Picking Daisies in Private: Federated Learning from Small Datasets

1 INTRODUCTION . How can we learn high quality models when data is inherently distributed into small parts that can not be shared or pooled , as we for example often encounter in the medical domain ( Rieke et al. , 2020 ) ? Federated learning solves many but not all of these problems . While it can achieve good global models without disclosing any of the local data , it does require sufficient data to be available at each site in order for the locally trained models to achieve a minimum quality . In many relevant applications , this is not the case : in healthcare settings we often have as little as a few dozens of samples ( Granlund et al. , 2020 ; Su et al. , 2021 ; Painter et al. , 2020 ) , but also domains where DL is generally regarded as highly successful , such as natural language processing and object detection often suffer from a lack of data ( Liu et al. , 2020 ; Kang et al. , 2019 ) . In this paper , we present an elegant idea in which models are moved around iteratively and passed from client to client , thus forming a daisy-chain that the model traverses . This daisy-chaining allows us to learn from such small , distributed datasets simply by consecutively training the model with the data availalbe at each site . We should not do this naively , however , since it would not only lead to overfitting – a common problem in federated learning which can cause learning to diverge ( Haddadpour and Mahdavi , 2019 ) – but also violate privacy , since a client can infer from a model upon the data of the client it received it from ( Shokri et al. , 2017 ) . To alleviate these issues , we propose an approach to combine daisy-chaining of local datasets with aggregation of models orchestrated by a coordinator , which we term federated daisy-chaining ( FEDDC ) . In a nutshell , in a daisy-chain round , local models are send to a coordinator and randomly redistributed to clients , without aggregation . Thereby , each individual model follows its own random daisy-chain of clients . In an aggregation round , models are aggregated and redistributed , as in standard federated learning . Our approach maintains privacy of local datasets , while it provably guarantees improvement of model quality of convex models with a suitable aggregation method which standard federated learning can not . For non-convex models such as convolutional neural networks , it improves the performance upon the state-of-the-art on standard benchmark and medical datasets . Formally , we show that FEDDC allows convergences on datasets so small that standard federated learning diverges by analyzing aggregation via the Radon point from a PAC-learning perspective . We substantiate this theoretical analysis by showing that FEDDC in practice matches the accuracy of a model trained on the full data of the SUSY binary classification dataset , beating standard federated learning by a wide margin . In fact , FEDDC allows us to achieve optimal model quality with only 2 samples per client . In an extensive empirical evaluation , we then show that FEDDC outperforms vanilla federated learning ( McMahan et al. , 2017 ) , naive daisy-chaining , and FedProx ( Li et al. , 2020a ) on the benchmark dataset CIFAR10 ( Krizhevsky , 2009 ) , and more importantly on two realworld medical datasets . In summary , our contributions are as follows . • FEDDC , an elegant novel approach to federated learning from small datasets via a combination of daisy-chaining and aggregation , • a theoretical guarantee that FEDDC improves models in terms of , δ-guarantees , which standard federated averaging can not , • a thorough discussion of the privacy aspects and mitigations suitable for FEDDC , including an empirical evaluation of differentially private FEDDC , and • an extensive set of experiments showing that FEDDC substantially improves model quality for small datasets , being able to train ResNet18 on a pneumonia dataset on as little as 8 samples per client . 