DP-REC: Private & Communication-Efficient Federated Learning

1 INTRODUCTION . The performance of modern neural-network-based machine learning models scales exceptionally well with the amount of data that they are trained on ( Kaplan et al. , 2020 ; Henighan et al. , 2020 ) . At the same time , industry ( Xiao & Karlin ) , legislators ( Dwork , 2019 ; Voigt & Von dem Bussche , 2017 ) and consumers ( Laziuk , 2021 ) have become more conscious about the need to protect the privacy of the data that might be used in training such models . Federated learning ( FL ) describes a machine learning principle that enables learning on decentralized data by computing updates on-device . Instead of sending its data to a central location , a “ client ” in a federation of devices sends model updates computed on its data to the central server . Such an approach to learning from decentralized data promises to unlock the computing capabilities of billions of edge devices , enable personalized models and new applications in e.g . healthcare due to the inherently more private nature of the approach . On the other hand , the federated paradigm brings challenges along many dimensions such as learning from non-i.i.d . data , resource-constrained devices , heterogeneous compute and communication capabilities , questions of fairness and representation , as well as the focus of our paper : communication overhead and characterization of privacy . Neural network training requires many passes over the data , resulting in repeated transfer of the model and updates between the server and the clients , potentially making communication a primary bottleneck ( Kairouz et al. , 2019 ; Wang et al. , 2021 ) . Compressing updates is an active area of research in FL and an essential step in “ untethering ” edge devices from WiFi . Moreover , while FL is intuitively more private through keeping data on-device , client updates have been shown to reveal sensitive information , even allowing to reconstruct a client ’ s training data ( Geiping et al. , 2020 ) . To truly protect client privacy , a more rigorous mathematical notion of Differential Privacy ( DP ) is widely adopted as the de-facto standard in FL . More specifically , DP for FL is usually defined at a client-level , which provides plausible deniability of an individual client ’ s contribution to the federated model . Both aspects of FL , communication efficiency and differential privacy , have been extensively studied in separation . Effective combination of the two , however , is an open problem and an active area of research ( Kairouz et al. , 2021 ; Chen et al. , 2020 ; Girgis et al. , 2020 ) . Some methods offer very limited compression capabilities for comparable utility ( Kairouz et al. , 2021 ) , whereas others ( Girgis et al. , 2020 ) offer significant compression but require additional compromises , due to a looser privacy composition . In this work , we present Differentially Private Relative Entropy Coding ( DP-REC ) , a unified approach to jointly tackle privacy and communication efficiency . DP-REC makes use of the informationlimiting constraints of DP to encode the client updates in FL with extremely short messages . First , we build our method based on compression without quantization ; namely , the lossy variant of Relative Entropy Coding ( REC ) , recently proposed by Flamich et al . ( 2020 ) . Second , we show that it can be modified to satisfy DP , and we provide a proof of its privacy guarantees along with the appropriate accounting technique . Third , we run extensive evaluation on 4 datasets and 3 types of models to demonstrate that our algorithm achieves extreme compression of client-to-server updates ( down to 7 bits per tensor ) at privacy levels ε < 1 with a small impact on utility ( < 6.5 % accuracy reduction on FEMNIST compared to DP-FedAvg ) . Additionally , we show how to reduce server-to-client communication by sending a history of updates accumulated since the client ’ s last participation . 