Differential Privacy in Federated Learning
Differential Privacy (DP) in Federated Learning is the application of formal DP guarantees to federated training — adding calibrated noise to gradient updates so that the shared model update does not reveal whether any specific data point was in a client's training set.
DP-FL Mechanisms
- User-Level DP: Each client's entire contribution is protected — the model is indistinguishable regardless of whether a specific client participated.
- Record-Level DP: Each individual training example is protected — stronger but harder to achieve.
- Clipping: Clip gradient norms to bound sensitivity: $g_k \leftarrow g_k \cdot \min(1, C / |g_k|)$.
- Noising: Add Gaussian noise: $g_k + N(0, \sigma^2 C^2 I)$ calibrated to the privacy budget ($\epsilon, \delta$).
Why It Matters
- Formal Guarantee: DP provides mathematical, information-theoretic privacy guarantees — unlike heuristic anonymization.
- Gradient Inversion: FL without DP is vulnerable to gradient inversion attacks — DP prevents this.
- Trade-Off: Stronger privacy ($\epsilon$ closer to 0) = more noise = lower model accuracy.
DP in FL is mathematical privacy for federated learning — formally guaranteeing that gradient updates do not leak individual training examples.