Federated learning system improves privacy and model accuracy
Toward verifiably private learning from federated data
Cryptography and Security
Summary
Many devices collect private data that could help train smart computer programs, but sharing this data risks privacy. This paper describes a new system that lets devices safely contribute their data while keeping it private, using special secure computing areas called trusted execution environments. The system also lets anyone check that privacy rules are being followed. The authors show their system trains better models faster with stronger privacy protections than earlier methods, and it is already used for the Android Keyboard app.
What this means in practice
- •For mobile app developers: Build keyboard apps that train personalized models faster while ensuring user data privacy with verifiable protections.$Commercial implications: Enables development of privacy-preserving keyboard apps that improve accuracy and speed, a direct upgrade over prior privacy solutions.
- •For enterprise data teams: Implement secure, verifiable federated learning pipelines that optimize privacy and model quality despite device availability issues.
Authors
Katharine Daly, Yu Xiao, Zachary Garrett, Brett McLarnon, Jianpeng Hou, Arun Ganesh, Yanxiang Zhang, Noriyuki Takahashi, Haicheng Sun, Yuanbo Zhang, Timon Van Overveldt, Daniel Ramage
Abstract
Federated Learning (FL) allows devices with private data to collaborate in training a shared model. We present a next-generation FL system based on Trusted Execution Environments (TEEs) that addresses operational challenges associated with earlier systems and provides externally verifiable central Differential Privacy (DP) guarantees for the first time while offering a better privacy-utility tradeoff. In our system, devices upload data encrypted with keys managed by a TEE-hosted Key Management Service (KMS). The uploaded data is cryptographically tied to a policy limiting the set of Python programs that may later process the data in server-side TEEs. External parties may inspect public transparency logs to observe the set of workloads allowed by these policies. Our experimental results show that the new system improves device coverage and favorably shifts privacy-utility curves by enabling collected data to be integrated into the server-side workload at a schedule that optimizes DP guarantees and is unaffected by device availability. Our new system has been productionized, enabling models for the Android Keyboard (Gboard) to be trained faster and achieve better accuracy under smaller, now externally verifiable privacy budgets in comparison to models trained using the prior system.