2 DP-REC FOR PRIVATE AND EFFICIENT COMMUNICATION IN FL Federated learning has been described by McMahan et al . ( 2016 ) in the form of the FedAvg algorithm . At each communication round t , the server sends the current model parameters w ( t ) to a subset S ( t ) of all clients S. Each chosen client s updates the server-provided model w ( t ) , e.g. , via stochastic gradient descent , to better fit its local dataset Ds = { dsi } Nsi=1 with a given loss function Ls ( Ds , w ) : = 1 Ns Ns∑ i=1 L ( dsi , w ) . ( 1 ) After E epochs of optimization on the local dataset , the client-side optimization procedure results in an updated model w ( t ) s , based on which the client computes its update to the global model ∆ ( t ) s = w ( t ) s −w ( t ) ; ( 2 ) and sends it to the server . The server then aggregates client-specific updates to get the new global model w ( t+1 ) = w ( t ) + 1|S ( t ) | ∑ s ∆ ( t ) s = 1 |S ( t ) | ∑ s w ( t ) s . Outside the context of differential privacy , client updates are usually weighted by the size Ns of the local dataset . A generalization of this serverside scheme ( Reddi et al. , 2020 ) interprets 1|S ( t ) | ∑ s∈S ( t ) ∆ ( t ) s as a “ gradient ” for the server-side model and introduces more advanced updating schemes , such as Adam ( Kingma & Ba , 2014 ) . Federated training involves repeated communication of model updates from clients to the server and vice versa . These updates can reveal sensitive information about the client data , so there is a need for formal privacy guarantees . The total communication cost can be significant , thus constraining FL to the use of unmetered channels , such as WiFi . Hence , compressing the update messages in a privacypreserving way plays an important role in moving FL to a truly mobile use-case . In the following sections , we first describe the lossy version of Relative Entropy Coding ( REC ) ( Flamich et al. , 2020 ) , then show how to extend it to the FL scenario before discussing it in the context of differential privacy . Finally , we show how DP-REC can be used to additionally compress server-to-client messages . 2.1 REC FOR EFFICIENT COMMUNICATION . Lossy REC , and its predecessor minimal random code learning ( MIRACLE ) ( Havasi et al. , 2018 ) , have been originally proposed as a way to compress a random sample w from a distribution qφ ( w ) parameterized with φ , i.e. , w ∼ qφ ( w ) , by using information that is “ shared ” between the sender and the receiver . This information is given in terms of a shared prior distribution pθ ( w ) with parameters θ along with a shared random seed R. The sender proceeds by generating K independent random samples , w1 , . . . , wK , from the prior distribution pθ ( w ) according to the random seed R. Subsequently , it forms a categorical distribution q̃π ( w1 : K ) over the K samples with the probability of each sample being proportional to the likelihood ratio πk ∝ qφ ( w = wk ) /pθ ( w = wk ) . Finally , it draws a random sample wk∗ from q̃π ( w1 : K ) , corresponding to the k∗ ’ th sample drawn from the shared prior . The sender can then communicate to the receiver the index k∗ with log2K bits . On the receiver side , wk∗ can be reconstructed by initializing the random number generator with R and sampling the first k∗ samples from pθ ( w ) . These procedures are described in Algorithms 1 and 2 . Havasi et al . ( 2018 ) set K to the exponential of the Kullback-Leibler ( KL ) divergence of qφ ( w ) to the prior pθ ( w ) with an extra constant c , i.e. , K = exp ( KL ( qφ ( w ) ||pθ ( w ) ) + c ) . In this case , the message length is at least O ( KL ( qφ ( w ) ||pθ ( w ) ) ) . This can be theoretically motivated based on the work by Harsha et al . ( 2007 ) ; when the sender and the receiver share a source of randomness , under some assumptions , this KL divergence is a lower bound on the expected message length ( Flamich et al. , 2020 ) . This brings forth an intuitive notion of compression that connects the compression rate Algorithm 1 The sender-side algorithm for lossy REC with the shared random seed R , the shared prior pθ ( w ) and the number of prior samples K. Set state of pseudo-RNG to R Draw w1 , . . . , wK i.i.d.∼ pθ ( w ) αk ← qφ ( w = wk ) /pθ ( w = wk ) πk ← αk/ ∑ j αj wk∗ ∼ q̃π ( w1 : K ) return k∗ encoded with log2K bits Algorithm 2 The receiver-side algorithm for lossy REC . Receive k∗ from the sender Set state of pseudo-RNG to R Draw w1 , . . . , wk∗ i.i.d.∼ pθ ( w ) Use wk∗ for downstream task with the amount of additional information encoded in qφ ( w ) relative to the information in pθ ( w ) ; the smaller the amount of extra information the shorter the message length will be and , in the extreme case where qφ ( w ) = pθ ( w ) , the message length will be O ( 1 ) . Of course , achieving this efficiency is meaningless if the bias of this procedure is high ; fortunately , Havasi et al . ( 2018 ) show that for appropriate values of c and under mild assumptions , the bias , namely |Eq̃π ( w1 : K ) [ f ] − Eqφ ( w ) [ f ] | for arbitrary functions f , can be sufficiently small . In all of our subsequent discussions , we parametrize K as a function of a binary bit-width b , i.e. , K = 2b , and treat b as the hyperparameter . 