Federated Model Decomposition with Private Vocabulary for Text Classification (2022)

Abstract: With the necessity of privacy protection, it becomes increasingly vital to train deep neural models in a federated learning manner for natural language processing (NLP) tasks. However, recent studies show eavesdroppers (i.e., dishonest servers) can still reconstruct the private input in federated learning (FL). Such a data reconstruction attack relies on the mappings between vocabulary and associated word embedding in NLP tasks, which are unfortunately less studied in current FL methods. In this paper, we propose a fedrated model decomposition method that protects the privacy of vocabularies, shorted as FEDEVOCAB. In FEDEVOCAB, each participant keeps the local embedding layer in the local device and detaches the local embedding parameters from federated aggregation. However, it is challenging to train an accurate NLP model when the private mappings are unknown and vary across participants in a cross-device FL setting. To address this problem, we further propose an adaptive updating technique to improve the performance of local models. Experimental results show that FEDEVOCAB maintains competitive performance and provides better privacy-preserving capacity compared to status quo methods.

## introduction privacy-sensitive natural language processing (nlp) applications, such as personal virtual assistants @xcite , online medical diagnosis @xcite and mobile keyboards @xcite , often have sensitive user data stored in local devices to protect user privacy. to ensure service quality, they also need a large amount of such data for training the corresponding machine learning models. however, it would breach user privacy or data protection law, e.g., gdpr, to apply conventional training methods by putting sensitive data in a centralized place. the doctor records the user's health conditions, demographic information and contact details. the sensitive information of the user is made bold. the sensitive information can either be constructed from model updates and private mappings by e.g. data reconstruction attack, or be inferred from the local vocabulary when the local data is small. to resolve the dilemma, federated learning (fl) methods are proposed to collaboratively learn a global model in a distributed manner without requiring sensitive data to leave local devices @xcite . in the fl framework, each local device downloads the current model, updates the model using local data, and subsequently sends model updates to a central server for improving the current model. the process is repeated until certain criteria are met. due to improved privacy protection, there is a fast-growing interest in applying fl to nlp applications @xcite @xcite . however, recent studies show that it is still possible to reconstruct user data from model updates sent to servers @xcite . such attack methods, e.g. deep leakage from gradient (dlg) @xcite , need to know the mappings between words and their embeddings. eavesdroppers may be able to infer sensitive information by knowing which words are used in local devices, as shown in figure 1 . hence, privacy-preserving models should protect the mappings between sensitive words and their embeddings. however, it is challenging to train nlp models using current fl methods if such mappings are unknown and vary across devices. despite potential privacy risks, prior works largely neglect the importance of protecting private vocabularies and the associated word embedding layers in local devices in the fl framework. to address the above problems, we propose a fedrated model decomposition algorithm that protects private vocabularies, coined fedevocab, which keeps the word embedding layer (i.e., local parameters) of a deep neural network in local devices and only collaboratively updates the remaining components of the model (i.e., global parameters). because the word embedding layer does not participate in federated aggregations and a user device may not be always-available in each federated training round in cross-device fl settings @xcite , the local parameters may be poorly coupled with those global parameters, resulting in performance degeneration @xcite . to alleviate this issue, we introduce an adaptive updating procedure into fedevocab, which learns effective local parameters for resolving the performance drops. to sum up, our contributions are two-fold: compared with the stateof-the-art fl method, our method can reduce token-wise recovery by 80.1% on average, improve local model performance by about 1.3% on average, and reduce communication cost by 83 times at most. a line of work has introduced differential privacy (dp) @xcite or homomorphic encryption @xcite into the federated training pipeline to ensure user privacy. fl with dp is a general technique to protect user data by injecting controlled noise to shared gradients @xcite . nevertheless, it falls into the dilemma of low utility @xcite , and is still uncertain how much privacy can be preserved in real-world applications @xcite . fl with encryption method is another way to secure federated learning @xcite . it is several orders of magnitude slower than the unencrypted equivalent, which is impractical for deep learning. recently, @xcite proposed texthide based on instance-encoding to preserve the model's utility, which shows promising results against gradients matching attack. however, @xcite have experimentally shown that texthide cannot provide rigorous privacy guarantee. orthogonal to previous work, our work proposes a novel method to ensure user data by protecting word embedding layers and the associated private vocabularies in local devices. partially local federated learning. our work is also related to recent partially local federated learning. liang et al. (2020) propose lg-fedavg, which jointly learns compact local representations on each device and a global model across devices. although lg-fedavg is very similar to our method, the differences are as follows: 1) lg-fedavg is tested on a few users and small data sets foot_0 , and does not use pre-trained models (such as glove @xcite or distilbert @xcite ); 2) lg-fedavg assumes users are stateful or always-available, which is not undesirable at scale in cross-device settings @xcite ; 3) lg-fedavg partitions local and global parameters unstructuredly, which may lead to performance degradation. @xcite present the state-of-the-art partially local fl method called fedrecon, which trains sensitive user-specific parameters locally and other parameters globally. fe-drecon only protects mappings between sparsely sensitive words and embeddings, yet it performs poorly against data reconstruction attacks and incurs large communication overhead compared with fedevocab. distinguished from previous studies, our work conceals all mappings between vocabulary and word embedding in the stateless federated training process, and handles the trade-off between the model's utility and privacy protection. ## experiments in this section, we demonstrate how our method 1) effectively defends against data reconstruction attacks by protecting private mappings between vocabularies and word embeddings, 2) preserves the model's utility with achieving competitive performance, 3) efficiently reduces communicated parameters by keeping embedding layer in local devices. in addition, we also show adaptive updating plays a critical role in challenging yet practical crossdevice fl setting. ## conclusion we have presented fedevocab, a practical training method for privacy-preserving nlp models. fedevocab protects the private mappings between local vocabulary and the associated embedding layer by detaching the embedding layer from federated aggregation. in this manner, fedevo-cab allows users to personalize their vocabularies and word embedding layers. to tackle the dilemma in cross-device fl, we propose an adaptive updating to minimize performance drops. the privacy and utility experiments show fedevocab pro-vides significantly better privacy protection than the baselines while maintaining the utility of models. moreover, fedevocab also significantly reduces communication costs than the sota fl methods.