An Adaptive Gradient Clipping and Noise Injection Mechanism for Differentially Private Federated Learning

arXiv:2608.15153v1 [cs.CR] 15 Aug 2026

An Adaptive Gradient Clipping and Noise Injection Mechanism for Differentially Private Federated Learning Wenjing Wei

Alla Jammine

Farid Nait-Abdesselam

Université Paris Cité wenjing.wei2026@outlook.com

Université Paris Cité alla.jammine@u-paris.fr

Université Paris Cité farid.nait-abdesselam@u-paris.fr

Abstract—Differentially private federated learning must balance privacy protection against model accuracy and training efficiency. Static gradient clipping applies a fixed threshold throughout training and across model layers, which can cause excessive clipping when the threshold is too small or unnecessarily large noise when it is too large. This paper presents DDP-SA-adaptive, an adaptive gradient clipping and noise adding mechanism for differentially private federated learning with secure aggregation. At each communication round, every client determines a separate clipping threshold for each model layer from the median of its per-sample gradient norms. The resulting layer-wise thresholds adapt to the evolving gradient distributions and calibrate the Laplace noise added before the updates are encoded and secretshared among intermediate aggregation servers. We evaluate the proposed mechanism on a federated regression task in terms of efficiency, accuracy, privacy, convergence, clipping norm, and noise magnitude. Compared with the static DDP-SA baseline, DDP-SA-adaptive reduces the number of communication rounds by 6.81%, total training time by 19.21%, and average perround training time by 13.33%, leading to improved training efficiency. It also reduces test loss by 98.74% and increases test R2 by 3.41%, leading to improved model accuracy. To attain R2 = 0.99, the adaptive mechanism operates with a privacy budget of approximately ϵ = 0.1, compared with ϵ = 0.4 for static DDP-SA, thus providing stronger privacy protection and achieving stronger privacy guarantees. These results demonstrate that round-wise, layer-wise adaptation can improve the privacyaccuracy-efficiency trade-off of differentially private federated learning. Index Terms—Federated Learning, Differential Privacy, Adaptive Gradient Clipping, Noise Injection, Secure Aggregation, Privacy-Accuracy-Efficiency Trade-off

I. I NTRODUCTION Machine learning has become a core technology for intelligent applications in computer vision, speech recognition, and natural language processing. In conventional centralized training, however, raw user data must be uploaded to a remote server, which raises serious privacy concerns when the data contain sensitive personal information [1]. Federated learning (FL) mitigates this risk by keeping private data on local devices and exchanging only model updates, such as parameters or gradients, so that multiple clients can collaboratively train a shared global model without centralizing their datasets [2]. Despite this design, recent studies have shown that shared updates can still leak private information through inference

attacks, including membership inference, attribute inference, and gradient inversion [3]–[5]. Differential privacy (DP) and secure multi-party computation (MPC) are two principal defenses against such attacks. DP protects individual records by injecting calibrated noise into local updates before they leave the client [6], but larger noise typically degrades model accuracy. MPC-based secure aggregation allows a server to obtain only the sum of client updates without observing any individual contribution [7], yet cryptographic protocols often incur substantial communication and computation overhead. Hybrid frameworks that combine local DP with secure aggregation, such as distributed differential privacy through secure aggregation (DDP-SA) [8], reduce the noise each client must add while still preventing the parameter server from inspecting individual updates. In such pipelines, gradient clipping is indispensable: it bounds the sensitivity of each update so that Laplace or Gaussian noise can be calibrated to a target privacy budget. Existing DP-FL systems, including static DDP-SA, typically employ a fixed clipping threshold for the entire model and for all communication rounds. A threshold that is too small clips informative gradients and slows convergence, whereas a threshold that is too large inflates the sensitivity and forces the client to inject excessive noise. Moreover, different layers of a neural network generally exhibit different gradient norm scales, so a single global threshold cannot match the local gradient distribution of every layer. Adaptive clipping methods have been studied in centralized and federated DP training [9]– [11], yet they are not directly tailored to a distributed DP setting in which noisy updates are subsequently encoded and secret-shared among intermediate aggregation servers. To address this gap, we propose DDP-SA-adaptive, an adaptive gradient clipping and noise injection mechanism for differentially private federated learning with secure aggregation. At each communication round, every client estimates a separate clipping threshold for each model layer from the median of its per-sample gradient norms, clips the corresponding layer gradients, and injects Laplace noise whose scale is calibrated to the adapted threshold and the allocated privacy budget. The noisy updates are then fixed-precision encoded and secret-shared for secure aggregation, preserving the end-to-end privacy pipeline of DDP-SA while adapting the

