Enforcing fairness in private federated learning via the modified method of differential multipliers

1 INTRODUCTION . Machine learning requires data to build models . This data is often private and resides on users ’ devices . Federated learning ( FL ) ( McMahan et al. , 2017 ) is a strategy where multiple users ( or other entities ) collaborate in training a model under the coordination of a central server or service provider . In FL , devices share only data statistics ( e.g . gradients of the model computed from their data ) with the server , and therefore the users ’ data never leaves their devices . However , these statistics can still leak information about the users ( see Shokri et al . ( 2017 ) ; Fredrikson et al . ( 2015 ) for practical attacks recovering the users ’ identity and reconstructing the users ’ face images ) . To protect against this leakage , differential privacy ( DP ) can be provided . Differential privacy offers a mathematical guarantee on the maximal amount of information any attacker can obtain about a user after observing the released model . In practice , often ( Bhowmick et al. , 2018 ; McMahan et al. , 2018a ; b ; Truex et al. , 2019 ; Granqvist et al. , 2020 ) this guarantee is achieved by adding a certain amount of noise to the individuals ’ statistics . In this paper , federated learning with differential privacy will be referred to as private federated learning ( PFL ) . The models trained with PFL are often neural networks , since they work well in many use cases , and turn out to be resistant to the noise added for DP . These models have been successfully trained with PFL for tasks like next word prediction or speaker verification ( McMahan et al. , 2017 ; Granqvist et al. , 2020 ) . However , they are prone to perpetuating societal biases existing in the data ( Caliskan et al. , 2017 ) or to discriminate against certain groups even when the data is balanced ( Buolamwini & Gebru , 2018 ) . Moreover , when the training is differentially private , degradation in the performance of these models disproportionately impacts under-represented groups ( Bagdasaryan et al. , 2019 ) . More specifically , the accuracy of the model on minority groups is deteriorated to a larger extent than the accuracy for the majority groups . In the realm of FL , there has been some research studying how to achieve that the performance of the model is similar among devices ( Hu et al. , 2020 ; Huang et al. , 2020 ; Li et al. , 2019 ; 2021 ) . However , this notion of fairness falls short in terms of protecting users from under-represented groups falling foul of disproportionate treatment . For example , Castelnovo et al . ( 2021 , Section 3.6 ) show that a model that performs well on the majority of the users will have a good score on individual fairness metrics , even if all the users suffering from bad performance belong to the same group . Conversely , there is little work proposing solutions to enforce group fairness , i.e . that the performance is similar among users from different groups . Current work in this area is either limited to reducing demographic parity in logistic regression ( Du et al. , 2021 ) or to minimizing the largest loss across the different groups with a minimax optimization ( Mohri et al. , 2019 ) . Concurrently to this paper , Cui et al . ( 2021 ) proposed an approach to enforce group fairness in FL for general models and metrics . However , this approach does not consider DP . Moreover , most prior work does not consider the adverse effects that DP has on the models trained with private federated learning , or is restricted to logistic regression models ( Abay et al. , 2020 ) . On the other hand , work studying the trade-offs between privacy and group fairness proposes solutions that are either limited to simple models such as linear logistic regression ( Ding et al. , 2020 ) , require an oracle ( Cummings et al. , 2019 ) , scale poorly for large hypothesis classes ( Jagielski et al. , 2019 ) , or only offer privacy protection for the variable determining the group ( Tran et al. , 2021 ; Rodrı́guez-Gálvez et al. , 2021 ) . Furthermore , the aforementioned work only considers the central learning paradigm , and the techniques are not directly adaptable to FL . For all the above reasons , in this paper , we propose an algorithm to train neural networks with PFL while enforcing group fairness . We pose the problem as an optimization problem with fairness constraints and extend the modified method of differential multipliers ( MMDM ) ( Platt & Barr , 1987 ) to solve such a problem with FL and DP . Hence , the resulting algorithm ( i ) is applicable to any model that can be learned using stochastic gradient descent ( SGD ) or any of its variants , ( ii ) can be tailored to enforce the majority of the group fairness metrics , ( iii ) can consider any number of attributes determining the groups , and ( iv ) can consider both classification and regression tasks . The paper is structured as follows : in Section 2 , we review the background on differential privacy , private federated learning , the MMDM algorithm , and group fairness ; in Section 3 , we present our approach for fair private federated learning ; in Section 4 , we describe our experimental results ; and in Section 5 , we conclude with a summary and interpretation of our findings . 2 BACKGROUND . In this section , we review several aspects on the theory of private federated learning , the MMDM algorithm , and group fairness that are necessary to develop and understand the proposed algorithm . 2.1 FEDERATED LEARNING . The federated learning setting focuses on learning a model that minimizes the expected value of a loss function ` using a dataset d = ( z1 , z2 , . . . , zn ) ∈ D of n samples distributed across K users . This paper will consider models parametrized by a fixed number of parameters w ∈ Rp and differentiable loss functions ` , which includes neural networks . Since the distribution of the data samples Z is unknown and each user k is the only owner of their private dataset dk , the goal of FL is to find the parametersw ? that minimize the loss function across the samples of the users . That is , defining L ( dk , w ) : = ∑ z∈dk ` ( z , w ) , to solve w ? = argmin w∈Rp 1 n ∑K k=1 L ( dk , w ) . ( 1 ) This way , the parameters w can be learned with an approximation of SGD . McMahan et al . ( 2017 ) suggest that the central server iteratively samples m users ; they compute and send back to the server an approximation of the model ’ s gradient ∇wL ( dk , w ) ; and finally the server updates the parameters as dictated by gradient descentw ← w − 1n ∑ k η∇wL ( dk , w ) , where η is the learning rate . If the users send back the exact gradient the algorithm is known as FederatedSGD . A generalisation of this , FederatedAveraging , involves users running several local epochs of mini-batch SGD and sending up the difference . However , the method in this paper considers an optimization with fairness constraints , requiring the communication of extra information in each iteration , and therefore will extend FederatedSGD . 