Computing epsilon for Federated Learning with differential Privacy

[google-research]

Computing epsilon for Federated Learning with differential Privacy

[kairouzp]

With respect to your first question, you should set T = FLAGS.total_rounds. T is the number of federated rounds, which is captured by FLAGS.total_rounds.

With respect to your second question, there are a few things you need to be aware of. (1) The sampling probability needs to be small enough for you to get a meaningful epsilon. How many clients do you have per round? If it's around 50, then you should get a reasonable sampling probability. (2) The noise multiplier has to be around 1 for you to get reasonable epsilon. What noise multiplier are you using?

[codaibk]

r you to get a meaningful epsilon. How many clients do you have per round?

Thanks for your quick reply, I think my sampling probability is small enough (2/100= 0.02). I use 2 clients/100 clients per round. The noise multiplier I play with : 0.1,0.2,0.3, 0.5 (for 0.5 my accuracy result is already bad, so I don't play it more). Could you update your code with calculating epsilon? I think it will be quick? But it will helpful for everyone wants to follow.

[kairouzp]

It seems that you may be calculating the sampling probability wrong. The sampling probability is equal to the number of clients per round divided by the total number of clients in the dataset. If you are choosing 2 clients per round and your dataset has around 3,000 clients, then the sampling probability should be 2/3000. Having said that, applying user-level differential privacy with only 2 clients per round is extremely challenging. This explains why you can't go beyond a noise multiplier of 0.5. Did you try to increase the number of clients per round? Can you try using 50? That should allow you to scale up the noise multiplier to something larger than 0.5 (hopefully closer to 1).

With respect to adding how we compute epsilon, this is a good suggestion. I will discuss it internally. For now though, you can use the following.

from tensorflow_privacy.privacy.analysis.rdp_accountant import compute_rdp  
from tensorflow_privacy.privacy.analysis.rdp_accountant import get_privacy_spent

def get_eps(q, noise_multiplier, steps, target_delta, orders):
  rdp = compute_rdp(q=q, noise_multiplier=noise_multiplier, steps=steps, orders=orders)
  eps, delta, _ = get_privacy_spent(orders, rdp, target_delta=target_delta)
  return eps

orders = [2, 3, 4, 5, 6, 7, 8, 10, 11, 12, 14, 16, 20, 24, 28, 32, 64, 256]
number_clients = 3012 # Set this to the number of clients in the dataset you are using
q= FLAGS.clients_per_round / number_clients 
noise_multiplier = FLAGS.noise_multiplier 
steps = FLAGS.total_rounds
target_delta = 1e-5

eps = get_eps(q, noise_multiplier, steps, target_delta, orders)

[codaibk]

It seems that you may be calculating the sampling probability wrong. The sampling probability is equal to the number of clients per round divided by the total number of clients in the dataset. If you are choosing 2 clients per round and your dataset has around 3,000 clients, then the sampling probability should be 2/3000. Having said that, applying user-level differential privacy with only 2 clients per round is extremely challenging. This explains why you can't go beyond a noise multiplier of 0.5. Did you try to increase the number of clients per round? Can you try using 50? That should allow you to scale up the noise multiplier to something larger than 0.5 (hopefully closer to 1).

With respect to adding how we compute epsilon, this is a good suggestion. I will discuss it internally. For now though, you can use the following.

from tensorflow_privacy.privacy.analysis.rdp_accountant import compute_rdp  
from tensorflow_privacy.privacy.analysis.rdp_accountant import get_privacy_spent

def get_eps(q, noise_multiplier, steps, target_delta, orders):
  rdp = compute_rdp(q=q, noise_multiplier=noise_multiplier, steps=steps, orders=orders)
  eps, delta, _ = get_privacy_spent(orders, rdp, target_delta=target_delta)
  return eps

z

orders = [2, 3, 4, 5, 6, 7, 8, 10, 11, 12, 14, 16, 20, 24, 28, 32, 64, 256]
number_clients = 3012 # Set this to the number of clients in the dataset you are using
q= FLAGS.clients_per_round / number_clients
noise_multiplier = FLAGS.noise_multiplier
steps = FLAGS.total_rounds
target_delta = 1e-5

eps = get_eps(q, noise_multiplier, steps, target_delta, orders)

Thanks for your reply. My dataset includes 3012 images (not 3012 clients) which separated into 100 clients. Therefore my sampling probability is correct with 2/100 (2 clients per round). Anyway, I will check with larger number of clients per round as you mentioned. Thanks for your suggestion.