Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Adaptive Differential Privacy in Federated Learning: A Priority-Based Approach

Mahtab Talaei, Iman Izadi

TL;DR

Federated learning exposes model updates to potential privacy leaks, motivating the use of differential privacy $(\epsilon,\delta)$-DP. The paper proposes adaptive DP in FL by allocating Gaussian noise according to feature and parameter importance, via sensitivity-based and variance-based ranking methods. The authors implement uplink noise $\sigma_U = c L \Delta s_U / \epsilon$ (with $\Delta s_U \le 2C/m$) and a derived downlink noise $\sigma_D$ to preserve DP, and demonstrate improved privacy-accuracy trade-offs on MNIST with an MLP. The work highlights the importance of parameter-level adaptivity in DP for FL and suggests directions such as per-parameter noise distributions and analyzing the effect of perturbing irrelevant features.

Abstract

Federated learning (FL) as one of the novel branches of distributed machine learning (ML), develops global models through a private procedure without direct access to local datasets. However, access to model updates (e.g. gradient updates in deep neural networks) transferred between clients and servers can reveal sensitive information to adversaries. Differential privacy (DP) offers a framework that gives a privacy guarantee by adding certain amounts of noise to parameters. This approach, although being effective in terms of privacy, adversely affects model performance due to noise involvement. Hence, it is always needed to find a balance between noise injection and the sacrificed accuracy. To address this challenge, we propose adaptive noise addition in FL which decides the value of injected noise based on features' relative importance. Here, we first propose two effective methods for prioritizing features in deep neural network models and then perturb models' weights based on this information. Specifically, we try to figure out whether the idea of adding more noise to less important parameters and less noise to more important parameters can effectively save the model accuracy while preserving privacy. Our experiments confirm this statement under some conditions. The amount of noise injected, the proportion of parameters involved, and the number of global iterations can significantly change the output. While a careful choice of parameters by considering the properties of datasets can improve privacy without intense loss of accuracy, a bad choice can make the model performance worse.

Adaptive Differential Privacy in Federated Learning: A Priority-Based Approach

TL;DR

Federated learning exposes model updates to potential privacy leaks, motivating the use of differential privacy -DP. The paper proposes adaptive DP in FL by allocating Gaussian noise according to feature and parameter importance, via sensitivity-based and variance-based ranking methods. The authors implement uplink noise (with ) and a derived downlink noise to preserve DP, and demonstrate improved privacy-accuracy trade-offs on MNIST with an MLP. The work highlights the importance of parameter-level adaptivity in DP for FL and suggests directions such as per-parameter noise distributions and analyzing the effect of perturbing irrelevant features.

Abstract

Federated learning (FL) as one of the novel branches of distributed machine learning (ML), develops global models through a private procedure without direct access to local datasets. However, access to model updates (e.g. gradient updates in deep neural networks) transferred between clients and servers can reveal sensitive information to adversaries. Differential privacy (DP) offers a framework that gives a privacy guarantee by adding certain amounts of noise to parameters. This approach, although being effective in terms of privacy, adversely affects model performance due to noise involvement. Hence, it is always needed to find a balance between noise injection and the sacrificed accuracy. To address this challenge, we propose adaptive noise addition in FL which decides the value of injected noise based on features' relative importance. Here, we first propose two effective methods for prioritizing features in deep neural network models and then perturb models' weights based on this information. Specifically, we try to figure out whether the idea of adding more noise to less important parameters and less noise to more important parameters can effectively save the model accuracy while preserving privacy. Our experiments confirm this statement under some conditions. The amount of noise injected, the proportion of parameters involved, and the number of global iterations can significantly change the output. While a careful choice of parameters by considering the properties of datasets can improve privacy without intense loss of accuracy, a bad choice can make the model performance worse.
Paper Structure (12 sections, 6 equations, 8 figures)

This paper contains 12 sections, 6 equations, 8 figures.

Table of Contents

  1. Introduction
  2. Preliminaries
  3. Deep Learning
  4. Federated Learning
  5. Differential Privacy
  6. Federated learning with adaptive differential privacy
  7. Federated Learning with Differential Privacy
  8. Adaptive Differential Privacy in Federated Learning
  9. Sensitivity-Based Method
  10. Variance-Based Method
  11. Simulation Results
  12. Conclusions

Figures (8)

  • Figure 1: A simple neural network with one hidden layer. $b^k$ vectors contain the bias values for each neuron. $W^k$ is the weight matrix of each layer.
  • Figure 2: FL training model.
  • Figure 3: Average of each $784$ pixels of all local samples in the first client.
  • Figure 4: The relative feature importance assigned to the first client samples for four different global iterations.
  • Figure 5: The comparison of model accuracies with different protection levels $\epsilon = 0.5$, $\epsilon = 1$, $\epsilon = 5$ and $\epsilon = 10$, for 30 clients. The additive Gaussian noise distribution is considered the same for all of the parameters.
  • ...and 3 more figures

Theorems & Definitions (1)

  • Definition 1: $(\epsilon, \delta)$-DP