differential privacy in federated learning

**Differential Privacy (DP) in Federated Learning** is the **application of formal DP guarantees to federated training** — adding calibrated noise to gradient updates so that the shared model update does not reveal whether any specific data point was in a client's training set. **DP-FL Mechanisms** - **User-Level DP**: Each client's entire contribution is protected — the model is indistinguishable regardless of whether a specific client participated. - **Record-Level DP**: Each individual training example is protected — stronger but harder to achieve. - **Clipping**: Clip gradient norms to bound sensitivity: $g_k leftarrow g_k cdot min(1, C / |g_k|)$. - **Noising**: Add Gaussian noise: $g_k + N(0, sigma^2 C^2 I)$ calibrated to the privacy budget ($epsilon, delta$). **Why It Matters** - **Formal Guarantee**: DP provides mathematical, information-theoretic privacy guarantees — unlike heuristic anonymization. - **Gradient Inversion**: FL without DP is vulnerable to gradient inversion attacks — DP prevents this. - **Trade-Off**: Stronger privacy ($epsilon$ closer to 0) = more noise = lower model accuracy. **DP in FL** is **mathematical privacy for federated learning** — formally guaranteeing that gradient updates do not leak individual training examples.