P RIVATE F EDERATED L EARNING W ITHOUT A T RUSTED S ERVER : O PTIMAL A LGORITHMS FOR C ONVEX L OSSES
A BSTRACT
This paper studies federated learning (FL)—especially cross-silo FL—with data from people who do not trust the server or other silos.
In this setting, each silo (e.g. hospital) has data from different people (e g. patients) and must maintain the privacy of each person’s data (e g. medical record), even if the server or other silos act as adversarial eavesdroppers.
This requirement motivates the study of
Inter-Silo Record-Level Differential Privacy (ISRL-DP), which requires silo i ’s communications to satisfy record/item-level differential privacy (DP).
ISRL-DP ensures that the data of each person (e g. patient) in silo i (e g. hospital i ) cannot be leaked.
ISRL-DP is different from well-studied privacy notions.
Central and user-level DP assume that people trust the server/other silos.
On the other end of the spectrum, local DP assumes that people do not trust anyone at all (even their own silo).
Sitting between central and local DP, ISRL-DP makes the realistic assumption (in cross-silo FL) that people trust their own silo, but not the server or other silos .
In this work we provide tight (up to logarithms) upper and lower bounds for
ISRL-DP FL with convex/strongly convex loss functions and homogeneous (i i d.) silo data.
Remarkably, we show that similar bounds are attainable for smooth losses with arbitrary heterogeneous silo data distributions , via an accelerated
ISRL-DP algorithm.
We also provide tight upper and lower bounds for ISRL-DP federated empirical risk minimization, and use acceleration to attain the optimal bounds in fewer rounds of communication than the state-of-the-art.
Finally, with a secure “shuffler” to anonymize silo messages (but without a trusted server), our algorithm attains the optimal central DP rates under more practical trust assumptions.
Numerical experiments show favorable privacy-accuracy tradeoffs for our algorithm in classification and regression tasks.
I NTRODUCTION
Machine learning tasks often involve data from different “silos” (e.g. cell-phone users or organizations such as hospitals) containing sensitive information (e.g. location or health records).
In federated learning (FL), each silo (a.k.a.
“client”) stores its data locally and a central server coordinates updates among different silos to achieve a global learning objective (Kairouz et al., 2019).
One of the primary reasons for the introduction of FL was to offer greater privacy (McMahan et al., 2017).
However, storing data locally is not sufficient to prevent data leakage.
Model parameters or updates can still reveal sensitive information (e.g. via model inversion attacks or membership inference attacks) (Fredrikson et al., 2015;
He et al., 2019; Song et al., 2020; Zhu & Han, 2020).
Differential privacy (DP) (Dwork et al., 2006) protects against privacy attacks.
Different notions of
DP have been proposed for FL.
The works of Jayaraman & Wang (2018); Truex et al.
Noble et al.
(2022) considered central DP (CDP) FL, which protects the privacy of silos’ aggregated data against an external adversary who observes the final trained model .
1 There are two major issues with
CDP FL: 1) it does not guarantee privacy for each specific silo ; and 2) it does not guarantee data privacy when an adversarial eavesdropper has access to other silos or the server.
To address the first issue, McMahan et al.
; Geyer et al.
; Jayaraman & Wang (2018); Gade & Vaidya (2018);
Wei et al.
(2020a)
Zhou & Tang (2020); Levy et al.
; Ghazi et al.
(2021) considered user-level
DP (a.k.a.
client-level DP).
User-level DP guarantees privacy of each silo’s full local data set .
This is a practical notion for cross-device FL , where each silo/client corresponds to a single person (e.g. cell-phone user) with many records (e.g. text messages).
However, user-level DP still suffers from the second critical shortcoming of CDP: it allows silo data to be leaked to an untrusted server or to other silos .
Furthermore, user-level DP is less suitable for cross-silo FL , where silos are typically organizations (e.g. hospitals, banks, or schools) that contain data from many different people (e.g. patients, customers, or students).
In cross-silo FL, each person has a record (a.k.a. “item”) that may contain sensitive data.
Thus, an appropriate notion of DP for cross-silo FL should protect the privacy of each individual record (“item-level DP”) in silo i , rather than silo
i ’s full aggregate data.
[Figure]
Another notion of DP is local DP (LDP) (Kasiviswanathan et al., 2011; Duchi et al., 2013).
While central and userlevel DP assume that people trust all of the silos and the server, LDP assumes that individuals (e.g. patients) do not trust anyone else with their sensitive data, not even their own silo (e.g. hospital).
Thus, LDP would require each person (e.g. patient) to randomize her report (e.g. medical test results) before releasing it (e.g. to their own doctor/hospital).
Since patients/customers/students usually trust their own hospital/bank/school, LDP may be unnecessarily stringent, hindering performance/accuracy .
In this work, we consider a privacy notion called intersilo record-level differential privacy (ISRL-DP), which requires that all of the communications of each silo satisfy (item-level) DP; see Fig.
By the post-processing property of DP, this also ensures that the the broadcasts by the server and the global model are DP.
Privacy notions similar or identical to ISRL-DP have been considered in Truex et al.
; Huang et al.
; Huang & Gong (2020); Wu et al.
; Wei et al. (2020b); Dobbe et al.
Zhao et al.
Arachchige et al.
; Seif et al.
; Liu et al.
We provide a rigorous definition of ISRL-DP in Definition 2 and Appendix B.
Why ISRL-DP?
ISRL-DP is the natural notion of DP for cross-silo FL, where each silo contains data from many individuals who trust their own silo but may not trust the server or other silos (e.g., hospitals in Fig. 1).
The item-level privacy guarantee that ISRL-DP provides for each silo (e.g. hospital) ensures that no person’s record can be leaked.
In contrast to central DP and user-level
DP, the protection of ISRL-DP is guaranteed even against an adversary with access to the server and/or other silos (e.g. hospitals).
This is because each silo’s communications are DP with respect to their own data records and cannot leak information to any adversarial eavesdropper.
On the other hand, since individuals (e.g. patients) trust their own silo (e.g. hospital), ISRL-DP does not require individuals to randomize their own data reports (e.g. health records).
Thus, ISRL-DP leads to better performance/accuracy than local DP by relaxing the strict local DP requirement.
Another benefit of
ISRL-DP is that each silo i can set its own p
ϵ i , δ i q item-level DP budget depending on its privacy needs; see Appendix H and also Liu et al.
; Aldaghri et al.
In addition, ISRL-DP can be useful in cross-device FL without a trusted server: If the ISRL privacy parameters are chosen sufficiently small, then ISRL-DP implies user-level DP (see Appendix C).
Unlike user-level DP, ISRL-DP does not allow data to be leaked to the untrusted server/other users.
Another intermediate trust model between the low-trust local model and the high-trust central/userlevel models is the shuffle model of DP (Bittau et al., 2017; Cheu et al., 2019).
In this model, a secure shuffler receives noisy reports from the silos and randomly permutes them before the reports are sent to the untrusted server.
An algorithm is Shuffle Differentially Private (SDP) if silos’ shuffled messages are CDP; see Definition 3.
Fig.
2 summarizes which parties are assumed to be trustworthy (from the perspective of a person contributing data to a silo) in each of the described privacy notions.
Problem setup: Consider a FL setting with N silos, each containing a local data set with n samples: 3 X i “ p x i, 1 , ¨ ¨ ¨ , x i,n q for i P r N s : “ t 1 , . . . , N u .
In each round of communication r , silos download the global model w r and use their local data to improve the model.
Then, silos send local updates to the server (or other silos, in peer-to-peer FL), who updates the global model to w r ` 1 .
For each silo i , let D i be an unknown probability distribution on a data universe
X i (i.e. X i P X ni ).
Let
X : “ Ť Ni “ 1 X i .
Given a loss function f : W ˆ X Ñ R , define silo i ’s local objective as
[Equation]
where W Ă R d is a parameter domain.
Our goal is to find a model parameter that performs well for all silos, by solving the FL problem
[Figure]
[Figure]
[Figure]
[Equation]
while maintaining the privacy of each silo’s local data.
At times, we will focus on empirical risk minimization (ERM), where p F i p w q : “ 1 n ř nj “ 1 f p w, x i,j q is silo i ’s local objective.
Thus, in the ERM case, our goal is to solve min w P W p F X p w q : “ 1 N ř Ni “ 1 p F i p w q , while maintaining privacy.
When F i takes the form (1) (not necessarily ERM), we may refer to the problem as stochastic convex optimization (SCO) for emphasis.
For ERM, we make no assumptions on the data; for SCO, we assume the samples t x i,j u i Pr N s ,j Pr n s are drawn independently.
For SCO, we say problem (2) is “i.i.d.” or “homogeneous” if X i “ X and D i “ D , @ i.
The excess risk of an algorithm A for solving (2) is E F p
A p X qq ´ F ˚ , where
F ˚ “ inf w P W F p w q and the expectation is taken over both the random draw of X “ p X 1 , . . .
, X N q and the randomness of A .
For ERM, the excess empirical risk of
A is E p F X p
A p X qq ´ p F ˚ X , where the expectation is taken solely over the randomness of A .
Thus, a fundamental question in FL is about the minimum achievable excess risk while maintaining privacy .
In this work, we specifically study the following questions for FL with convex and strongly convex loss functions:
Question 1.
What is the minimum achievable excess risk for solving (2) with inter-silo record-level DP?
Question 2.
With a trusted shuffler (but no trusted server), can the optimal central DP rates be attained?
Contributions: Our first contribution is a complete answer to Question 1 when silo data is i.i.d.
: we give tight upper and lower bounds in Section 2.
The ISRL-DP rates sit between the local DP and central DP rates: higher trust allows for higher accuracy.
Further, we show that the ISRL-DP rates nearly match the optimal non-private rates if d À nϵ 20 , where ϵ 0 is the ISRL-DP parameter (“privacy for free”).
As a corollary of our analysis, we also derive tight upper and lower bounds for
FL algorithms that satisfy both ISRL-DP and user-level DP simultaneously , which could be useful in cross-device settings where (e.g. cell phone) users don’t trust the server or other users with their sensitive data (e.g. text messages): see Appendix D.3.5.
Second, we give a complete answer to Question 1 when F “ p F X is an empirical loss in Section 4.
While (Girgis et al., 2021) provided a tight upper bound for the (non- ) convex case, we use a Function g : W Ñ R is µ -strongly convex ( µ ě 0 ) if
[Table]
w
[Table] ě [Table] ` xB
[Table]
w
[Table]
, w ´ w
[Table]
y ` µ 2 } w ´ w 1 } 2 @ w, w
[Table]
P W and all sub-
[Table]
B
[Table]
p w
[Table]
If
[Table]
[Table]
[Table]
convex
ERM novel accelerated algorithm to achieve this upper bound in fewer communication rounds.
Further, we obtain matching lower bounds.
We also cover the strongly convex case.
Third, we give a partial answer to Question 1 when silo data is heterogeneous (non-i.i.d.), providing algorithms for smooth f p¨ , x q that nearly achieve the optimal i.i.d.
rates in Section 3.
For example, if f p¨ , x q is µ -strongly convex and β -smooth, then the excess risk of our algorithm nearly matches the i.i.d.
lower bound up to a multiplicative factor of r O p β { µ q .
Our algorithm is significantly more effective (in terms of excess risk) than existing ISRL-DP FL algorithms (e.g. Arachchige et al.
Dobbe et al.
Zhao et al.
(2020)): see Appendix A for a thorough discussion of related work.
Fourth, we address Question 2 in Section 5: We give a positive answer to Question 2 when silo data is i.i.d.
Further, with heterogeneous silo data, the optimal central DP rates are nearly achieved without a trusted server, if the loss function is smooth.
We summarize our results in Fig.
1. P RELIMINARIES
[Table]
+ κd ϵ 20 n 2 N d ϵ 0 n N d ϵ 20 n 2 N d ϵ 0 n N d ϵ 20 n 2 N 1 nN + d ϵnN 1 nN + d ϵ 20 n 2 N 1 nN + d ϵ 2 n 2 N1 nN + d ϵnN (Thm. 3.1) (Thm. 2.1) (Thm. 2.1) (Thm. 3.1) (Girgis et al., 2021)
+ (Thm. 4.1) (Thm. 4.1) (Thm. 5.1) (Thm. 5.1) (Thm. 2.2) (Thm. 2.2) (Thm. 2.2*) (Thm. 2.2*) (Thm. 4.2) (Thm. 4.2) (Bassily et al., 2019)
1 nN + ( d ϵnN ) 4/5 (Thm. 5.2) 1 nN
+ κd ϵ 2 n 2 N(Thm. 5.2) 1 nN + d ϵ 2 n 2 N1 nN + d ϵnN (Bassily et al., 2019) (Bassily et al., 2019)
(Bassily et al., 2019)
Differential Privacy: Let X “ X n 1 ˆ ¨ ¨ ¨ X n
and ρ : X 2 Ñ r 0 , 8q be a distance between databases.
Two databases X , X 1 P X are ρadjacent if ρ p X , X
1 q ď 1 .
DP ensures that (with high probability) an adversary cannot distinguish between the outputs of algorithm A when it is run on adjacent databases:
Definition 1 (Differential Privacy) .
Let ϵ ě 0 , δ P r 0 , 1 q .
A randomized algorithm A :
X Ñ W is p ϵ, δ q -differentially private (DP) (with respect to ρ ) if for all ρ -adjacent data sets X , X 1 P X and all measurable subsets
S Ď W , we have
[Equation]
Definition 2 (Inter-Silo Record-Level Differential Privacy) .
Let ρ
i : X 2 i Ñ
[Equation]
0 , 8q
[Equation]
i ,
[Equation]
randomized algorithm A is p ϵ 0 , δ 0 q -ISRL-DP if for all i P r N s and all ρ i -adjacent silo data sets X i ,
X 1 i , the full transcript of silo i ’s sent messages satisfies (3) for any fixed settings of other silos’ messages and data.
Definition 3 (Shuffle Differential Privacy (Bittau et al., 2017; Cheu et al., 2019)) .
A randomized algorithm A is p ϵ, δ q -shuffle DP (SDP) if for all ρ -adjacent databases X , X 1 P X and all measurable subsets S , the collection of all uniformly randomly permuted messages that are sent by the shuffler satisfies (3) , with ρ p X , X 1 q : “ ř Ni “ 1 ř nj “ 1 1 t x i,j ‰ x 1 i,j u .
Notation and Assumptions: Let } ¨ } be the ℓ 2 norm and Π W p z q : “ argmin w P W } w ´ z } 2 denote the projection operator.
Function h : W Ñ R m is L -Lipschitz if } h p w q ´ h p w 1 q} ď L } w ´ w 1 } , @ w, w 1 P W .
A differentiable function h p¨q is β -smooth if its derivative ∇ h is β -Lipschitz.
If h is β -smooth and µ -strongly convex, denote its condition number by κ : “ β { µ .
For differentiable (w.r.t.
w ) f p w, x q , we denote its gradient w.r.t.
w by ∇ f p w, x q .
Write a À b if D C ą 0 such that a ď Cb.
Write a “ r O p b q if a À log 2 p θ q b for some parameters θ .
Assume the following throughout:
Assumption 1.
W Ă R d is closed, convex, and } w ´ w 1 } ď D , @
w, w 1 P W . 2.
f p¨ , x q is L -Lipschitz and convex for all x P X .
In some parts of the paper, we assume f p¨ , x q is µ -strongly convex.
sup w P W E
x i „ D i } ∇ f p w, x i q ´ ∇
F i p w q} 2 ď ϕ 2 for all i P r N s .
In each round r , a uniformly random subset S r of M r P r N s silos is available to communicate with the server, where t M r u r ě 0 are independent random variables with 1 M : “ E p 1 M r q .
In Assumption 1 part 4, the network determines M r : it is not a design parameter.
This assumption is more general (and realistic for cross-device FL (Kairouz et al., 2019)) than most (DP) FL works, which usually assume M “ N or M r “ M is deterministic.
On the other hand, in cross-silo FL, typically all silos can reliably communicate in each round, i.e. M “ N (Kairouz et al., 2019).
I NTER -S ILO R ECORD -L EVEL DP FL WITH H OMOGENEOUS S ILO D ATA
In this section, we provide tight (up to logarithms) upper and lower bounds on the excess risk of
ISRL-DP algorithms for FL with i.i.d.
silo data.
For consistency of presentation, we assume that there is an untrusted server.
However, our algorithms readily extend to peer-to-peer FL (no server), by having silos send private messages directly to each other and perform model updates themselves.
2. U PPER B OUNDS VIA N OISY D ISTRIBUTED M INIBATCH SGD
We begin with our upper bounds, obtained via Noisy Distributed Minibatch SGD (MB-SGD) :
In each round r , all M r available silos receive w r from the server and send noisy stochastic gradients to the server: r g ir : “ 1 K ř Kj “ 1 ∇ f p w r , x ri,j q ` u i , where u i „ N p 0 , σ 2 I d q and x ri,j are drawn uniformly from X
i
(and then replaced).
The server averages these M r reports and updates w r ` 1 : “ Π W r w r ´ η r M r ř i P S r r g ir s .
After R rounds, a weighted average of the iterates is returned: p w R “ 1Γ R ř R ´ 1 r “ 0 γ r w r with Γ R : “ ř R ´ 1 r “ 0 γ r .
With proper choices of t η r , γ r u R ´ 1 r “ 0 , σ 2 , K , and R , we have:
Theorem 2.1 (Informal) .
Let ϵ 0 ď 2 ln p 2 { δ 0 q , δ 0 P p 0 , 1 q .
Then Noisy MB-SGD is p ϵ 0 , δ 0 q -ISRL-DP.
Moreover:
1.If f p¨ , x q is convex, then
[Equation]
If f p¨ , x q is µ -strongly convex, then
[Equation]
The first terms in each of (4) and (5) ( LD {?
Mn for convex and L 2 { µMn for strongly convex) are bounds on the uniform stability (Bousquet & Elisseeff, 2002) of Noisy MB-SGD.
We use these uniform stability bounds to bound the generalization error of our algorithm.
Our stability bound for µ ą 0 in Lemma D.2 is novel even for N “ 1 .
The second terms in (4) and (5) are bounds on the empirical risk of the algorithm.
We use Nesterov smoothing (Nesterov, 2005) to extend our bounds to non-smooth losses.
This requires us to choose a different stepsize and R from Bassily et al.
(for
N “ 1 , µ “ 0 ), which eliminates the restriction on the smoothness parameter that appears in (Bassily et al., 2019, Theorem 3.2).
6 Privacy of Noisy MB-SGD follows from the Gaussian mechanism (Dwork & Roth, 2014, Theorem A.2), privacy amplification by subsampling (Ullman, 2017), and advanced composition (Dwork & Roth, 2014, Theorem 3.20) or moments accountant (Abadi et al., 2016,
Theorem 1).
See Appendix D.2 for the detailed proof.