clipping-noise trade-off to the evolving training dynamics. The main contributions of this paper are summarized as follows: 1) We design a round-wise and layer-wise adaptive clipping mechanism for DP-FL with secure aggregation, in which each client sets the clipping threshold of each layer to the median of its current per-sample gradient norms. 2) We couple the adaptive thresholds with Laplace noise injection and per-round, per-layer privacy budget allocation, so that the noise scale tracks the local sensitivity without changing the secure aggregation workflow. 3) We empirically evaluate DDP-SA-adaptive against static DDP-SA on a federated regression task in terms of efficiency, accuracy, privacy, convergence, clipping norm, and noise magnitude. The results show fewer communication rounds, shorter training time, lower test loss, higher test R2 , and a smaller privacy budget for the same accuracy target. The remainder of this paper is organized as follows. Section II reviews related work on privacy-preserving federated learning, differential privacy, and adaptive clipping. Section III presents the system model and the proposed DDP-SA-adaptive mechanism. Section IV reports the experimental results. Section V concludes the paper. II. R ELATED W ORK Federated learning enables collaborative model training without centralizing raw data and has been widely adopted in privacy-sensitive domains such as healthcare, finance, and the Internet of Things [1], [2]. Nevertheless, exchanging model parameters or gradients remains vulnerable to privacy inference attacks. Prior work has shown that shared updates can leak sensitive attributes [12], enable adversarial reconstruction via generative models [13], or recover training samples from gradients [5], [14]. Membership inference and related threats further demonstrate that FL alone does not provide adequate privacy guarantees [3], [4]. These attacks motivate stronger defenses based on differential privacy, cryptography, or their combination. Differential privacy has become a standard tool for protecting FL updates [6], [15], [16]. Client-level and local DP mechanisms inject calibrated noise into gradients or parameters before aggregation, thereby limiting the influence of any individual record. Because noise magnitude is determined by sensitivity, gradient clipping is a necessary preprocessing step. Most early DP-FL systems use a fixed clipping threshold throughout training. Such a static threshold is difficult to tune: an overly small value discards useful signal, whereas an overly large value inflates sensitivity and forces excessive noise. Recent studies therefore explore adaptive noise or clipping schedules to improve the privacy-utility trade-off. Fu et al. [11] and Liu et al. [17] adapt the noise scale during federated training, while Andrew et al. [9] and McMahan et al. [10] adapt clipping thresholds online. Adaptive optimization and noise-aware training have also been investigated for nonIID and heterogeneous federated settings [18], [19]. These