2 RELATED WORK . Learning from small datasets is a well studied problem in machine learning . In the literature , we find among others general solutions , such as using simpler models , and transfer learning ( Torrey and Shavlik , 2010 ) , to more specialized ones , such as data augmentation ( Ibrahim et al. , 2021 ) and fewshot learning ( Vinyals et al. , 2016 ; Prabhu et al. , 2019 ) . In our scenario , however , data is abundant , but the problem is that the local datasets at each site are small and can not be pooled . Federated learning and its variants have been shown to learn from incomplete local data sources , e.g. , non-iid label distributions ( Li et al. , 2020a ; Wang et al. , 2019 ) and differing feature distributions ( Li et al. , 2020b ; Reisizadeh et al. , 2020a ) , but were proven to fail in case of large gradient diversity ( Haddadpour and Mahdavi , 2019 ) and too dissimilar label distribution ( Marfoq et al. , 2021 ) . For very small datasets , local empirical distributions may vary greatly from the global data distribution—while the difference of empirical to true distribution decreases exponentially with the sample size ( e.g. , according to the Dvoretzky–Kiefer–Wolfowitz inequality ) , for small sample sizes the difference can be substantial , in particular if the data distribution differs from a Normal distribution ( Kwak and Kim , 2017 ) . FedProx ( Li et al. , 2020a ) is a variant of federated learning that is particularly suitable for tackling non-iid data distributions . It increases training stability by adding a momentum-like proximal term to the objective functions . This increase in stability , however , comes at the cost of not being privacypreserving anymore ( Rahman et al. , 2021 ) . We compare FEDDC to FedProx in Section 7 . We can reduce sample complexity by training networks only partially , e.g. , by collaboratively training only a shared part of the model . This approach allows training client-specific models in the medical domain ( Yang et al. , 2021 ) , but by design can not train a global model . Kiss and Horvath ( 2021 ) propose a decentralized and communication-efficient variant of federated learning that migrates models over a decentralized network and stores incoming models locally at each client until sufficiently many models are collected on each client for an averaging step , similar to Gossip federated learing ( Jelasity et al. , 2005 ) . The variant without averaging is similar to simple daisy-chaining which we compare to in Section 7 . FEDDC is compatible with any aggregation operator , including the Radon point ( Kamp et al. , 2017 ) and the geometric median ( Pillutla et al. , 2019 ) . It can also be straightforwardly combined with approaches to improve communication-efficiency , such as dynamic averaging ( Kamp et al. , 2018 ) , and model quantization ( Reisizadeh et al. , 2020b ) . 3 PRELIMINARIES . We assume iterative learning algorithms ( cf . Chp . 2.1.4 Kamp , 2019 ) A : X × Y × H → H that update a model h ∈ H using a dataset D ⊂ X × Y from an input space X and output space Y , i.e. , ht+1 = A ( D , ht ) . Given a set of m ∈ N clients with local datasets D1 , . . . , Dm ⊂ X × Y drawn iid from a data distribution D and a loss function ` : Y × Y → R , the goal is to find a single model h∗ ∈ H that minimizes the risk ε ( h ) = E ( x , y ) ∼D [ ` ( h ( x ) , y ) ] . ( 1 ) In centralized learning , the datasets are pooled as D = ⋃ i∈ [ m ] D i and A is applied to D until convergence . Note that applying A on D can be the application to any random subset , e.g. , as in mini-batch training , and convergence is measured in terms of low training loss , small gradient , or small deviation from previous iterate . In standard federated learning ( McMahan et al. , 2017 ) , A is applied in parallel for b ∈ N rounds on each client locally to produce local models h1 , . . . , hm . These models are then centralized and aggregated using an aggregation operator agg : Hm → H , i.e. , h = agg ( h1 , . . . , hm ) . The aggregated model h is then redistributed to local clients which perform another b rounds of training using h as a starting point . This is iterated until convergence of h. In the following section , we describe FEDDC . 4 METHOD . We propose federated daisy chaining as an extension to federated learning and hence assume a setup where we have m clients and one designated coordinator node.1 We provide pseudocode of our approach as Algorithm 1 . The client Each client trains its local model in each round on local data ( line 4 ) , and sends its model to the coordinator every b rounds for aggregation , where b is the aggregation period , and every d rounds for daisy chaining , where d is the daisy-chaining period ( line 6 ) . This re-distribution of models results in each individual model following a daisy-chain of clients , training on each local dataset . Such a daisy-chain is interrupted by each aggregation round . The coordinator Upon receiving models ( line 10 ) , in a daisy-chaining round ( line 11 ) the coordinator draws a random permutation π of clients ( line 12 ) and re-distributes the model of client i to client π ( i ) ( line 13 ) , while in an aggregation round ( line 15 ) , the coordinator instead aggregates all local models ( line 16 ) and re-distributes the aggregate to all clients ( line 17 ) . Communication