2. L OWER B OUNDS
We provide excess risk lower bounds for the case M “ N , establishing the optimality of Noisy MBSGD for two function classes: F L,D : “ t f | f p¨ , x q is convex, L -Lipschitz, @
x P X and } w ´ w 1 } ď
D @ w, w 1 P W u ; and G µ,L,D : “ t f P F L,D | f p¨ , x q is µ -strongly convex , @ x P X u .
We restrict attention to distributions D satisfying Assumption 1, part 3.
The p ϵ 0 , δ 0 q -ISRL-DP algorithm class
A p ϵ 0 ,δ 0 q ,C contains all sequentially interactive algorithms and all fully interactive , C -compositional (defined in Appendix D.3) algorithms.
If A is sequentially interactive or O p 1 q -compositional, write
A P A p ϵ 0 ,δ 0 q .
The vast majority of DP algorithms in the literature are C -compositional.
For example, any algorithm that uses the strong composition theorems of (Dwork & Roth, 2014; Kairouz et al., 2015; Abadi et al., 2016) for its privacy analysis is 1 -compositional: see Appendix D.3.2.
In particular, Noisy MB-SGD is 1 -compositional, hence it is in A p ϵ 0 ,δ 0 q
Theorem 2.2 (Informal) .
Let ϵ 0 P p 0 , ?
N s , δ 0 “ o p 1 { nN q , M “ N , and A P
A p ϵ 0 ,δ 0 q ,C .
Then:
There exists a f P F L,D and a distribution D such that for X „ D nN , we have:
[Equation]
There exists a µ -smooth f P G µ,L,D and distribution D such that for X „ D nN , we have
[Equation]
Further, if A P A , then the above lower bounds hold with C “ 1 .
The lower bounds for A p ϵ 0 ,δ 0 q are nearly tight 8 by Theorem 2.1.
The first term in each of the lower bounds is the optimal non-private rate; the second terms are proved in Appendix D.3.4.
In particular, if d À ϵ 20 n , then the non-private term in each bound is dominant, so the ISRL-DP rates match the respective non-private rates, resulting in “privacy for free” (Nemirovskii & Yudin, 1983).
The
ISRL-DP rates sit between the rates for LDP and CDP: higher trust allows for higher accuracy.
For example, for F L,D , the LDP rate is Θ p LD min t 1 , ?
d { ϵ 0 ?
N uq (Duchi et al., 2013), and the CDP rate is Θ p ϕ 2 { ?
Nn ` LD min t 1 , ?
d { ϵ 0 nN uq (Bassily et al., 2019).
Theorem 2.2 is more generally applicable than existing LDP and CDP lower bounds.
When n “ 1 ,
ISRL-DP is equivalent to LDP and Theorem 2.2 recovers the LDP lower bounds (Duchi et al., 2013;
Smith et al., 2017).
However, Theorem 2.2 holds for a wider class of algorithms than the lower bounds of (Duchi et al., 2013; Smith et al., 2017), which were limited to sequentially interactive LDP algorithms.
When N “ 1 , ISRL-DP is equivalent to CDP and Theorem 2.2 recovers the CDP lower bounds (Bassily et al., 2019).
Obtaining our more general lower bounds under the more complex notion of ISRL-DP is challenging.
The lower bound approaches of (Duchi et al., 2013; Smith et al., 2017; Duchi & Rogers, 2019) are heavily tailored to LDP and sequentially interactive algorithms.
Further, the applicability of the standard CDP lower bound framework (e.g. (Bassily et al., 2014; 2019)) to ISRL-DP FL is unclear.
In light of these challenges, we take a different approach to proving Theorem 2.2: We first analyze the central DP guarantees of A when silo data sets X 1 , ¨ ¨ ¨ , X N are shuffled in each round, showing that CDP amplifies to ϵ “ r O p ϵ 0 ?
N q .
We could not have concluded this from existing amplification results (Erlingsson et al., 2020b; Feldman et al., 2020b; Balle et al., 2019; Cheu et al., 2019; Balle et al., 2020) since these results are all limited to sequentially interactive LDP algorithms and n “ 1 .
Thus, we prove the first privacy amplification by shuffling bound for fully interactive ISRL-DP FL algorithms .
Then, we apply the CDP lower bounds of Bassily et al.
to A s , the “shuffled” version of A .
This implies that the shuffled algorithm A s has excess population loss that is lower bounded as in Theorem 2.2.
Finally, we observe that the i.i.d.
assumption implies that A s and A have the same expected population loss.
Note that our proof techniques can also be used to obtain
ISRL-DP lower bounds for other problems in which a CDP lower bound is known.
I NTER -S ILO R ECORD -L EVEL DP FL WITH H ETEROGENEOUS S ILO D ATA
Consider the non-i.i.d.
FL problem, where F i p w q takes the form (1) for some unknown distributions
D i on X i , @
i .
The uniform stability approach that we used to obtain our i.i.d.
upper bounds does not work in this setting.
9 Instead, we directly minimize F by modifying Noisy MB-SGD as follows:
We draw disjoint batches of K local samples without replacement from each silo and set R “ t nK u .
Thus, stochastic gradients are independent across iterations, so our bounds apply to F . 2.
We use acceleration (Ghadimi & Lan, 2012) to increase the convergence rate.
To provide ISRL-DP, we re-calibrate σ 2 and apply parallel composition (McSherry, 2009).
After these modifications, we call the resulting algorithm One-Pass Accelerated Noisy MB-SGD .
It is described in Algorithm 1.
In the strongly convex case, we use a multi-stage implementation of One-Pass Accelerated Noisy MB-SGD (inspired by (Ghadimi & Lan, 2013)) to further expedite convergence: see Appendix E.1 for details.
Carefully tuning step sizes, σ 2 , and K yields:
Theorem 3.1 ( M “ N case) .
Let f p¨ , x q be β -smooth for all x P X .
Assume ϵ 0 ď 8 ln p 1 { δ 0 q , δ 0 P p 0 , 1 q .
Then One-Pass Accelerated Noisy MB-SGD is p ϵ 0 , δ 0 q -ISRL-DP.
Moreover, if M “ N , then: 1.
For convex f p¨ , x q , we have
[Equation]
For µ -strongly convex f p¨ , x q with κ “ βµ , we have
[Equation]
Remarkably, the bound (7) nearly matches the optimal i.i.d.
bound (5) up to the factor r O p?
κ q .
In particular, for well-conditioned loss functions, our algorithm achieves the optimal i.i.d.
rates even when silo data is arbitrarily heterogeneous .
The gap between the bound (6) and the i.i.d.
bound (4) is
O pp?
d { ϵ 0 n ?
N q 1 { 5 q .
Closing the gaps between the non-i.i.d.
upper bounds in Theorem 3.1 and the i.i.d.
lower bounds in Theorem 2.2 is left as an open problem.
Compared to previous upper bounds,
Theorem 3.1 is a major improvement: see Appendix A for details.
for r P r R s do 4:
Server updates and broadcasts w mdr “ p 1 ´ α r qp µ ` η r q η r `p 1 ´ α 2 r q µ w agr ´
{+1 ` α r rp 
 ´+}
α r q µ ` η r s η r `p 1 ´ α 2 r q µ w r ´5: for i P S r in parallel do 6: Silo i draws t x ri,j u kj “ 1 from X i ( replace samples for ERM ) and noise u i „ N p 0 , σ 2 I d q .
Silo i computes r g ir : “ 1 K ř Kj “ 1 ∇ f p w mdr , x ri,j q ` u i .
8: end for 9:
Server aggregates r g r : “ 1 M r ř i P S r r g ir and updates w r : “ argmin w P W ␣ α r “ x r g r , w y ` µ 2 } w mdr ´ w }‰ ` “ p 1 ´ α r q µ 2 ` η r‰ } w r ´ 1 ´ w }( .
Server updates and broadcasts w agr “ α r w r ` p 1 ´ α r q w agr ´ 1 .
11: end for 12: Output: w agR .
In Appendix E.2, we provide a general version (and proof) of Theorem 3.1 for M ď N .
If M ă N but
M is sufficiently large or silo heterogeneity sufficiently small, then the same bounds in Theorem 3. hold with N replaced by M .
Intuitively, the M ă N case is harder when data is highly heterogeneous, since stochastic estimates of ∇ F will have larger variance.
In Lemma E.3 (Appendix E.2), we use a combinatorial argument to bound the variance of stochastic gradients.
I NTER -S ILO R ECORD -L EVEL DP F EDERATED ERM
In this section, we provide an ISRL-DP FL algorithm, Accelerated Noisy MB-SGD , with optimal excess empirical risk.
The difference between our proposed algorithm and One-Pass Accelerated
Noisy MB-SGD is that silo i now samples from X i with replacement in each round: see line 6 in
Algorithm 1.
This allows us to a) amplify privacy via local subsampling and advanced composition/moments accountant, allowing for smaller σ 2 ; and b) run more iterations of our algorithm to better optimize p F X .
These modifications are necessary for obtaining the optimal rates for federated
ERM.
We again employ Nesterov smoothing (Nesterov, 2005) to extend our results to non-smooth f .
Theorem 4.1 (Informal) .
Let ϵ 0 ď 2 ln p 2 { δ 0 q , δ 0 P p 0 , 1 q .
Then, there exist algorithmic parameters such that Algorithm 1 is p ϵ 0 , δ
q -ISRL-DP and:
If f p¨ , x q is convex, then
[Equation]
If f p¨ , x q is µ -strongly convex then
[Equation]
See Appendix F.1 for the formal statement and proof.
With non-random M r “ M , Girgis et al.
(2021) provides an upper bound for (non-strongly) convex ISRL-DP ERM that nearly matches the one we provide in (8).
However, Algorithm 1 achieves the upper bounds for convex and strongly convex loss in fewer rounds of communication than (Girgis et al., 2021): see Appendix F.1 for details.
In Appendix F.2, we get matching lower bounds, establishing the optimality of Algorithm 1 for ERM.
S HUFFLE DP F EDERATED L EARNING
Assume access to a secure shuffler and fix M r “ M .
In each round r , the shuffler receives reports p Z p 1 q r , ¨ ¨ ¨ Z p M q r q from active silos (we assume S r “ r M s here for concreteness), draws a uniformly random permutation of r M s , π , and then sends p Z p π p 1 qq r , ¨ ¨ ¨ , Z p π p M qq r q to the server for aggregation.
When this shuffling procedure is combined with ISRL-DP Noisy Distributed MB-SGD, we obtain:
Theorem 5.1 (i.i.d.) .
Let ϵ ď ln p 2 { δ q , δ P p 0 , 1 q .
Then there are choices of algorithmic parameters such that Shuffled Noisy MB-SGD is p ϵ, δ q -SDP.
Moreover:
If f p¨ , x q is convex, then
[Equation]
If f p¨ , x q is µ -strongly convex, then
[Equation]
˙˙
[Equation]
See Appendix G.1 for details and proof.
When M “ N , the rates in Theorem 5.1 match the optimal central DP rates (Bassily et al., 2019), and are attained without a trusted server .
Thus, with shuffling,
Noisy MB-SGD is simultaneously optimal for i.i.d.
FL in the inter-silo and central DP models .
If silo data is heterogeneous , then we use a shuffle DP variation of One-Pass Accelerated Noisy
MB-SGD , described in Appendix G.2, to get:
Theorem 5.2 (Non-i.i.d.) .
Assume f p¨ , x q is β -smooth @
x P X .
Let ϵ ď 15 , δ P p 0 , 12 q .
Then, there is an p ϵ, δ q -SDP variation of One-Pass Accelerated Noisy MB-SGD such that for M “ N , we have:
If f p¨ , x q is convex, then
[Equation]
If f p¨ , x q is µ -strongly convex with κ “ βµ , then
[Equation]
The bound (11) matches the optimal i.i.d. , central DP bound (Bassily et al., 2019) up to r O p?
κ q .
Hence, if f is not ill-conditioned, then (11) shows that it is not necessary to have either i.i.d.
data or a trusted server to attain the optimal CDP rates .
See Appendix G.2 for proof and the M ă N case.
N UMERICAL E XPERIMENTS
We validate our theoretical findings with three sets of experiments.
Our results indicate that ISRL-DP
MB-SGD yields accurate, private models in practice.
Our method performs well even relative to non-private Local SGD, a.k.a.
FedAvg (McMahan et al., 2017), and outperforms ISRL-DP Local
SGD for most privacy levels.
Appendix I contains details of experiments, and additional results.
Binary Logistic Regression with MNIST:
Following (Woodworth et al., 2020b), we consider binary logistic regression on MNIST (LeCun & Cortes, 2010).
The task is to classify digits as odd or even.
Each of 25 odd/even digit pairings is assigned to a silo ( N “ 25 ).
Fig.
4 shows that ISRL-DP
MB-SGD outperforms (non-private) Local SGD for ϵ ě 12 and outperforms ISRL-DP Local SGD.
Linear Regression with Health Insurance Data: We divide the data set (Choi, 2018)
( d “ 7 , n ˆ
N “ 1338 ) into N silos based on the level of the target: patient medical costs.
Fig.
5 shows that
ISRL-DP MB-SGD outperforms ISRL-DP Local SGD, especially in the high privacy regime ϵ ď 2 .
For ϵ ě 2 , ISRL-DP MB-SGD is in line with (non-private) Local SGD.
Multiclass Logistic Regression with Obesity Data: We train a softmax regression model for a 7way classification task with an obesity data set (Palechor & de la Hoz Manotas, 2019).
We divide the data into N “ 7 heterogeneous silos based on the value of the target variable, obesity level, which takes 7 values: Insufficient Weight, Normal Weight, Overweight Level I, Overweight Level II,
Obesity Type I, Obesity Type II and Obesity Type III.
As shown in Fig.
6, our algorithm significantly outperforms ISRL-DP Local SGD by 10 ´ 30% across all privacy levels .
[Figure] [Figure]
[Figure]
C ONCLUDING R EMARKS AND O PEN Q UESTIONS
This paper considered FL without a trusted server and advocated for inter-silo record-level DP (ISRL-DP) as a practical privacy notion in this setting, particularly in cross-silo applications.
We provided optimal ISRL-DP algorithms for convex/strongly convex FL in both the i.i.d.
and ERM settings when all M “ N clients are able to communicate.
The i.i.d.
rates sit between the rates for the stringent “no trust” local DP and relaxed “high trust” central DP notions, and allow for “privacy for free” when d À ϵ 2 0 n .
As a side result, in Appendix D.3.5, we established the optimal rates for cross-device FL with user-level DP in the absence of a trusted server.
Additionally, we devised an accelerated ISRL-DP algorithm to obtain state-of-the-art upper bounds for heterogeneous FL.
We also gave a shuffle DP algorithm that (nearly) attains the optimal central DP rates for (non-i.i.d.)
i.i.d.
FL.
An open problem is to close the gap between our i.i.d.
lower bounds and non-i.i.d.
upper bounds: e.g. can ?
κ in (7) be removed?
Also, when M ă N , are our upper bounds tight?
Finally, what performance is possible for non-convex ISRL-DP FL?
A CKNOWLEDGMENTS
This work was partly supported by a gift from the USC-Meta Center for Research and Education in
AI and Learning.
A PPENDIX
To ease navigation, we provide a high-level table of contents for this Appendix:
Contents
Appendix A: Thorough Discussion of Related Work
Appendix B: Rigorous Definition of Inter-Silo Record-Level DP Appendix C: Relationships Between Notions of DP Appendix D: Proofs and Supplementary Material for SectionAppendix E: Proofs and Supplemental Material for SectionAppendix F: Proofs and Supplementary Material for SectionAppendix G: Proofs and Supplementary Materials for SectionAppendix H: ISRL-DP Upper Bounds with Unbalanced Data and Differing Silo Privacy Needs Appendix I: Numerical Experiments: Details and Additional Results Appendix J: Limitations and Societal Impacts
A T HOROUGH D ISCUSSION OF R ELATED W ORK
Federated Learning:
In the absence of differential privacy constraints, federated learning (FL) has received a lot of attention from researchers in recent years.
Among these, the most relevant works to us are (Koloskova et al., 2020;
Li et al., 2020; Karimireddy et al., 2020;
Woodworth et al., 2020a;b;
Yuan & Ma, 2020), which have proved bounds on the convergence rate of FL algorithms.
From an algorithmic standpoint, all of these works propose and analyze either Minibatch SGD (MB-SGD),
FedAvg/Local SGD (McMahan et al., 2017), or an extension or accelerated/variance-reduced variation of one of these (e.g. SCAFFOLD (Karimireddy et al., 2020)).
Notably, Woodworth et al.
(2020b) proves tight upper and lower bounds that establish the near optimality of accelerated MB-SGD for the heterogeneous SCO problem with non-random M r “ M “ N in a fairly wide parameter regime.
Lobel & Ozdaglar (2010); Touri & Gharesifard (2015); Nedic et al.
(2017) provide convergence results with random connectivity graphs.
Our upper bounds describe the effect of the mean of 1 { M r on DP FL.
DP Optimization: In the centralized setting, DP ERM and SCO is well-understood for convex and strongly convex loss functions (Bassily et al., 2014;
Wang et al., 2017; Bassily et al., 2019; Feldman et al., 2020a; Lowy & Razaviyayn, 2021; Asi et al., 2021).
Tight excess risk bounds for local DP SCO were provided in Duchi et al.
; Smith et al.
A few works have also considered Shuffle DP ERM and SCO.
Girgis et al.
; Erlingsson et al.
(2020a) showed that the optimal CDP convex ERM rate can be attained in the lower trust (relative to the central model) shuffle model of DP.
The main difference between our treatment of shuffle DP and
Cheu et al.
(2021) is that our results are much more general than Cheu et al.
For example,
Cheu et al.
(2021) does not consider FL: instead they consider the simpler problem of stochastic convex optimization (SCO).
SCO is a simple special case of FL in which each silo has only n “sample.
Additionally, Cheu et al.
(2021) only considers the i.i.d.
case, but not the more challenging non-i.i.d. case.
Further, Cheu et al.
(2021) assumes perfect communication ( M “ N ), while we also analyze the case when M ă N and some silos are unavailable in certain rounds (e.g. due to internet issues).
Note that our bounds in Theorem 5.1 recover the results in Cheu et al.
(2021) in the special case considered in their work.
DP Federated Learning: More recently, there have been many proposed attempts to ensure the privacy of individuals’ data during and after the FL process.
Some of these have used secure multi-party computation (MPC)
(Chen et al., 2018; Ma et al., 2018), but this approach leaves users vulnerable to inference attacks on the trained model and does not provide the rigorous guarantee of
DP.
Others (McMahan et al., 2018; Geyer et al., 2017; Jayaraman & Wang, 2018; Gade & Vaidya, 2018; Wei et al., 2020a; Zhou & Tang, 2020; Levy et al., 2021; Ghazi et al., 2021; Noble et al., 2022) have used user-level DP or central DP (CDP), which rely on a trusted third party, or hybrid DP/MPC approaches (Jayaraman & Wang, 2018; Truex et al., 2019).
The work of (Jayaraman & Wang, 2018) proves CDP empirical risk bounds and high probability guarantees on the population loss when the data is i.i.d.
across silos.
