Private Federated Learning Without a Trusted Server: Optimal Algorithms for Convex Losses

TL;DR

Tight upper and lower bounds are provided for ISRL-DP federated empirical risk minimization with convex/strongly convex loss functions and homogeneous silo data distributions, and similar bounds are attainable for smooth losses with arbitrary heterogeneous silo data distributions, via an accelerated ISRL-DP algorithm.

Abstract

This paper studies federated learning (FL)--especially cross-silo FL--with data from people who do not trust the server or other silos. In this setting, each silo (e.g. hospital) has data from different people (e.g. patients) and must maintain the privacy of each person's data (e.g. medical record), even if the server or other silos act as adversarial eavesdroppers. This requirement motivates the study of Inter-Silo Record-Level Differential Privacy (ISRL-DP), which requires silos' communications to satisfy record/item-level differential privacy (DP). ISRL-DP ensures that the data of each person (e.g. patient) in silo i (e.g. hospital i) cannot be leaked. ISRL-DP is different from well-studied privacy notions. Central and user-level DP assume that people trust the server/other silos. On the other end of the spectrum, local DP assumes that people do not trust anyone at all (even their own silo). Sitting between central and local DP, ISRL-DP makes the realistic assumption (in cross-silo FL) that people trust their own silo, but not the server or other silos. In this work, we provide tight (up to logarithms) upper and lower bounds for ISRL-DP FL with convex/strongly convex loss functions and homogeneous (i.i.d.) silo data. Remarkably, we show that similar bounds are attainable for smooth losses with arbitrary heterogeneous silo data distributions, via an accelerated ISRL-DP algorithm. We also provide tight upper and lower bounds for ISRL-DP federated empirical risk minimization, and use acceleration to attain the optimal bounds in fewer rounds of communication than the state-of-the-art. Finally, with a secure "shuffler" to anonymize silo messages (but without a trusted server), our algorithm attains the optimal central DP rates under more practical trust assumptions. Numerical experiments show favorable privacy-accuracy tradeoffs for our algorithm in classification and regression tasks.

Figures (9)

• Figure 1: ISRL-DP protects the privacy of each patient's record regardless of whether the server/other silos are trustworthy, as long as the patient's own hospital is trusted. By contrast, user-level DP protects aggregate data of patients in hospital $i$ and does not protect against adversarial server/other silos.
• Figure 2: Trust assumptions of DP FL notions: We put "trust" in quotes because the shuffler is assumed to be secure and silo messages must already satisfy (at least a weak level of) ISRL-DP in order to realize SDP: anonymization alone cannot "create" DP dwork2014.
• Figure 3: We fix $M=N$, omit logs, and $C^2 := (\epsilon_0 n \sqrt{N}/\sqrt{d})^{2/5}$. Round complexity in \ref{['thm: informal accel non smooth ERM upper bound']} improves on girgis21a. *For our non-i.i.d. algorithm, \ref{['thm: SCO lower bound']} only applies if $\epsilon_0 = \mathcal{O}(1/n)$ or $N = \mathcal{O}(1)$: see \ref{['app: lower bounds']}.
• Figure 4: Binary logistic regression on MNIST. $\delta = 1/n^2.$$90\%$ error bars are shown.
• Figure 5: Linear regression on health insurance data. $\delta = 1/n^2.$$90\%$ error bars are shown.

Theorems & Definitions (78)

• Definition 1.1: Differential Privacy
• Definition 1.2: Inter-Silo Record-Level Differential Privacy
• Definition 1.3: Shuffle Differential Privacy prochlocheu2019distributed
• Theorem 2.1: Informal
• Theorem 2.2: Informal
• Theorem 3.1: $M=N$ case
• Theorem 4.1: Informal
• Theorem 5.1: i.i.d.
• Theorem 5.2: Non-i.i.d.
• Definition B.1