Protection Against Reconstruction and Its Applications in Private Federated Learning
Abhishek Bhowmick ML Privacy Team, Apple, Inc. John Duchi ML Privacy Team, Apple, Inc. Stanford University Julien Freudiger ML Privacy Team, Apple, Inc. Gaurav Kapoor ML Privacy Team, Apple, Inc. Ryan Rogers ML Privacy Team, Apple, Inc.
Abstract
In large-scale statistical learning, data collection and model fitting are moving increasingly toward peripheral devices—phones, watches, fitness trackers—away from centralized data collection. Concomitant with this rise in decentralized data are increasing challenges of maintaining privacy while allowing enough information to fit accurate, useful statistical models. This motivates local notions of privacy—most significantly, local differential privacy, which provides strong protections against sensitive data disclosures—where data is obfuscated before a statistician or learner can even observe it, providing strong protections to individuals’ data. Yet local privacy as traditionally employed may prove too stringent for practical use, especially in modern high-dimensional statistical and machine learning problems. Consequently, we revisit the types of disclosures and adversaries against which we provide protections, considering adversaries with limited prior information and ensuring that with high probability, ensuring they cannot reconstruct an individual’s data within useful tolerances. By reconceptualizing these protections, we allow more useful data release—large privacy paramet
中文速览
在手机、手表等边缘设备上训练大规模机器学习模型时，如何在保护用户隐私的同时还能学到有用的模型，是一个核心难题。传统的本地差分隐私（local differential privacy）虽然保护力度强，但要求隐私参数 ε 很小，导致在高维问题中模型精度大幅下降，几乎无法实用。本文重新审视了"需要防御什么样的攻击者"这一问题：与其防御掌握大量先验信息的全能攻击者，不如针对那些对用户数据知之甚少、试图重建原始数据的"好奇旁观者"，并在此基础上允许使用大得多的 ε 值，同时在全局层面仍叠加标准差分隐私保护。在这一新框架下，作者设计了适用于所有隐私参数范围（ε ≤ d，d 为维度）的极小化极大最优（minimax optimal）私有化机制，并将其嵌入联邦随机梯度下降流程，在大规模图像分类和语言模型训练上实验验证了其有效性——在以往小 ε 设置下完全无法收敛的场景中，新方法的性能已接近无隐私保护的基线。这项工作为在真实分布式学习场景中兼顾实用性与隐私保护提供了理论保证和可落地的方案。
原文 arXiv:1812.00984;中英对照 + 大白话阅读 https://aha.fim.ai/paper/1812.00984v2