However, ISRL-DP and SDP are not considered, nor is heterogeneous (non-i.i.d.)
FL.
It is also worth mentioning that (Geyer et al., 2017) considers random M r
but does not prove any bounds.
Despite this progress, prior to our present work, very little was known about the excess risk potential of ISRL-DP FL algorithms, except in the two extreme corner cases of N “ 1 and n “ 1 .
When
N “ 1 , ISRL-DP and CDP are essentially equivalent; tight ERM (Bassily et al., 2014) and i.i.d.
SCO (Bassily et al., 2019; Feldman et al., 2020a) bounds are known for this case.
In addition, for LDP i.i.d.
SCO when n “ 1 and M r “ N , (Duchi et al., 2013) establishes the minimax optimal rate for the class of sequentially interactive algorithms and non-strongly convex loss functions.
To the best of our knowledge, all previous works examining the general ISRL-DP FL problem with arbitrary n, M, N ě 1 either focus on ERM and/or do not provide excess risk bounds that scale with both M and n , making the upper bounds provided in the present work significantly tighter.
Furthermore, none of the existing works on ISRL-DP FL provide lower bounds or upper bounds for the case of random
M r .
We discuss each of these works in turn below:
(Truex et al., 2020) gives a ISRL-DP FL algorithm, but no risk bounds are provided in their work.
The works of (Huang et al., 2020) and (Huang & Gong, 2020) use ISRL-DP ADMM algorithms for smooth convex Federated ERM.
However, the utility bounds in their works are stated in terms of an average of the silo functions evaluated at different points, so it is not clear how to relate their result to the standard performance measure for learning (which we consider in this paper): expected excess risk at the point p w output by the algorithm.
Also, no lower bounds are provided for their performance measure.
Therefore, the sub-optimality gap of their result is not clear.
(Wu et al., 2019, Theorem 2) provides an p ϵ, 0 q -ISRL-DP ERM bound for fixed M r “ M “ N of
O ´ κ L 2 µ d nNϵ 2 ` ϵ ¯ for µ -strongly convex, β -smooth f with condition number κ “ β { µ, and 1 { ϵis an average of 1 { ϵ 2 i .
The additive ϵ term is clearly problematic: e.g. if ϵ “ Θ p 1 q , then the bound becomes trivial.
Ignoring this term, the first term in their bound is still looser than the bound that we provide in Theorem 4.1.
Namely, for ϵ “ ϵ 0 , our bound in part 2 of Theorem 4.1 is tighter by a factor of O
[Equation]
¯ and does not require β -smoothness of the loss.
Additionally, the bounds in (Wu et al., 2019) require R “large enough” and do not come with communication complexity guarantees.
In the convex case, the ISRL-DP ERM bound reported in (Wu et al., 2019, Theorem 3) is difficult to interpret because the unspecified “constants” in the upper bound on E p F X p p
w R q ´ p F ˚ X are said to be allowed to depend on R .
(Wei et al., 2020b, Theorems 2-3) provide convergence rates for smooth convex Polyak-Łojasiewicz (a generalization of strong convexity) ISRL-DP ERM, which are complicated non-monotonic functions of R. Since they do not prescribe a choice of R, it is unclear what excess loss and communication complexity bounds are attainable with their algorithm.
(Dobbe et al., 2020) proposes a ISRL-DP Inexact Alternating Minimization Algorithm (IAMA) with Laplace noise; their result (Dobbe et al., 2020, Theorem 3.11) gives a convergence rate for smooth, strongly convex ISRL-DP FL of order O
[Equation]
˙ ignoring smoothness and strong convexity factors, where Θ is a parameter that is only upper bounded in special cases (e.g. quadratic objective).
Thus, the bounds given in (Dobbe et al., 2020) are not complete for general strongly convex loss functions.
Even in the special cases where a bound for Θ is provided, our bounds are tighter.
Assuming that Θ “ 1 and (for simplicity of exposition) that parameters are the same across silos, (Dobbe et al., 2020, Theorem 3.11) implies taking σ 2 “ 1 { ϵ 2 to ensure p ϵ, 0 q -ISRL-DP.
The resulting convergence rate is then O p M { ϵ 2 q , which does not scale with n and is increasing with M.
Also, the dependence of their rate on the dimension d is unclear, as it does not appear explicitly in their theorem.
Ignoring this issue, the dependence on M and n in the bound of (Dobbe et al., 2020) is still looser than all of the excess loss bounds that we provide in the present work.
(Zhao et al., 2020) and (Arachchige et al., 2019) apply the ISRL-DP FL framework to Internet of
Things, and (Seif et al., 2020) uses noisy (full-batch) GD for ISRL-DP wireless channels in the FL (smooth strongly convex)
ERM setting.
The bounds in these works do not scale with the number of data points n , however (only with the number of silos N ).
Therefore, the bounds that we provide in the present work are tighter, and apply to general convex FL problems besides wireless channels and
Internet of Things.
B R IGOROUS D EFINITION OF I NTER -S ILO R ECORD -L EVEL DP Recall:
Definition 4.
(Differential Privacy) Let ϵ ě 0 , δ P r 0 , 1 q .
A randomized algorithm A :
X Ñ W is p ϵ, δ q -DP if for all ρ -adjacent data sets X , X 1 P X and all measurable subsets S Ă W , we have
[Equation]
If (12) holds for all measurable subsets S , then we denote this property by A p X q » p ϵ,δ
q
A p X 1 q .
An
R -round fully interactive randomized algorithm A for FL is characterized in every round r P r R s by
N local silo functions called randomizers R p i q r : Z p r ´ 1 qˆ N ˆ X
ni Ñ Z
( i P r N s ) and an aggregation mechanism.
(See below for an example that further clarifies the terminology used in this paragraph.)
The randomizers send messages Z p i
q r : “ R p i q r p Z 1: r ´ 1 , X i q , to the server or other silos.
The messages
Z p i q r may depend on silo data X i and the outputs Z 1: r ´ 1 : “ t Z p j q t u j Pr N s ,t Pr r ´ 1 s of silos’ randomizers in prior rounds.
Then, the server (or silos, for peer-to-peer FL) updates the global model.
We consider the output of A : X Ñ Z R ˆ N to be the transcript of all silos’ communications: i.e. the collection of all N ˆ R messages t Z p i q r u .
Algorithm A is p ϵ 0 , δ 0 q -ISRL-DP if for all silos i , the full transcript t Z p i q r u r Pr R
s
is p ϵ 0 , δ 0 q -DP, for any fixed settings of the other silos’ messages and data.
More precisely:
Definition 5.
(Inter-Silo Record-Level Differential Privacy) Let ρ i
p X i , X 1 i q : “ ř nj “ 1 1 t x i,j ‰ x 1 i,j u , i P r N s .
A randomized algorithm A is p ϵ 0 , δ 0 q -ISRL-DP if for all silos i and all ρ i
-adjacent
X i , X 1 i , p
[Equation]
[Equation]
[Equation]
[Equation]
where Z r : “ t R p i q r p Z 1: r ´ 1 , X
i qu Ni “ 1 and Z 1 r : “ t R p i q r p Z 1 1: r ´ 1 , X
i qu Ni “ 1 .
Example clarifying the terminology used in the definition of ISRL-DP given above: Assume all M r “ N silos are available in every round and consider A to be the minibatch SGD algorithm, w r ` 1 : “ w r ´ ηg r , where g r “ 1 NK ř Ni “ 1 ř Kj “ 1 ∇ f p w r , x ri,j q for t x ri,j u Kj “ 1 drawn randomly from
X i .
Then the randomizers R p i
q r : Z p r ´ 1 qˆ N ˆ X ni Ñ Z of silo i are its stochastic gradients:
Z p i q r “ R p i q r p Z 1: r ´ 1 , X i q “ 1 K ř Kj “ 1 ∇ f p w r , x ri,j q for t x ri,j u Kj “ 1 drawn randomly from X i .
Note that the output of these randomizers depends on w r , which is a function of previous stochastic gradients of all silos Z 1: r ´ 1 “ t Z p i q t u i Pr N s ,t Pr r ´ 1 s .
The aggregation mechanism outputs g r by simply averaging the outputs of silos’ randomizers: g r “ 1 N ř Ni “ 1 Z p i q r .
We view the output of
A : X Ñ Z R ˆ N to be the transcript of all silos’ communications, which in this case is the collection of all N ˆ R stochastic minibatch gradients t Z p i q r u i Pr N s ,r Pr R s .
Note that in practice, the algorithm A does not truly output a list of gradients, but rather outputs p w P W that is some convex combination of the iterates t w r u r Pr R s , which themselves are functions of t Z p i q r u i Pr N s ,r Pr R s .
However, by the post-processing property of DP (Dwork & Roth, 2014, Proposition 2.1), the privacy of p w will be guaranteed if the silo transcripts are DP.
Thus, here we simply consider the output of A to be the silo transcripts.
Clearly, minibatch SGD is not ISRL-DP.
To make it ISRL-DP, it would be necessary to introduce additional randomness to make sure that each silo’s collection of stochastic gradients is DP, conditional on the messages and data of all other silos.
For example, Noisy MB-SGD is a ISRL-DP variation of (projected) minibatch SGD.
C R ELATIONSHIPS BETWEEN NOTIONS OF DP C. ISRL-DP IS STRONGER THAN CDP
Assume A is p ϵ 0 , δ 0 q -ISRL-DP.
Let X , X 1 be adjacent databases in the CDP sense; i.e. there exists a unique i P r N s , j P r n s such that x i,j ‰ x 1 i,j .
Then for all r P r R s , l ‰ i , X l “ X 1 l , so the conditional distributions of R p l q r p Z 1: r ´ 1 , X l q and R p l q r p Z 1 1: r ´ 1 , X 1 l q given Z p l 1 ‰ l q 1: r ´ 1 “ z p l 1 ‰ l q 1: r ´ 1 are identical for all z p l 1 ‰ l q 1: r ´ 1 P Z p r ´ 1 qˆp N ´ 1 q .
Integrating both sides of this equality with respect to the joint density of
Z p l 1 ‰ l q 1: r ´ 1 shows
that R p l q r p Z 1: r ´ 1 , X l q “ R p l q r p Z 1 1: r ´ 1 , X
1 l q (unconditional equality of distributions).
Hence the full transcript of silo l is (unconditionally) p 0 , 0 q -CDP for all l ‰ i. A similar argument (using the inequality (3) instead of equality) shows that silo i ’s full transcript is unconditionally p ϵ 0 , δ 0 q -CDP.
Therefore, by the basic composition theorem for DP (Dwork & Roth, 2014), the full combined transcript of all N silos is p ϵ 0 , δ 0 q -CDP, which implies that A is p ϵ 0 , δ 0 q -CDP.
Conversely, p ϵ, δ q -CDP does not imply p ϵ 1 , δ 1 q -ISRL-DP for any ϵ 1 ą 0 , δ 1 P p 0 , 1 q .
This is because a CDP algorithm may send non-private updates to the server and rely on the server to randomize, completely violating the requirement of LDP.
C. ISRL-DP I MPLIES U SER -L EVEL DP FOR SMALL p ϵ 0 , δ 0 q
Precisely, we claim that if A is p ϵ 0 , δ
q -ISRL-DP then A is p nϵ, ne p n ´ 1 q ϵ δ q user-level DP; but conversely p ϵ, δ q -user-level DP does not imply p ϵ 1 , δ 1 q -ISRL-DP for any ϵ 1 ą 0 , δ 1 P p 0 , 1 q .
The first part of the claim is due to group privacy (see (Kamath, 2020, Theorem 10) ) and the argument used above in Appendix C.1 to get rid of the “conditional”.
The second part of the claim is true because a user-level DP algorithm may send non-private updates to the server and rely on the server to randomize, completely violating the requirement of ISRL-DP.
Therefore, if ϵ 0 “ O p 1 { n q and δ 0 ! 1 { n , then any p ϵ 0 , δ 0 q -ISRL-DP algorithm also provides a strong user-level privacy guarantee.
D P ROOFS AND S UPPLEMENTARY M ATERIAL FOR S ECTIOND. P SEUDOCODE OF N OISY MB-SGD
We present pseudocode for Noisy MB-SGD in Algorithm 2:
Algorithm 2 Noisy ISRL-DP MB-SGD 1: Input: N, d, R P N , σ 2 ě 0 , X i P X ni for i P r N s , loss function f p w, x q , K P r n s , t η r u r Pr R s and t γ r u r Pr R s .
: Initialize w 0 P W .
3: for r P t 0 , 1 , ¨ ¨ ¨ , R ´ 1 u do 4: for i P S r in parallel do 5:
Server sends global model w r to silo i .
Silo i draws K samples x ri,j uniformly from X
i (for j P r K s ) and noise u i „ N p 0 , σ 2 I d q .
Silo i computes r g ir : “ 1 K ř Kj “ 1 ∇ f p w r , x ri,j q ` u i and sends to server.
8: end for 9:
Server aggregates r g r : “ 1 M r ř i P S r r g ir .
Server updates w r ` 1 : “ Π W r w r ´ η r r g r s .
11: end for 12: Output: p w R “ 1Γ R ř R ´ 1 r “ 0 γ r w r , where Γ R : “ ř R ´ 1 r “ 0 γ r .
D. P ROOF OF T HEOREM 2.
We begin by proving Theorem 2.1 for β -smooth f p¨ , x q and then extend our result to the non-smooth case via Nesterov smoothing (Nesterov, 2005).
We will require some preliminaries.
We begin with the following definition from (Bousquet & Elisseeff, 2002):
Definition 6.
(Uniform Stability)
A randomized algorithm A : W ˆ X Ă N is said to be α -uniformly stable (w.r.t.
loss function f : W ˆ X ) if for any pair of adjacent data sets X , X 1 P X Ă N , | X ∆ X 1 | ď 2 , we have
[Equation]
In our context, r N “ N ˆ n .
The following lemma, which is well known, allows us to easily pass from empirical risk to population loss when the algorithm in Question 1s uniformly stable:
Lemma D.1.
Let A : X Ă N Ñ W be α -uniformly stable w.r.t.
convex loss function f : W ˆ X Ñ R .
Let D be any distribution over X and let X „ D Ă N .
Then the excess population loss is upper bounded by the excess expected empirical loss plus α :
[Equation]
where the expectations are over both the randomness in A and the sampling of X „ D Ă N .
Here we denote the empirical loss by p F p w q and the population loss by F p w, D q for additional clarity, and
Proof.
By Theorem 2.2 in (Hardt et al., 2016),
[Equation]
Hence
[Equation]
The next step is to bound the uniform stability of Algorithm 2.
Lemma D.2.
Let f p¨ , x q be convex, L -Lipschitz, and β -smooth loss for all x P X .
Let n : “ min t n u Ni “ 1 .
Then under Assumption 3, Noisy MB-SGD with constant stepsize η ď 1 β and averaging weights γ r “ 1 R is α -uniformly stable with respect to f for α “ 2 L 2 Rη nM .
If, in addition f p¨ , x q is µ -strongly convex, for all x P X , then Noisy MB-SGD with constant step size η r “ η ď 1 β and any averaging weights t γ r u
Rr “ 1 is α -uniformly stable with respect to f for α “ 4 L 2 µ p
Mn ´ 1 q (assuming min t M, n u ą 1 ).
Proof of Lemma D.2.
The proof of the convex case extends techniques and arguments used in the proofs of (Hardt et al., 2016, Theorem 3.8), (Feldman & Vondrak, 2019, Lemma 4.3), and (Bassily et al., 2019, Lemma 3.4) to the ISRL-DP FL setting; the strongly convex bound requires additional work to get a tight bound.
For now, fix the randomness of t M r u r ě 0 .
Let X , X 1 P X Ă N be two data sets, denoted X “ p X 1 , ¨ ¨ ¨ , X N q for X i P X n for all i P r N s and similarly for X 1 , and assume | X ∆ X 1 | “ 2 .
Then there is a unique a P r N s and b P r n s such that x a,b ‰ x 1 a,b .
For t P t 0 , 1 , ¨ ¨ ¨ , R u , denote the t -th iterates of Algorithm 2 on these two data sets by w t “ w t p X q and w 1 t “ w t p X 1 q respectively.
We claim that
[Equation]
for all t. We prove the claim by induction.
It is trivially true when t “ 0 .
Suppose (13) holds for all t ď τ.
Denote the samples in each local mini-batch at iteration τ by t x i,j u i Pr N s ,j Pr K s (dropping the τ for brevity).
Assume WLOG that S τ “ r M τ s .
First condition on the randomness due to minibatch sampling and due to the Gaussian noise, which we denote by s u “ 1 M τ
ř
i P S
τ u i .
Also, denote (for t ě 0 ) r g t : “
[Equation] [Equation]
and
[Equation]
Then by the same argument used in Lemma 3.4 of (Bassily et al., 2019), we can effectively ignore the noise in our analysis of step τ ` 1 of the algorithm since the same (conditionally non-random) update is performed on X and X 1 , implying that the noises cancel out.
More precisely, by non-expansiveness of projection and gradient descent step for η ď 2 β (see Lemma 3.7 in (Hardt et al., 2016)), we have } w
[Equation]
where q τ P t 0 , 1 , ¨ ¨ ¨ , K u is a realization of the random variable Q τ that counts the number of times index b occurs in worker a ’s local minibatch at iteration τ.
(Recall that we sample uniformly with replacement.)
Now Q τ is a sum of K independent Bernoulli( 1 n a q random variables, hence
E Q τ
“ Kn a .
Then using the inductive hypothesis and taking expected value over the randomness of the Gaussian noise and the minibatch sampling proves the claim.
Next, taking expectation with respect to the randomness of t M r u r Pr t s implies
[Equation]
since the M r are i.i.d.
with E p 1 M 1 q “ 1 M .
Then Jensen’s inequality and Lipschitz continuity of f p¨ , x
q imply that for any x P X ,
[Equation]
completing the proof of the convex case.
Next suppose f is µ -strongly convex.
The proof begins identically to the convex case.
We condition on M r , u i , and S r as before and (keeping the same notation used there) get for any r ě [Equation]
¸¸ˇˇˇˇˇˇˇˇˇˇ
[Equation]
We will need the following tighter estimate of the non-expansiveness of the gradient updates to bound the first term on the right-hand side of the inequality above:
Lemma D.3.
(Hardt et al., 2016) Let G : W Ñ R d be µ -strongly convex and β -smooth.
Assume η ď 2 β ` µ Then for any w, v P W , we have
[Equation]
Note that G r p w r q : “ 1 M r K ř p i,j q‰p a,b q , p i,j qPr M r sˆr K s f p w r , x ri,j q is p 1 ´ q r M r K q β -smooth and p 1 ´ q r
M r K q µ -strongly convex and hence so is G r p w r q ` s u .
