Subject Granular Differential Privacy in Federated Learning

TL;DR

This paper introduces two algorithms for subject-level differential privacy in federated learning, providing formal privacy guarantees and analyzing their impact on model utility through empirical evaluation.

Contribution

It proposes novel algorithms, LocalGroupDP and HiGradAvgDP, for enforcing subject-level DP locally in federated learning, with formal privacy proofs and utility analysis.

Findings

LocalGroupDP achieves the best empirical performance among the proposed algorithms.

Model utility is affected by privacy loss amplification and horizontal composition.

User-level LDP naturally guarantees subject-level DP.

Abstract

This paper considers subject level privacy in the FL setting, where a subject is an individual whose private information is embodied by several data items either confined within a single federation user or distributed across multiple federation users. We propose two new algorithms that enforce subject level DP at each federation user locally. Our first algorithm, called LocalGroupDP, is a straightforward application of group differential privacy in the popular DP-SGD algorithm. Our second algorithm is based on a novel idea of hierarchical gradient averaging (HiGradAvgDP) for subjects participating in a training mini-batch. We also show that user level Local Differential Privacy (LDP) naturally guarantees subject level DP. We observe the problem of horizontal composition of subject level privacy loss in FL - subject level privacy loss incurred at individual users composes across the federation. We formally prove the subject level DP guarantee for our algorithms, and also show their effect on model utility loss. Our empirical evaluation on FEMNIST and Shakespeare datasets shows that LocalGroupDP delivers the best performance among our algorithms. However, its model utility lags behind that of models trained using a DP-SGD based algorithm that provides a weaker item level privacy guarantee. Privacy loss amplification due to subject sampling fractions and horizontal composition remain key challenges for model utility.