2.2 REC FOR EFFICIENT COMMUNICATION IN FL . We can adapt this procedure to FL by appropriately choosing distributions over client-to-server messages ( model updates ) , q ( t ) φs ( ∆ ( t ) s ) , along with the prior distribution p ( t ) θ ( ∆ ( t ) s ) on each round t : p ( t ) θ ( ∆ ( t ) s ) : = N ( ∆ ( t ) s |0 , σ2I ) , q ( t ) φs ( ∆ ( t ) s ) : = N ( ∆ ( t ) s |w ( t ) s −w ( t ) , σ2I ) , ( 3 ) i.e. , for the prior we use a Gaussian distribution centered at zero with appropriately chosen σ and for the message distribution we opt for a Gaussian with the same standard deviation centered at the model update . The form of q is chosen to provide a plug-in solution to potentially resource constrained devices , as well as to readily satisfy the differential privacy constrains discussed in Section 2.3 . Note that , as opposed to the FedAvg client update definition in ( 2 ) , here we consider ∆ ( t ) s to be a random variable and the difference w ( t ) s −w ( t ) to be the mean of the client-update distribution q over ∆ ( t ) s . Let us now see how communication efficiency is realized in the FL pipeline . The length of the message will be a function of how much “ extra ” information about the local dataset Ds is encoded in w ( t ) s , measured by KL divergence . As we show later , this has a nice interplay with DP : the DP constraints bound the amount of information encoded in each update , resulting in highly compressible messages . It is also worth noting that this procedure can be done parameter-wise ( i.e. , communicate log2K bits per parameter ) , layer-wise ( log2K bits for each layer in the network ) or even network-wise ( log2K bits in total ) . Any arbitrary intermediate vector size is also possible . This is done by splitting ∆ ( t ) s into M independent groups ( which is possible due to our assumption of factorial distributions over the dimensions of the vector ) and applying compression independently to each group ( see also Theorem 3 ) . If we have many groups ( e.g. , when we perform per-parameter compression ) , we can boost the compression even further by entropy coding the indices with their empirical distribution . 2.3 PRIVATE & EFFICIENT COMMUNICATION FOR FL WITH DP-REC In order to make the compression procedure described in Section 2.2 differentially private , we need to bound the sensitivity of the mechanism and quantify the noise inherent to it . Similarly to DP-FedAvg , bounding the sensitivity consists of clipping the norm of client updates w ( t ) s −w ( t ) . In the context of REC , this means that the client message distribution q ( t ) φ can not be too different from the server prior p ( t ) θ in any given round t. After this step , instead of explicitly injecting additional noise to the updates , we make use of the fact that the procedure in itself is stochastic . Two sources of randomness play a role in each round t : ( 1 ) drawing K samples from the prior p ( t ) θ ; ( 2 ) drawing an update from the importance sampling distribution q̃ ( t ) π . We coin the name Differentially-Private Relative Entropy Coding ( DP-REC ) for the resulting mechanism , outlined in Algorithms 3 and 4 . Algorithm 3 The client-side algorithm for DP-REC at a given round t. R ( t ) s is the client-chosen shared random seed , w ( t ) is the server model , w ( t ) s is the fine-tuned model of client s , K is the number of prior samples , C is the clipping threshold and σ is the prior standard deviation . R ( t ) s ← choose and set client-specific seed for round t φ ( t ) s ← w ( t ) s −w ( t ) ∆1 , . . . , ∆K i.i.d.∼ N ( ∆ ( t ) s |0 , σ2I ) φ̂ ( t ) s = φ ( t ) s min ( 1 , C/‖φ ( t ) s ‖2 ) αk ← N ( ∆ ( t ) s = ∆k|φ̂ ( t ) s , σ2I ) /N ( ∆ ( t ) s = ∆k|0 , σ2I ) πk ← αk/ ∑ j αj ∆k∗ ∼ q̃ ( t ) π ( ∆1 : K ) return k∗ encoded with log2K bits , R ( t ) s Algorithm 4 The server side algorithm for DP-REC . Receive k∗ , R ( t ) s from client s Set state of pseudo-RNG to R ( t ) s ∆1 , . . . , ∆k∗ i.i.d.