differential privacy in federated learning

Differential Privacy (DP) in Federated Learning is the application of formal DP guarantees to federated training — adding calibrated noise to gradient updates so that the shared model update does not reveal whether any specific data point was in a client's training set.

DP-FL Mechanisms

• User-Level DP: Each client's entire contribution is protected — the model is indistinguishable regardless of whether a specific client participated.
• Record-Level DP: Each individual training example is protected — stronger but harder to achieve.
• Clipping: Clip gradient norms to bound sensitivity: $g_k \leftarrow g_k \cdot \min(1, C / |g_k|)$.
• Noising: Add Gaussian noise: $g_k + N(0, \sigma^2 C^2 I)$ calibrated to the privacy budget ($\epsilon, \delta$).

Why It Matters

• Formal Guarantee: DP provides mathematical, information-theoretic privacy guarantees — unlike heuristic anonymization.
• Gradient Inversion: FL without DP is vulnerable to gradient inversion attacks — DP prevents this.
• Trade-Off: Stronger privacy ($\epsilon$ closer to 0) = more noise = lower model accuracy.

DP in FL is mathematical privacy for federated learning — formally guaranteeing that gradient updates do not leak individual training examples.