Therefore, invoking Lemma D.3 and the assumption η r “ η ď 1 β , as well as Lipschitzness of f p¨ , x q@ x P X , yields
[Equation]
Next, taking expectations over the M r (with mean E p 1 M r q “ 1 M ), the minibatch sampling (recall
E q r “ Kn a ), and the Gaussian noise implies
[Equation]
One can then prove the following claim by an inductive argument very similar to the one used in the proof of the convex part of Lemma D.2: for all t ě 0 ,
[Equation]
r “p 1 ´ b q r , where b : “ µη´ n a
[Equation]
n a M ¯ ă 1 .
The above claim implies that
[Equation]
Finally, using the above bound together with Lipschitz continuity of f and Jensen’s inequality, we obtain that for any x P X ,
[Equation]
This completes the proof of Lemma D.2.
Next, we will bound the empirical loss of Noisy MB-SGD (Algorithm 2).
We will need the following two lemmas for the proof of Lemma D.6 (and hence Theorem 2.1):
Lemma D.4.
(Projection lemma) Let W Ă R d be a closed convex set.
Then } Π W p a q´ b } 2 ď } a ´ b }for any a P R d , b P W .
Lemma D.5.
(Stich, 2019)
Let b ą 0 , let a, c ě 0 , and t η t u t ě
be non-negative step-sizes such that η t ď 1 g for all t ě 0 for some parameter g ě a .
Let t r t u t ě
and t s t u t ě 0 be two non-negative sequences of real numbers which satisfy
[Equation]
2 t for all t ě 0 .
Then there exist particular choices of step-sizes η t ď 1 g and averaging weights γ t ěsuch that
[Equation]
where Γ T : “ ř Tt “ 0 γ t .
In fact, we can choose η t and γ t as follows:
[Equation]
We give the excess empirical risk guarantee of ISRL-DP MB-SGD below:
Lemma D.6.
Let f : W ˆ
X
Ñ
R be µ -strongly convex (with µ “ 0 for convex case), L -Lipschitz, and β -smooth in w for all x P X , where W is a closed convex set in R d s.t. } w ´ w 1 } ď D for all w, w 1 P W .
Let X P X .
Then Noisy MB-SGD (Algorithm 2) with σ 2 “ 256 L 2 R ln p 2 .
5 R δ
q ln p 2 { δ 0 q n 2 ϵattains the following empirical loss bounds as a function of step size and the number of rounds:
(Convex)
For any η ď 1 { β and R P N , γ r : “ 1 { R , we have
[Equation]
(Strongly Convex)
There exists a constant stepsize η r η ď 1 { β such that if R ě
2 κ ln ´ µMϵ [Equation]
L
[Equation]
¯
, then
[Equation]
Proof.
First, condition on the random M r and consider M r as fixed.
Let w ˚ P argmin w P W p F X p w q be any minimizer of p F X , and denote the average of the i.i.d.
Gaussian noises across all silos in one round by s u r : “ 1 M r ř i
P S
r u i .
Note that s u r „ N ´ 0 , σ 2 M r I d ¯ by independence of the t u i u i Pr N s and hence E } s u r } 2 “ dσ 2 M r .
Then for any r ě 0 , conditional on M r , we have that
[Equation]
where we used Lemma D.4 in the first inequality, µ -strong convexity of p F (for µ ě 0 ) and the fact that s u r is independent of the gradient estimate and mean zero in the next inequality, and the fact that f p¨ , x q is L -Lipschitz for all x in the last inequality (together with independence of the noise and the data again).
Now we consider the convex ( µ “ 0 ) and strongly convex ( µ ą 0 ) cases separately.
Convex ( µ “ 0 ) case: Re-arranging (15), we get
[Equation]
˙ and hence
[Equation]
by taking total expectation and using E r 1 { M r s “ 1 { M .
Then for η r “ η , the average iterate s w R satisfies:
[Equation]
Plugging in σ 2 finishes the proof of the convex case.
Strongly convex ( µ ą 0 ) case: Recall from (15)
that
[Equation]
for all t ě 0 (upon taking expectation over M t ).
Now, (16) satisfies the conditions for Lemma D.5, with sequences
[Equation]
and parameters
[Equation]
Then Lemma D.5 and Jensen’s inequality imply
[Equation]
Finally, plugging in R and σ 2 completes the proof.
We are now prepared to prove Theorem 2.1 in the β -smooth case:
Theorem D.1.
Let f p w, x q be β -smooth in w for all x P X .
Assume ϵ 0 ď 2 ln p 2 { δ 0 q , choose σ 2 “ 256 L 2 R ln p 2 .
5 R δ
q ln p 2 { δ 0 q n 2 ϵand K ě ϵ 0 n 4 ?
2 R ln p 2 { δ 0 q .
Then Algorithm 2 is p ϵ 0 , δ 0 q -ISRL-DP.
Moreover, there are choices of t η r u
Rr “ 1 such that Algorithm 2 achieves the following excess loss bounds: 1.
If f p¨ , x q is convex, then setting R βD ?
M L
[Equation]
yields
[Equation]
If f p¨ , x q is µ -strongly convex, then setting R “ max
[Equation]
yields
[Equation]
Proof.
Privacy: By independence of the Gaussian noise across silos, it suffices to show that transcript of silo i ’s interactions with the server is DP for all i P r N s (conditional on the transcripts of all other silos).
WLOG consider i “ 1 .
By the advanced composition theorem (Theorem 3.20 in (Dwork & Roth, 2014)), it suffices to show that each of the R rounds of the algorithm is p r ϵ, r δ q -ISRL-DP, where r ϵ “
[Equation]
2 R ln p 2 { δ 0 q
(we used the assumption ϵ 0 ď 2 ln p 2 { δ 0 q here) and r δ “ δ 0 2 R .
First, condition on the randomness due to local sampling of the local data point x r 1 , 1 (line 4 of Algorithm 2).
Now, the L 2 sensitivity of each local step of SGD is bounded by ∆ : “ sup | X 1 ∆ X 1 1 |ď 2 ,w P W } 1 K ř Kj “ 1 ∇ f p w, x 1 ,j q ´ ∇ f p w, x 1 1 ,j q} ď 2 L { K, by L -Lipschitzness of f.
Thus, the standard privacy guarantee of the Gaussian mechanism (see (Dwork & Roth, 2014, Theorem A.1)) implies that (conditional on the randomness due to sampling) taking σ 21 ě 8 L 2 ln p 1 .
25 { r δ q r ϵ 2 Ksuffices to ensure that round r (in isolation) is p r ϵ, r δ q -ISRL-DP.
Now we invoke the randomness due to sampling: (Ullman, 2017) implies that round r (in isolation) is p 2 r ϵKn , r δ q -ISRL-DP.
The assumption on K ensures that ϵ 1 : “ n 2 K
[Equation]
1 , so that the privacy guarantees of the Gaussian mechanism and amplification by subsampling stated above indeed hold.
Therefore, with sampling, it suffices to take σ 2 ě
[Equation]
2 ln p 1 .
[Equation]
δ
[Equation]
n 2 r ϵ
[Equation]
to ensure that round r (in isolation) is p r ϵ, r δ q -ISRL-DP for all r and hence that the full algorithm ( R rounds) is p ϵ 0 , δ 0 q -ISRL-DP.
Excess loss: 1.
First suppose f is merely convex ( µ “ 0 ).
By Lemma D.2, Lemma D.1, and
Lemma D.6, we have:
[Equation]
for any η ď 1 { β .
Choosing η “ min ´ 1 β , DL ? R min
[Equation]
1 , ϵ 0 n ?
M ?
Rd , b nMR )¯ implies
[Equation]
Finally, one verifies that the prescribed choice of R yields (17).
Now suppose f is µ -strongly convex.
Then for the η ď 1 { β used in the proof of Lemma D.6 and
R ě 2 βµ ln
[Equation]
dL¯ , we have
[Equation]
by Lemma D.6, Lemma D.2, and Lemma D.1.
Hence (18) follows by our choice of R ě min
[Equation]
¯ . We use Theorem D.1 to prove Theorem 2.1 via Nesterov smoothing (Nesterov, 2005), similar to how (Bassily et al., 2019) proceeded for CDP SCO with non-strongly convex loss and N “ 1 .
That is, for non-smooth f , we run ISRL-DP Noisy MB-SGD on the smoothed objective (a.k.a.
β -Moreau envelope)
f β p w q : “ min v P W
[Equation]
` β [Equation] w ´ v }¯ , where β ą 0 is a design parameter that we will optimize for.
The following key lemma allows us to easily extend Theorem D.1 to non-smooth f :
Lemma D.7 (Nesterov (2005)) .
Let f : W Ñ R d be convex and L -Lipschitz and let β ą 0 .
Then the β -Moreau envelope f β p w q : “ min v P W
[Equation]
¯ satisfies:
f β is convex, 2 L -Lipschitz, and β -smooth.
w , f β p w q ď f p w q ď f β p w q ` L 2 2 β .
Now let us re-state the precise version of Theorem 2.1 before providing its proof:
Theorem D.2 (Precise version of Theorem 2.1) .
Let ϵ 0 ď 2 ln p 2 { δ 0 q and choose σ 2 “ 256 L
[Equation]
R ln p
[Equation]
5 R
[Equation]
q ln p 2 { δ 0 q n 2 ϵ, K ě
[Equation]
n
[Equation]
2 R ln p 2 { δ 0 q .
Then Algorithm 2 is p ϵ 0 , δ 0 q -ISRL-DP.
Further, there exist choices of β ą 0 such that running Algorithm 2 on f β p w, x q : “ min v P W
[Equation]
¯ yields:
If f p¨ , x q is convex, then setting R “ βD ?
M L
[Equation]
yields
[Equation]
If f p¨ , x q is µ -strongly convex, then setting R “ max
[Equation]
yields
[Equation]
Proof.
Privacy: ISRL-DP is immediate from post-processing (Dwork & Roth, 2014, Proposition 2.1), since we already showed that Algorithm 2 (applied to f β ) is ISRL-DP.
Excess risk: We have E F p p w R q ´ F ˚ ď E F β p p w R q ´ F ˚ β ` L 2 2 β , by part 2 of Lemma D.7.
Moreover, by part 1 of Lemma D.7 and Theorem D.1, we have:
[Equation]
for convex f , and 2 .
E F β p p
[Equation]
R q ´
[Equation]
for µ -strongly convex f .
Thus, choosing β 1 such that L 2 { β 1 ď LD ?
M ˆ
[Equation]
n ˙ and βsuch that L 2 { β 2 ď L 2 µM
[Equation]
¯ completes the proof.
D. L OWER B OUNDS FOR ISRL-DP FL: S UPPLEMENTAL M ATERIAL AND P ROOFS
This section requires familiarity with the notation introduced in the rigorous definition of ISRL-DP in Appendix B.
D.3. C -C OMPOSITIONALITY
The p ϵ 0 , δ
q -ISRL-DP algorithm class
A p ϵ 0 ,δ 0 q ,C contains all sequentially interactive and fully interactive, C -compositional algorithms.
Definition 7 (Compositionality) .
Let A be an R -round p ϵ 0 , δ
q -ISRL-DP FL algorithm with data domain X .
Let tp ϵ r 0 , δ r 0 qu Rr “ 1 denote the minimal (non-negative) parameters of the local randomizers
R p i q r selected at round r such that R p i q r p Z p 1: r ´ 1 q , ¨q is p ϵ r 0 , δ r 0 q -DP for all i P r N s and all Z p 1: r ´ 1 q .
For C ą 0 , we say that A is C -compositional if bř
[Equation]
0 q [Equation] ď Cϵ 0 .
If such C is an absolute constant, we simply say A is compositional.
Definition 7 is an extension of the definition in Joseph et al.
to δ 0 ą 0 .
D.3. A LGORITHMS WHOSE P RIVACY FOLLOWS FROM A DVANCED C OMPOSITION T HEOREM ARE 1 -C OMPOSITIONAL
Suppose A is p ϵ 0 , δ 0 q -ISRL-DP by the advanced composition theorem (Dwork & Roth, 2014, Theorem 3.20).
Then
[Equation]
and δ 0 “ ř Rr “ 1 δ r 0 ` δ 1 for any δ 1 P p 0 , 1 q .
Assume δ 1 P p 0 , 1 { 3 q without loss of generality: otherwise the privacy guarantee of A is essentially meaningless (see Remark D.1).
Then ϵ 0 ě b
[Equation]
bř
[Equation]
bř
Rr
[Equation]
p ϵ r 0 q 2 , so that A is 1 -compositional.
Note that even if δ 1 ą 1 { 3 , A would still be compositional, but the constant
D.3. E XAMPLE OF LDP A LGORITHM THAT IS N OT C OMPOSITIONAL
This example is a simple modification of Example 2.2 in (Joseph et al., 2019) (adapted to our definition of compositionality for δ 0 ą 0 ).
Given any C ą 0 , set d : “ 2 C 2 and let X “ t e 1 , ¨ ¨ ¨ e d u Ă t 0 , 1 u d be the standard basis for R d .
Let n “ 1 and X “ p x 1 , ¨ ¨ ¨ , x N q P X N .
For all i P r N s let
Q p i q : X Ñ X be the randomized response mechanism that outputs Q p i
q p x i q “ x i with probability
e
ϵe
ϵ
` d ´ 1 and otherwise outputs a uniformly random element of X zt x i u .
Note that Q p i q is ϵ 0 -DP, hence p ϵ 0 , δ 0 q -DP for any δ 0 ą 0 .
Consider the d -round algorithm
A : X N Ñ Z d ˆ N in Algorithm 3, where Z “ R d
Algorithm 3 LDP Algorithm that is not C -compositional 1: for r P r d s do 2: for i P N do 3: if x i “ e r then 4:
R p i
q r p x i q : “ Q p i q p x i q .
5: else 6:
R p i
q r p x i q : “ 0 P R d .
7: end if 8: end for 9: end for 10: Output: t R p i q r p x i qu i Pr N s ,r Pr d s .
Since each silo’s data is only referenced once and Q p i q is ϵ 0 -DP, we have ϵ r
“ ϵ 0 and A is p ϵ 0 , δ 0 q -DP.
However, bř
[Equation]
, so that A is not C -compositional.
Also, note that our One-Pass Accelerated Noisy MB-SGD is only C -compositional for C ě ?
R , since ϵ 0 “ ϵ r 0 for this algorithm.
Thus, substituting the R that is used to prove the upper bounds in Theorem 3.1 (see Appendix E.2) and plugging C “ ?
R into Theorem 2.2 explains where the non-i.i.d.
lower bounds in Fig.
3 come from.
D.3. P ROOF OF T HEOREM 2.
First, let us state the complete, formal version of Theorem 2.2, which uses notation from Appendix B:
Theorem D.3 (Complete Version of Theorem 2.2) .
Let ϵ 0 P p 0 , ?
N s , δ 0 “ o p 1 { nN q , and
A
P A p ϵ 0 ,δ 0 q ,C .
Suppose that in each round r , the local randomizers are all p ϵ r 0 , δ r 0 q -DP, for ϵ r 0 À 1 n , δ r 0 “ o p 1 { nNR q , N ě 16 ln p 2 { δ r 0 n q .
Then:
There exists a f P F L,D and a distribution D such that for X „ D nN , we have:
[Equation]
There exists a µ -smooth f P G µ,L,D and distribution D such that for X „ D nN , we have
[Equation]
Further, if A P A , then the above lower bounds hold with C “ 1 .
Before we proceed to the proof of Theorem 2.2, we recall the simpler characterization of ISRL-DP for sequentially interactive algorithms.
A sequentially interactive algorithm A with randomizers t R p i q u Ni “ 1 is p ϵ 0 , δ 0 q -ISRL-DP if and only if for all i P r N s , R p i q p¨ , Z p 1: i ´ 1 q q : X ni
ˆ Z is p ϵ 0 , δ
q -DP for all Z p 1: i ´ 1 q P Z
i ´ 1 .
In what follows, we will fix X i “ X for all i .
We now turn to the proof.
Step 1: Privacy amplification by shuffling.
We begin by stating and proving the amplification by shuffling result that we will leverage to obtain Theorem 2.2:
Theorem D.4.
Let A P
A p ϵ 0 ,δ 0 q ,C such that ϵ 0 P p 0 , ?
N s and δ 0 P p 0 , 1 q .
Assume that in each round, the local randomizers R p i q r p Z p 1: r ´ 1 q , ¨q : X n Ñ Z are p ϵ r 0 , δ r 0 q -DP for all i P r N s , r P r R s , Z p 1: r ´ 1 q P Z r ´ 1 ˆ N with ϵ r 0 ď 1 n .
Assume N ě 16 ln p 2 { δ r 0 n q .
If A is C -compositional, then assume δ r 0 ď 1 14 nNR and denote δ : “ 14 Nn ř Rr “ 1 δ r 0 ; if instead A is sequentially interactive, then assume δ
“ δ r 0 ď 1 7 Nn and denote δ : “ 7 Nnδ 0 .
Let A s : X Ñ W be the same algorithm as A except that in each round r , A s draws a random permutation π r of r N s and applies R p i q r to X π r p
i q instead of X i .
Then, A s is p ϵ, δ q -CDP, where ϵ “ O ˆ
[Equation]
˙ , and δ min0 : “ min r Pr R s δ r 0 .
In particular, if A P A , then ϵ “ O ˆ
[Equation]
N ˙ .
Note that for sequentially interactive A , δ min0 “ δ 0 .
To the best of our knowledge, the restriction on ϵ r 0 is needed to obtain ϵ “ r O p ϵ 0 {?
N q in all works that have analyzed privacy amplification by shuffling (Erlingsson et al., 2020b; Feldman et al., 2020b;
Balle et al., 2019; Cheu et al., 2019; Balle et al., 2020), but these works focus on the sequentially interactive case with n “ 1 , so the restriction amounts to ϵ 0 À 1 (or ϵ 0 “ r O p 1 qq .
The non-sequential
C -compositional part of Theorem D.4 will follow as a corollary (Corollary D.1 ) of the following result which analyzes the privacy amplification in each round:
Theorem D.
(Single round privacy amplification by shuffling) .
Let ϵ r 0 ď ln ´
N 16ln
[Equation] [Equation]
q ¯ { n, r P N and let R p i
q r p Z , ¨q : X n Ñ Z be an p ϵ r 0 , δ r 0 q -DP local randomizer for all Z “ Z p 1: N q p 1: r ´ 1 q P Z p r ´ 1 qˆ N
and i P r N s , where X is an arbitrary set.
Given a distributed data set X “ p X 1 , ¨ ¨ ¨ , X N q P
X N ˆ n and Z “ Z p 1: N q p 1: r ´ 1 q , consider the shuffled algorithm
A rs : X n ˆ N ˆ Z p r ´ 1 qˆ N Ñ Z N that first samples a random permutation π of r N s and then computes Z r “ p Z p 1 q r , ¨ ¨ ¨ , Z p N q r q , where
Z p i q r : “ R p i
q r p Z , X π p i q q .
Then, A rs is p ϵ r , r δ r q -CDP, where
[Equation]
and r δ r : “ δ r ` 2 Nne p n ´ 1 q ϵ r 0 δ r 0 .
