DP-REC: Private & Communication-Efficient Federated Learning

1 INTRODUCTION . The performance of modern neural-network-based machine learning models scales exceptionally well with the amount of data that they are trained on ( Kaplan et al. , 2020 ; Henighan et al. , 2020 ) . At the same time , industry ( Xiao & Karlin ) , legislators ( Dwork , 2019 ; Voigt & Von dem Bussche , 2017 ) and consumers ( Laziuk , 2021 ) have become more conscious about the need to protect the privacy of the data that might be used in training such models . Federated learning ( FL ) describes a machine learning principle that enables learning on decentralized data by computing updates on-device . Instead of sending its data to a central location , a “ client ” in a federation of devices sends model updates computed on its data to the central server . Such an approach to learning from decentralized data promises to unlock the computing capabilities of billions of edge devices , enable personalized models and new applications in e.g . healthcare due to the inherently more private nature of the approach . On the other hand , the federated paradigm brings challenges along many dimensions such as learning from non-i.i.d . data , resource-constrained devices , heterogeneous compute and communication capabilities , questions of fairness and representation , as well as the focus of our paper : communication overhead and characterization of privacy . Neural network training requires many passes over the data , resulting in repeated transfer of the model and updates between the server and the clients , potentially making communication a primary bottleneck ( Kairouz et al. , 2019 ; Wang et al. , 2021 ) . Compressing updates is an active area of research in FL and an essential step in “ untethering ” edge devices from WiFi . Moreover , while FL is intuitively more private through keeping data on-device , client updates have been shown to reveal sensitive information , even allowing to reconstruct a client ’ s training data ( Geiping et al. , 2020 ) . To truly protect client privacy , a more rigorous mathematical notion of Differential Privacy ( DP ) is widely adopted as the de-facto standard in FL . More specifically , DP for FL is usually defined at a client-level , which provides plausible deniability of an individual client ’ s contribution to the federated model . Both aspects of FL , communication efficiency and differential privacy , have been extensively studied in separation . Effective combination of the two , however , is an open problem and an active area of research ( Kairouz et al. , 2021 ; Chen et al. , 2020 ; Girgis et al. , 2020 ) . Some methods offer very limited compression capabilities for comparable utility ( Kairouz et al. , 2021 ) , whereas others ( Girgis et al. , 2020 ) offer significant compression but require additional compromises , due to a looser privacy composition . In this work , we present Differentially Private Relative Entropy Coding ( DP-REC ) , a unified approach to jointly tackle privacy and communication efficiency . DP-REC makes use of the informationlimiting constraints of DP to encode the client updates in FL with extremely short messages . First , we build our method based on compression without quantization ; namely , the lossy variant of Relative Entropy Coding ( REC ) , recently proposed by Flamich et al . ( 2020 ) . Second , we show that it can be modified to satisfy DP , and we provide a proof of its privacy guarantees along with the appropriate accounting technique . Third , we run extensive evaluation on 4 datasets and 3 types of models to demonstrate that our algorithm achieves extreme compression of client-to-server updates ( down to 7 bits per tensor ) at privacy levels ε < 1 with a small impact on utility ( < 6.5 % accuracy reduction on FEMNIST compared to DP-FedAvg ) . Additionally , we show how to reduce server-to-client communication by sending a history of updates accumulated since the client ’ s last participation . 