≈ 0, while the three baselines remain unable to exploit the transition effectively.Source: E. FL Training Validation · p. 12
  • The FL experiments use one topology realization and random seed, a statistical OTA channel variance proxy, lightweight CNNs, and single-batch local updates.Multiple topology realizations, per-round fading, and larger architectures remain future investigation directions.Source: E. FL Training Validation · pp. 11–12

VII. CONCLUSION

  • In the privacy-limited regime, the optimizer reduces AP-UE link use and transmit power to substitute thermal noise for artificial perturbation; beyond a critical threshold, artificial noise vanishes and spatial diversity targets interference.Boundary targeting sets the physical noise floor to satisfy the ergodic privacy design constraint in expectation.Source: §VII · p. 12
  • The framework is stated to require only large-scale fading statistics and privacy targets as inputs, with future work including multi-antenna UEs, frequency-selective channels, adaptive clipping, and partial participation.Source: §VII · p. 12

APPENDIX A DERIVATION OF THE CSI ERROR PROXY

The CSI error proxy retains a dominant self-term whose transmit-power dependence cancels, while omitting residual cross-UE leakage terms for tractability. The convergence proof accounts for OTA aggregation variance alongside stochastic-gradient variance and additive physical and DP noise sources.

APPENDIX A DERIVATION OF THE CSI ERROR PROXY

  • The dominant self-aligned CSI-error term is independent of transmit power because substituting the equalization coefficient yields an algebraic cancellation of pₖ.Source: Appendix A · p. 13
  • The proxy omits residual cross-UE CSI-leakage terms for tractability; pilot contamination can leave additional off-diagonal contributions, while orthogonal pilots make those terms vanish in expectation.Source: Appendix A · p. 13

APPENDIX B PROOF OF PROPOSITION 1

  • The proof's aggregation variance combines stochastic-gradient variance with additive DP perturbation, multi-UE interference plus CSI error, and thermal noise contributions.Under Assumption 3, the aggregated gradient estimate is conditionally unbiased because clipping bias is negligible.Source: Appendix B · p. 13
Loading 2610.37424v1…