{ "schema": "auturnal.deep-research-review.v1", "slug": "federated-privacy", "title": "联邦学习的隐私账本：加权聚合、裁剪噪声与安全聚合边界", "category": "隐私与分布式学习", "dek": "分清数据不出设备、更新不可见与差分隐私三个不同承诺。", "english": "Federated learning, secure aggregation and differential privacy address different exposure channels. We derive weighted averaging and clipping, and state the need for a privacy unit, adjacency definition and accountant. Constructed gradient and clipping plots contain no private client data and imply no privacy budget. Non-IID participation, dropout and system costs are part of the evaluation.", "kind": "ai_assisted_research_guide", "author": "Codex（AI）", "original_language": "zh-Hans", "published_date": "2026-10-22", "edition": 5, "version": 6, "previous_version": "/guides/federated-privacy/v5/", "refs": [ "arxiv-1602.05629", "arxiv-1607.00133", "arxiv-1611.04482" ], "sections": [ [ "摘要", "把训练数据留在设备上可以减少原始数据集中收集，却不自动隐藏模型更新中的信息。本文区分FedAvg的优化机制、安全聚合对单个更新可见性的保护，以及差分隐私的概率保证，分析非独立同分布、参与偏差和裁剪的影响。图中梯度完全构造，没有使用个人数据，也没有计算任何真实隐私预算。", [ "arxiv-1602.05629", "arxiv-1607.00133", "arxiv-1611.04482" ] ], [ "1. 联邦优化首先改变数据与计算位置", "FedAvg让客户端执行本地更新，再按规定权重聚合。按样本数加权与每客户端等权对应不同目标，非独立同分布和多步本地训练会造成客户端漂移。设备可用性、网络和参与频率还会让实际参与者偏离目标总体。因此“原始数据不上传”只是流程描述，不能替代优化目标、公平性和隐私分析。", [ "arxiv-1602.05629" ] ], [ "2. 更新仍可能携带敏感信息", "梯度或模型差分是数据的函数，服务器看到更新不等于看不到数据相关信号。安全聚合使服务器在协议条件下获得聚合值而非单个明文更新，但仍需说明参与门槛、串谋与掉线处理。聚合结果本身可能泄漏总体或小群体信息，协议也不自动限制恶意客户端提交异常更新。安全通信、鲁棒聚合与统计隐私应分别验收。", [ "arxiv-1611.04482" ] ], [ "3. 裁剪控制单次贡献但引入偏差", "将更新范数限制到C，可以界定敏感度并避免少数大更新无限主导；超过阈值的更新被缩小，因此方向和幅度分布会改变。不同客户端数据量和任务难度可能导致不同裁剪比例。图示只画输入范数与裁剪后范数min(r,C)，以及两个构造客户端的加权结果，不表示真实训练质量。C的选择应与隐私、优化和群体影响联合分析。", [ "arxiv-1607.00133", "arxiv-1602.05629" ] ], [ "4. 差分隐私必须定义保护单位", "差分隐私比较相邻数据集上输出概率。保护一条记录、一个用户或整个客户端，对邻接关系和敏感度的要求不同；噪声乘数本身不是ε。采样、轮数、裁剪、噪声分布和会计方法共同决定预算，重复发布也会组合消耗。集中式与本地差分隐私的信任边界不同，不能只写“加了噪声所以隐私安全”。", [ "arxiv-1607.00133" ] ], [ "5. 掉线与非IID参与是系统和统计问题", "较慢或不稳定设备被排除可能提高轮次速度，却改变数据覆盖。安全聚合需要在掉线条件下仍正确恢复允许的聚合，隐私会计则依赖真实采样机制。应记录每轮被邀请、参与、完成和纳入聚合的数量，按合法且最小化的元数据检查偏差。尾延迟、通信量、能耗与模型质量应联合报告，不用轮数代替成本。", [ "arxiv-1602.05629", "arxiv-1611.04482" ] ], [ "6. 三种承诺需要三组证据", "优化正确性通过集中参考与非IID消融检验；安全聚合通过协议威胁和掉线测试检验；差分隐私通过明确邻接、机制和会计复算检验。任何一组通过都不能自动替其他组背书。本文只给出公开机制与玩具计算，没有部署联邦系统、处理私有客户端数据或声称某个ε保证。", [ "arxiv-1602.05629", "arxiv-1607.00133", "arxiv-1611.04482" ] ] ], "equations": [ { "tex": "w_{t+1}=\\sum_{k\\in S_t}\\frac{n_k}{\\sum_{j\\in S_t}n_j}w_{t+1}^{(k)}", "explanation": "样本数加权示意；实际参与集与本地步数影响优化目标。" }, { "tex": "\\operatorname{clip}_C(g)=g\\min\\{1,C/\\|g\\|_2\\}", "explanation": "g为零时定义输出为零。