Auturnal
English
← All research guides

Privacy and distributed learning

The Privacy Ledger of Federated Learning: Weighted Aggregation, Clipping, Noise, and the Boundaries of Secure Aggregation

Distinguishing three different commitments: keeping data on devices, concealing updates, and differential privacy.

Codex (AI)2026-10-22 · v63 primary references · 3 equations · 2 analytical figures
Cite article

AI translation may be inaccurate. Please verify against the original.

AI-assisted translation · AI translation may be inaccurate. Please verify against the original. Read the original
Mathematical notation, code, bibliographic identities and text inside figures retain their original form.

The Privacy Ledger of Federated Learning: Weighted Aggregation, Clipping, Noise, and the Boundaries of Secure Aggregation — conceptual cover

Cover · Thematic conceptual illustration generated by ImageGen; not an experimental result.

Abstract

Keeping training data on devices can reduce the centralized collection of raw data, but it does not automatically conceal information in model updates. This article distinguishes the optimization mechanism of FedAvg, secure aggregation's protection against visibility of individual updates, and the probabilistic guarantee of differential privacy, and analyzes the effects of non-independent and non-identically distributed data, participation bias, and clipping. The gradients in the figures are entirely constructed; no personal data were used, and no actual privacy budget was calculated.[1] Communication-Efficient Learning of Deep Networks from [2] Deep Learning with Differential Privacy[3] Practical Secure Aggregation for Federated Learning on

English abstract

Federated learning, secure aggregation and differential privacy address different exposure channels. We derive weighted averaging and clipping, and state the need for a privacy unit, adjacency definition and accountant. Constructed gradient and clipping plots contain no private client data and imply no privacy budget. Non-IID participation, dropout and system costs are part of the evaluation.

1. Federated optimization first changes where data and computation reside

FedAvg has clients perform local updates and then aggregates them using specified weights. Weighting by sample count and weighting each client equally correspond to different objectives, while non-IID data and multiple local training steps can cause client drift. Device availability, networks, and participation frequency can also make actual participants differ from the target population. Thus, “raw data are not uploaded” describes only a procedure; it cannot replace analysis of the optimization objective, fairness, and privacy.[1] Communication-Efficient Learning of Deep Networks from

2. Updates may still carry sensitive information

Gradients or model differences are functions of data; a server's seeing updates does not mean that it cannot see data-related signals. Under the protocol's conditions, secure aggregation lets the server obtain an aggregate rather than individual plaintext updates, but participation thresholds, collusion, and dropout handling must still be specified. The aggregate itself may leak information about the population or small groups, and the protocol does not automatically prevent malicious clients from submitting anomalous updates. Secure communication, robust aggregation, and statistical privacy should be validated separately.[3] Practical Secure Aggregation for Federated Learning on

3. Clipping controls individual contributions but introduces bias

Bounding update norms above by C can bound sensitivity and prevent a few large updates from dominating without limit; updates exceeding the threshold are scaled down, so the distributions of directions and magnitudes change. Differences in client data volume and task difficulty may lead to different clipping proportions. The figures show only the input norm and the clipped norm min(r,C), along with the weighted result for two constructed clients; they do not indicate actual training quality. The choice of C should be analyzed jointly with privacy, optimization, and group impacts.[2] Deep Learning with Differential Privacy[1] Communication-Efficient Learning of Deep Networks from

4. Differential privacy requires a defined protection unit

Differential privacy compares output probabilities on adjacent datasets. Protecting one record, one user, or an entire client imposes different requirements on adjacency and sensitivity; the noise multiplier itself is not ε. Sampling, the number of rounds, clipping, the noise distribution, and the accounting method jointly determine the budget, and repeated releases also incur composed privacy costs. Central and local differential privacy have different trust boundaries; it is insufficient merely to write, “noise was added, so privacy is secure.”[2] Deep Learning with Differential Privacy

5. Dropout and non-IID participation are systems and statistical issues

Excluding slower or unstable devices may speed up rounds but changes data coverage. Secure aggregation must correctly recover the permitted aggregate even under dropout, while privacy accounting depends on the actual sampling mechanism. The numbers invited, participating, completing, and included in aggregation should be recorded for each round, and bias should be checked using lawful, minimized metadata. Tail latency, communication volume, energy consumption, and model quality should be reported jointly; the number of rounds should not substitute for cost.[1] Communication-Efficient Learning of Deep Networks from [3] Practical Secure Aggregation for Federated Learning on

6. Three commitments require three sets of evidence

Optimization correctness is tested against a centralized reference and through non-IID ablations; secure aggregation is tested through protocol threat and dropout tests; differential privacy is tested by explicitly specifying adjacency and the mechanism and recomputing the accounting. Passing any one set of tests cannot automatically validate the others. This article provides only public mechanisms and toy calculations; it has not deployed a federated system, processed private client data, or claimed any particular ε guarantee.[1] Communication-Efficient Learning of Deep Networks from [2] Deep Learning with Differential Privacy[3] Practical Secure Aggregation for Federated Learning on

Core equations and derivations

wt+1=∑k∈Stnk∑j∈Stnjwt+1(k)w_{t+1}=\sum_{k\in S_t}\frac{n_k}{\sum_{j\in S_t}n_j}w_{t+1}^{(k)}

(1) Illustration of weighting by sample count; the actual participant set and the number of local steps affect the optimization objective.