approaches improve utility over naive static DP-FL, but they are typically designed for central or local DP pipelines in which the server observes individual (noisy) updates, rather than for a distributed DP setting with subsequent secure aggregation. Cryptographic techniques provide a complementary line of defense. Secure aggregation based on MPC allows the server to learn only the sum of client updates [7], while homomorphic encryption supports encrypted aggregation or training [20]. Hybrid schemes combine DP with secure computation to obtain both statistical privacy and cryptographic confidentiality [21]. In particular, DDP-SA integrates client-side Laplace perturbation with full-threshold additive secret sharing across intermediate servers, so that the parameter server reconstructs only an aggregated noisy update [8]. This design strengthens end-to-end privacy relative to LDP or MPC alone. However, the original DDP-SA pipeline still relies on a single static clipping threshold applied to the entire gradient vector in every round. As a result, it cannot track the contraction of gradient norms during training, nor the heterogeneous gradient scales across neural network layers. Overall, existing work either adapts clipping and noise outside a secure aggregation pipeline, or combines DP with secure aggregation under static sensitivity control. DDP-SAadaptive addresses this gap by embedding round-wise, layerwise median-based clipping and correspondingly calibrated Laplace noise into the DDP-SA workflow. The adaptive thresholds remain local to each client, while the noisy updates continue to be encoded and secret-shared for secure aggregation, thereby improving the privacy-accuracy-efficiency tradeoff without altering the aggregation architecture. III. M ETHOD OF R ESEARCH This section presents the system model and threat model, the proposed DDP-SA-adaptive mechanism, and the associated privacy analysis. The overall workflow follows the three-layer DDP-SA architecture of clients, intermediate servers, and a parameter server [8]. The key difference is that each client replaces the static clipping threshold with round-wise, layerwise median-based clipping and correspondingly calibrated Laplace noise. A. System Model and Threat Model We consider n clients C = {C1 , . . . , Cn }, m intermediate servers S = {S1 , . . . , Sm }, and one parameter server (PS). Client Ci holds a private local dataset Di of size Ni and never uploads raw samples. The global model is parameterized by θ = {θ(1) , . . . , θ(L) }, where θ(l) denotes the parameters of Pn layer l ∈ {1, . . . , L}. Let N = i=1 Ni denote the total number of training samples. Unlike conventional two-party FL with only clients and a PS, the intermediate server layer enables secure aggregation via full-threshold additive secret sharing (ASS). At each communication round, every client first privatizes its local update with calibrated Laplace noise, encodes the noisy update with fixed precision encoding, and decomposes the encoded vector

into m additive shares. Each intermediate server receives one share per client, sums the shares it holds, and forwards only the partial aggregate to the PS. The PS reconstructs the global aggregate after collecting all m partial sums, updates the model, and broadcasts the new parameters to the clients. We adopt a semi-honest (honest-but-curious) adversary model: clients, intermediate servers, and the PS follow the protocol correctly, but may attempt to infer private information from observed messages. We assume authenticated channels and that an adversary may corrupt at most f < m intermediate servers. Under full-threshold ASS, any strict subset of shares is information-theoretically independent of the secret. Confidentiality degenerates only if an adversary obtains all m shares, which is an inherent limitation of full-threshold secure aggregation [7]. The security goal is that no individual client update is revealed in transit or at the PS; the PS observes only the reconstructed aggregate of already privatized updates. B. Problem Setup At round t, client Ci receives the current model θt and computes per-sample gradients (l)

gt (x) = ∇θ(l) L(θt , x)

(1)

t

for each layer l and each local sample x ∈ Di . In static DDPSA, a single fixed clipping threshold ∆ is applied to the entire gradient vector in every round. If ∆ is too small, informative gradients are over clipped; if ∆ is too large, sensitivity is overestimated and the Laplace noise becomes unnecessarily large. Moreover, different layers typically exhibit different gradient norm scales, so one global threshold cannot match every layer. DDP-SA-adaptive therefore determines a separate clipping threshold for each client, round, and layer from local gradient statistics.

D. Adaptive Noise Injection and Secure Aggregation Let ϵtotal denote the total privacy budget. We first allocate a per-round budget ϵt = ϵtotal /T and then split it uniformly across layers, (l)

ϵt =

(2)

denote the multiset of per-sample ℓ1 gradient norms. The adaptive clipping threshold is defined as (l) (l)
∆t,i = median Gt,i . (3) Each per-sample gradient is then clipped by (l)

(l)

g t (x) =

gt (x) (l)

max 1,

∥gt (x)∥1

!,

(4)

(l)

∆t,i (l)

(l)

which guarantees ∥g t (x)∥1 ≤ ∆t,i . The client forms the layer-wise summed gradient X (l) (l) g t (x). Gt,i = (5) x∈Di

Applying this procedure independently to every layer yields (1) (L) thresholds ∆t,i , . . . , ∆t,i that typically decrease as training progresses and gradient magnitudes contract.

l = 1, . . . , L.