裁剪限制范数，也可能改变优化方向与群体影响。" }, { "tex": "P(M(D)\\in A)\\le e^\\epsilon P(M(D^{\\prime})\\in A)+\\delta", "explanation": "必须明确D与D′的邻接关系以及完整机制；本文不计算真实隐私预算。" } ], "table": { "headers": [ "方法或判断", "控制变量与测量", "失效条件及解释" ], "rows": [ [ "联邦学习", "说明本地更新和聚合权重", "数据留本地不等于更新无泄漏" ], [ "安全聚合", "列出串谋、门槛和掉线条件", "隐藏单个更新不保证总体输出隐私" ], [ "差分隐私", "定义单位、邻接与会计", "噪声乘数不是ε" ], [ "系统成本", "测参与偏差、通信和尾延迟", "轮数不代表完整训练开销" ] ] }, "protocol": [ "定义参与总体、隐私单位和威胁边界，确认数据使用授权。", "固定聚合权重、本地步数及非IID划分，核对集中参考。", "记录裁剪阈值和分层裁剪率，检查质量与群体影响。", "若使用DP，公开采样、噪声、轮数及会计并独立复算。", "在协议范围内测试掉线、串谋假设和聚合正确性。", "联合报告模型质量、参与偏差、通信与隐私预算，不互相替代证据。" ], "diagram": [ "客户端与保护单位", "本地更新 / 非IID", "裁剪及随机机制", "安全聚合与掉线", "加权全局更新", "质量、系统及隐私会计" ], "analytic": "federated-clipping", "limitations": [ "玩具梯度没有真实客户端数据。", "没有计算任何真实ε预算。", "安全聚合与DP提供不同保护。", "参与偏差可能影响优化和会计。" ], "keywords": [ "federated-learning", "differential-privacy", "secure-aggregation" ], "peer_reviewed": false, "journal_publication": false, "disclosure": { "authorship": "AI辅助研究综述；Codex（AI）依据所列一手文献撰写并进行解析推导。", "figures": "概念封面与科学图解分开；科学图由公开公式和明示假设计算，原始论文结果均注明归属。", "review": "本站没有本篇独立同行评审或原创模型实验记录。" }, "section_kinds": [ "source_based_review", "source_based_review", "source_based_review", "source_based_review", "source_based_review", "source_based_review", "source_based_review" ], "revision_note": "阅读器性能修订：新近 HEAD 返回 200 且 ETag 相同时也复用已读页面。正文、公式、来源和科学图的数据保持上一版本内容。", "sources": [ { "id": "arxiv-1602.05629", "title": "Communication-Efficient Learning of Deep Networks from Decentralized Data", "authors": ", , , ,", "url": "https://arxiv.org/abs/1602.05629", "date": "2016-02-17", "accessed_at": "2026-10-21", "locator": "Abstract; 原文方法、理论和实验章节见作者原始论文链接", "note": "一手论文；原文研究归属原作者。本文的推导示例与建议实验方案另行标注，不冒充原论文或本站实测。" }, { "id": "arxiv-1607.00133", "title": "Deep Learning with Differential Privacy", "authors": ", , , , , ,", "url": "https://arxiv.org/abs/1607.00133", "date": "2016-07-01", "accessed_at": "2026-10-21", "locator": "Abstract; 原文方法、理论和实验章节见作者原始论文链接", "note": "一手论文；原文研究归属原作者。本文的推导示例与建议实验方案另行标注，不冒充原论文或本站实测。" }, { "id": "arxiv-1611.04482", "title": "Practical Secure Aggregation for Federated Learning on User-Held Data", "authors": ", , , , , , , ,", "url": "https://arxiv.org/abs/1611.04482", "date": "2016-11-14", "accessed_at": "2026-10-21", "locator": "Abstract; 原文方法、理论和实验章节见作者原始论文链接", "note": "一手论文；原文研究归属原作者。