federated learning
In plain wordsTraining one shared AI model across many phones, hospitals or companies without collecting their data in one place: each trains on its own data and sends back only model updates.
A distributed training setting in which a model is learned from data held by many separate parties, such as millions of phones (cross-device) or a few hospitals or firms (cross-silo), without the data being pooled: raw examples stay with their owners, and only model updates go to a coordinating server. In each round a server sends the current model to a sample of clients, each runs a few steps of training on its own data, and the server combines the returned updates, typically by weighted averaging (federated averaging, FedAvg). Challenges include unevenly distributed (non-IID) data, unreliable clients and communication cost. Keeping data local is not itself a privacy guarantee: shared updates can leak training examples through gradient inversiongradient inversion attack, n.: Rebuilding someone's private training data — such as photos or text — just from the model updates their device shared during collaborative training., and malicious clients can poison the model. Deployments therefore add secure aggregationsecure aggregation, n.: A cryptographic trick that lets a server add up updates from many devices while learning only the total, never any single device's contribution., differential privacydifferential privacy, n.: A mathematical promise that the results of analyzing a dataset — or a model trained on it — would look almost the same whether or not any one person's data was included, so little can be learned about that person. and robust aggregation rules.
The keyboard's next-word model was improved with federated learning, so typed text never left users' phones.
Origin
Coined at Google: Brendan McMahan and colleagues' 'Communication-Efficient Learning of Deep Networks from Decentralized Data' (arXiv February 2016; AISTATS 2017) introduced federated averaging, and Jakub Konečný and colleagues' 2016 papers also used the name. A 2017 Google blog post and the Gboard mobile keyboard deployment made it widely known.
Usage note
Often described as 'privacy-preserving', but its protections depend on the added techniques and the threat model; the server, other clients or anyone seeing the final model may still learn about individual data.
Related
- secure aggregationsecure aggregation, n.: A cryptographic trick that lets a server add up updates from many devices while learning only the total, never any single device's contribution.
- differential privacydifferential privacy, n.: A mathematical promise that the results of analyzing a dataset — or a model trained on it — would look almost the same whether or not any one person's data was included, so little can be learned about that person.
- gradient inversion attackgradient inversion attack, n.: Rebuilding someone's private training data — such as photos or text — just from the model updates their device shared during collaborative training.
- data poisoningdata poisoning, n.: Sneaking bad examples into the data an AI learns from, so the finished model behaves as the attacker wants — badly overall, or wrongly only in special situations.
- privacy-preserving machine learningprivacy-preserving machine learning, n.: The family of techniques for training and using AI models while keeping the underlying personal or confidential data hidden — from adding careful noise to computing on encrypted data.
- local differential privacylocal differential privacy, n.: A privacy method in which each person's device scrambles their data with random noise before sending it anywhere, so the company collecting it never sees anyone's true answer but can still estimate overall trends.
Sources
- McMahan, H. B., Moore, E., Ramage, D., Hampson, S. & Agüera y Arcas, B. (2017). Communication-Efficient Learning of Deep Networks from Decentralized Data. AISTATS 2017. arXiv:1602.05629.
- Kairouz, P. et al. (2021). Advances and Open Problems in Federated Learning. Foundations and Trends in Machine Learning 14(1–2).
Mentioned in
privacyprivacy, n.: Your ability to control who knows what about you. AI raises new privacy questions because it learns from huge amounts of personal data and can infer things about people they never shared., data poisoningdata poisoning, n.: Sneaking bad examples into the data an AI learns from, so the finished model behaves as the attacker wants — badly overall, or wrongly only in special situations., differential privacydifferential privacy, n.: A mathematical promise that the results of analyzing a dataset — or a model trained on it — would look almost the same whether or not any one person's data was included, so little can be learned about that person., distributed trainingdistributed training, n.: Training one AI model on many computer chips at once, splitting up the data or the model itself among them and keeping them in sync, so that jobs that would take a single chip thousands of years finish in weeks., edge AIedge AI, n.: Doing AI's computing on or near the devices that collect the data, such as cameras, cars, factory machines, phones or local servers, instead of sending everything off to distant data centers., privacy-preserving machine learningprivacy-preserving machine learning, n.: The family of techniques for training and using AI models while keeping the underlying personal or confidential data hidden — from adding careful noise to computing on encrypted data., decentralized trainingdecentralized training, n.: Training an AI model on computers owned by many different people or companies around the world, linked over the ordinary internet rather than housed together in one data center., DiLoCoDiLoCo, prop. n.: A training method from Google DeepMind that lets groups of chips in different places train one language model while talking to each other hundreds of times less often than usual., gradient inversion attackgradient inversion attack, n.: Rebuilding someone's private training data — such as photos or text — just from the model updates their device shared during collaborative training., local differential privacylocal differential privacy, n.: A privacy method in which each person's device scrambles their data with random noise before sending it anywhere, so the company collecting it never sees anyone's true answer but can still estimate overall trends., local SGDlocal SGD, n.: A way to train on many machines that talk to each other only occasionally: each trains its own copy for a while, then they average their copies and continue, cutting the amount of communication needed., secure aggregationsecure aggregation, n.: A cryptographic trick that lets a server add up updates from many devices while learning only the total, never any single device's contribution., secure multi-party computationsecure multi-party computation, n.: Cryptographic methods that let several parties compute a result from their combined private data — say, an average salary — without any of them revealing its own data to the others.