∼ N ( ∆ ( t ) s |0 , σ2I ) Use ∆k∗ for downstream task Finally , to prove that DP-REC is differentially private and calculate the corresponding ε , δ , we build upon prior work in privacy accounting for ML and FL ; particularly , on Rényi differential privacy ( RDP ) ( Mironov , 2017 ) and the moments accountant ( Abadi et al. , 2016 ) . Our analysis in the next section follows the established approach based on tail bounds of the privacy loss random variable , addressing such important differences as two sources of randomness and non-Gaussianity of q̃ ( t ) π . Additional discussion on other aspects of our method can be found in Appendices B.1 and D.2 . 2.4 PRIVACY ANALYSIS OF DP-REC A possible avenue to analyze privacy for DP-REC is to derive DP bounds relying on Theorem 3.2 of Havasi et al . ( 2018 ) . However , obtaining reasonable guarantees can be challenging , as the probability bound in ( Havasi et al. , 2018 , Theorem 3.2 ) has to be incorporated in δ and it is at least e−0.125 lnK . As such , a fairly common value δ = 10−5 would require ∼e92 samples from the prior . To overcome this issue , we consider an importance sampling bound by Agapiou et al . ( 2017 , Section 2.2 ) . It scales ( inversely ) linearly with the number of samples , helping for smaller sample sizes . Let us restate the bound for completeness . For some test function ζ , one can characterize the bound between the true expectation and the importance sampling estimate in the following way : sup |ζ| < 1 ∣∣E [ µN ( ζ ) − µ ( ζ ) ] ∣∣ ≤ 12 K eD2 ( qφ||pθ ) , ( 4 ) where K is the number of samples , µN ( · ) = Eq̃π [ · ] , µ ( · ) = Eqφ [ · ] and D2 ( ·||· ) denotes the Rényi divergence of order 2 between the target qφ and the proposal pθ . Our choice of ζ ( cf . Appendix A.1 ) guarantees |ζ| < 1 for any input and enables the use of this bound . Theorem 1 summarizes our main theoretical result . It enables DP-REC to combine the server-side privacy accounting in the central model of DP with extreme model update compression , while allowing clients to privatize their updates locally and protect against an honest-but-curious server . Theorem 1 . After T rounds , with the client-to-server bitrate b , DP-REC is differentially private with δ ≤ min λ e−λε T∏ t=1 e ( λ−1 ) c ( t ) λ +λc ( t ) λ+1 + 12 2b T∑ t=1 ec ( t ) 2 , where the constant c ( t ) λ ≥ Dλ ( q ( t ) φ ||p ( t ) θ ) is the upper bound on the Rényi divergence of order λ between the client model update distribution q ( t ) φ and the server prior p ( t ) θ in any given round t. Proof . See Appendix A.1 . An attentive reader may notice a strong resemblance between Theorem 1 and the moments accountant ( Abadi et al. , 2016 ) and Rényi DP ( Mironov , 2017 ) results . Indeed , it turns out that the DP-REC compression procedure yields the privacy loss that can be bound by almost the double of the normal continuous Gaussian mechanism loss , plus a small overhead , and composed in a very similar manner . Shared random seed Prior work relying on shared random seeds has been shown to be vulnerable to attacks due to the possibility of “ inverting ” the noise ( Kairouz et al. , 2021 ) . DP-REC is not susceptible to this for two reasons . First , the randomness of the method comes from two sources instead of one , and knowing one seed does not permit to fully reconstruct the un-noised sample . In our guarantee , δ corresponds to the probability of the mechanism failure w.r.t . both sources of randomness , making it as secure as the standard Gaussian mechanism even when one of the seeds is shared . However , this alone is not sufficient because the shared seed R could be manipulated to generate a set of samples on which to encode the update such that the guarantee would not hold ( e.g. , in the tails of the privacy loss distribution ) . Hence , we add the second line of defense as we shift the task of picking R to a client , who then transmits the seed along with the index k∗ for decoding . This way , neither the server nor any other entity can manipulate the seed to break the privacy guarantee . Privacy amplification Like many recent approaches , including ( Kairouz et al. , 2021 ) , DP-REC can be seen as a hybrid method , privatizing updates locally and providing an amplified central guarantee . A key difference , however , is that our method does not calibrate noise to the aggregate . Namely , the scale of noise and the guarantee do not depend on whether a thousand , a hundred , or just one client is sampled in a round . This is due to non-additive nature of our mechanism , which does not let us easily benefit from the variance