D2p-fed:Differentially Private Federated Learning with Efficient Communication

1 INTRODUCTION . Federated learning ( FL ) is a popular machine learning paradigm that allows a central server to train models over decentralized data sources . In federated learning , each client performs training locally on their data source and only updates the model change to the server , which then updates the global model based on the aggregated local updates . Since the data stays locally , FL can provide better privacy protection than traditional centralized learning . However , FL is facing two main challenges : ( 1 ) FL lacks a rigorous privacy guarantee ( e.g. , differential privacy ( DP ) ) and indeed , it has been shown to be vulnerable to various inference attacks ( Nasr et al. , 2019 ; Pustozerova & Mayer ; Xie et al. , 2019 ) ; ( 2 ) FL incurs considerable communication costs . In many potential applications of FL such as mobile devices , these two challenges are present simultaneously . However , privacy and communication-efficiency have mostly been studied independently in the past . As regards privacy , existing work has applied a gold-standard privacy notion – differential privacy ( DP ) – to FL , which ensures that the server could hardly determine the participation of each client by observing their updates ( Geyer et al. , 2017 ) . To achieve DP , each client needs to inject noise to their local updates and as a side effect , the performance of the trained model would inevitably degrade . To improve model utility , secure multiparty computation ( SMC ) has been used in tandem with DP to reduce noise ( Jayaraman et al. , 2018 ; Truex et al. , 2019 ) . The key idea is to prevent the server from observing the individual updates , make only the aggregate accessible , and thus transform from local DP to central DP . However , SMC introduces extra communication overhead to each client . There has been extensive research on improving communication efficiency of FL while ignoring the privacy aspect ( Tsitsiklis & Luo , 1987 ; Balcan et al. , 2012 ; Zhang et al. , 2013 ; Arjevani & Shamir , 2015 ; Chen et al. , 2016 ) . However , these communication reduction methods either have incompatible implementations with the existing DP mechanisms or would break the DP guarantees when combined with SMC . The only existing work that tries to reconcile DP and communication efficiency in FL is cpSGD ( Agarwal et al. , 2018 ) . The authors leveraged the Binomial mechanism , which adds Binomial noise into local updates to ensure differential privacy . The discrete nature of Binomial noise allows it to be transmitted efficiently . However , cpSGD faces several limitations when applied to real-world applications . Firstly , with Binomial noise , the output of a learning algorithm would have different supports on different input datasets ; as a result , Binomial noise can only guarantee approx- imate DP where the participation of the client can be completely exposed with nonzero probability . Also , there lacks a tight composition for DP with Binomial noise and the resulting privacy budget skyrockets in a multi-round FL protocol . Hence , the Binomial mechanism can not produce a useful model with a reasonable privacy budget on complex tasks . Last but not least , the Binomial mechanism involves several mutually constrained hyper-parameters and the privacy formula is extremely complicated , which makes hyper-parameter tuning a difficult task . In this paper , we propose the discrete Gaussian based differential private federated learning ( D2PFED ) , an alternative technique to reduce communication costs while maintaining differential privacy in FL . Our key idea is to leverage the discrete Gaussian mechanism in FL , which adds discrete Gaussian noise into client updates . We show that the discrete Gaussian mechanism satisfies Rényi DP which provides better composability . We employ secure aggregation along with the discrete Gaussian mechanism to lower the noise and exhibit the privacy guarantee for this hybrid privacy protection approach . To save the communication cost , we integrate the stochastic quantization and random rotation into the protocol . We then cast FL as a general distributed mean estimation problem and provide the analysis of the utility for the overall protocol . Our theoretical analysis sheds light on the superiority of D2P-FED to cpSGD . Our experiments show that D2P-FED can lead to state-ofthe-art performance in terms of managing the trade-off among privacy , utility , and communication . 2 RELATED WORK . It is well studied how to improve the communication cost in traditional distributed learning settings ( Tsitsiklis & Luo ( 1987 ) ; Balcan et al . ( 2012 ) ; Zhang et al . ( 2013 ) ; Arjevani & Shamir ( 2015 ) ; Chen et al . ( 2016 ) ) . However , most of the approaches either require communication between the workers or are designed for specific learning tasks so they can not be applied directly to generalpurpose FL . The most relevant work is Suresh et al . ( 2017 ) which proposed to use stochastic quantization to save the communication cost and random rotation to lower mean squared error of the estimated mean . We follow their approach to improve the communication efficiency and model utility of D2P-FED . Nevertheless , our work differs from theirs in that we also study how to ensure DP for rotated and quantized data transmission and prove a convergence result for the learning algorithm with both communication cost reduction and privacy protection steps in place . On the other hand , differentially private FL is undergoing rapid development during the past few years ( Geyer et al . ( 2017 ) ; McMahan et al . ( 2017 ) ; Jayaraman et al . ( 2018 ) ) . However , these methods mainly focus on improving utility under a small privacy budget and ignore the issue of communication cost . In particular , we adopt a similar hybrid approach to Truex et al . ( 2019 ) , which combines SMC with DP for reducing the noise . SMC ensures that the centralized server can only see the aggregated update but not individual ones from clients and as a result , the noise added by each client can be reduced by a factor of the number of clients participating in one round . The difference of our work from theirs is that we inject discrete Gaussian noise to local updates instead of the continuous Gaussian noise . This allows us to use secure aggregation ( Bonawitz et al. , 2017 ) which is much cheaper than threshold homomorphic encryption used by Truex et al . ( 2019 ) . We further study the interaction between discrete Gaussian noise and the secure aggregation as well as their effects on the learning convergence . We identify cpSGD ( Agarwal et al . ( 2018 ) ) as the most comparable work to D2P-FED . Just like D2P-FED , cpSGD aims to improve both the communication cost and the utility under rigorous privacy guarantee . However , cpSGD suffers from three main defects discussed in Section 1 . This paper proposes to use the discrete Gaussian mechanism to mitigate these issues in cpSGD . 