complexity Communication between clients and coordinator happens in O ( tmaxd + tmax b ) rounds , where tmax is the overall number of rounds . Although inherently higher than in plain federated learning , the overall amount of communication in daisy chained federated learning is still low . In particular , in each communication round , each client sends and receives only a single model from the coordinator . The amount of communication per communication round is thus linear in the number of clients and model size , similar to federated averaging . In the following section we show that the additional daisy-chaining rounds ensure convergence for small datasets in terms of PAC-like , δ-guarantees . 5 THEORY . Next , we theoretically analyze the key properties of FEDDC in terms of PAC-like ( , δ ) -guarantees . For that , we make the following assumption on the learning algorithm A . Assumption 1 ( ( , δ ) -guarantees ) . The learning algorithmA applied on all datasets drawn iid from D of size n ≥ n0 ∈ N produces a model h ∈ H such that with probability δ ∈ ( 0 , 1 ] it holds for > 0 that P ( ε ( h ) > ) < δ . The sample size n0 is a monotone function in δ and , i.e. , for fixed n0 is monotonically increasing with δ and for fixed δ it is monotonically decreasing with ( note that typically n0 is a polynomial in −1 and log ( δ−1 ) ) . 1This star-topology can be extended to hierarchical networks in a straight-forward manner . Federated learning can also be performed in a decentralized network via gossip algorithms ( Jelasity et al. , 2005 ) Algorithm 1 Federated Daisy-Chaining FEDDC Require : daisy-chaining period d , aggregation period b , learning algorithmA , aggregation operator agg , m clients with local datasets D1 , . . . , Dm 1 : initialize local models h10 , . . . , h m 0 2 : at local client i in round t 3 : draw random set of samples S from local dataset Di 4 : hit ←A ( S , hit−1 ) 5 : if t % d = d− 1 or t % b = b− 1 then 6 : send hit to coordinator 7 : end if 8 : 9 : at coordinator in round t 10 : receive models h1t , . . . , h m t 11 : if t % d = d− 1 then 12 : draw permutation π of [ 1 , m ] at random 13 : for all i ∈ [ m ] send model hit to client π ( i ) 14 : end if 15 : if t % b = b− 1 then 16 : ht ← agg ( h1t , . . . , hmt ) 17 : send ht to all clients 18 : end if 19 : Here ε ( h ) is the risk defined in Equation 1 . We will show that aggregation for small local datasets can diverge and that daisy-chaining can prevent this . For this , we analyze the development of ( , δ ) guarantees on model quality when aggregating local models with and without daisy-chaining . It is an open question how such an ( , δ ) -guarantee develops when averaging local models . Existing work analyzes convergence ( Haddadpour and Mahdavi , 2019 ; Kamp et al. , 2018 ) or regret ( Kamp et al. , 2014 ) and thus gives no generalization bound . Recent work on generalization bounds for federated averaging via the NTK-framework ( Huang et al. , 2021 ) is promising , but not directly compatible with daisy-chaining : the analysis of Huang et al . ( 2021 ) requires local datasets to be disjoint which would be violated by a daisy-chaining round . Using the Radon point ( Radon , 1921 ) as aggregation operator , however , does permit analyzing the development of ( , δ ) -guarantees . In particular , it was shown that for fixed the probability of bad models is reduced doubly exponentially ( Kamp et al. , 2017 ) when we aggregate models using the ( iterated ) Radon point ( Clarkson et al. , 1996 ) . Here , a Radon point of a set of points S from a space X is—similar to the geometric median—a point in the convex hull of S with a high centrality ( more precisely , a Tukey depth ( Tukey , 1975 ; Gilad-Bachrach et al. , 2004 ) of at least 2 ) . For a Radon point to exist , the size of S has to be sufficiently large ; the minimum size of S ⊂ X is denoted the Radon number of the space X and for X ⊆ Rd the radon number is d+ 2 . Let r ∈ N be the Radon number of H , A be a learning algorithm as in assumption 1 , and ε be convex . Assume m ≥ rh many clients with h ∈ N. For > 0 , δ ∈ ( 0 , 1 ] assume local datasets D1 , . . . , Dm of size larger than n0 ( , δ ) drawn iid from D , and h1 , . . . , hm be local models trained on them usingA . Let rh be the iterated Radon point with h iterations computed on the local models . Then it follows from Theorem 3 in Kamp et al . ( 2017 ) that for all i ∈ [ m ] it holds that P ( ε ( rh ) > ) ≤ ( r P ( ε ( hi ) > ) ) 2 h ( 2 ) where the probability is over the random draws of local datasets . This implies that the iterated Radon point only improves over the local models if δ < r−1 . Consequently , local