Protection Against Reconstruction and Its Applications in Private Federated Learning

By Abhishek Bhowmick, John C. Duchi, Julien Freudiger, Gaurav Kapoor, Ryan M. Rogers. 2018

408 citations recorded by the source corpus.

In large-scale statistical learning, data collection and model fitting are moving increasingly toward peripheral devices---phones, watches, fitness trackers---away from centralized data collection. Concomitant with this rise in decentralized data are increasing challenges of maintaining privacy while allowing enough information to fit accurate, useful statistical models. This motivates local notions of privacy---most significantly, local differential privacy, which provides strong protections against sensitive data disclosures---where data is obfuscated before a statistician or learner can even observe it, providing strong protections to individuals' data. Yet local privacy as traditionally employed may prove too stringent for practical use, especially in modern high-dimensional statistical and machine learning problems. Consequently, we revisit the types of disclosures and adversaries against which we provide protections, considering adversaries with limited prior information and ensuring that with high probability, ensuring they cannot reconstruct an individual's data within useful tolerances. By reconceptualizing these protections, we allow more useful data release---large privacy parameters in local differential privacy---and we design new (minimax) optimal locally differentially private mechanisms for statistical learning problems for \emph{all} privacy levels. We thus present practicable approaches to large-scale locally private model training that were previously impossible, showing theoretically and empirically that we can fit large-scale image classification and language models with little degradation in utility.

Subfields: Artificial Intelligence, Federated & Distributed Learning, Privacy & Security

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Federated & Distributed Learning

In Privacy & Security

Citations in the corpus

Advances and Open Problems in Federated Learning (2019, methodology): “To limit or eliminate the information that could be learned about an individual from the iterates (and/or final model), user-level differential privacy can be used in FL’s iterative training process [7, 290, 288, 62].”
Breaking the Communication-Privacy-Accuracy Trilemma (2020, methodology): “Xi ∈ [−1, 1], then directly quantizing, sampling and perturbing each entry can achieve optimal ∞ estimation error that matches the LDP lower bound in [34], where their privatization steps are based on techniques developed in [34] and [7].”
Privacy in Deep Learning: A Survey (2020, methodology): “, 2017) # # MNIST Image Classification w/ DNN ScalarDP, PrivUnit(Bhowmick et al., 2018) # # MNIST, CIFAR Image Classification w/ DNN DSSGD(Shokri & Shmatikov, 2015) # # MNIST, SVHN Image Classification w/ DNN Private Collaborative NN(Chase et al.”
Honeycrisp: large-scale differentially private aggregation without a trusted core (2019, methodology): “A related approach is used in federated learning; for instance, [11, 14] update complex models, such as neural networks, locally on user devices, to avoid sending data to a centralized aggregator.”
Differentially Private Meta-Learning (2019, methodology): “In this work, though we achieve a relaxation of the privacy of Bhowmick et al. (2019), we do not restrict the adversary’s power.”
The Privacy Blanket of the Shuffle Model (2019, methodology): “This randomizer has been studied and used (in the local model) in several previous works [8, 21, 22].”
Federated Learning: Challenges, Methods, and Future Directions (2019, background): “Current works that aim to improve the privacy of federated learning typically build upon previous classical cryptographic protocols such as SMC [10, 42] and differential privacy [3, 8, 41, 76].”
Federated Model Distillation with Noise-Free Differential Privacy (2020, methodology): “Nevertheless, recent works have demonstrated that FL may not always provide sufficient privacy guarantees, as communicating model updates throughout the training process can nonetheless reveal sensitive information [Bhowmick et al., 2018; Melis et al., 2019].”
Survey on Federated Learning Threats: concepts, taxonomy on attacks and defences, experimental study and challenges (2022, background): “[123] step out of the standard Local DP protocol, to relax it and provide”
A Comprehensive Survey of Privacy-preserving Federated Learning (2021, methodology): “WHO RA1 [61, 196, 228] [26, 137, 218] [157, 169, 198] [144, 164, 199] [63, 70, 193] [16, 174, 191] [78, 110, 228] [52, 81, 216] [32, 56, 222] [30, 127, 173] RA2 [114, 175, 187] [215, 221, 224] [29, 111, 113] [13, 199] [3, 10, 40] [109, 155, 168] [45, 172, 193] [20, 52, 57] [56, 165, 197] [173, 199, ”
Client Selection and Bandwidth Allocation in Wireless Federated Learning Networks: A Long-Term Perspective (2020, background): “and unbalanced datasets [8]–[10], and preserving model privacy [11]–[15] etc.”
Privacy preservation in federated learning: An insightful survey from the GDPR perspective (2020, background): “User-level DP [95, 57, 48, 82, 10, 115] Membership Tracing”
LDP-FL: Practical Private Aggregation in Federated Learning with Local Differential Privacy (2020, methodology): “Bhowmick et al. [Bhowmick et al., 2018] is the first work focus on the LDP on federated learning with deep learning models.”
Differentially-private Federated Neural Architecture Search (2020, background): “Several studies (Bhowmick et al., 2018; Carlini et al., 2018; Fredrikson et al., 2015) have shown that intermediates results such as gradients can reveal private information.”