Federated learning method protects privacy on curved spaces
Projection-Based Federated Learning on Compact Submanifolds with Geometry-Independent Differential Privacy
Machine Learning
Summary
Federated learning lets many devices train a shared model without sharing personal data, but updates can still reveal secrets. The paper presents a new way that carefully adds noise to protect privacy when the model's parameters live on curved shapes, called manifolds. This method works across different geometric settings without extra complexity and ensures strong privacy protections while still learning effectively. Tests show it improves privacy and performance on tasks like brain signal classification compared to older methods.
What this means in practice
- •For mobile app developers: Train privacy-preserving machine learning models on devices with parameters constrained to geometric manifolds without extra tuning per device.
- •For medical data teams: Improve privacy and accuracy of distributed learning on sensitive biomedical signals whose models involve manifold constraints like EEG classification.
Authors
Thibault Pautrel, Florent Bouchard, Guillaume Ginolhac, Ammar Mian, Aurélien Bellet
Abstract
Federated learning trains a shared model across clients without exchanging their data, yet the updates they transmit still leak information about individual records. Enforcing differential privacy is harder still when the model parameters lie on a Riemannian manifold. Existing methods rebuild the noise added for privacy in the geometry of each new iterate, aggregate through intrinsic maps that often lack a closed form, and prove convergence only in restricted regimes. We introduce DP-RFedProj, a record-level differentially private federated learning method for compact submanifolds that aggregates through closed-form projections and privatises gradients in a fixed ambient geometry. Each client may run any stochastic first-order optimiser, take several local steps, and participate only intermittently. An explicit record-level $f$-DP guarantee holds for the entire training transcript, independently of the manifold, the aggregation scheme and the local optimiser. We establish convergence of DP-RFedProj when each client runs Riemannian SGD locally and the server aggregates by projected averaging, and show that privacy enters the rate through a term scaling with the manifold's intrinsic dimension rather than the ambient one. Synthetic experiments on federated PCA over the Grassmann manifold corroborate these findings. On EEG motor-imagery classification with SPDNet, whose weights lie on the Stiefel manifold, the method outperforms a Euclidean baseline at every privacy budget considered. In both experimental settings, our accounting requires five to six times less noise than that of the closest prior method for the same budget, which translates into higher utility.