[论文解读] On the Practicality of Differential Privacy in Federated Learning by Tuning Iteration Times

Yao Fu, Yipeng Zhou+4 more|arXiv (Cornell University)|Jan 11, 2021

Privacy-Preserving Technologies in Data参考文献 34被引用 10

一句话总结

该论文提出通过调节联邦学习（FL）中的本地迭代次数来提升差分隐私（DP）的实用性，表明最优的本地迭代次数可在存在DP噪声的情况下稳定收敛。理论上证明了基于高斯机制的DP-FedAvg收敛到有界误差，而基于拉普拉斯机制的版本则发散，但通过调节迭代次数可显著降低发散速率。

ABSTRACT

In spite that Federated Learning (FL) is well known for its privacy protection when training machine learning models among distributed clients collaboratively, recent studies have pointed out that the naive FL is susceptible to gradient leakage attacks. In the meanwhile, Differential Privacy (DP) emerges as a promising countermeasure to defend against gradient leakage attacks. However, the adoption of DP by clients in FL may significantly jeopardize the model accuracy. It is still an open problem to understand the practicality of DP from a theoretic perspective. In this paper, we make the first attempt to understand the practicality of DP in FL through tuning the number of conducted iterations. Based on the FedAvg algorithm, we formally derive the convergence rate with DP noises in FL. Then, we theoretically derive: 1) the conditions for the DP based FedAvg to converge as the number of global iterations (GI) approaches infinity; 2) the method to set the number of local iterations (LI) to minimize the negative influence of DP noises. By further substituting the Laplace and Gaussian mechanisms into the derived convergence rate respectively, we show that: 3) The DP based FedAvg with the Laplace mechanism cannot converge, but the divergence rate can be effectively prohibited by setting the number of LIs with our method; 4) The learning error of the DP based FedAvg with the Gaussian mechanism can converge to a constant number finally if we use a fixed number of LIs per GI. To verify our theoretical findings, we conduct extensive experiments using two real-world datasets. The results not only validate our analysis results, but also provide useful guidelines on how to optimize model accuracy when incorporating DP into FL

研究动机与目标

• 为解决在联邦学习（FL）中应用差分隐私（DP）时模型准确率下降的关键挑战。
• 研究本地迭代次数（LIs）和全局迭代次数（GIs）在DP约束下对收敛性和模型准确率的影响。
• 推导DP增强型FedAvg收敛的理论条件，特别是针对拉普拉斯和高斯机制。
• 提供一种系统化的方法来设定LIs，以最小化DP噪声对联邦学习模型收敛的负面影响。

提出的方法

• 通过建模DP噪声对梯度更新的影响，推导DP增强型FedAvg的收敛速率。
• 引入时变学习率 ηₖ = α/(k + γ) 以分析全局迭代过程中的收敛行为。
• 通过有界模型权重的期望平方范数，建立收敛条件。
• 使用数学归纳法证明：在特定学习率和噪声假设下，误差界 Yₖ ≤ φ/(k+γ) + (α²t)/(k+γ−1)² ω₁ 成立。
• 将拉普拉斯和高斯机制代入收敛框架，比较其在最优LIs下的行为表现。
• 推导出拉普拉斯机制（Cₘ = 8pbξ₁²/(N²ε²)）和高斯机制（Cₘ = 8pc₂²log(1/δ)ξ₂²/(Nε²)）的显式常数Cₘ，以量化噪声影响。

实验结果

研究问题

• RQ1 当全局迭代次数趋于无穷时，DP增强型FedAvg在何种条件下能够收敛？
• RQ2 如何最优地调节本地迭代次数，以最小化DP噪声对模型收敛的负面影响？
• RQ3 基于拉普拉斯机制的DP-FedAvg是否收敛，还是发散？其发散速率能否被控制？
• RQ4 基于高斯机制的DP-FedAvg学习误差是否能收敛到常数？在何种条件下实现？

主要发现

• 基于拉普拉斯机制的DP-FedAvg在全局迭代增加时无法收敛，但通过调节本地迭代次数可显著降低发散速率。
• 若每轮全局迭代中使用固定数量的本地迭代，基于高斯机制的DP-FedAvg学习误差将收敛到一个常数值。
• 理论收敛界表明，主项误差以 O(1/k) 速率衰减，噪声影响项以 O(t/(k+γ)²) 速率衰减，其中 t 为DP噪声注入次数。
• 通过最优调节本地迭代次数，可最小化DP噪声引起的模型准确率下降，该结论已在真实世界数据集上通过实验验证。
• 所推导的收敛条件依赖于学习率调度和噪声幅度，当本地迭代次数被精心选择时，边界更紧密。
• 分析表明，在每次本地迭代后注入噪声（而非仅在最后一步）是次优的；将噪声注入延迟至最后一次本地更新可减轻其负面影响。