Towards Sparse Federated Analytics: Location Heatmaps under Distributed Differential Privacy with Secure Aggregation

Abstract

We design a scalable algorithm to privately generate location heatmaps over decentralized data from millions of user devices. It aims to ensure differential privacy before data becomes visible to a service provider while maintaining high data accuracy and minimizing resource consumption on users' devices. To achieve this, we revisit the distributed differential privacy concept based on recent results in the secure multiparty computation field and design a scalable and adaptive distributed differential privacy approach for location analytics. Evaluation on public location datasets shows that this approach successfully generates metropolitan-scale heatmaps from millions of user samples with a worst-case client communication overhead that is significantly smaller than existing state-of-the-art private protocols of similar accuracy.

FedWalk: Communication Efficient Federated Unsupervised Node Embedding with Differential Privacy

“…TriHH [38] discovers the heavy hitters in a population of data without uploading the data to the server. Federated location heatmap from Google applies distributed differential privacy to generate location heatmaps [1]. FedFPM [28] presents a unified framework for frequent pattern analysis.…”

“…In the random walk generator, FedWalk contains a sequence encoder to encrypt the edge information to provide privacy and a two-hop neighbor predictor to save the communication cost among devices. The typical Skip-Gram model is then used 1 Clients and data holders are used interchangeable in this paper.…”

Locally Differentially Private Sparse Vector Aggregation

“…Some of these works showed how to compute distributed summation with error comparable to central DP, relying on cryptographic assumptions. Recently, Bagdasaryan et al [6] considered frequency estimation under CDP assuming 1-sparsity, with the extra assumption that the frequency vector must be sparse too. For the more general setting of k-sparsity that we consider, it is not known how CDP can further improve the acccuracy in comparison with LDP, while still preserving succinct communication.…”

Privacy by Projection: Federated Population Density Estimation by Projecting on Random Features

“…One application is to provide a data-driven perspective for public transit operators, since it can capture customer mobility patterns and inform resource allocation in urban areas [6,21,29,33]. In addition, the relationship between population density and infectious disease is of considerable public health relevance [5,17,32], especially during the COVID-19 pandemic [3,23,35,48]. Local differences in population density and interaction rates can have substantial impacts on the community risk levels [41,42], but information about people's locations and movements is clearly sensitive.…”

“…Unfortunately, even in a Federated KDE setting where users' data is not directly disclosed, a malicious server can still infer users' locations, by querying users for local density information and using it to deduce their most probable locations. A range of privacypreserving techniques have been developed and added onto the basic federated learning and analytics frameworks, including differential privacy (DP) on the mobiles and/or the server [16,27,34], secure aggregation [7,15], and combinations thereof [25], [3].…”