models need to achieve a minimum quality for the federated learning system to converge . Corollary 2 . Given a model space H with Radon number r ∈ N , convex risk ε , and a learning algorithm A with sample size n ( , δ ) . Given > 0 and any h ∈ N , if local datasets D1 , . . . , Dm with m ≥ rh are smaller than n0 ( , r−1 ) , then federated learning using the Radon point does not improve model quality in terms of ( , δ ) -guarantees . In other words , when using aggregation by Radon points alone , an improvement in terms of ( , δ ) guarantees is strongly dependent on large enough local datasets . Furthermore , given δ > r−1 , the guarantee can become arbitrarily bad by increasing the number of aggregation rounds . Federated Daisy-Chaining as given in Algo . 1 permutes local models at random , which is in theory equivalent to permuting local datasets . This way , the amount of data visible to each model is increased . Since the permutation is drawn at random , the minimum amount of distinct local samples observed by each model can be given with high probability . Lemma 3 . Given δ ∈ ( 0 , 1 ] , m ∈ N clients , and k ∈ [ m ] , if Algorithm 1 with daisy chaining period d ∈ N is run for T ∈ N rounds with T ≥ d ln δ ln ( m−1 m ) ( m− k + 1 ) m then each local model has seen at least k distinct datasets with probability 1− δ . Proof . For m clients with m local datasets , the chance of a client i to not see dataset j after τ many permutations is ( m−1 m ) τ . The probability that each of the m clients is not seeing m − k + 1 other datasets is hence m−k+1∏ j=1 ( m− 1 m ) τ = ( m− 1 m ) τ ( m−k+1 ) , and corresponds to the probability of each client seeing less than k distinct other datasets . The probability of all clients seeing at least k distinct datasets is hence at least 1− ( m− 1 m ) τ ( m−k+1 ) m ! ≥ 1− δ ⇔ ( m− 1 m ) τ ( m−k+1 ) m ! ≤ δ . Taking the logarithm on both sides with base ( m− 1 ) /m < 1 yields τ ( m− k + 1 ) m ≥ ln δ ln m−1m . Multiplying with m− k+1 and observing that τ many daisy-chaining rounds with period d require T = τd total rounds yields the result . From Lm . 3 it follows that when we perform daisy-chaining with m clients , and local datasets of size n , for at least d ln δ ( ( ln ( m− 1 ) − ln ( m ) ) ( m− k+1 ) m ) −1 rounds , each local model will with probability at least 1− δ be trained on at least kn samples . Proposition 4 . Given a model space H with Radon number r ∈ N , convex risk ε , and a learning algorithm A with sample size n ( , δ ) . Given > 0 , δ ∈ ( 0 , r−1 ) and any h ∈ N , if local datasets D1 , . . . , Dm of size n ∈ N with m ≥ rh , then Alg . 1 using the Radon point with b ≥ d ln δ ln ( m−1 m ) ( m− n0 ( , δ ) n + 1 ) m improves model quality in terms of ( , δ ) -guarantees . Proof . The number of daisy-chaining rounds before computing a Radon point ensure that with probability 1−δ all local models are trained on at least kn samples with k = n0 ( , δ ) /n , i.e. , each model is trained on at least n0 ( , δ ) samples and thus an ( , δ ) -guarantee holds for each model . Since δ < r−1 , this guarantee is improved as detailed in Eq . ( 2 ) . To support this theoretical result , we compare FEDDC using the iterated Radon point with standard federated learning on the SUSY binary classification dataset ( Baldi et al. , 2014 ) , training a linear model on 441 clients with only 2 samples per client . The results in Figure 1 show that after 500 rounds FEDDC reached the test accuracy of a model that has been trained on the centralized dataset ( ACC=0.77 ) beating federated learning by a large margin ( ACC=0.65 ) . Before further investigating FEDDC empirically in Section 7 , we discuss the privacy-aspects of FEDDC in the following section . 6 PRIVACY A major benefit of federated learning is that data remains undisclosed on the local clients and only model parameters are exchanged . It is , however , possible to infer upon local data given model parameters ( Ma et al. , 2020 ) . In classical federated learning there are two types of attacks that would allow such inference : ( i ) an attacker intercepting the communication of a client with the coordinator obtaining model updates to infer upon the clients data , and ( ii ) a malicious coordinator obtaining models to infer upon the data of each client . A malicious client can not learn about other clients data , since it only obtains the average of all local models . In federated daisychaining there is a third possible attack : ( iii ) a malicious client obtaining model updates from another client to infer upon its data . In the following , we discuss potential defenses against these three types of attacks in more detail . Note that we