Privacy in Machine Learning Training: Federated Learning
1. Privacy in Machine Learning Training: Federated Learning
Now, let's move on to the next methodology, Federated Learning. Federated learning is a useful method for training large-scale machine learning models using edge devices such as smartphones, while preserving data privacy by avoiding the need to share raw data. This technique is adopted in many Google services and applications, including Gboard. Gboard has several machine learning models to enhance users' typing experiences on smartphones based on users' inputs. Since every user has different usages and needs, fine-tuning and personalizing the models for each user is critical to support unique needs, while it is also important to sync updated models among all users to improve the product itself. However, the typing input can contain sensitive information, including PII, which users don't want to send out to a central server for machine learning training. In this use case, federated learning is a critical method for ensuring both privacy and personalization. Google has been implementing many systems that use this technology. Let's take a look at how it works. Imagine you built a mobile application which includes a machine-learning model. You trained the first model with a standard data set and distributed the app to users' devices. Similar to how Gboard personalization works, federated learning can update machine learning models on user devices like Smartphones using their own data. After these local updates, the approved model parameters or gradients are shared with the central server so that the changes are reflected in the central model. This way, the central model is enhanced with updated models using fresh data that benefits all users without compromising their privacy. Lots of update information is gathered from the numerous user devices without collecting any raw data from those devices. Practically, you should carefully design the user sampling method to avoid unintended results like data skew. Then aggregate the gradients to update the central model. By following these federated learning steps, you can update models using actual user's data while keeping them on each device. This can be repeated to update the model. Although the concept of federated learning may seem straightforward, it's implementation and configuration is tricky, since it requires multiple systems working together. TensorFlow Federated, or TFF, offers a useful toolbox for this purpose. With TFF, you can simulate the federated learning environment quickly and apply complex novel algorithms. You can even use TFF for non-machine learning training purposes like computing the mean of all user behavior. This is called federated analytics. Federated learning technology sounds cool, but it still has some issues we need to tackle. For example, membership inference attack. This is a privacy-focused attack against machine learning models. In this attack, an adversary with access to the gradients or central model provider tries to determine whether a specific data record or data point was used to train the target model based on inferences from gradients. Sensitive property breach. This is a similar attack to membership inference attack, but involves the exposure of sensitive characteristics or patterns that the model has learned. This exposure comes from reconstructing sensitive features from gradients. Model poisoning. This occurs when a user who participates in the federated learning process wants to manipulate the model behavior and intentionally creates poisoned data points on its device in order to degrade the performance of the model, cause it to make incorrect predictions or behave in a way that benefits the attacker. Since the provider doesn't know the data itself, even if they apply anomaly detections on shared gradients, it is difficult to tell if a set of gradients came from a user with malicious intent or from a user with unique behavior. Although there is not a perfect solution that can solve all problems at once, the secure aggregation method can help you avoid membership inference attacks and sensitive property breaches. Secure aggregation is a cryptographic method used to aggregate multiple data in a secure way by encrypting data before it is sent to the server. Let's say we compute a sum of three data points from Emma, Takumi, and Nick. In secure aggregation, instead of simply adding the data up on the central server, the participants modify the values a little by adding a value shared with other participants. The pair two values add up to zero. In this case, Emma and Nick share a green value pair, Emma and Takumi share purple, and Takumi and Nick share orange. The server receives these perturbed values and aggregates them. The values don't affect the result of aggregation since the pairs add up to zero. At the same time, it is much harder for the server to reconstruct the original data because of the modifications. By adding secure aggregation, we can apply federated learning in a more secure way. You can also use differential privacy in federated learning as well. Clients can add noise to their gradients or the server can take care of it. By applying differential privacy in federated learning, you mitigate the risk of gradients revealing sensitive information of a specific user. In addition, you can make a more robust update strategy to avoid data poisoning. However, you should note that there is no perfect solution, and each technique has trade-offs between multiple factors such as privacy, performance, robustness, and fairness. If you apply large noise using differential privacy in order to provide stronger privacy, it may affect performance. Although differential privacy can make the process robust, it could mean the system deprioritized data from users that were unique or in the minority compared to the rest of the data. This could potentially lead to a bias issue. In summary, to ensure stronger privacy in machine learning models, it is important to understand the requirements of a system, then re-evaluate the system using multiple proper metrics and criteria.2. Let's practice!
Create Your Free Account
or
By continuing, you accept our Terms of Use, our Privacy Policy and that your data is stored in the USA.