2.2 PRIVATE FEDERATED LEARNING . Private federated learning combines federated learning with differential privacy . Differential privacy ( Dwork et al. , 2006 ; 2014 ) provides a mathematical guarantee by restricting the amount of information that a randomized function m of a dataset d leaks about any individual . More precisely , it ensures that the probability that the output of the function m on the dataset d belongs to any set of outcomes O is close to the probability that the output of the function m applied to a neighbouring dataset d′ ( i.e . equal to d but where all samples from any individual are removed or replaced ) belongs to said set of outcomes . Formally , a randomized function m is ( , δ ) -differentially private if P [ m ( d ) ∈ O ] ≤ e P [ m ( d′ ) ∈ O ] + δ , ( 2 ) where and δ are parameters that determine the strength of the guarantee . Two useful properties of DP are that that it composes ( i.e . the combination of DP functions is DP ) and that post-processing does not undo its privacy guarantees ( Dwork et al. , 2014 ) . These properties ensure that the modifications that we will make to FederatedSGD will keep the algorithm differentially private . Typically , the functions of interest are not differentially private . For this reason , they are privatized with “ privacy mechanisms ” , which apply a random transformation to the output of the function on the dataset . A standard mechanism is the Gaussian mechanism , which adds Gaussian noise to the function ’ s output , calibrating the noise variance with the privacy parameters ( , δ ) and the maximum individual ’ s contribution to the function ’ s output measured by the ` 2 norm . In the context of FederatedSGD , the functions to privatize are the gradient estimates sent to the server . The individual ’ s contribution is the gradient computed on their data . This gradient is “ normclipped ” ( Abadi et al. , 2016 ) , i.e . it is scaled down so its ` 2 norm is at most a predetermined value C. Then , Gaussian noise is added to the sum of contributions , which is sent to the server . Applying the privacy mechanism to a sum of contributions is a form of central DP . An alternative is local DP ( Dwork et al. , 2014 ) , where the privacy mechanism is applied to the statistics before leaving the device . However , models trained with local DP often suffer from low utility ( Granqvist et al. , 2020 ) , and are thus not considered in this paper . Central DP can involve trust in the server that updates the model , or a trusted third party separated from the model , which is how DP was originally formulated . This paper instead assumes the noisy sum is computed through secure multiparty computation ( Goryczka & Xiong , 2015 ) , such as secure aggregation ( Bonawitz et al. , 2017 ) . This is a cryptographic method that ensures the server only sees the sum of contributions . A crucial limitation of secure aggregation is that it can only compute sums , so the novel method introduced in Section 3 is restricted to working only on sums of individuals ’ statistics . 2.3 THE MODIFIED METHOD OF DIFFERENTIAL MULTIPLIERS . Ultimately , our objective is to find a parametric model that minimizes a differentiable loss function and respects some fairness constraints . Thus , this subsection reviews a constrained differential optimization algorithm , the modified method of differential multipliers ( MMDM ) ( Platt & Barr , 1987 ) . This algorithm tries to find a solution to the following constrained optimization problem : w ? = argmin w∈Rp φ ( w ) s.t . g ( w ) = 0 , ( P1 ) where φ : Rp → R is the function to minimize , g ( w ) = ( g1 ( w ) , g2 ( w ) , . . . , gr ( w ) ) is the concatenation of r constraint functions , and { w ∈ Rp : g ( w ) = 0 } is the solution subspace . The algorithm consists of solving the following set of differential equations resulting from the Lagrangian of ( P1 ) with an additional quadratic penalty cg ( w ) 2 using gradient descent/ascent . This results in an algorithm that applies these updates iteratively : { λ← λ+ γg ( w ) w ← w − η ( ∇wφ ( w ) + λT∇wg ( w ) + cg ( w ) T∇wg ( w ) ) , ( 3 ) where λ ∈ Rr is a Lagrange ( or dual ) multiplier , c ∈ R+ is a damping parameter , η is the learning rate of the model parameters , and γ is the learning rate of the Lagrange multiplier . Intuitively , these updates gradually fulfill ( P1 ) . Updating the parameters ∇wφ ( w ) and ∇wg ( w ) respectively enforce function minimization and constraint ’ s satisfaction . Then , the multiplier λ and the multiplicative factor cg ( w ) control how strongly the constraints ’ violations are penalized . A desirable property of MMDM is that for small enough learning rates η , γ and large enough damping parameter c , there is a region comprising the vicinity of each constrained minimum such that if the parameters ’ initialization is in that region and the parameters remain bounded , then the algorithm converges to a constrained minimum ( Platt & Barr , 1987 ) . Intuitively , the term cg ( w ) ∇wg ( w ) enforces a quadratic shape on the optimization search space to the neighbourhood of the solution subspace , and this local behavior is stronger the larger the damping parameter c. Thus , the algorithm converges to a minimum if the parameters ’ initialization is in this locally quadratic region .

Summary: This paper studies the problem of training neural networks with differential privacy and fairness guarantees. The authors proposed an algorithm using a modified method of differential multipliers. In terms of group fairness, the authors focus on false negative rate parity and accuracy parity notions. They compare their proposed algorithm with federatedSGD and its variants with clipping and adding noise.