In particular, if ϵ r 0 “ O ` 1 n ˘ , then
[Equation]
[Equation]
Further, if ϵ r 0 ď 1 { n , then setting δ r : “ Nnδ r 0 implies that
[Equation]
23) and r δ r ď 7 Nnδ r 0 , which is in p 0 , 1 q if we assume δ r 0 P p 0 , 1 7 Nn s .
We sometimes refer to the algorithm A rs as the “shuffled algorithm derived from the randomizers t R p i q r u . ”
From Theorem D.5, we obtain:
Corollary D.1 ( R -round privacy amplification for C -compositional algorithms) .
Let A : X n ˆ N Ñ
Z R ˆ N be an R -round p ϵ 0 , δ
q -ISRL-DP and C -compositional algorithm such that ϵ 0 P p 0 , ?
N s and δ 0 P p 0 , 1 q , where X is an arbitrary set.
Assume that in each round, the local randomizers
R p i q r p Z p 1: r ´ 1 q , ¨q : X n Ñ Z are p ϵ r 0 , δ r 0 q -DP for i P r N s , r P r R s , where N ě 16 ln p 2 { δ r 0 n q , ϵ r 0 ď 1 n , and δ r 0 ď 1 14 nNR .
Then, the shuffled algorithm A s : X n ˆ N Ñ Z R
ˆ N derived from t R p
i q r p Z p 1: r ´ 1 q , ¨ qu i Pr N s ,r Pr R s (i.e. A s is the composition of the R shuffled algorithms A rs defined in Theorem D.5) is p ϵ, δ q -CDP, where δ ď
Nn
ř
Rr “ 1 δ r 0 and ϵ
“ O ˆ ϵ
ln p 1 { nNδ min0 q C 2 ?
N ˙ , where δ min: “ min r Pr R s δ r 0 .
In particular, if A P A is compositional, then ϵ “ O ˆ ϵ
ln p 1 { nNδ min0 q ?
N ˙ .
Proof.
Let δ 1 : “ ř r Nnδ r 0 and δ r : “ Nnδ r 0 .
Then the (central) privacy loss of the full R -round shuffled algorithm is bounded as
[Equation]
where the three (in)equalities follow in order from the Advanced Composition Theorem (Dwork & Roth, 2014), (23) in Theorem D.5, and C -compositionality of A combined with the assumption ϵ 0 À ?
N .
Also, δ “ δ 1 ` ř r r δ r by the Advanced Composition Theorem, where r δ r ď 7 Nnδ r 0 by
Theorem D.5.
Hence δ ď 14 Nn ř r δ r 0 .
In particular, if A is compositional, then C “ O p 1 q , so ϵ
[Equation]
Remark D.1.
The upper bounds assumed on δ r 0 and δ r in Theorem 2.2 ensure that δ P p 0 , 1 q and that the lower bounds of (Bassily et al., 2014) apply (see Theorem D.6).
These assumptions are not very restrictive in practice, since δ r 0 , δ 0 !
1 { n is needed for meaningful privacy guarantees (see e.g.
Chapter 2 in (Dwork & Roth, 2014)) and R must be polynomial for the algorithm to run.
To quote (Dwork & Roth, 2014), “typically we are interested in values of δ that are less than the inverse of any polynomial in the size of the database” (page 18).
For larger δ (e.g. δ “ Ω p 1 { n q ), there are examples of algorithms that satisfy the definition of DP but clearly violate any reasonable notion of privacy.
For instance, an algorithm that outputs δ 0 n random samples from each silo’s data set is p 0 , δ 0 q -ISRL-DP, but completely violates the privacy of at least one person in each silo if δ 0 ě 1 { n .
Also, since N " 1 is the regime of interest (otherwise if N “ r O p 1 q , the CDP lower bounds of (Bassily et al., 2019) already match our upper bounds up to logarithms), the requirement that N be larger than 16 ln p 2 { δ min0 n q is unimportant.
The sequentially interactive part of Theorem D.4 will be clear directly from the proof of Theorem D.5.
We now turn to the proof of Theorem D.5, which uses the techniques from (Feldman et al., 2020b).
First, we’ll need some more notation.
The privacy relation in (3) between random variables P and
Q can be characterized by the hockey-stick divergence : D e ϵ p P } Q q [Equation]
[Equation]
where p and q denote the probability density or mass functions of P and Q respectively.
Then
P » p ϵ,δ q Q iff max t D e ϵ p P } Q q , D e ϵ p Q } P qu ď δ.
Second, recall the total variation distance between
P and Q is given by TV p P, Q q “ş
R | p p x q ´ q p x q| dx.
Third, we recall the notion of group privacy:
Definition 8 (Group DP) .
A randomized algorithm A : X N Ñ Z is p ϵ, δ q group DP for groups of size N if A p X q » p ϵ,δ q A p X 1 q for all X , X 1 P X N .
We’ll also need the following stronger version of a decomposition from (Kairouz et al., 2015) and
Lemma 3.2 of (Murtagh & Vadhan, 2016).
Lemma D.8 ((Kairouz et al., 2015)) .
Let R 0 , R 1 : X n Ñ Z be local randomizers such that R 0 p X 0 q and R 1 p X 1 q are p ϵ, 0 q indistinguishable.
Then, there exists a randomized algorithm U : t X 0 , X 1 u Ñ
Z such that R 0 p X 0 q “ e ϵ e ϵ ` 1 U p X 0 q ` 1 e ϵ ` 1 U p X 1 q and R 1 p X 1 q “ 1 e ϵ ` 1 U p X 0 q ` e ϵ e ϵ ` 1 U p X 1 q .
Lemma D.8 follows from the proof of Lemma 3.2 in (Murtagh & Vadhan, 2016), noting that the weaker hypothesis assumed in Lemma D.8 sufficient for all steps to go through.
Definition 9 (Deletion Group DP) .
Algorithm R : X n Ñ Z is p ϵ, δ q deletion group DP for groups of size n if there exists a reference distribution ρ such that R p X q » p ϵ,δ q ρ for all X P X n .
It’s easy to show that if R is p ϵ, δ q - deletion group DP for groups of size n , then R is p 2 ϵ, p 1 ` e ϵ q δ q group DP for groups of size n .
In addition, we have the following result:
Lemma D.9.
Let X 0 P X n .
If R : X n Ñ Z is an p ϵ, δ q -DP local randomizer, then R is p nϵ, ne p n ´ 1 q ϵ δ q deletion group DP for groups of size n with reference distribution R p X 0 q (i.e.
R p
X q » p r ϵ, r δ q R p X 0 q for all X P X n , where r ϵ “ nϵ and r δ “ ne p n ´ 1 q ϵ δ ).
Proof.
By group privacy (see e.g. Theorem 10 in (Kamath, 2020)), and the assumption that R is p ϵ, δ q -DP, it follows that R p X q
and R p X 1 q are p nϵ, ne p n ´ 1 q ϵ δ q indistinguishable for all X, X 1 P X n .
In particular, taking X 1 : “ X 0 completes the proof.
Lemma D.10.
Let R p
i q : X n Ñ Z be randomized algorithms ( i P r N s ) and let A s : X n ˆ N Ñ Z N be the shuffled algorithm
A s p X q : “ p R p 1 q p X π p 1 q q , ¨ ¨ ¨ R p N q p X π p N q qq derived from t R p i q u i Pr N s for X “ p X 1 , ¨ ¨ ¨ , X N q , where π is a uniformly random permutation of r N s .
Let X 0 “ p X 01 , X 2 , ¨ ¨ ¨ , X N q and X 1 “ p X 11 , X 2 , ¨ ¨ ¨ , X N q , δ P p 0 , 1 q and p P r 16ln p 2 { δ q N , 1 s .
Suppose that for all i P r N s , X P X n zt X 11 , X 01 u , there exists a distribution LO p
i q p
X
q such that
[Equation]
Then A s p X
[Equation]
, where
[Equation]
Proof.
The proof mirrors the proof of Lemma 3.3 in (Feldman et al., 2020b) closely, replacing their notation with ours.
Observe that the DP assumption in Lemma 3.3 of (Feldman et al., 2020b) is not actually needed in the proof.
Lemma D.11.
Let R : X n Ñ Z be p ϵ, δ q deletion group DP for groups of size n with reference distribution ρ .
Then there exists a randomizer R 1 : X n Ñ Z such that:
(i) R 1 is p ϵ, 0 q deletion group DP for groups of size n with reference distribution ρ ; and (ii) TV p
R p X q , R 1 p X qq ď δ.
In particular, R 1 is p 2 ϵ, 0 q group DP for groups of size n (by (i)).
Proof.
The proof is nearly identical to the proof of Lemma 3.7 in (Feldman et al., 2020b).
We also need the following stronger version of Lemma 3.7 from (Feldman et al., 2020b):
Lemma D.12.
If R p X 01 q » p ϵ 0 ,δ 0 q R p X 11 q , then there exists a randomizer R 1 : X n Ñ Z such that
R 1 p X 11 q » p ϵ 0 , 0 q R p X 01 q and TV p R 1 p X 11 q , R p X 11 qq ď δ 0 .
Proof.
The proof follows the same techniques as Lemma 3.7 in (Feldman et al., 2020b), noting that the weaker hypothesis in Lemma D.12 is sufficient for all the steps to go through and that the assumption of n “ 1 in (Feldman et al., 2020b) is not needed in the proof.
Lemma D.13 ((Dwork & Roth, 2014), Lemma 3.17) .
Given random variables P, Q, P 1 and Q 1 , if
D e ϵ p P 1 , Q 1 q ď δ , TV p P, P 1 q ď δ 1 , and TV p Q, Q 1 q ď δ 1 , then D e ϵ p P, Q q ď δ ` p e ϵ ` 1 q δ 1 .
Lemma D.14 ((Feldman et al., 2020b), Lemma 2.3) .
Let P and Q be distributions satisfying
P “ p 1 ´ q q P 0 ` qP 1 and Q “ p 1 ´ q q P 0 ` qQ 1 for some q P r 0 , 1 s .
Then for any ϵ ą 0 , if ϵ 1 “ log p 1 ` q p e ϵ ´ 1 qq , then
[Equation]
We are now ready to prove Theorem D.5:
Proof of Theorem D.5.
Let X 0 , X 1 P X n ˆ N be adjacent (in the CDP sense) distributed data sets (i.e.
| X 0 ∆ X 1 | ď 1 ).
Assume WLOG that X
“ p X 01 , X 2 , ¨ ¨ ¨ , X N q and X 1 “ p X 11 , X 2 , ¨ ¨ ¨ , X N q , where X 01 “ p x 1 , 0 , x 1 , 2 , ¨ ¨ ¨ , x 1 ,n q ‰ p x 1 , 1 , x 1 , 2 , ¨ ¨ ¨ , x 1 ,n q .
We can also assume WLOG that
X j R t X 01 , X 11 u for all j P t 2 , ¨ ¨ ¨ , N u by re-defining X and R p
i q r if necessary.
Fix i P r N s , r P r R s , Z “ Z 1: r ´ 1 “ Z p 1: N q p 1: r ´ 1 q P Z p r ´ 1 qˆ N , denote R p X q : “ R p i
q r p Z , X q for
X P X n , and A s p X q : “ A rs p Z 1: r ´ 1 , X q .
Draw π uniformly from the set of permutations of r N s .
Now, since R is p ϵ 0 , δ 0 q -DP, R p
X 11 q » p
ϵ r 0 ,δ r 0 q R p X 01 q , so by Lemma D.12, there exists a local randomizer R 1 such that R 1 p X 11 q » p ϵ r 0 , 0 q R p X 01 q and TV p R 1 p X 11 q , R p X 11 qq ď δ r 0 .
Hence, by Lemma D.8, there exist distributions
U p X 01 q and U p X 11 q such that
[Equation]
(24) and
[Equation]
[Equation]
Denote r ϵ 0 : “ nϵ r 0 and r δ 0 : “ ne p n ´ 1 q ϵ r 0 δ r 0 .
By convexity of hockey-stick divergence and the hypothesis that R is p ϵ r 0 , δ r 0 q -DP
(hence R p X q »
p
Ă
ϵ 0 , Ă δ
q
R
p
X
01 q , R p X 11 q for all X by Lemma D.9), we have
R p X q »
p
Ă
ϵ 0 , Ă δ 0 q 12 p R p X
01 q ` R p X 11 qq : “ ρ for all X P X n .
That is, R is p r ϵ 0 , r δ 0 q deletion group DP for groups of size n with reference distribution ρ.
Thus, Lemma D.11 implies that there exists a local randomizer R 2 such that R 2 p X q and ρ are p r ϵ 0 , 0 q indistinguishable and TV p R 2 p X q , R p
X qq ď r δfor all X.
Then by the definition of p r ϵ 0 , 0 q indistinguishability, for all X there exists a “left-over” distribution LO
p X q such
that R 2 p
X
q “ 1 e Ă ϵ
ρ ` p 1 ´ 1 { e Ă ϵ 0 q LO p X
[Equation]
R p X [Equation] p X 11 qq
[Equation]
p 1 ´ 1 { e Ă ϵ 0 q LO p X q .
Now, define a randomizer L by L p X 01 q : “ R p X 01 q , L p X 11 q : “ R 1 p X 11 q , and
L [Equation] X q :
[Equation] [Equation]
(26) for all X
P
X n zt X 01 , X 11 u .
(The equality follows from (24) and (25).)
Note that TV p R p X 01 q , L p X 01 qq “ 0 ,
TV p R p X 11 q , L p X 11 qq ď δ r 0 , and for all X
P
X n zt X 01 , X 11 u , TV p
R
p
X q , L p
X qq ď TV p R
p X q , R 2 p
X qq ` TV p R 2 p
X q , L p
X qq ď r
δ 0 ` 1 2 e Ă ϵ 0 TV p R 1 p X 11 q , R p
X
qq “ p ne p n ´ 1 q ϵ r {+
+}
` 1 2 e nϵr 0 q δ r 0 ď p 2 ne p n ´ 1 q ϵ r 0 q δ r 0 “ 2 r δ 0 .
Keeping r fixed (omitting r scripts everywhere), for any i P r N s and Z : “ Z 1: r ´ 1 P Z p r ´ 1 qˆ N , let
L p i q p Z , ¨q , U p i q p Z , ¨q , and LO p i q p Z , ¨q denote the randomizers resulting from the process described above.
Let A L : X n ˆ N Ñ Z N be defined exactly the same way as A rs : “ A s (same π ) but with the randomizers R p
i q replaced by L p i q .
Since A s applies each randomizer R p
i q exactly once and R p 1 q p Z , X π p 1 q , ¨ ¨ ¨ R p N q p Z , X π p N q q are independent (conditional on Z “ Z 1: r ´ 1 ) 14 , we have
TV p
A s p X 0 q , A L p X
q ď N p 2 ne p n ´ 1 q ϵ r 0 q δ r 0 and TV p
A s p X 1 q , A L p X 1 q ď N p 2 ne p n ´ 1 q ϵ r 0 q δ r
(see (Den Hollander, 2012)).
Now we claim that A L p X 0 q and A L p X 1 q are p ϵ r , δ r q indistinguishable for any δ r ě 2 e ´ Ne ´ nϵr 0 { 16 .
Observe that this claim implies that A s p X 0 q and A s p X 1 q are p ϵ r , r δ r q indistinguishable by Lemma D.13 (with P 1 : “ A L p X 0 q , Q 1 : “ A L p X 1 q , P : “ A s p X 0 q , Q : “
A s p X 1 q .)
Therefore, it remains to prove the claim, i.e. to show that D e ϵr p
A L p X 0 q , A L p X 1 q ď δ r any
Now, define L p i
q U p Z , X q : “
[Equation]
if
[Equation]
p
[Equation] [Equation]
if
[Equation]
L
[Equation]
p Z , [Equation] q otherwise .
For any inputs Z , X , let A U
p Z , X q be defined exactly the same as A s p Z , X q
(same π ) but with the randomizers R p i q replaced by L p
i q U .
Then by (24) and (25),
A
[Equation]
Then by (26), for any X P X n zt X 01 , X 11 u and any Z “ Z 1: r ´ 1 P Z p r ´ 1 qˆ N , we have L p
i q U p Z , X q “ 1 2 e Ă ϵ
L p
i q U
p Z , X 01 q ` {+
+}
[Equation]
[-ϵ 
-]0 L p i q U p Z , X 11 q ` p
[Equation]
´ e
[Equation]
Ă
[Equation]
0 q LO p
i q p
Z , X q .
Hence, Lemma D.10 (with p : “ e ´ Ă ϵ 0 “ e ´ nϵ r 0 ) implies that A U p X 0 q and A U p X 1 q ) are ˜
[Equation]
indistinguishable for any δ r ě 2 e ´ Ne ´ nϵr 0 { 16 .
Applying Lemma D.14 with P : “ A L p X 0 q , Q “
A L p X 1 q , q “ e ϵr 0 ´ 1 e ϵr 0 ` 1 , P 1 “ A U p X 0 q , Q 1 “ A U p X 1 q , and P 0 “ 12 p P 1 ` Q 1 q and convexity of the hockey-stick divergence yields that A L p X 0 q and A L p X 1 q are p ϵ r , δ r q indistinguishable, as desired.
This proves the claim and hence (by Lemma D.13, as described earlier) the theorem.
Remark D.2.
Notice that if A is sequentially interactive, then the proof of Theorem D.5 above almost immediately implies the sequentially interactive part of Theorem D.4.
Essentially, just change notation: replace Z 1: r ´ 1 by Z p 1: i ´ 1 q , the collection of (single) reports sent by the first i ´ 1 silos; note that ϵ r 0 “ ϵ 0 , δ r 0 “ δ 0 ; and view the N reports as being sent in order instead of simultaneously.
Alternatively, plug our techniques for n ą 1 into the proof of Theorem 3.8 in (Feldman et al., 2020b), which is for sequentially interactive algorithms.
Step 2: Combine Theorem D.4 with the following CDP SCO lower bounds which follow from (Bassily et al., 2014; 2019) and the non-private SCO lower bounds (Nemirovskii & Yudin, 1983;
Agarwal et al., 2012) :
Theorem D.6.
(Bassily et al., 2019; 2014) Let µ, D, ϵ ą 0 , L ě µD , and δ “ o p 1 { nN q .
Consider
X : “ t ´ D ?
d , D ?
d u d Ă R d and W : “ B 2 p 0 , D q Ă R d .
Let A : X nN Ñ W be any p ϵ, δ q -CDP algorithm.
Then:
There exists a ( µ “ 0 ) convex, linear ( β -smooth for any β ), L -Lipschitz loss f : W ˆ X Ñ R and a distribution D on X such that if X „ D nN , then the expected excess loss of A is lower bounded as
[Equation]
For L « µD , there exists a µ -strongly convex and smooth, L -
Lipschitz loss f : W ˆ X Ñ R and a distribution D on X such that if X „ D nN , then the expected excess loss of A is lower bounded as
[Equation]
For general L, µ, D , the above strongly convex lower bound holds with the factor L 2 µ replaced by
LD .
