Privacy versus Robustness in Federated Learning: Limits and Algorithms
summary
Proves a tight lower bound: any algorithm that is both locally differentially private and robust to an f fraction of malicious participants incurs an unavoidable excess error that includes a coupling penalty = corruption_fraction × privacy_cost (beyond separate privacy and robustness costs). Builds matching algorithms using robust high‑dimensional mean estimation plus variance reduction (Polyak momentum) and an efficient shared‑randomness protocol with pairwise canceling shares, achieving rates that interpolate between central DP and local DP and empirically match central DP‑SGD when f is small.
AI-written summary · about
chapters (6)
- 0:00Privacy and robustness intro
- 3:32Failure modes in ML
- 10:55Robustness and privacy goals
- 18:24Trade-offs in local DP
- 20:48Shared randomness for privacy
- 25:34Summary and future
related talks
17mData privacy and reliable learning
09mFrom Robustness to Privacy and Back
16mDP-BREM: Differentially-Private and Byzantine-Robust Federated Learning...
37mUser-level and federated local differential privacy
43mDifferential Privacy Meets Robust Statistics
12mDistribution-Free Robustness
29mBalancing Thin Line Between Data Intelligence & Privacy
33mHeterogeneity and Privacy in Modern Learning