Federated Learning with Bayesian Differential Privacy

Triastcyn, Aleksei; Faltings, Boi

doi:10.1109/bigdata47090.2019.9005465

Cited by 145 publications

(108 citation statements)

References 35 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…In [27], the authors study the privacy risk of FL, and propose a GAN-based attack that allows servers to target a specific client and compromise the client level privacy. Triastcyn and Faltings [28] introduce Bayesian differential privacy, a natural relaxation of differential privacy that provides better privacy guarantees for clients. The main idea is based on a fact that FL tasks are often focused on a particular type of data.…”

Section: B Privacy and Security Of Flmentioning

confidence: 99%

Federated Learning for Vehicular Internet of Things: Recent Advances and Open Issues

Yoshinaga

et al. 2020

IEEE Open J. Comput. Soc.

267

106

View full text Add to dashboard Cite

show abstract

Section: B Privacy and Security Of Flmentioning

confidence: 99%

Federated Learning for Vehicular Internet of Things: Recent Advances and Open Issues

Yoshinaga

et al. 2020

IEEE Open J. Comput. Soc.

267

106

View full text Add to dashboard Cite

show abstract

“…Although the local raw data is not exposed in FL setting, FL on its own still lacks theoretical privacy guarantees [33], and may leak sensitive information about the training data [36]. Therefore, the combination of FL and proper privacy-preserving mechanisms, such as DP [14], HE [30], MPC [17], etc., is a necessity to alleviate FL's privacy risks.…”

Section: Related Workmentioning

confidence: 99%

“…McMahan et al [26] proposed DP-FedAvg, a differentially private version of vanilla FedAvg. Triastcyn and Faltings [33] proposed Bayesian differential privacy, a relaxation of DP for FL with a tighter privacy budget so that FL task over population with similarly distributed data could converge faster than DP-FedAvg. Unlike the existing methods providing gradient-level perturbation, our method focuses on IR perturbation within each multi-party SGD iteration, which is unique in VFL.…”

Section: Related Workmentioning

confidence: 99%

“…In HFL, gradients, trained with each participant's local data and vulnerable to information leakage [29], are sent from each participant to server for a secure aggregation [5]. The numerous participants of HFL are mostly personal smart phones or edge devices with limited computation power and network bandwidth, thus the goal of gradient protection in HFL setting is mainly achieved by differential privacy (DP) [14,1,2,26,33], secret sharing [5], and so on. In VFL setting, however, few enterpriselevel participants jointly learn a machine learning model with their own data by merely exchanging intermediate result (IR), e.g.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Differentially Private Publication of Vertically Partitioned Data

Tang

Cheng

et al. 2021

IEEE Trans. Dependable and Secure Comput.

View full text Add to dashboard Cite

We present HDP-VFL, the first hybrid differentially private (DP) framework for vertical federated learning (VFL) to demonstrate that it is possible to jointly learn a generalized linear model (GLM) from vertically partitioned data with only a negligible cost, w.r.t. training time, accuracy, etc., comparing to idealized nonprivate VFL. Our work builds on the recent advances in VFL-based collaborative training among different organizations which rely on protocols like Homomorphic Encryption (HE) and Secure Multi-Party Computation (MPC) to secure computation and training. In particular, we analyze how VFL's intermediate result (IR) can leak private information of the training data during communication and design a DP-based privacy-preserving algorithm to ensure the data confidentiality of VFL participants. We mathematically prove that our algorithm not only provides utility guarantees for VFL, but also offers multi-level privacy, i.e. DP w.r.t. IR and joint differential privacy (JDP) w.r.t. model weights. Experimental results demonstrate that our work, under adequate privacy budgets, is quantitatively and qualitatively similar to GLMs, learned in idealized non-private VFL setting, rather than the increased cost in memory and processing time in most prior works based on HE or MPC. Our codes will be released if this paper is accepted.

show abstract

“…Around the same time of our work, Triastcyn et al [40] independently propose Bayesian differential privacy that takes into account both of the sources of randomness. Despite this similarity, our works differ in multiple dimensions.…”

Section: Related Workmentioning

confidence: 99%

Differential Privacy at Risk: Bridging Randomness and Privacy Budget

Dandekar¹,

Basu

Bressan

2020

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

The calibration of noise for a privacy-preserving mechanism depends on the sensitivity of the query and the prescribed privacy level. A data steward must make the non-trivial choice of a privacy level that balances the requirements of users and the monetary constraints of the business entity.Firstly, we analyse roles of the sources of randomness, namely the explicit randomness induced by the noise distribution and the implicit randomness induced by the data-generation distribution, that are involved in the design of a privacy-preserving mechanism. The finer analysis enables us to provide stronger privacy guarantees with quantifiable risks. Thus, we propose privacy at risk that is a probabilistic calibration of privacy-preserving mechanisms. We provide a composition theorem that leverages privacy at risk. We instantiate the probabilistic calibration for the Laplace mechanism by providing analytical results.Secondly, we propose a cost model that bridges the gap between the privacy level and the compensation budget estimated by a GDPR compliant business entity. The convexity of the proposed cost model leads to a unique fine-tuning of privacy level that minimises the compensation budget. We show its effectiveness by illustrating a realistic scenario that avoids overestimation of the compensation budget by using privacy at risk for the Laplace mechanism. We quantitatively show that composition using the cost optimal privacy at risk provides stronger privacy guarantee than the classical advanced composition. Although the illustration is specific to the chosen cost model, it naturally extends to any convex cost model. We also provide realistic illustrations of how a data steward uses privacy at risk to balance the trade-off between utility and privacy.

show abstract

Federated Learning with Bayesian Differential Privacy

Cited by 145 publications

References 35 publications

Federated Learning for Vehicular Internet of Things: Recent Advances and Open Issues

Federated Learning for Vehicular Internet of Things: Recent Advances and Open Issues

Differentially Private Publication of Vertically Partitioned Data

Differential Privacy at Risk: Bridging Randomness and Privacy Budget

Contact Info

Product

Resources

About