(6)

After clipping, client Ci injects independent Laplace noise into each layer’s summed gradient and averages by the local sample size: !! (l) ∆t,i 1 (l) (l) e Gt,i + Lap 0, (l) . (7) Gt,i = Ni ϵt (l)

Conditioned on ∆t,i , this is the standard Laplace mechanism (l) (l) with sensitivity ∆t,i and privacy parameter ϵt , and therefore (l) satisfies ϵt -local differential privacy for layer l at round t. The client concatenates all layer-wise noisy updates into a et , encodes it by fixed precision scaling factor single vector g SF = 10dn , et,encoded = round(e g gt · SF),

(8)

and secret-shares the encoded vector among the m intermediate servers. Each intermediate server sums the received shares and sends the partial aggregate to the PS. The PS reconstructs ! m X ∇θagg = ∇θagg,j mod p, (9) j=1

decodes by dividing by SF, and updates the global model by θt+1 = θt − η ·

C. Adaptive Layer-wise Clipping For client Ci , round t, and layer l, let  (l) (l) Gt,i = ∥gt (x)∥1 : x ∈ Di

ϵt , L

Ni · ∇θagg . N

(10)

The complete procedure is summarized in Algorithm 1. Relative to static DDP-SA, only the clipping and noise calibration steps change; the encoding and secure aggregation workflow remains unchanged. E. Privacy Analysis Across layers within one round, basic composition yields at most ϵt -DP. Over T rounds, the overall local mechanism inherits the same multi-round privacy bound as static DDP-SA under the chosen composition theorem [6], [8]. Secure aggregation is deterministic post-processing of already privatized updates and therefore introduces no additional privacy loss, while still preventing the PS from observing any individual client update. IV. P ERFORMANCE E VALUATION This section evaluates DDP-SA-adaptive against static DDP-SA and a No-Private baseline in terms of efficiency, accuracy, privacy, convergence, clipping norms, and noise magnitude.

Algorithm 1 DDP-SA-adaptive Input: the set of clients C = {C1 , C2 , . . . , Cn }, the number of training rounds T , the global model parameters θ = {θ(1) , . . . , θ(L) }, the set of intermediate servers S = {S1 , S2 , . . . , Sm }, the total privacy budget ϵtotal , the number of samples Ni for client Ci , the learning rate η, the total number of samples N all clients posses, the large prime number p, the loss function L, the gradient ∇θ(l) L (θt , xj ) of the loss t

13:

(l)

(l)

t

(l)

Gt,i ← Gt,i ∪ {∥gt (xj )∥1 } end for (l) (l) ∆t,i ← median(Gt,i ) for each sample xj ∈ Di do (l) (l) gt (xj ) ←!gt (xj ) (l)

/ max 1, 14: 15: 16: 17:

gt (xj )

1

(l)

∆t,i

(l)

∇θ(l) ← ∇θ(l) + gt (xj ) end for (l) ϵt ← ϵt /L ▷ uniformper-layer allocation (l) ∆t,i (l) 1 (l) g̃t ← Ni ∇θ + Lap 0, (l) ϵt

end for (l) 19: Concatenate all g̃t into a single vector g̃t 20: SF ← 10dn 21: g̃t,encoded ← round(g̃t · SF) 22: shares ← Ci .secret share(g̃t,encoded , S) 23: for each share shares[j] do 24: send shares[j] to Sj 25: end for 26: end for 27: for each server Sj in parallel do 28: ∇θagg,j ←sum of shares received at Sj 29: send ∇θagg,j to the PS 30: end for P
m 31: ∇θagg ← j=1 ∇θagg,j mod p ∇θ 32: ∇θagg ← SFagg i 33: θt+1 ← θt − η · N N · ∇θagg 34: end for 35: return θT 18:

Metric

No-Private

DDP-SA

DDP-SA-adaptive

Communication Rounds Parameters Uploaded Total Time (min) Avg Time (s)