Namely, if A is p ϵ 0 , δ 0 q -ISRL-DP, then (under the hypotheses of Theorem 2.2)
A s is p ϵ, δ q -CDP for ϵ “ r O p ϵ 0 {?
N q , so Theorem D.6 implies that the excess loss of A s is lower bounded as in
Theorem D.6 with ϵ replaced by ϵ 0 { ?
N .
Step 3: We simply observe that when the expectation is taken over the randomness in sampling
X „ D n ˆ N , the expected excess population loss of A s is identical to that of A since X i and
X π p
i q have the same distribution for all i, π by the i.i.d.
assumption.
This completes the proof of
Theorem 2.2.
D.3. T IGHT E XCESS R ISK B OUNDS FOR C ROSS -D EVICE FL W ITHOUT A T RUSTED S ERVER
We explain how our ISRL-DP excess risk bounds also imply tight excess risk bounds for algorithms that satisfy both ISRL-DP and user-level DP simultaneously , which may be desirable for cross-device
FL without a trusted server.
Assume M “ N for simplicity and consider i.i.d.
FL for concreteness.
Given p ϵ, δ q with ϵ ď 1 , let ϵ
“ ϵ { n, δ
“ δ { 4 n ď δ {p ne p n ´ 1 q ϵ 0 q “ δ {p ne p n ´ 1 q ϵ { n q and run Noisy (ISRL-DP) MB-SGD with noise calibrated to p ϵ 0 , δ 0 q .
Then the algorithm also satisfies p ϵ, δ q -user level DP by Appendix C.
Thus, by Theorem 2.1, we obtain hybrid ISRL-DP/user-level DP excess risk upper bounds.
For example, in the convex case, we get
[Equation]
Regarding lower bounds: note that the semantics of the hybrid ISRL-DP/user-level DP notion are essentially identical to LDP, except that individual “records/items” are now thought of as datasets of size n .
Thus, letting n “ 1 in our ISRL-DP lower bounds (we think of each silo as having just one “record” even though that record is really a dataset) yields lower bounds matching (up to logarithms)
the upper bounds attained above.
For example, putting n “ 1 in the convex lower bound in Theorem 2.2 yields a bound that matches (28), establishing the optimal FL rates (up to logarithmic factors) for this algorithm class.
Note that the minimax risk bounds for ISRL-DP/user-level DP hybrid algorithms resemble the bounds for LDP algorithms (Duchi et al., 2013), scaling with N , but not with n .
E P ROOFS AND S UPPLEMENTAL M ATERIAL FOR S ECTIONE. M UTLI -S TAGE I MPLEMENTATION OF A CCELERATED N OISY MB-SGD
Here we describe the multi-stage implementation of Accelerated Noisy MB-SGD that we will use to further expedite convergence for strongly convex loss, which builds on (Ghadimi & Lan, 2013).
As before, for SCO, silos sample locally without replacement in each round and set R “ t n { K u .
Whereas for ERM, silos sample locally with replacement .
Multi-stage implementation of Algorithm 1: Inputs: U P r R s such that ř Uk
“ 1 R k ď R for R k defined below; w 0 P W , ∆ ě F p w 0 q ´ F ˚ , V ą 0 , and q 0 “ 0 .
For k P r U s , do the following:
Run R k rounds of Algorithm 1 using w 0 “ q k ´ 1 , t α r u r ě 1 and t η r u r ě 1 , where
[Equation]
Set q k “ w agR k , where w agR k is the output of Step 1 above.
Then update k Ð k ` 1 and return to Step 1.
E. C OMPLETE VERSION AND PROOF OF T HEOREM 3.
We will state and prove the theorem for general M P
r N s under Assumption 3 .
We first require some additional notation:
Define the heterogeneity parameter
[Equation]
which has appeared in (Khaled et al., 2019;
Koloskova et al., 2020; Karimireddy et al., 2020;
Woodworth et al., 2020b).
υ
[Equation]
iff F [Equation] “ F ` a i for constants a i P R , i P r N s (“homogeneous up to transaltion”).
Theorem E.1 (Complete version of Theorem 3.1) .
Let f p¨ , x q be β -smooth for all x P X .
Assume ϵ 0 ď 8 ln p 1 { δ 0 q , δ 0 P p 0 , 1 q
Then, with σ 2 “ 32 L 2 ln p 1 .
25 { δ 0 q ϵ 20 K, One-Pass Accelerated Noisy MB-SGD is p ϵ 0 , δ 0 q -ISRL-DP.
Moreover, there are choices of stepsize, batch size, and λ ą 0 such that : 1.
Running One-Pass Accelerated Noisy MB-SGD on r f p w, x q : “ f p w, x q ` λ 2 } w ´ w 0 } 2 (where w 0 P W ) yields
[Equation]
If f p¨ , x q is µ -strongly convex @
x P X and κ “ βµ , then running the Multi-Stage Implementation of One-Pass Accelerated Noisy MB-SGD directly on f yields with batch size K yields
[Equation]
Remark E.1.
For convex f , if M “ N or υ
[Equation]
then (30) recovers the bound (6) in Theorem 3.1 ( M “ N version), with N replaced by M .
For µ -strongly convex f , if M “ N or
[Equation]
then (31) recovers the bound (7) in Theorem 3.1, with N replaced by M .
To prove Theorem E.1, we will need some preliminaries:
Lemma E.1.
(Woodworth et al., 2020b, Lemma 4)
Let F : W Ñ R d be convex and β -smooth, and suppose that the unbiased stochastic gradients r g p w t q at each iteration have bounded variance E } r g p w q´ ∇ F p w q} 2 ď V 2 .
If p w agR is computed by R steps of Accelerated MB-SGD on the regularized objective r F p w q “ F p w q `
V 2 } w 0 ´ w ˚ }?
R } w ´ w 0 } 2 , then
[Equation]
We then have the following bound for the multi-stage protocol:
Lemma E.2.
(Ghadimi & Lan, 2013, Proposition 7) Let f : W Ñ R d be µ -strongly convex and β -smooth, and suppose that the unbiased stochastic gradients r g p w r q at each iteration r have bounded variance E } r g p w r q ´ ∇ F p w t q} 2 ď V 2 .
If p w agR is computed by R steps of the Multi-Stage Accelerated
MB-SGD, then
[Equation]
where ∆ “ F p w 0 q ´ F ˚ .
Of course, (Woodworth et al., 2020b, Lemma 4) and (Ghadimi & Lan, 2013, Proposition 7) are stated for the non-private Accelerated MB-SGD (AC-SA).
However, we observe that the bounds in (Woodworth et al., 2020b, Lemma 4) and (Ghadimi & Lan, 2013, Proposition 7) depend only on the stochastic gradient oracle via its bias and variance.
Hence these results also apply to our (multi-stage implementation of)
Accelerated Noisy MB-SGD.
Next, we bound the variance of our noisy stochastic gradient estimators:
Lemma E.3.
Let X i „ D ni , r g
[Equation]
: “ 1 M r ř i P S r 1 K ř j Pr K s p ∇ f p w r , x ri,j q ` u i q , where p x ri,j q j Pr K s are sampled from X i and u i „ N p 0 , σ 2 I d q is independent of ∇ f p w r , x ri,j q for all i P r N s , j P r K s .
Then
[Equation]
The three terms on the right-hand side correspond (from left to right) to the variances of: local minibatch sampling within each silo, the draw of the silo set S r of size M r under Assumption 3 , and the Gaussian noise.
We now turn to the proof of Lemma E.3.
Proof of Lemma E.3.
First, fix the randomness due to the size of the silo set M r .
Now r g r “ g r ` s u r , where s u r “ 1 M r ř M r
i “ 1 u i „ N p 0 , σ 2 M r I d q and s u r is independent of g r : “ 1 M r ř i P S r 1 K
i ř j Pr K s ∇ f p w r , x ri,j q .
Hence,
E
[Equation]
Let us drop the r subscripts for brevity (denoting g “ g r , w “ w r , S “ S r , and M r “ M 1 since they have the same distribution) and denote h i : “ 1 K
i
ř K
i j “ 1 ∇ f p w, x i,j q .
Now, we have (conditionally on
M 1 )
[Equation]
since, conditional on S , the cross-terms vanish by (conditional) independence of h i and the nonrandom
ř i 1 P S ∇
F i 1 p w q ´ ∇ F p w q for all
i P S.
Now we bound a ⃝ :
[Equation]
by conditional independence of h i ´ ∇ F i and h
i 1 ´ ∇ F i 1 given S .
Hence
[Equation]
Next we bound b ⃝ .
Denote y i : “ ∇ F i p w q
and s y : “ 1 N ř Ni “ 1 y i “ ∇ F p w q .
We claim b ⃝ =
E
[Equation]
¯ υ 2 .
Assume WLOG that s y “ 0 (otherwise, consider y 1 i “ y
i ´ s y , which has mean 0 ).
In what follows, we shall omit the “conditional on M 1 ” notation (but continue to condition on M 1 ) and denote by Ω the collection of all `
NM˘ subsets of r N s of size
M 1 .
Now,
[Equation]
p M 1 ´ 1 q
N p N ´ 1 q ÿ 1 ď
i ă i 1 ď N x y i , y i
y “ M
N
M 1 ´
N ´››››› N ÿ i “y i ›››››
` M
N
N ´ M
N ´
N ÿ i “} y i }“ M
N
N ´ M
N ´
N ÿ i “} y i }ď Mˆ N ´ M
N ´˙ υ 2 .
Hence 1 M 21 E „
[Equation]
q
[Equation]
F
[Equation] ˇˇˇˇ M [Equation] ȷ ď N ´ M 1 N ´ 1 υ 2 M 1 .
Finally, we take expectation over the randomness in M 1 and use E r 1 { M 1 s “ 1 { M to arrive at the lemma.
Also, the result clearly holds when N “ 1 since the b ⃝ term is zero when there is no variance in silo sampling (which is the case when N “ 1 ).
Proof of Theorem E.1.
Privacy: By post-processing (Dwork & Roth, 2014, Proposition 2.1), it suffices to show that the R “ n { K noisy stochastic gradients computed in line 7 of Algorithm 1 are p ϵ 0 , δ 0 q -ISRL-DP.
Further, since the batches sampled locally are disjoint (because we sample locally without replacement ), parallel composition (McSherry, 2009) implies that if each update in line 7 is p ϵ 0 , δ 0 q -ISRL-DP, then the full algorithm is p ϵ 0 , δ 0 q -ISRL-DP.
Now recall that the Gaussian mechanism provides p ϵ 0 , δ
q -DP if σ 2 ě 8∆
ln
p 1 .
25 { δ 0 q ϵ, where ∆ 2 “ sup w,X i „ X 1 i } 1 K
[Equation]
is the L 2 sensitivity of the non-private gradient update in line 7 of Algorithm 1: this follows from (Bun & Steinke, 2016, Propositions 1.3 and 1.6) and our assumption ϵ 0 ď 8 ln p 1 { δ 0 q .
Therefore, conditional on the private transcript of all other silos, our choice of σ 2 implies that silo
i ’s transcript is p ϵ 0 , δ
q -DP for all i P r N s , which means that One-Pass Noisy Accelerated Distributed MB-SGD is p ϵ 0 , δ 0 q -ISRL-DP.
Excess loss: 1.
For the convex case, we choose λ “
V 2 D ?
R , where V 2 “ ϕ 2 MK ` υ 2 M 1 t N ą 1 u ´
N ´ M N ´¯ ` dσ 2 M is the variance of the noisy stochastic minibatch gradients, by Lemma E. for our noise with variance σ 2 “ 32 L 2 ln p 1 .
25 { δ 0 q K 2 ϵ. Now plugging V 2 into Lemma E.1, setting
R “ n { K , and λ : “
V 2 D ?
R yields
[Equation]
Choosing K “ ´
LβD
[Equation]
implies (30).
For strongly convex loss, we plug the same estimate for V 2 used above into Lemma E.2 with
R “ n { K to obtain
[Equation]
Choosing K “
[Equation]
[Equation]
F P ROOFS AND S UPPLEMENTARY M ATERIAL FOR S ECTIONF. P ROOF OF T HEOREM 4.
We begin by considering β -smooth f .
Theorem F.1 (Smooth ERM Upper Bound) .
Assume f p¨ , x q is β -smooth for all x .
Let ϵ 0 ď 2 ln p 2 { δ 0 q , δ 0 P p 0 , 1 q , choose K ě ϵ 0 n 4 ?
2 R ln p 2 { δ 0 q , and σ 2 “ 256 L 2 R ln p 2 .
5 R δ
q ln p 2 { δ 0 q n 2 ϵ.
Then Algorithm 1 is p ϵ 0 , δ 0 q -ISRL-DP.
Further:
If f λ p¨ , x q is convex, then running Algorithm 1 on the regularized objective r f p w, x q “ f p w, x q ` λ 2 } w ´ w 0 } 2 with R “ max
[Equation]
λ specified in the proof) yields
[Equation]
If f p¨ , x q is µ -strongly convex, then running the multi-stage implementation (Appendix E.1) of Algorithm 1 with R “ max
[Equation]
yields
[Equation]
To prove Theorem F.1, we will require the following lemma:
Lemma F.1 ((Lei et al., 2017)) .
Let t a l u l Pr Ă
N s be an arbitrary collection of vectors such that ř Ă Nl “ 1 a l “ 0 .
Further, let S be a uniformly random subset of r r N s of size Ă M .
Then,
[Equation]
ÿ l P S a l ››› ›› “ r N ´ Ă M p r N ´ 1 q Ă M r N Ă N ÿ l “} a l } 2 ď 1 t Ă M ă Ă N u Ă M r N Ă N ÿ l “} a l } 2 .
Proof of Theorem F.1.
Privacy: ISRL-DP of Algorithm 2 follows from ISRL-DP of the stochastic gradients t r g ir u
Rr “ 1 in line 7 of the algorithm (which was established in Theorem D.1) and the postprocessing property of DP (Dwork & Roth, 2014, Proposition 2.1).
Namely, since the choices of σ 2 , K given in Theorem F.1 ensure that silos’ local stochastic minibatch gradients are ISRL-DP and the iterates in Algorithm 1 are functions of these private noisy gradients (which do not involve additional data queries), it follows that the iterates themselves are ISRL-DP.
Excess risk: 1.
For λ “
V [Equation]
R , Lemma E.1 implies
[Equation]
) where V
[Equation]
X : “
[Equation]
defined in line 7 of Algorithm 1.
Now Lemma F.1 and L -Lipschitzness of f p¨ , x q implies that
[Equation]
conditional on M r .
Hence, taking total expectation with respect to M r and plugging this bound into (34) yields:
[Equation]
by our choice of σ 2 and independence of noises t u i u i P S r across silos.
Then one verifies that the prescribed choice of R yields (32).
Invoking Lemma E.2 with the same estimate for V 2 X obtained above gives
[Equation]
, and plugging in the prescribed R completes the proof.
We now re-state a precise form of Theorem 4.1 before providing its proof:
Theorem F.2 (Precise Re-statement of Theorem 4.1) .
Let ϵ 0 ď 2 ln p 2 { δ 0 q , δ 0 P p 0 , 1 q , choose σ
[Equation]
and K ě ϵ 0 n 4 ? 2 R ln p 2 { δ 0 q .
Then, Algorithm 1 is p ϵ 0 , δ 0 q -ISRLDP.
Further, there exist choices of β ą 0 such that for Algorithm 2 run on f β p w, x q : “ min v P W
[Equation]
¯ , we have:
If f p¨ , x q is convex, then setting R “ max
[Equation]
yields
[Equation]
If f p¨ , x q is µ -strongly convex and R “ r O ˆ
[Equation]
(in the multi-stage implementation in Appendix E.1), then
[Equation]
Proof.
We established ISRL-DP in Theorem F.1.
Excess risk: 1.
By Lemma D.7 and Theorem F.1, we have
[Equation]
if R “ max
[Equation]
Now choosing β : “ ϵ
[Equation]
ML
[Equation]
yields both the desired excess risk and communication complexity bound.
[Equation]
[Equation] ¯ , 1 t MK ă Nn u ϵ 20 n 2 Kd ln p 1 { δ 0 q ) .
Now choosing β : “ µMϵ 20 n 2 d yields both the desired excess risk and communication complexity bound.
Remark F.1.
The algorithm of (Girgis et al., 2021) requires R “ r Ω p ϵ 20 n 2 M { d
q communications, making Algorithm 1 faster by a factor of min p?
Mϵ 0 n {?
d, MK q .
If M “ N and full batches are used, the advantage of our algorithm over that of (Girgis et al., 2021) is even more significant.
F. L OWER BOUNDS FOR ISRL-DP F EDERATED ERM
Formally, define the algorithm class B p ϵ 0 ,δ 0 q ,C to consist of those (sequentially interactive or Ccompositional, ISRL-DP) algorithms
A P
A p ϵ 0 ,δ 0 q ,C such that for any X P X , f P F L,D , the expected empirical loss of the shuffled algorithm A s derived from A is upper bounded by the expected loss of A : E A ,
t π r u r p F p
A s p
X qq À
E
A p F p
A p X qq .
Here A s denotes the algorithm that applies the randomizer R p
i q r to X π r p i q for all i, r , but otherwise behaves exactly like A .
This is not a very constructive definition but we will describe examples of algorithms in B p ϵ 0 ,δ 0 q ,C .
B p ϵ 0 ,δ 0 q ,C includes all C -compositional or sequentially interactive ISRL-DP algorithms that are symmetric with respect to each of the N silos, meaning that the aggregation functions g r are symmetric (i.e. g r p Z 1 , ¨ ¨ ¨ , Z N q “ g r p
Z π p 1 q , ¨ ¨ ¨ Z π p N q q for all permutations π ) and in each round r the randomizers
R p i
q r “ R r are the same for all silos i P r N s .
( R p i q r can still change with r though.)
For example,
Algorithm 2 and Algorithm 1 are both in B p ϵ 0 ,δ 0 q : “ B p ϵ 0 ,δ 0 q , 1 .
This is because the aggregation functions used in each round are simple averages of the M “ N noisy gradients received from all silos (and they are compositional) and the randomizers used by every silo in round r are identical: each adds the same Gaussian noise to the stochastic gradients.
B also includes sequentially interactive algorithms that choose the order in which silos are processed uniformly at random.
This is because the distributions of the updates of A and A s are both averages over all permutations of r N s of the conditional (on π ) distributions of the randomizers applied to the π -permuted database.
If
A P B p ϵ 0 ,δ 0 q ,C is sequentially interactive or compositional, we write A P B .
We now state and prove our ERM lower bounds:
Theorem F.3.
Let ϵ 0 P p 0 , ?
N s , δ 0 “ o p 1 { nN q and A P B p ϵ 0 ,δ 0 q ,C
such that in every round r P r R s , the local randomizers R p i
q r p Z p 1: r ´ 1 q , ¨q : X n Ñ Z are p ϵ r 0 , δ r
q -DP for all
i P r N s , Z p 1: r ´ 1 q P
Z r ´ 1 ˆ N , with ϵ r 0 ď 1 n , δ r 0 “ o p 1 { nNR q , and N ě 16 ln p 2 { δ r 0 n q .