2 DP-REC FOR PRIVATE AND EFFICIENT COMMUNICATION IN FL Federated learning has been described by McMahan et al . ( 2016 ) in the form of the FedAvg algorithm . At each communication round t , the server sends the current model parameters w ( t ) to a subset S ( t ) of all clients S. Each chosen client s updates the server-provided model w ( t ) , e.g. , via stochastic gradient descent , to better fit its local dataset Ds = { dsi } Nsi=1 with a given loss function Ls ( Ds , w ) : = 1 Ns Ns∑ i=1 L ( dsi , w ) . ( 1 ) After E epochs of optimization on the local dataset , the client-side optimization procedure results in an updated model w ( t ) s , based on which the client computes its update to the global model ∆ ( t ) s = w ( t ) s −w ( t ) ; ( 2 ) and sends it to the server . The server then aggregates client-specific updates to get the new global model w ( t+1 ) = w ( t ) + 1|S ( t ) | ∑ s ∆ ( t ) s = 1 |S ( t ) | ∑ s w ( t ) s . Outside the context of differential privacy , client updates are usually weighted by the size Ns of the local dataset . A generalization of this serverside scheme ( Reddi et al. , 2020 ) interprets 1|S ( t ) | ∑ s∈S ( t ) ∆ ( t ) s as a “ gradient ” for the server-side model and introduces more advanced updating schemes , such as Adam ( Kingma & Ba , 2014 ) . Federated training involves repeated communication of model updates from clients to the server and vice versa . These updates can reveal sensitive information about the client data , so there is a need for formal privacy guarantees . The total communication cost can be significant , thus constraining FL to the use of unmetered channels , such as WiFi . Hence , compressing the update messages in a privacypreserving way plays an important role in moving FL to a truly mobile use-case . In the following sections , we first describe the lossy version of Relative Entropy Coding ( REC ) ( Flamich et al. , 2020 ) , then show how to extend it to the FL scenario before discussing it in the context of differential privacy . Finally , we show how DP-REC can be used to additionally compress server-to-client messages . 2.1 REC FOR EFFICIENT COMMUNICATION . Lossy REC , and its predecessor minimal random code learning ( MIRACLE ) ( Havasi et al. , 2018 ) , have been originally proposed as a way to compress a random sample w from a distribution qφ ( w ) parameterized with φ , i.e. , w ∼ qφ ( w ) , by using information that is “ shared ” between the sender and the receiver . This information is given in terms of a shared prior distribution pθ ( w ) with parameters θ along with a shared random seed R. The sender proceeds by generating K independent random samples , w1 , . . . , wK , from the prior distribution pθ ( w ) according to the random seed R. Subsequently , it forms a categorical distribution q̃π ( w1 : K ) over the K samples with the probability of each sample being proportional to the likelihood ratio πk ∝ qφ ( w = wk ) /pθ ( w = wk ) . Finally , it draws a random sample wk∗ from q̃π ( w1 : K ) , corresponding to the k∗ ’ th sample drawn from the shared prior . The sender can then communicate to the receiver the index k∗ with log2K bits . On the receiver side , wk∗ can be reconstructed by initializing the random number generator with R and sampling the first k∗ samples from pθ ( w ) . These procedures are described in Algorithms 1 and 2 . Havasi et al . ( 2018 ) set K to the exponential of the Kullback-Leibler ( KL ) divergence of qφ ( w ) to the prior pθ ( w ) with an extra constant c , i.e. , K = exp ( KL ( qφ ( w ) ||pθ ( w ) ) + c ) . In this case , the message length is at least O ( KL ( qφ ( w ) ||pθ ( w ) ) ) . This can be theoretically motivated based on the work by Harsha et al . ( 2007 ) ; when the sender and the receiver share a source of randomness , under some assumptions , this KL divergence is a lower bound on the expected message length ( Flamich et al. , 2020 ) . This brings forth an intuitive notion of compression that connects the compression rate Algorithm 1 The sender-side algorithm for lossy REC with the shared random seed R , the shared prior pθ ( w ) and the number of prior samples K. Set state of pseudo-RNG to R Draw w1 , . . . , wK i.i.d.∼ pθ ( w ) αk ← qφ ( w = wk ) /pθ ( w = wk ) πk ← αk/ ∑ j αj wk∗ ∼ q̃π ( w1 : K ) return k∗ encoded with log2K bits Algorithm 2 The receiver-side algorithm for lossy REC . Receive k∗ from the sender Set state of pseudo-RNG to R Draw w1 , . . . , wk∗ i.i.d.∼ pθ ( w ) Use wk∗ for downstream task with the amount of additional information encoded in qφ ( w ) relative to the information in pθ ( w ) ; the smaller the amount of extra information the shorter the message length will be and , in the extreme case where qφ ( w ) = pθ ( w ) , the message length will be O ( 1 ) . Of course , achieving this efficiency is meaningless if the bias of this procedure is high ; fortunately , Havasi et al . ( 2018 ) show that for appropriate values of c and under mild assumptions , the bias , namely |Eq̃π ( w1 : K ) [ f ] − Eqφ ( w ) [ f ] | for arbitrary functions f , can be sufficiently small . In all of our subsequent discussions , we parametrize K as a function of a binary bit-width b , i.e. , K = 2b , and treat b as the hyperparameter . 