reduction as the Gaussian mechanism does . As a result , we always calibrate to an “ aggregate ” of one client . While this property increases the necessary noise , it has an upside of allowing stronger privacy amplification . Substituting the typical sampling without replacement by sampling with replacement , we can use the amplification factor of 1/|S| while accounting for T |S′| rounds , instead of |S′|/|S| while accounting for T rounds , and obtain a tighter overall guarantee . Secure aggregation One of the considerations in FL is that the server might be honest-but-curious rather than fully trusted . In DP-FedAvg ( McMahan et al. , 2017 ) , the noise addition is delegated to the server , and thus , secure aggregation ( Bonawitz et al. , 2017 ) is necessary to prevent the server from receiving client updates in the clear . DDGauss ( Kairouz et al. , 2021 ) and analogous methods mitigate this problem by shifting the noise addition to the client side , but still use secure aggregation for the reasons stated in the previous paragraph : noise is calibrated to the aggregate and may be insufficient to protect some clients . In DP-REC , because of the noise calibration to individual updates , we believe that the provided local guarantee ( which can be computed by removing subsampling amplification ) is sufficient against non-malicious servers . To further boost privacy protection , an important future work direction is integrating the DP-REC compression scheme with secure aggregation . Interplay of privacy and compression Theorem 1 relates privacy to our compression scheme in an intuitive manner . In order to get meaningful privacy guarantees , we have to bound the Rényi divergence in any given round t for any λ ≥ 1 , which limits the amount of information encoded in q ( t ) φ relative to p ( t ) θ . As a result , enforcing DP guarantees also implies that our scheme will have highly compressible messages . We formalize this interplay in the following lemma . Lemma 2 . Consider compressing the expected value of ζ under the qφs ( ∆s ) at ( 3 ) , and let ξ be a desired average compression bias of REC for ζ . To achieve this target , a sufficient bitrate b is at most b ≤ log2 12 + 1 log 2 D2 ( qφs ||pθ ) − log2 ξ G , where |ζ| ≤ G and D2 ( qφs ||pθ ) , and thus the maximum bitrate b , is controlled by the chosen ( ε , δ ) . Proof . The proof follows from ( 4 ) , by settingK = 2b , rearranging the terms and adjusting forG . We also verify the claim empirically ( Figure 2 ) , fixing the bound on the Rényi divergence and showing that the performance with extreme compression ( i.e. , 7 bits/tensor ) and no compression is similar . Finally , to confirm that various granularity of compression ( per-parameter , per-layer , per-network , etc . ) does not interfere with our privacy analysis , we introduce and prove the following theorem . Theorem 3 ( Compression-by-parts ) . Expectation of an arbitrary function ζ ( ∆ [ 1 ] , . . . , ∆ [ M ] ) over the importance sampling distributions q [ 1 ] π , . . . , q [ M ] π , built for M non-intersecting parameter groups independently , is equivalent to the expectation over the joint distribution qπ built on 2 ∑M i=1 bi samples : E ∆ [ 1 ] ∼q [ 1 ] π [ . . .E ∆ [ M ] ∼q [ M ] π [ ζ ( ∆ [ 1 ] , . . . , ∆ [ M ] ) ] . . . ] = E∆ [ 1 : M ] ∼qπ [ ζ ( ∆ [ 1 : M ] ) ] . Proof . See Appendix A.2 .

Summary: This paper introduces a compression and privatization technique to federated learning based on Relative Entropy Coding (REC). For each round, client $s$ aims to privatize its local model update $w_s$ by releasing $\Delta_s = w_s + N(0, \sigma I)$. However, instead of directly adding Gaussian noise, the client first picks $K$ random vectors from a prior distribution (which is independent of $w_s$) with shared randomness and then performs importance sampling according to the law of $w_s + N(0, \sigma I)$. It can be shown that as long as $K$ large enough (i.e., when $\log_2 K$ is much larger than the Renyi divergence of the prior and the target distributions), the sample obtained from importance sampling has a law close to the target distribution (i.e. the Gaussian perturbation) and thus can potentially preserve privacy. Moreover, the communication needed is $\log_2 K$ bits per round per client. By accounting the privacy loss over $T$ rounds, the authors characterize the overall privacy guarantees, which have a clean form and connect to the communication budgets nicely.