Private federated learning with protection against reconstruction
Embodiments described herein provide for a non-transitory machine-readable medium storing instructions to cause one or more processors to perform operations comprising receiving a machine learning model from a server at a client device, training the machine learning model using local data at the client device, generating an update for the machine learning model, the update including a weight vector that represents a difference between the received machine learning model and the trained machine learning model, privatizing the update for the machine learning model, and transmitting the privatized update for the machine learning model to the server.
1. A non-transitory machine-readable medium storing instructions to cause one or more processors of a data processing system to perform operations comprising:
receiving a machine learning model from a server at a client device;
training the machine learning model using local data at the client device to generate a trained machine learning model;
determining a weight vector that is a difference between first weights of the machine learning model and second weights of the trained machine learning model;
generating an update for the machine learning model, the update including the weight vector;
privatizing the update for the machine learning model by separately privatizing a magnitude and a unit vector of the update; and
transmitting the privatized update for the machine learning model to the server.
2. The non-transitory machine-readable medium as in claim 1 , wherein privatizing the update for the machine learning model includes privatizing the update using separated differential privacy, wherein privatizing the update using separated differential privacy includes:
decomposing the weight vector into the unit vector and the magnitude.
3. The non-transitory machine-readable medium as in claim 2 , wherein the magnitude is privatized using relative noise.
4. The non-transitory machine-readable medium as in claim 2 , wherein the unit vector and the magnitude are each differentially private.
5. The non-transitory machine-readable medium as in claim 4 , wherein the magnitude is privatized with absolute error.
6. The non-transitory machine-readable medium as in claim 4 , wherein the magnitude is privatized with relative error.
7. The non-transitory machine-readable medium as in claim 4 , wherein the unit vector is privatized based on 2 -unit vectors on a unit cube.
8. The non-transitory machine-readable medium as in claim 4 , wherein the unit vector is privatized based on ∞ -unit vectors on a unit cube.
9. The non-transitory machine-readable medium as in claim 1 , wherein the machine learning model is a natural language processing model, an image classification model, or a voice classification model.
10. The non-transitory machine-readable medium as in claim 9 , additionally comprising receiving an updated machine learning model from the server at the client device, training the updated machine learning model using local data at the client device, and transmitting a privatized update for the updated machine learning model to the server.
11. A data processing system comprising:
a memory to store instructions;
one or more processors to execute the instructions, wherein the instructions cause the one or more processors to:
receive a machine learning model from a server at a client device;
train the machine learning model using local data at the client device to generate a trained machine learning model;
generate a weight vector by subtracting first weights of the received machine learning model from second weights of the trained machine learning model;
generate an update for the machine learning model, the update including the weight vector;
privatize the update for the machine learning model by separately privatizing a magnitude and a unit vector of the update; and
transmit the privatized update for the machine learning model to the server.
12. The data processing system as in claim 11 , wherein to privatize the update for the machine learning model includes to privatize the update using separated differential privacy, wherein to privatize the update using separated differential privacy includes to:
decompose the weight vector into the unit vector and the magnitude.
13. The data processing system as in claim 12 , wherein the magnitude is privatized using relative noise.
14. The data processing system as in claim 12 , wherein the unit vector and the magnitude are each differentially private.
15. The data processing system as in claim 14 , wherein the magnitude is privatized with absolute error.
16. The data processing system as in claim 14 , wherein the magnitude is privatized with relative error.
17. The data processing system as in claim 14 , wherein the unit vector is privatized based on 2 -unit vectors on a unit cube.
18. The data processing system as in claim 14 , wherein the unit vector is privatized based on based on ∞ -unit vectors on a unit cube.
19. The data processing system as in claim 11 , wherein the machine learning model is a natural language processing model, an image classification model, or a voice classification model.
20. The data processing system as in claim 19 , the one or more processors additionally to: receive an updated machine learning model from the server at the client device; train the updated machine learning model using local data at the client device; and transmit a privatized update for the updated machine learning model to the server.
21. A method comprising:
receiving a machine learning model from a server at a client device;
training the machine learning model using local data at the client device to generate a trained machine learning model;
determining a weight vector that is a difference between first weights of the machine learning model and second weights of the trained machine learning model;
generating an update for the machine learning model, the update including the weight vector;
privatizing the update for the machine learning model by separately privatizing a magnitude and a unit vector of the update; and
transmitting the privatized update for the machine learning model to the server.
22. The method as in claim 21 , wherein privatizing the update for the machine learning model includes privatizing the update using separated differential privacy, wherein privatizing the update using separated differential privacy includes:
decomposing the weight vector into the unit vector and the magnitude.
23. The method as in claim 22 , wherein the magnitude is privatized using relative noise.
24. The method as in claim 22 , wherein the unit vector and the magnitude are each differentially private.
25. The method as in claim 24 , wherein the magnitude is privatized with absolute error.
26. The method as in claim 24 , wherein the magnitude is privatized with relative error.
27. The method as in claim 24 , wherein the unit vector is privatized based on 2 -unit vectors on a unit cube.
28. The method as in claim 24 , wherein the unit vector is privatized based on ∞ -unit vectors on a unit cube.
29. The method as in claim 21 , wherein the machine learning model is a natural language processing model, an image classification model, or a voice classification model.
30. The method as in claim 29 , additionally comprising receiving an updated machine learning model from the server at the client device, training the updated machine learning model using local data at the client device, and transmitting a privatized update for the updated machine learning model to the server.