2.2 REC FOR EFFICIENT COMMUNICATION IN FL . We can adapt this procedure to FL by appropriately choosing distributions over client-to-server messages ( model updates ) , q ( t ) φs ( ∆ ( t ) s ) , along with the prior distribution p ( t ) θ ( ∆ ( t ) s ) on each round t : p ( t ) θ ( ∆ ( t ) s ) : = N ( ∆ ( t ) s |0 , σ2I ) , q ( t ) φs ( ∆ ( t ) s ) : = N ( ∆ ( t ) s |w ( t ) s −w ( t ) , σ2I ) , ( 3 ) i.e. , for the prior we use a Gaussian distribution centered at zero with appropriately chosen σ and for the message distribution we opt for a Gaussian with the same standard deviation centered at the model update . The form of q is chosen to provide a plug-in solution to potentially resource constrained devices , as well as to readily satisfy the differential privacy constrains discussed in Section 2.3 . Note that , as opposed to the FedAvg client update definition in ( 2 ) , here we consider ∆ ( t ) s to be a random variable and the difference w ( t ) s −w ( t ) to be the mean of the client-update distribution q over ∆ ( t ) s . Let us now see how communication efficiency is realized in the FL pipeline . The length of the message will be a function of how much “ extra ” information about the local dataset Ds is encoded in w ( t ) s , measured by KL divergence . As we show later , this has a nice interplay with DP : the DP constraints bound the amount of information encoded in each update , resulting in highly compressible messages . It is also worth noting that this procedure can be done parameter-wise ( i.e. , communicate log2K bits per parameter ) , layer-wise ( log2K bits for each layer in the network ) or even network-wise ( log2K bits in total ) . Any arbitrary intermediate vector size is also possible . This is done by splitting ∆ ( t ) s into M independent groups ( which is possible due to our assumption of factorial distributions over the dimensions of the vector ) and applying compression independently to each group ( see also Theorem 3 ) . If we have many groups ( e.g. , when we perform per-parameter compression ) , we can boost the compression even further by entropy coding the indices with their empirical distribution . 2.3 PRIVATE & EFFICIENT COMMUNICATION FOR FL WITH DP-REC In order to make the compression procedure described in Section 2.2 differentially private , we need to bound the sensitivity of the mechanism and quantify the noise inherent to it . Similarly to DP-FedAvg , bounding the sensitivity consists of clipping the norm of client updates w ( t ) s −w ( t ) . In the context of REC , this means that the client message distribution q ( t ) φ can not be too different from the server prior p ( t ) θ in any given round t. After this step , instead of explicitly injecting additional noise to the updates , we make use of the fact that the procedure in itself is stochastic . Two sources of randomness play a role in each round t : ( 1 ) drawing K samples from the prior p ( t ) θ ; ( 2 ) drawing an update from the importance sampling distribution q̃ ( t ) π . We coin the name Differentially-Private Relative Entropy Coding ( DP-REC ) for the resulting mechanism , outlined in Algorithms 3 and 4 . Algorithm 3 The client-side algorithm for DP-REC at a given round t. R ( t ) s is the client-chosen shared random seed , w ( t ) is the server model , w ( t ) s is the fine-tuned model of client s , K is the number of prior samples , C is the clipping threshold and σ is the prior standard deviation . R ( t ) s ← choose and set client-specific seed for round t φ ( t ) s ← w ( t ) s −w ( t ) ∆1 , . . . , ∆K i.i.d.∼ N ( ∆ ( t ) s |0 , σ2I ) φ̂ ( t ) s = φ ( t ) s min ( 1 , C/‖φ ( t ) s ‖2 ) αk ← N ( ∆ ( t ) s = ∆k|φ̂ ( t ) s , σ2I ) /N ( ∆ ( t ) s = ∆k|0 , σ2I ) πk ← αk/ ∑ j αj ∆k∗ ∼ q̃ ( t ) π ( ∆1 : K ) return k∗ encoded with log2K bits , R ( t ) s Algorithm 4 The server side algorithm for DP-REC . Receive k∗ , R ( t ) s from client s Set state of pseudo-RNG to R ( t ) s ∆1 , . . . , ∆k∗ i.i.d.∼ N ( ∆ ( t ) s |0 , σ2I ) Use ∆k∗ for downstream task Finally , to prove that DP-REC is differentially private and calculate the corresponding ε , δ , we build upon prior work in privacy accounting for ML and FL ; particularly , on Rényi differential privacy ( RDP ) ( Mironov , 2017 ) and the moments accountant ( Abadi et al. , 2016 ) . Our analysis in the next section follows the established approach based on tail bounds of the privacy loss random variable , addressing such important differences as two sources of randomness and non-Gaussianity of q̃ ( t ) π . Additional discussion on other aspects of our method can be found in Appendices B.1 and D.2 . 