2082 3 112 6.46

2436 9 203 10.00

2270 9 164 8.67

(l)

function L with respect to the model parameters θt of layer l, the fixed precision scaling factor SF, the number of decimal places dn you want to preserve Output: the trained global model θT 1: for each round t = 0, 1, . . . , T − 1 do 2: PS broadcasts current model parameters θt to all clients 3: ϵt ← ϵtotal /T ▷ uniform per-round allocation 4: for each client Ci in parallel do 5: for each layer l = 1, . . . , L do (l) 6: ∇θ(l) ← 0, Gt,i ← ∅ 7: for each sample xj ∈ Di do (l) 8: gt (xj ) ← ∇θ(l) L(θt , xj ) 9: 10: 11: 12:

TABLE I E FFICIENCY C OMPARISON UNDER D IFFERENT D EFENSIVE M ECHANISMS

A. Experimental Setup Experiments were implemented in Python using PyTorch 1.4.0 and PySyft 0.2.9 on GitHub Codespaces (16 cores, 64GB RAM, and 128GB storage). We generated a 10000 × 2 array whose samples were drawn from a uniform distribution and constructed the labels as y = x1 +x2 +1, thereby yielding a federated linear regression task. The data were split into training, validation, and test sets in a ratio of 60%, 20%, and 20%, respectively, and the training set was partitioned evenly across clients under an IID setting. The model was a two-layer neural network with two input neurons and one output neuron. (l) The per-round, per-layer privacy budget was set to ϵt = 0.1, and the number of decimal places was set to dn = 10. NoPrivate used SGD with a learning rate of 0.1, whereas DDPSA and DDP-SA-adaptive used Adam with a learning rate of 0.001. Static DDP-SA employed a fixed clipping threshold, whereas DDP-SA-adaptive used the round-wise, layer-wise median-based clipping method described in Algorithm 1. Due to the randomness of DP noise, the reported results were averaged over multiple runs. We compared DDP-SA-adaptive with static DDP-SA under the same secure aggregation architecture. B. Efficiency Analysis We measure communication cost by the number of communication rounds until convergence and by the number of parameters uploaded per client per round, and measure computation cost by total training time and average per-round time. Table I summarizes the results. No-Private converges in 2082 rounds, while DDP-SA and DDP-SA-adaptive require 2436 and 2270 rounds, respectively. Thus, DDP-SA-adaptive reduces the round count of static DDP-SA by 6.81%. Both DDP-SA and DDP-SA-adaptive upload 9 parameters per client when m = 3, compared with 3 for No-Private, because each encoded coordinate is split into three secret shares. In computation, No-Private, DDP-SA, and DDP-SA-adaptive spend 112 minutes, 203 minutes, and 164 minutes in total, and 6.46 seconds, 10.00 seconds, and 8.67 seconds per round on average. Relative to static DDP-SA, the adaptive mechanism therefore reduces total time by 19.21% and average per-round time by 13.33%. Hence, the DDP-SA-adaptive mechanism significantly reduces both communication and computational costs compared to the original DDP-SA mechanism, leading to improved training efficiency. C. Accuracy Analysis Table II report test loss and test R2 . No-Private attains nearzero test loss (10−12 ) and R2 = 0.9999. Static DDP-SA yields

TABLE II ACCURACY C OMPARISON UNDER D IFFERENT D EFENSIVE M ECHANISMS Metric

No-Private

DDP-SA

DDP-SA-adaptive

3.5

Test Loss Test R2

10−12 0.9999

0.0055 0.9666

6.9354 × 10−5 0.9996

3.0

No-Private DDP-SA DDP-SA-adaptive

Train loss

2.5

1.000

2.0 1.5

0.995

1.0 R² = 0.99

0.990

Test R2

ε ≈ 0.1

ε ≈ 0.4

0.5 0.0

0.985

0 0.980

250

500 750 1000 1250 1500 Number of communication rounds

1750

2000

Fig. 2. Train loss under different number of communication rounds.