3 BACKGROUND AND NOTATION . In this section , we provide an overview of FL and DP and establish the notation system . We use bold lower-case letters ( e.g . a , b , c ) to denote vectors , and bold upper-case letters ( e.g . A , B , C ) for matrices . We denote 1 · · ·n by [ n ] . FL Overview . In a FL system , there are one server and n clients Ci , i ∈ [ n ] . The server holds a global model of dimension d. Each client holds ( IID or non-IID ) samples drawn from some unknown distribution D. The goal is to learn the global model w ∈ Rd that minimizes some loss function L ( w , D ) . To achieve this , the system runs a T -round FL protocol . The server initializes the global model with w0 . In round t ∈ [ T ] , the server randomly sub-samples γn clients from [ n ] with sub-sampling rate γ and broadcasts the global model wt−1 to the chosen clients . Each chosen client Ci then runs the local optimizers ( e.g . SGD , Adam , and RMSprop ) , computes the difference between the locally optimized model w ( i ) t and the global model wt−1 : g ( i ) t = w ( i ) t − wt−1 , and uploads g ( i ) t to the server . The server takes the average of the differences and update the global model wt = wt−1 + 1k ∑ g ( i ) t . Communication in FL . The clients in FL are often edge devices , where the upload bandwidth is fairly limited ; therefore , communication efficiency is of uttermost importance to FL . Let π denote a communication protocol . We denote the per-round communication cost as C ( π , g [ n ] ) . To lower the communication cost , the difference vectors are typically compressed before sent to the server . The compression would degrade model performance and we measure the performance loss via the mean squared error . Specifically , letting ḡ denote the actual mean of difference vectors 1n ∑n i=1 g ( i ) and g̃ denote the server ’ s estimated mean of difference vectors using some protocol such as D2PFED , we could measure the performance loss by E ( π , g [ n ] ) = E [ ‖g̃ − ḡ‖2 ] , i.e. , the mean squared error between the estimated and the actual mean . This mean squared error is directly related to the convergence rate of FL ( Agarwal et al. , 2018 ) . Threat Model & Differential Privacy . We assume that the server is honest-but-curious . Namely , the server will follow the protocol honestly under the law enforcement or reputation pressure , but is curious to learn the client-side data from the legitimate client-side messages . In the FL context , the server wants to get information about the client-side data by studying the local updates received without deviating from the protocol . The above attack , widely known as the inference attack ( Shokri et al. , 2017 ; Yeom et al. , 2018 ; Nasr et al. , 2019 ) , can be effectively mitigated using a canonical privacy notation namely differential privacy ( DP ) . Intuitively , DP , in the context of ML , ensures that the trained model is nearly the same regardless of the participation of any arbitrary client . Definition 1 ( ( , δ ) -DP ) . A randomized algorithm f : D → R is ( , δ ) -differentially private if for every pair of neighboring datasets D and D′ that differs only by one datapoint , and every possible ( measurable ) output set E the following inequality holds : P [ f ( D ) ⊆ E ] ≤ e P [ f ( D′ ) ⊆ E ] + δ . ( , δ ) -DP has been used as a privacy notion in most of the existing works of privacy-preserving FL . However , in this paper , we consider a generalization of DP , Rényi differential privacy ( RDP ) , which is strictly stronger than ( , δ ) -DP for δ > 0 and allows tighter analysis for compositing multiple mechanisms . This second point is particularly appealing , as FL mostly comprises multiple rounds yet the existing works suffer from skyrocketing privacy budgets for multi-round learning . Definition 2 ( ( α , ) -RDP ) . For two probability distributions P and Q with the same support , the Rényi divergence of order α > 1 is defined by Dα ( P‖Q ) ∆ = 1α−1 logEx∼Q ( P ( x ) Q ( x ) ) α . A randomized mechanism f : D → R is ( α , ) -RDP , if for any neighboring datasets D , D′ ∈ D it holds that Dα ( f ( D ) ‖f ( D′ ) ) ≤ . The intuition behind RDP is the same as other variants of differential privacy : “ Similar inputs should yield similar output distributions , ” and the similarity is measured by the Rényi divergence under RDP . RDP can also be converted to ( , δ ) -DP using the following transformation . Lemma 1 ( RDP-DP conversion ( Mironov ( 2017 ) ) ) . If M obeys ( α , ) -RDP , then M obeys ( + log ( 1/δ ) / ( α− 1 ) , δ ) -DP for all 0 < δ < 1 . RDP enjoys an operationally convenient and quantitatively accurate way of tracking cumulative privacy loss when compositing multiple mechanisms ( Lemma 2 ) or being combined with subsampling ( Wang et al. , 2018 ) . As a result , RDP is particularly suitable for the context of ML . Lemma 2 ( Adaptive composition of RDP ( Mironov ( 2017 ) ) ) . If ( randomized ) mechanismM1 obeys ( α , 1 ) -RDP , andM2 obeys ( α , 2 ) -RDP , then their composition obeys ( α , 1 + 2 ) -RDP .

Summary: The paper proposes the discrete Gaussian based differentially private federated learning algorithm to achieve both differential privacy and communication efficiency in federated learning. In particular, it adds discrete Gaussian noise into client updates and uses secure aggregation to prevent the server from observing the individual updates. The algorithm satisfies RDP and has lower communication cost compared to the previous method cpSGD.