2.4 PRIVACY ANALYSIS OF DP-REC A possible avenue to analyze privacy for DP-REC is to derive DP bounds relying on Theorem 3.2 of Havasi et al . ( 2018 ) . However , obtaining reasonable guarantees can be challenging , as the probability bound in ( Havasi et al. , 2018 , Theorem 3.2 ) has to be incorporated in δ and it is at least e−0.125 lnK . As such , a fairly common value δ = 10−5 would require ∼e92 samples from the prior . To overcome this issue , we consider an importance sampling bound by Agapiou et al . ( 2017 , Section 2.2 ) . It scales ( inversely ) linearly with the number of samples , helping for smaller sample sizes . Let us restate the bound for completeness . For some test function ζ , one can characterize the bound between the true expectation and the importance sampling estimate in the following way : sup |ζ| < 1 ∣∣E [ µN ( ζ ) − µ ( ζ ) ] ∣∣ ≤ 12 K eD2 ( qφ||pθ ) , ( 4 ) where K is the number of samples , µN ( · ) = Eq̃π [ · ] , µ ( · ) = Eqφ [ · ] and D2 ( ·||· ) denotes the Rényi divergence of order 2 between the target qφ and the proposal pθ . Our choice of ζ ( cf . Appendix A.1 ) guarantees |ζ| < 1 for any input and enables the use of this bound . Theorem 1 summarizes our main theoretical result . It enables DP-REC to combine the server-side privacy accounting in the central model of DP with extreme model update compression , while allowing clients to privatize their updates locally and protect against an honest-but-curious server . Theorem 1 . After T rounds , with the client-to-server bitrate b , DP-REC is differentially private with δ ≤ min λ e−λε T∏ t=1 e ( λ−1 ) c ( t ) λ +λc ( t ) λ+1 + 12 2b T∑ t=1 ec ( t ) 2 , where the constant c ( t ) λ ≥ Dλ ( q ( t ) φ ||p ( t ) θ ) is the upper bound on the Rényi divergence of order λ between the client model update distribution q ( t ) φ and the server prior p ( t ) θ in any given round t. Proof . See Appendix A.1 . An attentive reader may notice a strong resemblance between Theorem 1 and the moments accountant ( Abadi et al. , 2016 ) and Rényi DP ( Mironov , 2017 ) results . Indeed , it turns out that the DP-REC compression procedure yields the privacy loss that can be bound by almost the double of the normal continuous Gaussian mechanism loss , plus a small overhead , and composed in a very similar manner . Shared random seed Prior work relying on shared random seeds has been shown to be vulnerable to attacks due to the possibility of “ inverting ” the noise ( Kairouz et al. , 2021 ) . DP-REC is not susceptible to this for two reasons . First , the randomness of the method comes from two sources instead of one , and knowing one seed does not permit to fully reconstruct the un-noised sample . In our guarantee , δ corresponds to the probability of the mechanism failure w.r.t . both sources of randomness , making it as secure as the standard Gaussian mechanism even when one of the seeds is shared . However , this alone is not sufficient because the shared seed R could be manipulated to generate a set of samples on which to encode the update such that the guarantee would not hold ( e.g. , in the tails of the privacy loss distribution ) . Hence , we add the second line of defense as we shift the task of picking R to a client , who then transmits the seed along with the index k∗ for decoding . This way , neither the server nor any other entity can manipulate the seed to break the privacy guarantee . Privacy amplification Like many recent approaches , including ( Kairouz et al. , 2021 ) , DP-REC can be seen as a hybrid method , privatizing updates locally and providing an amplified central guarantee . A key difference , however , is that our method does not calibrate noise to the aggregate . Namely , the scale of noise and the guarantee do not depend on whether a thousand , a hundred , or just one client is sampled in a round . This is due to non-additive nature of our mechanism , which does not let us easily benefit from the variance reduction as the Gaussian mechanism does . As a result , we always calibrate to an “ aggregate ” of one client . While this property increases the necessary noise , it has an upside of allowing stronger privacy amplification . Substituting the typical sampling