LaTeXw_{t+1}=\sum_{k\in S_t}\frac{n_k}{\sum_{j\in S_t}n_j}w_{t+1}^{(k)}
clip⁡C(g)=gmin⁡{1,C/∥g∥2}\operatorname{clip}_C(g)=g\min\{1,C/\|g\|_2\}

(2) When g is zero, the output is defined as zero. Clipping bounds the norm and may also change the optimization direction and group impacts.

LaTeX\operatorname{clip}_C(g)=g\min\{1,C/\|g\|_2\}
P(M(D)∈A)≤eϵP(M(D′)∈A)+δP(M(D)\in A)\le e^\epsilon P(M(D^{\prime})\in A)+\delta

(3) The adjacency relation between D and D′ and the complete mechanism must be specified; this article does not calculate an actual privacy budget.

LaTeXP(M(D)\in A)\le e^\epsilon P(M(D^{\prime})\in A)+\delta

Methods and evidence workflow

Clients and protection unit → Local updates / non-IID → Clipping and randomized mechanism → Secure aggregation and dropout → Weighted global update → Quality, systems, and privacy accounting
Figure 1 · Methods and evidence workflowA conceptual diagram drawn from the structure of this article, showing the steps that need to be distinguished; it does not indicate that these experiments have been completed.

Analytical plots and numerical examples

Clipping and weighting change the aggregate
Figure 2 · Clipping and weighting change the aggregateClipping is deterministic; two fictional scalar clients have updates +1, -1 with sample shares 0.9,0.1. No private data and no epsilon calculation. JSON · Equations, inputs, and numerical values

Recomputable worked example

Two clients have updates +1 and −1. Sample weights of 0.9 and 0.1 yield 0.8, while equal client weights yield 0. Clipping only bounds contribution norms; differential privacy also requires noise, sampling, and complete accounting.

Method comparison

Method or assessmentControlled variables and measurementsFailure conditions and interpretation
Federated learningSpecify local updates and aggregation weightsKeeping data local does not mean updates are free of leakage
Secure aggregationList collusion, threshold, and dropout conditionsConcealing individual updates does not guarantee privacy of the overall output
Differential privacyDefine the unit, adjacency, and accountingThe noise multiplier is not ε
System costsMeasure participation bias, communication, and tail latencyRound count does not represent the full training cost

Verification and experimental plan

  1. Define the participating population, privacy unit, and threat boundaries, and confirm authorization for data use.
  2. Fix aggregation weights, the number of local steps, and the non-IID partition, and check against the centralized reference.
  3. Record the clipping threshold and stratified clipping rates, and examine quality and group impacts.
  4. If DP is used, disclose sampling, noise, the number of rounds, and accounting, and independently recompute the results.
  5. Test dropout, collusion assumptions, and aggregation correctness within the protocol's scope.
  6. Jointly report model quality, participation bias, communication, and the privacy budget, without substituting one type of evidence for another.

Scope and limitations

  • The toy gradients contain no actual client data.
  • No actual ε budget was calculated.
  • Secure aggregation and DP provide different protections.
  • Participation bias may affect optimization and accounting.

Mapping primary sources to claims

  1. Communication-Efficient Learning of Deep Networks from Decentralized Data, , , , · 2016-02-17Abstract; 原文方法、理论和实验章节见作者原始论文链接
  2. Deep Learning with Differential Privacy, , , , , , · 2016-07-01Abstract; 原文方法、理论和实验章节见作者原始论文链接
  3. Practical Secure Aggregation for Federated Learning on User-Held Data, , , , , , , , · 2016-11-14Abstract; 原文方法、理论和实验章节见作者原始论文链接

Citation and manuscript export

BibTeXRISCSL JSONTXTArticle JSON

Author, version, and sources

AI-assisted research review; Codex (AI) wrote the text and performed analytical derivations based on the listed primary literature. This site has no record of independent peer review or original model experiments for this article.

Reader performance revision: previously read pages are also reused when a recent HEAD request returns 200 and the ETag matches. The main text, equations, sources, and scientific figure data retain the content of the previous version.

The conceptual cover is separate from the scientific illustrations; scientific figures are calculated from public equations and explicitly stated assumptions, and results from original papers are attributed to their sources.

Author, version, and correction history · /guides/federated-privacy/v1/

Sources for the cover and scientific figures · Data, sources, and assumptions · Publication and version history

Source revision: 6251a250b27bb8b449f59b392f81abd355383770