Then:
there exists a (linear, hence β -smooth @ β ě 0 ) loss function f P F L,D and a database X P X nN (for some X ) such that:
[Equation]
There exists a ( µ -smooth)
f P G µ,L,D and database X P X nN such that
[Equation]
Further, if A P B , then the above lower bounds hold with C “ 1 .
Proof.
Step 1 is identical to Step 1 of the proof of Theorem 2.2.
Step 2 is very similar to Step 2 in the proof of Theorem 2.2, but now we use Theorem F.4 (below) instead of Theorem D.6 to lower bound the excess empirical loss of A s .
Step 3: Finally, the definition of B implies that the excess risk of A is the same as that of A s , hence the lower bound also applies to A .
Theorem F.4.
(Bassily et al., 2014) Let µ, D, ϵ ą 0 , L ě µD , and δ “ o p 1 { nN q .
Consider
X : “ t ´ D ?
d , D ?
d u d Ă R d and W : “ B 2 p 0 , D q Ă R d
Let A : X nN Ñ W be any p ϵ, δ q -CDP algorithm.
Then:
There exists a ( µ “ 0 ) convex, linear ( β -smooth for any β ), L -Lipschitz loss f : W ˆ X Ñ R and a database X P X nN such that the expected empirical loss of A is lower bounded as
[Equation]
There exists a µ -strongly convex, µ -smooth, L -Lipschitz loss f : W ˆ X Ñ R and a database
X P X nN such that the expected empirical loss of A is lower bounded as
[Equation]
G P ROOFS AND S UPPLEMENTARY M ATERIALS FOR S ECTIONG. P ROOF OF T HEOREM 5.
Theorem G.1 (Precise version of Theorem 5.1) .
Let ϵ ď ln p 2 { δ q , δ P p 0 , 1 q , and M ě 16 ln p 18 RM 2 { Nδ q for (polynomial) R specified in the proof.
Then, there is a constant C ąsuch that setting σ
[Equation] [Equation]
ensures that the shuffled version of Algorithm 2 is p ϵ, δ q -CDP.
Moreover, there exist η r “ η and t γ r u R ´ 1 r “ 0 such that the shuffled version of
Algorithm 2 achieves the following upper bounds:
If f p¨ , x q is convex, then
[Equation]
If f p¨ , x q is µ -strongly convex, then
[Equation]
Proof.
We fix K “ 1 for simplicity, but note that K ą 1 can also be used (see Lemma 3 in (Girgis et al., 2021)).
We shall also assume WLOG that f p¨ , x q is β -smooth: the reduction to non-smooth f follows by Nesterov smoothing, as in the proofs of Theorems 2.1 and 4.1.
Our choices of R shall be: R : “ max ´ n 2 N 2 ϵ 2 M , NM , min !
n, ϵ 2 n 2 N 2 dM ) , βDL min ! ?
nM, ϵnN ?
d )¯ for convex f ; and
R : “ max ´ n 2 N 2 ϵ 2 M , NM , 8 βµ ln ´ βD 2 µϵ 2 n 2 NdL¯ , min !
n, ϵ 2 n 2 N 2 dM )¯ for strongly convex.
Privacy: Observe that in each round r , the model updates of the shuffled algorithm A rs can be viewed as post-processing of the composition M r p X q “ S M ˝ samp M,N p
Z p 1 q r , ¨ ¨ ¨ , Z p N q r q , where S M uniformly randomly shuffles the M received reports, samp M,N is the mechanism that chooses M reports uniformly at random from N , and Z p i q r “ samp 1 ,n p p R r p x i, 1 q , ¨ ¨ ¨ p R r p x i,n qq , where p R r p x q : “ ∇ f p w r , x q ` u and u „ N p 0 , σ 2 I d q .
Recall (Theorem A.1 in (Dwork & Roth, 2014))
that σ 2 “ 8 L 2 ln p 2 { x δ 0 q x ϵsuffices to ensure that p R r is p p ϵ 0 ,
p δ 0 q -DP if p ϵ 0 ď 1 .
Now note that M r p X q “ r R M p S M ˝ samp M,N p X 1 , ¨ ¨ ¨ X N q , where r R : X n Ñ Z is given by X ÞÑ samp 1 ,n p p R p x 1 q , ¨ ¨ ¨ , p R p x n qq and r
R M : X nM Ñ Z M is given by X ÞÑ p r R p X 1 q , ¨ ¨ ¨ r R p X M qq for any X “ p X 1 , ¨ ¨ ¨ , X M q P X nM .
This is because we are applying the same randomizer (same additive Gaussian noise) across silos and the operators S M and r R M commute.
(Also, applying a randomizer to all N silos and then randomly choosing M reports is equivalent to randomly choosing M silos and then applying the same randomizer to all M of these silos.)
Therefore, conditional on the random subsampling of M out of N silos (denoted p X 1 , ¨ ¨ ¨ , X M q for convenience), Theorem 3.8 in (Feldman et al., 2020b) implies that p p R p x π p 1 q , 1 q , ¨ ¨ ¨ , p R p x π p 1 q ,n q , ¨ ¨ ¨ , ¨ ¨ ¨ , p R p x π p M q , 1 q , ¨ ¨ ¨ , p R p x π p M q ,n qq is p p ϵ, p δ q -CDP, where p ϵ “ O
[Equation]
˙ and p δ “ 9 M p δ 0 , provided p ϵ 0 ď 1 and M ě 16 ln p 2 { p δ 0 q (which we will see is satisfied by our assumption on M ).
Next, privacy amplification by subsampling (see (Ullman, 2017) and Lemma 3 in (Girgis et al., 2021)) silos and local samples implies that M r is p ϵ r , δ r q -CDP, where ϵ r “ 2 p ϵMnN “ O [Equation] p [Equation]
[Equation]
˙ and δ r “ MnN p δ “ 9 M 2 nN p δ 0 .
Finally, by the advanced composition theorem (Theorem 3.20 in (Dwork & Roth, 2014)), to ensure A s is p ϵ, δ q -CDP, it suffices to make each round p
ϵ r : “ ϵ 2 ?
2 R ln p 1 { δ q , δ r : “ δ { 2 R q -CDP.
Using the two equations to solve for p ϵ 0 “
CnNϵ ?
R ln p 1 { δ q ln p RM { nNδ q M for some C ą 0 and p δ 0 “ nNδ 18 RM 2 , we see that
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table] [Equation] [Table] [Equation]
[Table]
[Equation]
¯ ensures that A s is p ϵ, δ q -CDP, i.e. that A is p ϵ, δ q -SDP.
Note that our choices of R in the theorem (specifically R ě N { M and R ě n 2 N 2 ϵ 2 M ) ensure that p δ 0 , δ ď 1 and p ϵ 0 À 1 , so that Theorem 3.8 in (Feldman et al., 2020b) indeed gives us the amplification by shuffling result used above.
Excess risk: Note that shuffling does not affect the uniform stability of the algorithm.
So we proceed similarly to the proof of Theorem 2.1, except σ 2 is now smaller.
Convex case: Set γ r “ γ “ 1 { R for all r .
Now Lemma D.2, Lemma D.1, and Lemma D.6 (with σ 2 in the lemma replaced by the σ 2 prescribed here) together imply for any η ď 1 { β that
[Equation]
Now plugging in η : “ min
[Equation]
** yields
[Equation]
Then one can verify that plugging in the prescribed R yields the stated excess population loss bound.
µ - strongly convex case
By Lemma D.6 (and its proof), we know there exists η ď 1 { β and t γ r u
Rr “ 1 such that
[Equation]
Hence Lemma D.1 and Lemma D.2 imply
[Equation]
Then one verifies that the prescribed R is large enough to achieve the stated excess population loss bound.
G. SDP O NE -P ASS A CCELERATED N OISY MB-SGD AND THE P ROOF OF T HEOREM 5.
To develop an SDP variation of One-Pass Accelerated Noisy MB-SGD, we will use the binomial noise-based protocol of (Cheu et al., 2021)
(described in Algorithm 4) instead of using the Gaussian mechanism and amplification by shuffling.
This is because for our one-pass algorithm, amplification by shuffling would result in an impractical restriction on ϵ .
Algorithm 4 invokes the SDP scalar summation subroutine Algorithm 5.
We recall the privacy and accuracy guarantees of Algorithm 4 below:
Lemma G.1 ((Cheu et al., 2021)) .
For any 0 ă ϵ ď 15 ,
ă δ ă 1 { 2 , d, N P N , and L ą 0 , there are choices of parameters b, g P N and p P p 0 , 1 { 2 q for P 1D (Algorithm 5) such that, for
X “ p x 1 , ¨ ¨ ¨ x N q containing vectors of maximum norm max i Pr N s } x i } ď L , the following holds: 1)
P vec is p ϵ, δ q -SDP; and 2) P vec p X q is an unbiased estimate of ř Ni “ 1 x i with bounded variance
[Equation]
With these building blocks in hand, we provide our SDP One-Pass Accelerated Noisy MB-SGD algorithm in Algorithm 6.
We now provide the general version of Theorem 5.2 for M ď N : et al
1: Input: database of d -dimensional vectors X “ p x 1 , ¨ ¨ ¨ , x N ); privacy parameters ϵ, δ ; L .
2: procedure: Local Randomizer R vec p x i q 3: for j P r d s do 4:
Shift component to enforce non-negativity: w i,j Ð x i,j ` L 5: m j Ð R 1 D p w i,j q 6: end for 7:
Output labeled messages tp j, m j qu j Pr d s 8: end procedure 9: procedure: Analyzer A vec p y q 10: for j P r d s do 11:
Run analyzer on coordinate j ’s messages
z j Ð A 1D p
y j q 12:
Re-center: o j Ð z j ´ L 13: end for 14:
Output the vector of estimates o “ p o 1 , ¨ ¨ ¨ o d q 15: end procedure
Algorithm
1: Input: Scalar database X “ p x 1 , ¨ ¨ ¨ x N q P r 0 , L s N ; g, b P N ; p P p 0 , 1 2 q .
2: procedure: Local Randomizer R 1 D p x i q 3: s x i Ð t x
i g { L u .
Sample rounding value η 1 „
Ber p
x
i g { L ´ s x i q .
Set ˆ x i
Ð s x i ` η 1 .
Sample privacy noise value η 2 „ Bin p b, p q .
Report y i P t 0 , 1 u g ` b containing ˆ x i ` η 2 copies of 1 and g ` b ´ p ˆ x i ` η 2 q copies of 0 .
8: end procedure 9: procedure: Analyzer A 1D p S p y qq 10:
Output estimator Lg
pp ř Ni “ 1 ř b ` g j “ 1 p y i q j q ´ pbn q .
11: end procedure
1: Input: Data X i P X ni , i P r N s , strong convexity modulus µ ě 0 , privacy parameters p ϵ, δ q , iteration number R P N , batch size K P r n s , step size parameters t
η r u r Pr R s , t α r u r Pr R s .
2: Initialize w ag 0 “ w 0 P W and r “ 1 .
3: for r P r R s do 4:
Server updates and broadcasts w mdr “ p
[Table]
5: for i P S r in parallel do 6:
Silo i draws t x ri,j u Kj “ 1 from X
i (without replacement) and computes Z ri : “ t ∇ f p w mdr , x ri,j qu Kj “ 1 .
7: end for 8:
Server receives r g r : “ 1 M r K P vec pt Z ri u i P S r ; ϵ, δ ; L q .
Server computes w r : “ argmin w P W ␣ α r “ x r g r , w y ` µ 2 } w mdr ´ w } [Table] ‰ ` “ p 1 ´ α r q µ 2 ` η r‰ } w r ´ 1 ´ w }( .
Server updates and broadcasts w agr “ α r w r ` p 1 ´ α r q w agr ´ 1 .
11: end for 12: Output: w agR .
Theorem G.2 (Complete version of Theorem 5.2) .
Let f p¨ , x q be β -smooth @
x P X .
Assume ϵ ď 15 , δ P p 0 , 12 q .
Then, Algorithm 6 is p ϵ, δ q -SDP.
Moreover, there are choices of stepsize, batch size, and λ ą 0 such that (for υ defined in (29) ): 1.
Running Algorithm 6 on r f p w, x q : “ f p w, x q ` λ 2 } w ´ w 0 } 2 (where w 0 P W ) yields E F p [Equation] agR
[Equation]
If f p¨ , x q is µ -strongly convex @
x P X and κ “ βµ , then running the Multi-Stage Implementation of Algorithm 6 (recall Appendix E.1) directly on f yields
[Equation]
Remark G.1.
For convex f , if M “ N or υ À
[Equation]
then (39) recovers the bound (10) in Theorem 3.1 ( M “ N version), with N replaced by M .
For µ -strongly convex f , if M “ N or
[Equation]
then (40) recovers the bound (11) in Theorem 3.1, with N replaced by M .
Also, note that appealing to privacy amplification by subsampling would result in tighter excess risk bounds than those stated in Theorem G.2 when M ă N , but would require a restriction ϵ À M { N .
To avoid this restriction, we do not invoke privacy amplification by subsampling in our analysis.
Proof of Theorem G.2.
Privacy: By post-processing (Dwork & Roth, 2014, Proposition 2.1), it suffices to show that the R “ n { K noisy stochastic gradients computed in line 8 of Algorithmare p ϵ, δ q -SDP.
Further, since the batches sampled locally are disjoint (because we sample locally without replacement ), parallel composition (McSherry, 2009) implies that if each update in lineis p ϵ, δ q -SDP, then the full algorithm is p ϵ, δ q -SDP.
Since f p¨ , x q is L -Lipschitz, it follows directly from Lemma G.1 that each update in line 8 is p ϵ, δ q -SDP.
Excess loss: 1.
For the convex case, we choose λ “
V 2 D ?
R , where V 2 “ ϕ 2 MK ` υ 2 M 1 t N ą 1 u ´
N ´ M N ´¯ ` Var p r g r q is the conditional variance of the noisy stochastic minibatch gradients given M r , by Lemma E.3.
Also, conditional on M r , we have Var p r g r q À dL 2 ln 2 p
d
δ q ϵ 2 M 2 r K by Lemma G.1 and independence of the data.
Hence, taking total expectation over M r , we get
V 2 “ ϕ
[Equation]
MK `
[Equation]
2 M 1 t N ą 1 u ´
N
[Equation]
M N
[Equation]
¯
[Equation]
dL
[Equation]
ln
[Equation]
p d {
[Equation]
2 M 2 K 2 .
Now plugging V 2 into Lemma E.1, setting
R “ n { K , and λ : “
V 2 D ?
R yields
[Equation]
Choosing K “ ´
[Equation]
[Equation]
{implies (39).
For strongly convex loss, we plug the same estimate for V 2 used above into Lemma E.2 with
R “ n { K to obtain
[Equation]
where ∆ ě F p w 0 q ´ F ˚ .
Choosing K “
[Equation]
yields (40).
H ISRL-DP U PPER B OUNDS WITH U NBALANCED D ATA S ET S IZES AND D IFFERING P RIVACY N EEDS A CROSS SILOS
In order to state the generalized versions of our upper bounds (for arbitrary n i , ϵ i , δ i , i P r N s ), we will require some additional notation and assumptions.
H. A DDITIONAL N OTATION AND A SSUMPTIONS
First, we define a generalization of p ϵ 0 , δ
q -ISRL-DP (as it was formally defined in Appendix B) that allows for differing privacy parameters across silos:
Definition 10.
(Generalized Inter-Silo Record-Level Differential Privacy) Let ρ i
p X i , X 1 i q : “ ř n i j “ 1 1 t x i,j ‰ x 1 i,j u , i P r N s .
A randomized algorithm A is tp ϵ i , δ i qu Ni “ 1 -ISRL-DP if for all silos i and all ρ i -adjacent
X i , X 1 i ,
[Equation]
where Z r : “ t R p i q r p Z 1: r ´ 1 , X
i qu Ni “ 1 and Z 1 r : “ t R p i q r p Z 1 1: r ´ 1 , X
i qu Ni “ 1 .
We also allow for the weights put on each silo in the FL objective to differ and consider:
[Equation]
where p i P r 0 , 1 s and ř Ni “ 1 p i “ 1 .
However, we will present our results for the case where p i “ 1 N for all i P r N s .
This is without loss of generality: given any r F p w q “ ř Ni “ 1 p
i F i p w q , we have r
F p w q “ ř Ni “ 1 p
i F i p w q “ 1 N ř Ni “ 1 r F i p w q , where r F i p w q “ Np i F i p w q “ E x i „ D i r
Np i
f p w, x i qs : “
E x i „ D i r r f i p w, x i qs .
Thus, our results for the case of p i “ 1 { N apply for general p i , but L gets replaced with r L “ max i Pr N s p i NL , µ gets replaced with r µ “ min i Pr N s p i Nµ , and β gets replaced with r β “ max i Pr N s p i Nβ.
We will choose batch sizes K i such that K i { n i “ K l { n l for all i, l P r N s in each round, and denote
K “ min i Pr N s K i .
In addition to the assumptions we made in the main body, we also refine the assumption on t M r u to include a description of the second moment of 1 { M r :
Assumption 2.
In each round r , a uniformly random subset S r of M r P r N s distinct silos is available to communicate with the server, where t M r u r ě 0 are independent random variables with 1 M : “ E p 1 M r q and 1 M 1 : “
[Equation]
For M P r N s , denote
[Equation]
where σ 2 p 1 q : “ σ 2max : “ max i Pr N s σ 2 i ě σ 2 p 2 q ě ¨ ¨ ¨ ě σ 2 p N q : “ σ 2min : “ min i Pr N s σ 2 i , .
(More generally, whenever a bar and M subscript are appended to a parameter, it denotes the average of the
M largest values.)
Also, define
[Equation]
for any t σ 2 i u Ni “ 1 Ď r 0 , 8q .
Next, recall the heterogeneity parameter from (29):
[Equation]
Lastly, for given parameters, denote
[Equation]
for i P r N s , ξ max “ max p ξ 1 , ¨ ¨ ¨ ξ N q , and
[Equation]
: “ gffe
[Equation]
In the case of balanced data and same parameters across silos, we have ξ i “ ξ “ Ξ for all i .
In the general case, we have ξ min ď Ξ ď ξ max .
H.
P SEUDOCODE FOR N OISY ISRL-DP MB-SGD IN THE U NBALANCED C ASE
The generalized version of Noisy ISRL-DP MB-SGD is described in Algorithm 7.
Algorithm
1: Input: N, d, R P N , t σ i u i Pr N s Ă r 0 , 8q , X i P X n i
i for i P r N s , loss function f p w, x q , t K i u
Ni “ 1 Ă N , t η r u r Pr R s and t γ r u r Pr R s . 2: Initialize w 0 P W . 3: for r P t 0 , 1 ,
, R ´ 1 u do 4: for i P S parallel do 5: Server sends global model w r to silo i . Silo i draws K i samples x ri,j uniformly from X i (for j P r K i s ) and noise u i „ N p 0 , σ 2 i I d q .
