Echo of Neighbors: Privacy Amplification for Personalized Private Federated Learning with Shuffle Model

• Type of Material: Article
• Authors: Yixuan Liu, Renmin University of China; Suyun Zhao, Renmin University of China; Li Xiong, Emory University; Yuhan Liu, Renmin University of China; Hong Chen, Renmin University of China
• Language: English
• Date: 2023-02-01
• Publisher: Association for the Advancement of Artificial Intelligence
• Publication Version: Author Accepted Manuscript (After Peer Review)
• Copyright Statement: © 2023, Association for the Advancement of Artifcial Intelligence (www.aaai.org). All rights reserved.
• License: Creative Commons Attribution-NonCommercial 4.0 International
• Final Published Version (URL): https://doi.org/10.1609%2Faaai.v37i10.26400
• Title of Journal or Parent Work: Proceedings of the AAAI Conference on Artificial Intelligence
• Volume: 37
• Issue: 10
• Start Page: 11865
• End Page: 11872
• Grant/Funding Information: Our work is supported by National Natural Science Foundation of China (62072460, 62076245, 62172424,62276270), Beijing Natural Science Foundation (4212022), National Science Foundation (NSF) CNS-2124104, CNS-2125530, CNS-1952192, National Institute of Health (NIH) R01LM013712, R01ES033241, UL1TR002378, Cisco Research University Award #2738379, Fundamental Research Funds for the Central Universities, and Research Funds of Renmin University of China (21XNH180).
• Keywords: privacy; S-APES; Federated Learning; collaborative training; Personalized Local Differential Privacy (PLDP); Neighbor Divergence and Clip-Laplace Mechanism; echos; amplification effect; APES
• Research Categories: Artificial Intelligence; Computer Science

Abstract

Federated Learning, as a popular paradigm for collaborative training, is vulnerable against privacy attacks. Different privacy levels regarding users’ attitudes need to be satisfied locally, while a strict privacy guarantee for the global model is also required centrally. Personalized Local Differential Privacy (PLDP) is suitable for preserving users’ varying local privacy, yet only provides a central privacy guarantee equivalent to the worst-case local privacy level. Thus, achieving strong central privacy as well as personalized local privacy with a utility-promising model is a challenging problem. In this work, a general framework (APES) is built up to strengthen model privacy under personalized local privacy by leveraging the privacy amplification effect of the shuffle model. To tighten the privacy bound, we quantify the heterogeneous contributions to the central privacy user by user. The contributions are characterized by the ability of generating “echos” from the perturbation of each user, which is carefully measured by proposed methods Neighbor Divergence and Clip-Laplace Mechanism. Furthermore, we propose a refined framework (S-APES) with the post-sparsification technique to reduce privacy loss in high-dimension scenarios. To the best of our knowledge, the impact of shuffling on personalized local privacy is considered for the first time. We provide a strong privacy amplification effect, and the bound is tighter than the baseline result based on existing methods for uniform local privacy. Experiments demonstrate that our frameworks ensure comparable or higher accuracy for the global model.