limit the discussion on attacks that aim at inferring upon local data , thus breaching data privacy . For a discussion of attacks that aim to poison the learning process ( Bhagoji et al. , 2019 ) or create backdoors ( Sun et al. , 2019 ) for adversarial examples , we refer to Lyu et al . ( 2020 ) . A general and wide-spread approach to tackle all three possible attack types is to add noise to the model parameters before sending . Using appropriate clipping and noise , this guarantees , δdifferential privacy for local data ( Wei et al. , 2020 ) at the cost of a slight-to-moderate loss in model quality . Another approach to tackle an attack on communication ( i ) is to use encrypted communication . One can also protect against a malicious coordinator ( ii ) by using homomorphic encryption that allows the coordinator to average models without decrypting them ( Zhang et al. , 2020 ) . This , however , only works for particular aggregation operators and does not allow to perform daisy-chaining . Secure daisy-chaining in the presence of a malicious coordinator ( ii ) can , however , be performed using asymmetric encryption . Assume each client creates a public-private key pair and shares the public key with the coordinator . To avoid the malicious coordinator to send clients its own public key and act as a man in the middle , public keys have to be announced ( e.g. , by broadcast ) . While this allows sending clients to identify the recipient of their model , no receiving client can identify the sender . Thus , inference on the origin of a model remains impossible . For a daisy-chaining round the coordinator sends the public key of the receiving client to the sending client , the sending client checks the validity of the key and sends an encrypted model to the coordinator which forwards it to the receiving client . Since only the receiving client can decrypt the model , the communication is secure . In standard federated learning , a malicious client can not infer upon the data of other clients from model updates , since it only receives the average model . In federated daisy-chaining , it receives the model from a random , unknown client in each daisy-chaining round . Now , the malicious client can infer upon the membership of a particular data point in the local dataset of the client the model originated from , i.e. , a membership inference attack ( Shokri et al. , 2017 ) . Similarly , the malicious client can infer upon the presence of data points with certain attributes in the dataset ( Ateniese et al. , 2015 ) . The malicious client , however , does not know the client the model was trained on , i.e. , it does not know the origin of the dataset . Using a random scheduling of daisy-chaining and averaging rounds at the coordinator , the malicious client can not even distinguish between a model from another client or the average of all models . Nonetheless , daisy-chaining opens up new potential attack vectors ( e.g. , by clustering received models to potentially determine their origins ) . These potential attack vectors can be tackled by adding noise to model parameters as discussed above , since “ [ d ] ifferentially private models are , by construction , secure against membership inference attacks ” ( Shokri et al. , 2017 ) . To investigate the impact of this privacy technique on FEDDC , we apply it in practice : We train a small ResNet on 250 clients using FEDDC with d = 2 and b = 10 . Details on the experimental setup can be found in Supp . ? ? , ? ? . Differential privacy is achieved by clipping local model updates and adding Gaussian noise as proposed by Geyer et al . ( 2017 ) . The results shown in Figure 2 indicate that the standard trade-off between model quality and privacy holds for FEDDC as well . Moreover , for mild privacy settings the model quality does not decrease . That is , FEDDC is able to robustly predict even under differential privacy .

Summary: The paper presents a new training procedure for federated learning (FL) systems based on a daisy-chain network. Training the system has two phases, a daisy-chain phase in which models are transmitted from one client to another via a coordinator node, and the standard aggregation phase in which models are averaged according to FedAvg rule. The main motivation is reduced overfitting and improved generalization compared to the standard FedAvg training, especially with limited-sized local datasets. The paper presents PAC-like ($\epsilon, \delta$)-guarantees for their algorithm, and provides a discussion on privacy violation concerns of their algorithm. The method is demonstrated on several datasets and shows improved accuracy over the compared methods.