Differentially private federated averaging — morie_dp

Client updates clipped to L2 norm C, summed, Gaussian noise added once to the sum, divided by the number of clients.

Usage

morie_dp_fedavg(client_updates, C = 1, sigma = 1, seed = NULL)

Arguments

client_updates: matrix, one row per client.
C: L2 clipping norm per client.
sigma: noise multiplier.
seed: optional integer seed.

Value

list with aggregate, clipped_fraction, noise_sd_per_client, noise_sd_aggregate.

Details

The privacy unit here is the CLIENT, not the example. Clipping per example inside a client would leave a client with many examples contributing far more than C in total and therefore exposed by exactly the amount the accounting assumes away. Because the noise is added once to the sum, its effect per client falls as 1/m – more clients is strictly better, which is the one place in DP where scaling up helps for free.

References

McMahan, H. B. et al. (2018). Learning differentially private recurrent language models. ICLR.

Examples

set.seed(1)
morie_dp_fedavg(matrix(rnorm(50), ncol = 5),
  C = 1,
  sigma = 1
)$noise_sd_per_client
#> [1] 0.1