IEEE Consumer Electronics Magazine - September/October 2021 - 95

The privacy budget " limits the bounds of privacy
loss and the slack variable d allows the definition
break with a given probability.
The general way to realize this mechanism is to
add Gaussian noise to approximate a real-value
function f : D!R with differential privacy. The
noise is calibrated to sensitivity Sf,which is the
maximum value of the absolute distance
jfðdÞ fðd
Þj. fðdÞ and fðd Þ are function values
corresponding to the adjacent input d and d ,
respectively. We define a Gaussian noise addition
mechanism as MðdÞ¼ fðdÞþNð0;Sf
Nð0;Sf
2s2Þ,where
2s2Þ is the Gaussian distributed noise with
mean 0 and standard deviation Sfs.
Motivation
The privacy-preserving federated learning
can be realized by leveraging differential privacy,4
which effectively reduce the possibility to
infer extra information through data transferred
in each training round. Ideally, it requires a
trusted server to complete the noise addition
operation. In the real-world training process, we
consider the following situations.
The server is curious: The server can normally
complete the privacy processing steps, such as
noise addition after FedAvg. At the same time,
it wants to infer the private data of clients.
The server is incompetent: The servermay fail to
add noise into the averaged updates for some
reason before releasing the global model. It
puts all participating clients under great risks
of privacy leakage.
Due to the deficiency of centralized privacypreserving
approach, we adjust the client-selection
mechanism and shifting the noise addition
to client side in order to reduce the dependence
on the server. In the context of FedAvg, we are
more interested in the weights difference contributed
by each client. In this way, the noise
contained in the aggregation is the sum of the
noise added by each client. It will satisfies differential
privacy if each client process satisfies.3
STATE OF THE ART
Instead of collecting data from clients and
training the model on the server in a centralized
way, federated learning allows multiple clients to
learn a model collaboratively while keeping data
locally. It provides a new solution for preserving
September/October 2021
privacy in machine learning. Google first proposed
federated learning,2 a privacy-preserving
collaborative modeling mechanism. They applied
federated learning to the input prediction and
query suggestions of Gboard.5;6 Konecny et al. 7
used structured updates and model compression
to reduce uplink and downlink communication
costs. Bonawitz et al. proposed a protocol user
to improve the robustness of federated learning.8
However, they did not consider the privacy
risks of the federated learning mechanism.
The research of Fredrikson et al.
9 show that
after training, sample data involved in the model
training can be reconstructed via model parameters,
even if data are remained locally. To minimize
such disclosure, Geyer et al. 4 incorporated differential
privacy in the aggregation update on the server
side. Differential privacy can indeed reduce the correlation
between final model and aggregated
updates. However, it is a postprocessing method
with some limitations. Dealing with the results of
FedAvg directly and ignoring the training process
may reduce the usability of the model and increase
the difficulty of observing the true expression of
raw data for noises. Moreover, such approach
ignores the protection of the updates transmitted
during the communication, making the model vulnerable
to inversion attacks. Agarwal et al. 10 proposed
to add noise distributedly to approximate
global privacy. Wei et al. 11 applied this method in
federated learning. The global model will satisfy differential
privacy when each part satisfies. However,
the noise addition is performed by the server. Such
privacy preservation is invalid for untrusted servers.
Some researchers 12;13 incorporated homomorphic
encryption into federated learning. For such
encryption-based method, local updates are transmitted
and calculated in the form of ciphertext.
Therefore, it can well preserve the privacy without
losing model accuracy. However, the calculation
types supported by homomorphic encryption are
limited. For ciphertext, the encryption/decryption
and the calculation of it are with great computation
overhead.14 The transmission of it is also time consuming.
These limitations make the approach
impractical tobe used in IoE.
PROPOSED METHOD
System Design
Considering the diversity of devices, we uniformly
term the actual devices in IoE as clients
95
IEEE Consumer Electronics Magazine - September/October 2021

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - September/October 2021