without replacement by sampling with replacement , we can use the amplification factor of 1/|S| while accounting for T |S′| rounds , instead of |S′|/|S| while accounting for T rounds , and obtain a tighter overall guarantee . Secure aggregation One of the considerations in FL is that the server might be honest-but-curious rather than fully trusted . In DP-FedAvg ( McMahan et al. , 2017 ) , the noise addition is delegated to the server , and thus , secure aggregation ( Bonawitz et al. , 2017 ) is necessary to prevent the server from receiving client updates in the clear . DDGauss ( Kairouz et al. , 2021 ) and analogous methods mitigate this problem by shifting the noise addition to the client side , but still use secure aggregation for the reasons stated in the previous paragraph : noise is calibrated to the aggregate and may be insufficient to protect some clients . In DP-REC , because of the noise calibration to individual updates , we believe that the provided local guarantee ( which can be computed by removing subsampling amplification ) is sufficient against non-malicious servers . To further boost privacy protection , an important future work direction is integrating the DP-REC compression scheme with secure aggregation . Interplay of privacy and compression Theorem 1 relates privacy to our compression scheme in an intuitive manner . In order to get meaningful privacy guarantees , we have to bound the Rényi divergence in any given round t for any λ ≥ 1 , which limits the amount of information encoded in q ( t ) φ relative to p ( t ) θ . As a result , enforcing DP guarantees also implies that our scheme will have highly compressible messages . We formalize this interplay in the following lemma . Lemma 2 . Consider compressing the expected value of ζ under the qφs ( ∆s ) at ( 3 ) , and let ξ be a desired average compression bias of REC for ζ . To achieve this target , a sufficient bitrate b is at most b ≤ log2 12 + 1 log 2 D2 ( qφs ||pθ ) − log2 ξ G , where |ζ| ≤ G and D2 ( qφs ||pθ ) , and thus the maximum bitrate b , is controlled by the chosen ( ε , δ ) . Proof . The proof follows from ( 4 ) , by settingK = 2b , rearranging the terms and adjusting forG . We also verify the claim empirically ( Figure 2 ) , fixing the bound on the Rényi divergence and showing that the performance with extreme compression ( i.e. , 7 bits/tensor ) and no compression is similar . Finally , to confirm that various granularity of compression ( per-parameter , per-layer , per-network , etc . ) does not interfere with our privacy analysis , we introduce and prove the following theorem . Theorem 3 ( Compression-by-parts ) . Expectation of an arbitrary function ζ ( ∆ [ 1 ] , . . . , ∆ [ M ] ) over the importance sampling distributions q [ 1 ] π , . . . , q [ M ] π , built for M non-intersecting parameter groups independently , is equivalent to the expectation over the joint distribution qπ built on 2 ∑M i=1 bi samples : E ∆ [ 1 ] ∼q [ 1 ] π [ . . .E ∆ [ M ] ∼q [ M ] π [ ζ ( ∆ [ 1 ] , . . . , ∆ [ M ] ) ] . . . ] = E∆ [ 1 : M ] ∼qπ [ ζ ( ∆ [ 1 : M ] ) ] . Proof . See Appendix A.2 .

Summary: This paper studies differentially private algorithms in federated learning, and proposes to take advantage of the randomness in Relative Entropy Coding (REC) to achieve good privacy-utility trade offs while significantly saving the communication costs. On four benchmark datasets (MNIST, FEMNIST, Shakespeare, Stack Overflow linear regression), under same privacy epsilon, the proposed method can save communication for ~(4000, 20, 800, 100)  times with accuracy loss ~(15, 6, 10, 1) compared to DP-FedAvg.      ======= after rebuttal ============ I appreciate all the clarification and improvement on the draft. This paper is a borderline to me for the remaining concerns.  I want to be more specific here on "apples-to-apples" comparison. There are three things considered: differential privacy, communication and accuracy. It would be useful to show how this method can help achieve a reasonably good metric by tuning the other two metrics. Only working in the low accuracy regime sounds like a big limitation, and did not compare with other stronger compression method further weaken the claim (as also mentioned by other reviewers).  The authors mention secure aggregation in their rebuttal. IIUC, secure aggregation is future work in this draft. It is not very convincing.  That being said, The idea seems to be interesting, and I will raise the score from borderline reject to borderline accept.