Subject Granular Differential Privacy in Federated Learning
This paper introduces subject granular privacy in the Federated Learning (FL)
setting, where a subject is an individual whose private information is embodied
by several data items either confined within a single federation user or
distributed across multiple federation users. We formally define the notion of
subject level differential privacy for FL. We propose three new algorithms that
enforce subject level DP. Two of these algorithms are based on notions of user
level local differential privacy (LDP) and group differential privacy
respectively. The third algorithm is based on a novel idea of hierarchical
gradient averaging (HiGradAvgDP) for subjects participating in a training
mini-batch. We also introduce horizontal composition of privacy loss for a
subject across multiple federation users. We show that horizontal composition
is equivalent to sequential composition in the worst case. We prove the subject
level DP guarantee for all our algorithms and empirically analyze them using
the FEMNIST and Shakespeare datasets. Our evaluation shows that, of our three
algorithms, HiGradAvgDP delivers the best model performance, approaching that
of a model trained using a DP-SGD based algorithm that provides a weaker item
level privacy guarantee.