On the Practicality of Differential Privacy in Federated Learning by
Tuning Iteration Times
- URL: http://arxiv.org/abs/2101.04163v1
- Date: Mon, 11 Jan 2021 19:43:12 GMT
- Title: On the Practicality of Differential Privacy in Federated Learning by
Tuning Iteration Times
- Authors: Yao Fu, Yipeng Zhou, Di Wu, Shui Yu, Yonggang Wen, Chao Li
- Abstract summary: Federated Learning (FL) is well known for its privacy protection when training machine learning models among distributed clients collaboratively.
Recent studies have pointed out that the naive FL is susceptible to gradient leakage attacks.
Differential Privacy (DP) emerges as a promising countermeasure to defend against gradient leakage attacks.
- Score: 51.61278695776151
- License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
- Abstract: In spite that Federated Learning (FL) is well known for its privacy
protection when training machine learning models among distributed clients
collaboratively, recent studies have pointed out that the naive FL is
susceptible to gradient leakage attacks. In the meanwhile, Differential Privacy
(DP) emerges as a promising countermeasure to defend against gradient leakage
attacks. However, the adoption of DP by clients in FL may significantly
jeopardize the model accuracy. It is still an open problem to understand the
practicality of DP from a theoretic perspective. In this paper, we make the
first attempt to understand the practicality of DP in FL through tuning the
number of conducted iterations. Based on the FedAvg algorithm, we formally
derive the convergence rate with DP noises in FL. Then, we theoretically
derive: 1) the conditions for the DP based FedAvg to converge as the number of
global iterations (GI) approaches infinity; 2) the method to set the number of
local iterations (LI) to minimize the negative influence of DP noises. By
further substituting the Laplace and Gaussian mechanisms into the derived
convergence rate respectively, we show that: 3) The DP based FedAvg with the
Laplace mechanism cannot converge, but the divergence rate can be effectively
prohibited by setting the number of LIs with our method; 4) The learning error
of the DP based FedAvg with the Gaussian mechanism can converge to a constant
number finally if we use a fixed number of LIs per GI. To verify our
theoretical findings, we conduct extensive experiments using two real-world
datasets. The results not only validate our analysis results, but also provide
useful guidelines on how to optimize model accuracy when incorporating DP into
FL
Related papers
- DP-DyLoRA: Fine-Tuning Transformer-Based Models On-Device under Differentially Private Federated Learning using Dynamic Low-Rank Adaptation [15.023077875990614]
Federated learning (FL) allows clients to collaboratively train a global model without sharing their local data with a server.
Differential privacy (DP) addresses such leakage by providing formal privacy guarantees, with mechanisms that add randomness to the clients' contributions.
We propose an adaptation method that can be combined with differential privacy and call it DP-DyLoRA.
arXiv Detail & Related papers (2024-05-10T10:10:37Z) - Online Heavy-tailed Change-point detection [6.7643284029102295]
We present an algorithm based on clipped Gradient Descent (SGD), that works even if we only assume that the second moment of the data generating process is bounded.
We derive guarantees on worst-case, finite-sample false-positive rate (FPR) over the family of all distributions with bounded second moment.
Our method is the first OCPD algorithm that guarantees finite-sample FPR, even if the data is high dimensional and the underlying distributions are heavy-tailed.
arXiv Detail & Related papers (2023-06-15T23:39:05Z) - Towards the Flatter Landscape and Better Generalization in Federated
Learning under Client-level Differential Privacy [67.33715954653098]
We propose a novel DPFL algorithm named DP-FedSAM, which leverages gradient perturbation to mitigate the negative impact of DP.
Specifically, DP-FedSAM integrates Sharpness Aware of Minimization (SAM) to generate local flatness models with stability and weight robustness.
To further reduce the magnitude random noise while achieving better performance, we propose DP-FedSAM-$top_k$ by adopting the local update sparsification technique.
arXiv Detail & Related papers (2023-05-01T15:19:09Z) - Make Landscape Flatter in Differentially Private Federated Learning [69.78485792860333]
We propose a novel DPFL algorithm named DP-FedSAM, which leverages gradient perturbation to mitigate the negative impact of DP.
Specifically, DP-FedSAM integrates local flatness models with better stability and weight robustness, which results in the small norm of local updates and robustness to DP noise.
Our algorithm achieves state-of-the-art (SOTA) performance compared with existing SOTA baselines in DPFL.
arXiv Detail & Related papers (2023-03-20T16:27:36Z) - Generative Modeling with Flow-Guided Density Ratio Learning [12.192867460641835]
Flow-Guided Density Ratio Learning (FDRL) is a simple and scalable approach to generative modeling.
We show that FDRL can generate images of dimensions as high as $128times128$, as well as outperform existing gradient flow baselines on quantitative benchmarks.
arXiv Detail & Related papers (2023-03-07T07:55:52Z) - Consistent Diffusion Models: Mitigating Sampling Drift by Learning to be
Consistent [97.64313409741614]
We propose to enforce a emphconsistency property which states that predictions of the model on its own generated data are consistent across time.
We show that our novel training objective yields state-of-the-art results for conditional and unconditional generation in CIFAR-10 and baseline improvements in AFHQ and FFHQ.
arXiv Detail & Related papers (2023-02-17T18:45:04Z) - Normalized/Clipped SGD with Perturbation for Differentially Private
Non-Convex Optimization [94.06564567766475]
DP-SGD and DP-NSGD mitigate the risk of large models memorizing sensitive training data.
We show that these two algorithms achieve similar best accuracy while DP-NSGD is comparatively easier to tune than DP-SGD.
arXiv Detail & Related papers (2022-06-27T03:45:02Z) - Federated Learning with Sparsified Model Perturbation: Improving
Accuracy under Client-Level Differential Privacy [27.243322019117144]
Federated learning (FL) enables distributed clients to collaboratively learn a shared statistical model.
sensitive information about the training data can still be inferred from model updates shared in FL.
Differential privacy (DP) is the state-of-the-art technique to defend against those attacks.
This paper develops a novel FL scheme named Fed-SMP that provides client-level DP guarantee while maintaining high model accuracy.
arXiv Detail & Related papers (2022-02-15T04:05:42Z) - Achieving Statistical Optimality of Federated Learning: Beyond
Stationary Points [19.891597817559038]
Federated Learning (FL) is a promising framework that has great potentials in privacy preservation and in lowering the computation load at the cloud.
Recent work raised concerns on two methods: (1) their fixed points do not correspond to the stationary points of the original optimization problem, and (2) the common model found might not generalize well locally.
We show, in the general kernel regression setting, that both FedAvg and FedProx converge to the minimax-optimal error rates.
arXiv Detail & Related papers (2021-06-29T09:59:43Z) - Differentially Private Federated Learning with Laplacian Smoothing [72.85272874099644]
Federated learning aims to protect data privacy by collaboratively learning a model without sharing private data among users.
An adversary may still be able to infer the private training data by attacking the released model.
Differential privacy provides a statistical protection against such attacks at the price of significantly degrading the accuracy or utility of the trained models.
arXiv Detail & Related papers (2020-05-01T04:28:38Z)
This list is automatically generated from the titles and abstracts of the papers in this site.
This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.