14.4.4: Privacy-Preserving Analytics (Differential Privacy, Federated Learning)

Privacy-Preserving Analytics (Differential Privacy, Federated Learning)

Privacy concerns have spurred techniques that allow analytics without exposing individual data. Differential privacy (Dwork, 2006) is a mathematical framework that adds controlled noise to query results so that any single individual’s data cannot be inferred [13]. Tech companies use this for user analytics: for example, Apple applies differential privacy in its device analytics to learn aggregate trends (e.g. popular emoji usage) “without revealing individual behavior”. In practice, user devices send randomized (noisy) signals so that only collective insights emerge, protecting personal data. Differential privacy is also used in GDPR-compliant analytics: a retailer could compute customer spend distributions with DP to ensure no one’s exact purchases are revealed.

Federated learning is a related trend where the model comes to the data, not vice versa. Instead of uploading raw data to a central server, models train locally on user devices and only send back model updates (gradients or parameters). This approach, pioneered by Google (McMahan et al., 2017), enables collaborative learning while keeping user data on-device [14]. For example, Google’s mobile keyboard learns next-word predictions from millions of phones without collecting users’ typing data. In business analytics, federated learning can let multiple hospitals jointly train a disease prediction model without sharing patient records. The original federated learning work emphasizes its decentralized nature: “we advocate leaving the training data distributed on the mobile devices, and learn a shared model by aggregating locally-computed updates”. This dramatically improves privacy and reduces data transfer, at the cost of more complex coordination.

Figure \(\PageIndex{1}\): Federated Learning Process. Depicts the iterative cycle of federated learning where local devices train models on private data, send only model updates to a central server for aggregation, and receive the improved global model back — without raw data ever leaving the device. (CC BY 4.0; Felix Amoruwa) Access to a detailed description of Figure \(\PageIndex{1}\)