# Local Differential Privacy-Based Federated Learning under Personalized Settings
###### Abstract  
Federated learning is a distributed machine learning paradigm, which utilizes multiple clients' data to train a model. Although federated learning does not require clients to disclose their original data, studies have shown that attackers can infer clients' privacy by analyzing the local models shared by clients. Local differential privacy (LDP) can help to solve the above privacy issue. However, most of the existing federated learning studies based on LDP, rarely consider the diverse privacy requirements of clients. In this paper, we propose an LDP-based federated learning framework, that can meet the personalized privacy requirements of clients. We consider both independent identically distributed (IID) datasets and non-independent identically distributed (non-IID) datasets, and design model perturbation methods, respectively. Moreover, we propose two model aggregation methods, namely _weighted average method_ and _probability-based selection method_. The main idea, is to weaken the impact of those privacy-conscious clients, who choose relatively small privacy budgets, on the federated model. Experiments on three commonly used datasets, namely MNIST, Fashion-MNIST, and forest cover-types, show that the proposed aggregation methods perform better than the classic arithmetic average method, in the personalized privacy preserving scenario. federated learning; local differential privacy; personalized privacy preserving; model perturbation; model aggregation +
Footnote †: journal: Applied  
1  
Footnote †: journal: Applied  
(DP) [11] to federated learning. Secure multi-party computing and homomorphic encryption are encryption-based methods, that usually require the design of complex encryption computing protocols to hide the real input and output, where the communication cost and computation cost are high. SMC-based federated learning, generally utilizes the secret sharing strategy. The client needs to divide its local model to several parts and transmit these parts to all other clients, which incurs a high communication cost. In HE-based federated learning, clients send encrypted model parameters to the server, and the ciphertexts are of a larger size than the plaintexts. Differential privacy-based methods mainly hide some sensitive attributes of participants by adding noise to the data, until the attacker cannot distinguish individuals through differential attacks. In DP-based federated learning, the client sends perturbed model parameters to the server, and the communication cost is almost the same as that of ordinary federated learning. Compared with the first two methods, the differential privacy-based method has low computation and communication costs, which makes it more suitable for individual users to deploy. According to the trust assumption, existing differential privacy mechanisms can be roughly divided into two categories: centralized differential privacy (CDP) and local differential privacy (LDP) [12; 13]. In the federated learning framework based on centralized differential privacy [14], the client directly uploads the trained local model to the server, and a _trusted_ server aggregates the collected models, and then randomly perturbs the aggregated models. Although such a framework can maintain high accuracy, it relies on the trusted server. The federated learning framework based on local differential privacy [15], assumes that the server is _untrusted_, and it does not care what background knowledge the server has. The client performs model perturbation before sending the local model to the server, to protect its privacy. However, different clients have different definitions of privacy and expect different levels of privacy protection. The local differential privacy mechanism mainly uses the privacy parameter called _privacy budget_, to measure the level of privacy protection. The clients can express different privacy requirements by setting different privacy budgets.