Privacy-Preserving Federated Learning via Normalized (instead of Clipped) Updates

Differentially private federated learning (FL) entails bounding the sensitivity to each client’s update. The customary approach used in practice for bounding sensitivity is to clip the client updates, which is just projection onto an `2 ball of some radius (called the clipping threshold) centered at the origin. However, clipping introduces bias depending on the clipping threshold and its impact on convergence has not been properly analyzed in the FL literature. In this work, we propose a simpler alternative for bounding sensitivity which is normalization, i.e. use only the unit vector along the client updates, completely discarding the magnitude information. We call this algorithm DP-NormFedAvg and show that it has the same order-wise convergence rate as FedAvg on smooth quasar-convex functions (an important class of non-convex functions for modeling optimization of deep neural networks) modulo the noise variance term (due to privacy). Further, assuming that the per-sample client losses obey a strong-growth type of condition, we show that with high probability, the sensitivity reduces by a factor of O( 1 m ), where m is the minimum number of samples within a client, compared to its worst-case value. Using this high probability sensitivity value enables us to reduce the iteration complexity of DP-NormFedAvg by a factor of O( 1 m2 ), at the expense of an exponentially small degradation in the privacy guarantee. We also corroborate our theory with experiments on neural networks.