Adding calibrated noise to model updates so no individual record can be detected — mathematically provable privacy that complements FL's data-minimisation property.
Federated learning prevents raw data from leaving clients, but an adversarial server can still infer private information from model updates. Gradient inversion attacks reconstruct training images from gradients. Membership inference determines whether a specific record was in training data by observing model outputs. These attacks mean FL alone offers privacy in practice but not privacy in theory.
Differential Privacy (DP), introduced by Dwork et al. (2006), provides a mathematical definition of privacy: a mechanism M satisfies ε-DP if for any two datasets D and D' differing in one record, and any output set S: Pr[M(D)∈S] ≤ eᵉ · Pr[M(D')∈S]. Informally: no single individual's data should meaningfully change the output distribution.
For FL, the most practical DP mechanism is the Gaussian mechanism: clip each client's gradient to bounded sensitivity (||g|| ≤ C), then add Gaussian noise scaled to σ = C·√(2 ln(1.25/δ)) / ε. This gives (ε,δ)-DP guarantees — a relaxation of pure ε-DP that allows a small failure probability δ.
Gradient clipping serves two purposes: (1) it bounds the sensitivity (maximum impact one record can have), and (2) it prevents exploding gradients. After clipping, the added Gaussian noise overwhelms the contribution of any single data point — making it statistically impossible to determine whether that record was in the training data.
There are two trust models for DP in FL. Central DP: clients trust the server; clients send exact gradients; the server adds noise to the aggregated model. Provides better utility (noise added once). Local DP: clients do not trust the server; each client adds noise locally before sending. More privacy but much worse utility (noise added K times, scales as √K).
Adding noise degrades model accuracy. The trade-off between privacy (ε) and accuracy is the central tension in private ML. Google's DP-SGD paper showed that for large datasets (millions of users), DP models lose only 1–3% accuracy at ε≈8, making the utility cost acceptable. For small datasets or strongly non-IID FL, the cost is higher — sometimes prohibitive.
Say the answer out loud before revealing — recalling is what makes it stick.
Why isn't federated learning alone sufficient for privacy?
What does epsilon (ε) represent in differential privacy?
What is the key step in the Gaussian mechanism for DP-FL?
What is the fundamental difference between central DP and local DP?