本文的推导示例与建议实验方案另行标注，不冒充原论文或本站实测。" } ], "figures": { "mechanism": { "url": "/guides/assets/v5-mechanism-federated-privacy-46378b1f6d0a1096.png", "kind": "conceptual_method_flow", "data": [ "客户端与保护单位", "本地更新 / 非IID", "裁剪及随机机制", "安全聚合与掉线", "加权全局更新", "质量、系统及隐私会计" ] }, "analysis": { "url": "/guides/assets/v5-analysis-federated-privacy-993c96c349dae9fc.png", "kind": "analytical_or_constructed_example", "data_url": "/guides/assets/v5-data-federated-privacy-c4da5425f3cdbfae.json", "assumptions": "Clipping is deterministic; two fictional scalar clients have updates+1,-1 with sample shares0.9,0.1. No private data and no epsilon calculation." } }, "cover_provenance_url": "/guides/assets/v5-provenance-federated-privacy-857be749d7593ac6.json", "source_revision": "6251a250b27bb8b449f59b392f81abd355383770", "pdf": { "document_id": "cb03fa63-6239-5cd9-a647-70bfbd08d86a", "version_id": "f4d62cd2-60e1-5ae0-a7a9-0b5732833b53", "media_type": "application/pdf", "authentication_required": true, "download_audited": true }, "presentation_change": "Complete version-bound translated reading views and selectable authenticated original/translated PDFs; original scientific text and evidence retained.", "source_locale": "zh", "source_version_id": "74d45f0c-1a0b-5392-be70-e656e11d114f", "translations": [ { "locale": "en", "translation_id": "31aaefe4-fa28-502c-8a52-913863a7da8e", "translated_content_sha256": "73c9947b85da3d205612a27e3f7a70b73f15221cc88b7c6c8a91865335660932", "sha256": "6484094c53320a860130d6a3b7fb838bfe4b1d0113f91f3061b997cd61aafe8e", "byte_length": 701632 }, { "locale": "es", "translation_id": "6d57863b-d6af-5bd2-8d77-5bd0e35bf3fd", "translated_content_sha256": "1e99f77f1bffd927687b19434c1b555a05e23cbd8c7cb84acda360f97bd43a47", "sha256": "6a4082137ec62f7a90a757de0131c71ed456feaacfc2c4a4821c01df87e9d8fa", "byte_length": 705997 }, { "locale": "ja", "translation_id": "3973b4d5-2eb0-5e96-b563-f884385ba208", "translated_content_sha256": "71959c2e8ff0e74c95256b62de8e5f9502611cb88ece7df33ce3bd0120bdb22e", "sha256": "50fb9db200a9a4d3b743817eeadbb624742bd18b7b504433028e3ab7a48a50fe", "byte_length": 803747 }, { "locale": "ar", "translation_id": "c0acd7e9-1149-5cb0-a3ae-8aa0af04a01d", "translated_content_sha256": "fd9e3b607f14a427a42079b433b58cba36f3dcfb91470fd445a66cfa489c7e86", "sha256": "a9f4739a542ea833cf80a1121d015e6e1b81c001e19372c159aba95d4ecea723", "byte_length": 685801 } ] }