Silo i computes r g ir : “ 1 K i ř K i j “ 1 ∇ f p w r , x ri,j q ` u i and sends to server.
8: end for 9:
Server aggregates r g r : “ 1 M r ř i P S r r g ir .
Server updates w r ` 1 : “ Π W r w r ´ η r r g r s .
11: end for 12: Output: p w R “ 1Γ R ř R ´ 1 r “ 0 γ r w r , where Γ R : “ ř R ´ 1 r “ 0 γ r .
H. G ENERAL U NBALANCED V ERSION OF T HEOREM 2.
We first state the formal version of Theorem 2.1 for arbitrary n i , ϵ i , δ i , using the notation defined in Appendix H.1.
Theorem H.1 (Generalized Version of Theorem 2.1) .
Let ϵ i ď 2 ln p 2 { δ i q , δ i P p 0 , 1 q .
Then, Algorithm 2 is tp ϵ i , δ i qu Ni “
[Equation]
[Equation]
and
[Equation]
, with notation as in Appendix H.
[Equation]
there are choices of algorithmic parameters such that:
If f p¨ , x q is convex, then
[Equation]
If f p¨ , x q is µ -strongly convex, then
[Equation]
Remark H.1.
Note that 1 { M 1 ě 1 { M by the Cauchy-Schwartz inequality.
Both of the upper bounds in Theorem H.1 involve minima of the terms Ξ { M 1 and ξ max { M, which trade off the unbalancedness of silo data and privacy needs with the variance of 1 { M r .
In particular, if the variance of 1 { M r is small enough that Ξ M 1 ď ξ max M , then the excess risk bounds in Theorem H.1 depend on averages of the parameters across silos, rather than maximums.
In FL problems with unbalanced data and disparate privacy needs across a large number of silos, the difference between “average” and “max” can be substantial.
On the other hand, if data is balanced and privacy needs are the same across silos, then ξ
[Equation]
for all i and Ξ
[Equation]
so we recover Theorem 2.1, with dependence only on the mean 1 { M of 1 { M r and not the square root of the second moment 1 { M 1 .
To prove Theorem H.1, we need the following empirical loss bound for Algorithm 2, which generalizes Lemma D.6 to the unbalanced setting:
Lemma H.1.
Let f : W ˆ
X
Ñ
R be µ -strongly convex (with µ “ 0 for convex case), L -Lipschitz, and β -smooth in w for all x P X , where W is a closed convex set in R d s.t. } w ´ w 1 } ď D for all w, w 1 P W .
Let X P X .
Then Algorithm 2 with σ 2 i “ 256 L 2 R ln p 2 .
5 R δi q ln
p
{ δ i q ni
ϵ 2 i attains the following empirical loss bounds as a function of step size and the number of rounds: 1.
(Convex)
For any η ď 1 { β and R P N , γ r : “ 1 { R , we have
[Equation]
(Strongly Convex)
There exists a constant stepsize η r “ η ď 1 { β such that if R ě 2 κ ln ˆ
[Equation]
Proof.
By the proof of Lemma D.6, we have:
[Equation]
which implies
[Equation]
since E r} s u r } 2 | M r s “ 1 M 2 r ř i P S
r
and hence
[Equation]
using linearity of expectation for the first term in the minimum and Cauchy-Schwartz inequality for the second term in the minimum.
Now we consider the convex ( µ “ 0 ) and strongly convex ( µ ą 0 ) cases separately.
Convex ( µ “ 0 ) case: Re-arranging (43), we get
[Equation]
Then for η r “ η , the average iterate s w R satisfies:
[Equation]
which proves part 1 of the lemma.
Strongly convex ( µ ą 0 ) case: Note that (43) satisfies the conditions for Lemma D.5, with sequences
[Equation]
s and parameters
[Equation]
Then Lemma D.5 and Jensen’s inequality imply
[Equation]
where κ “ β { µ .
Finally, plugging in R completes the proof.
We are prepared to prove Theorem H.1.
Proof of Theorem H.1.
Privacy: The proof follows exactly as in the balanced case, since σ 2 i is now calibrated to p
ϵ
i , δ i q for all i P r N s .
Excess loss: We shall prove the results for the case when f p¨ , x q is β -smooth.
The non-smooth case follows by Nesterov smoothing, as in the proof of Theorem 2.1.
Convex case: By Lemma D.2 (and its proof), Lemma D.1, and Lemma H.1, we have:
[Equation]
for any η ď 1 β .
Choosing η “ min ˆ [Equation] { β, DL ?
R min
[Equation]
min M ?
R , 1 , c 1 dR max !
M 1 Ξ , Mξ max )˙˙ yields
[Equation]
˜
[Equation]
n min [Equation]
[Equation] d d min "
[Equation]
M 1 , ξ max
M *¸ .
Choosing R ě βDL min ˆ ?
[Equation]
c
[Equation]
[Equation]
[Equation]
)¯ completes the proof of the convex case.
µ -strongly convex case: By Lemma D.2 (and its proof), Lemma D.1, and Lemma H.1, we have:
[Equation]
O
[Equation]
" Ξ
M 1 , ξ max
M *˙˙ for the η ď 1 { β prescribed in the proof of Lemma H.1 and any R ě 2 κ ln ˆ βµD
L 2 d min p Ξ { M 1 , ξ max M q ˙ .
Thus, choosing R “ 2 κ ln ˆ [Equation]
˙ ` Mn min completes the proof.
Remark H.2.
Generalized versions of the other upper bounds in this paper can also be easily derived with the techniques used above.
The key takeaways are: a) the excess empirical risk (and the private term in the SCO bounds) involve a minimum of two terms that trade off the degree of unbalancedness with the variance of 1 { M r .
In particular, if the variance of 1 { M r is sufficiently small (e.g. if M r “ M , which is what most existing works on FL assume), then the refined excess risk bounds depend on averages of the parameters across silos, rather than worst-case maximums.
b) the generalization error scales with min
i Pr N s n i .
I N UMERICAL E XPERIMENTS : D ETAILS AND A DDITIONAL R ESULTS
In some plots in this section, we include a parameter describing the heterogeneity of the FL problem:
[Equation]
which has appeared in (Khaled et al., 2019;
Koloskova et al., 2020; Karimireddy et al., 2020;
Woodworth et al., 2020b).
If the data is homogeneous, then all F i share the same minimizers, so υ 2 ˚ “ 0 , but the converse is false.
ISRL-DP Local SGD runs as follows: in round r , each silo i P S r receives the global model w r and takes K steps of noisy SGD (with one sample per step) with their local data: w i, 0 r “ w r , w i,tr “ w i,t ´ 1 r ´ η p ∇
f p w i,t ´ 1 r , x ri,t q ` u ti q for t P r K s , where x ri,t is drawn uniformly at random from X i and u ti „ N p 0 , σ 2 I d q for σ 2 “ 8 L 2 RK log p 1 { δ q ϵ 20 n.
Then silo i sends its K -th iterate, w i,Kr to the server; the server averages the iterates across all silos and updates the global model to w r ` 1 “ 1 M r ř i P S
r w i,Kr .
I.
L OGISTIC R EGRESSION WITH MNIST
The data set can be downloaded from http://yann.lecun.com/exdb/mnist .
Our code does this for you automatically.
Experimental setup: To divide the data into N “ 25 silos and for preprocessing, we borrow code from (Woodworth et al., 2020b), which can be downloaded from: https://papers.nips.cc/paper/2020/hash/45713f6ff2041d3fdfae927b82488db8-Abstract.
html .
It is available under a Creative Commons Attribution-Share Alike 3.0 license.
There are n i “ n “ 8673 training and 2168 test examples per silo; to expedite training, we use only 1 { of the MNIST samples ( n “ 1238 training examples per silo).
We fix δ i “ δ “ 1 { n 2 and test ϵ P t 0 .
75 , 1 . 5 , 3 , 6 , 12 , 18 u .
The maximum υ 2 ˚ is about 0 .
17 for this problem (corresponding to each silo having disjoint local data sets/pairs of digits).
Preprocessing: We used PCA to reduce the dimensionality to d “ 50 .
We used an 80 { 20 train/test split for all silos.
To improve numerical stability, we clipped the input x w, x y (i.e. projected it onto r´ 15 , 15 s ) before feeding into logistic loss.
Hyperparameter tuning:
For each algorithm and each setting of ϵ, R, K, υ 2 ˚ , we swept through a range of constant stepsizes and ran 3 trials to find the (approximately) optimal stepsize for that particular algorithm and experiment.
We then used the corresponding w R (averaged over the 3 runs) to compute test error.
For (ISRL-DP) MB-SGD, the stepsize grid consisted of 10 evenly spaced points between e ´ 6 and 1 .
For (ISRL-DP) Local SGD, the stepsizes were between e ´ 8 and e ´ 1 .
We repeated this entire process 20 times for fresh train/test splits of the data and reported the average test error in our plots.
Choice of σ 2 and K : We used smaller noise (compared to the theoretical portion of the paper) to get better utility (at the cost of larger K /larger computational cost, which is needed for privacy): σ 2 “ 8 L 2 ln p 1 { [Equation] R n 2 ϵ, which provides ISRL-DP by Theorem 1 of (Abadi et al., 2016) if K “ n ?
ϵ 2 ?
R (c.f.
Theorem 3.1 in (Bassily et al., 2019)).
Here L “ 2 max x P X } x } is an upper bound on the Lipschitz parameter of the logistic loss and was computed directly from the training data.
To estimate υ 2 ˚ , we followed the procedure used in (Woodworth et al., 2020b), using Newton’s method to compute w ˚ and then averaging } ∇ p F i p w ˚ q} 2 over all i P r N s .
Additional experimental result :
In Fig.
7, we show an additional experiment with M “available to communicate in each round.
The results are qualitatively similar to the results presented in the main body for MNIST with M “ 25 , 12 .
Limitations of Experiments: It is important to note that pre-processing and hyperparameter tuning (and estimation of L ) were not done in a ISRL-DP manner, since we did not want to detract focus from evaluation of ISRL-DP FL algorithms.
As a consequence, the overall privacy loss for the entire experimental process is higher than the ϵ indicated in the plots, which solely reflects the privacy loss from running the FL algorithms with fixed hyperparameters and (pre-processed) data.
Similar remarks apply for the linear regression experiments (see Appendix I.2).
I. L INEAR R EGRESSION WITH H EALTH I NSURANCE D ATA
Data set: The data ( https://www.kaggle.com/mirichoi0218/insurance ), which is available under an Open Database license, consists of r N “ 1338 observations.
The target variable y is medical charges.
There are d ´ 1 “ 6 features: age, sex, BMI, number of children, smoker, and geographic region.
Experimental setup: For a given N, we grouped data into N (almost balanced) silos by sorting y in ascending order and then dividing into N groups, the first N ´ 1 of size r 1338 { N s and the remaining points in the last silo.
For each N, we ran experiments with R “ 35 .
We ran 20 trials, each with a fresh random train/test ( 80 { 20 ) split.
We tested ϵ P t .
5 , 1 , 2 , 3 u and fixed δ i “ 1 { n 2 i for all experiments.
To estimate υ 2 ˚ , we followed the procedure used in (Woodworth et al., 2020b), using Newton’s method to compute w ˚ and then averaging } ∇ p F i p w ˚ q} 2 over all i P r N s .
Preprocessing: We first numerically encoded the categorical variables and then standardized the numerical features age and BMI to have zero mean and unit variance.
Gradient clipping:
In the absence of a reasonable a priori bound on the Lipschitz parameter of the squared loss (as is typical for unconstrained linear regression problems with potentially unbounded data), we incorporated gradient clipping (Abadi et al., 2016) into the algorithms.
We then calibrated the noise to the clip threshold L to ensure LDP.
For fairness of comparison, we also allowed for clipping for the non-private algorithms (if it helped their performance).
Hyperparameter tuning: For each trial and each algorithm, we swept through a log-scale grid of 10 stepsizes and 5 clip thresholds 3 times, selected the parameter w that minimized average (overrepetitions) training error (among all 10 ˆ 5 “ 50 ), and computed the corresponding average test error.
The stepsize grids we used ranged from e ´ 8 and e 1 for (ISRL-DP) MB-SGD and from e ´ 10 to 1 for (ISRL-DP) Local SGD.
The excess risk (train and test) we computed was for the normalized objective function F p w, X, Y q “ } Y ´ wX } 2 { 2 N 0 where N 0 P t 1070 , 268 u ( 1070 for train,for test) and X is N
0 ˆ d with d “ 7 (including a column of all 1 s) and Y P R N 0 .
The clip threshold grids were t 100 , 10 4 , 10 6 , 10 8 , 10 32 u , with the last element corresponding to effectively no clipping.
Choice of σ 2 and K : We used the same σ 2 and K “ n ?
ϵ 2 ?
R as in the logistic regression experiments described in Appendix I.1.
However, here L is the clip threshold instead of the Lipschitz parameter.
Relative Root Mean Square Error (RMSE):
We scale our reported errors (in the plots) to make them more interpretable.
We define the Relative (test) RMSE of an algorithm to be
[Equation]
q 2 , where NMSE (“Naiive Mean Square Error”) is the (test) MSE incurred by the non-private naiive predictor that predicts y i to be s y train , the average of the training labels, for all test data i P r N test s .
Here ˆ y i is the predicted label of the algorithm.
Relative RMSE can be thought of as the Coefficient of Variation or Relative Standard Deviation of the predictions of the algorithm.
Note that even though the naiive predictor is completely non-private and allowed to access the entire training data even when M ă N (violating the decentralized data principle of FL), the ISRL-DP FL algorithms still outperform this predictor for most values of ϵ (except for some experiments when ϵ « 0 ), as evidenced by values of Relative RMSE being below 1 .
For ϵ « 1 , ISRL-DP MB-SGD tends to outperform the naiive predictor by 30 ´ 40% .
Additional experimental results: In Fig.
8 and Fig.
9, we present results for experiments with additional settings of N and M .
We observe qualitatively similar behavior as in the plots presented in the main body of the paper.
In particular, ISRL-DP MB-SGD continues to outperform ISRL-DP
Local SGD in most tested setups/privacy levels (especially the high-privacy regime).
On the other hand, for some settings of M, N, K , we observe that ISRL-DP Local SGD outperforms ISRL-DP
MB-SGD as ϵ Ñ 3 (e.g. Fig.
9, and N “ M “ 3 ).
In general, we see that the utility impact of
ISRL-DP is relatively insignificant for this problem when ϵ « 3 .
I. S OFTMAX R EGRESSION WITH O BESITY D ATASET
The data set can be freely downloaded from https://archive.ics.uci.edu/ml/ datasets/Estimation+of+obesity+levels+based+on+eating+habits+and+ physical+condition+ .
The data contains 17 attributes (such as age, gender, physical activity, eating habits, etc.) and 2111 records.
Experimental setup: We divide the data into N “ 7 heterogeneous silos based on the value of the target variable, obesity level, which is categorical and takes 7 values: Insufficient Weight, Normal
Weight, Overweight Level I, Overweight Level II, Obesity Type I, Obesity Type II and Obesity Type
III.
We fix δ i “ δ “ 1 { n 2 and test ϵ P t 0 .
5 , 1 , 3 , 6 , 9 u .
We ran three trials with a new train/test split in each trial and reported the average test error.
Preprocessing: We numerically encode the categorical variables and standardize the continuous numerical features to have mean zero and unit variance.
We used an 80 { 20 train/test split.
We discarded a small number of (randomly selected) training samples from some silos in order to obtain balanced silo sets, to ease implementation of the noisy methods.
Hyperparameter tuning:
For each algorithm and each setting of ϵ, R, K , we swept through a range of constant stepsizes to find the (approximately) optimal stepsize for that particular algorithm and experiment.
We then used the corresponding w R to compute test error for that trial.
For (ISRL-DP)
MB-SGD, the stepsize grid consisted of 8 evenly spaced points between e ´ 7 and e ´ 1 For (ISRL-DP)
[Figure]
[Figure]
Local SGD, we started with the same stepsize grid, but sometimes required additional tuning with smaller stepsizes (especially for small ϵ ) to find the optimal one.
Choice of σ 2 and K : We used smaller noise (compared to the theoretical portion of the paper) to get better utility (at the cost of larger K /larger computational cost, which is needed for privacy): σ [Equation] [Equation] L
[Equation]
ln
[Equation]
[Equation] R n [Equation] for ISRL-DP MB-SGD, which provides ISRL-DP by Theorem 1 of (Abadi et al., 2016) if K “ n ?
ϵ 2 ?
R (c.f. Theorem 3.1 in (Bassily et al., 2019)).
For ISRL-DP Local SGD, one needs σ
[Equation]
ln
[Equation]
since the sensitivity and number of gradient evaluations are both larger by a factor of K .
Here L “ 2 max x P X } x } “ 20 is an upper bound on the Lipschitz parameter of the softmax loss and was estimated directly from the pre-processed training data.
J L IMITATIONS AND S OCIETAL I MPACTS J. L IMITATIONS
Our results rely on certain assumptions (e.g convex, Lipschitz loss), which may be violated in certain practical applications.
Moreover, our theoretical results require an a priori bound on the Lipschitz parameter (for noise calibration).
While such a bound is fairly easy to obtain for models such as logistic regression with data that is (known to be) bounded (e.g. our MNIST experiments), it is unrealistic for models such as unconstrained linear regression with potentially unbounded data (e.g. our medical cost data experiments).
In practice, in such situations, gradient clipping can be incorporated into our algorithms; we have shown empirically (medical cost data experiments)
that
MB-SGD still performs well with clipping.
However, we did not obtain our theoretical results with gradient clipping.
An interesting direction for future work would be to determine optimal rates for
ISRL-DP FL without Lipschitzness and/or without convexity.
Further, as we explained in Appendix I, pre-processing and hyperparameter tuning (and estimation of L ) were not done in a ISRL-DP manner in our numerical experiments, since we did not want to detract focus from evaluation of ISRL-DP FL algorithms.
As a consequence, the overall privacy loss for the entire experimental process is higher than the ϵ indicated in the plots, which solely reflects the privacy loss from running the FL algorithms with fixed hyperparameters and (pre-processed) data.
J. S OCIETAL I MPACTS
Our work provides algorithms for protecting the privacy of users during federated learning.
Privacy is usually thought of favorably: for example, the right to privacy is an element of various legal systems.
However, it is conceivable that our algorithms could be misused by corporations and governments to justify malicious practices, such as collecting personal data without users’ permission.
Also, the (necessarily) lower accuracy from privately trained models could have negative consequences: e.g. if a ISRL-DP model is used to predict the effects of climate change and the model gives less accurate and more optimistic results, then a government might use this as justification to improperly eliminate environmental protections.
Nevertheless, we believe the dissemination of privacy-preserving machine learning algorithms and greater knowledge about these algorithms provides a net benefit to society.