0.975

0.970 DDP-SA DDP-SA-adaptive 0.965

0.1

0.2

0.3 0.4 Privacy budget ε

0.5

0.6

Fig. 1. Test R2 versus privacy budget ϵ. The red dashed line marks R2 = 0.99.

test loss 0.0055 and R2 = 0.9666, whereas DDP-SA-adaptive reduces the test loss to 6.9354 × 10−5 (98.74% lower) and increases R2 to 0.9996 (3.41% higher), approaching the NonPrivate baseline. Hence, the DDP-SA-adaptive mechanism significantly reduces test loss and increases test R2 compared to the original DDP-SA mechanism, leading to improved model accuracy.

Fig. 3. Clipping norm of the gradients of the Bob’s weights vs number of communication rounds.

D. Analysis of Privacy Protection Strength Fig. 1 plots test R2 against the privacy budget ϵ ∈ [0.1, 0.6]. Smaller ϵ corresponds to stronger privacy protection. DDPSA-adaptive remains close to R2 ≈ 1 across the entire range, whereas static DDP-SA degrades markedly under tight budgets. To reach the target R2 = 0.99, static DDP-SA requires ϵ ≈ 0.4, while DDP-SA-adaptive already meets the target at ϵ ≈ 0.1. Hence, for the same accuracy goal, the adaptive mechanism operates under a substantially smaller privacy budget, thus providing stronger privacy protection and achieving stronger privacy guarantees. E. Analysis of Convergence, Clipping Norm, and Noise Magnitude We further examine why adaptation improves efficiency and accuracy. Practical rounds to convergence are 1041 for NoPrivate, 1218 for DDP-SA, and 1135 for DDP-SA-adaptive, and the adaptive curve also attains a lower train loss at convergence, as shown in Fig. 2. Fig. 3 shows that the medianbased clipping norm of client Bob decreases rapidly over rounds as gradient magnitudes contract. Because the Laplace (l) (l) scale is proportional to ∆t,i /ϵt , the injected noise follows the same trend: raw noise samples fluctuate locally, but the

Fig. 4. Noise magnitude added to the gradient of the weight w1 of Bob versus communication rounds. Shaded curves show raw noise; navy curves show EMA-smoothed trends.

EMA-smoothed trajectories (EMA = 0.99) decline steadily, as illustrated in Fig. 4 and Fig. 5. Consequently, late stage updates are less distorted, which accelerates convergence and im-

Fig. 5. Noise magnitude added to the gradient of the weight w2 of Bob versus communication rounds. Shaded curves show raw noise; navy curves show EMA-smoothed trends.

proves final accuracy without changing the secure aggregation workflow. The reason for the above conclusion is that DDPSA-adaptive adopts an adaptive gradient clipping and noise injection mechanism, which uses the median of the norms of the unclipped samples’ gradients in the current training round as the clipping norm. Over the course of training, the train loss decreases gradually, and the predicted label becomes closer to the true label, leading to a decrease in the norm of each sample’s gradient. As a result, the clipping norm decreases gradually, which causes the required noise level to decrease as well. Therefore, DDP-SA-adaptive requires fewer communication rounds to achieve convergence and achieves higher model accuracy than DDP-SA. V. C ONCLUSION In this paper, we presented DDP-SA-adaptive, an adaptive gradient clipping and noise injection mechanism for differentially private federated learning with secure aggregation. Building on the DDP-SA pipeline, each client replaces a static clipping threshold with a round-wise, layer-wise median of per-sample gradient norms and calibrates Laplace noise accordingly, while preserving fixed precision encoding and additive secret sharing for secure aggregation. Extensive experiments on a federated regression task show that compared to the original DDP-SA, the proposed DDP-SAadaptive significantly improves training efficiency and model accuracy while preserving stronger privacy guarantees. Analyses of clipping norms and noise magnitudes further confirm that both quantities decrease as training progresses, which explains the faster convergence and higher final accuracy. Extending the study to deeper architectures and non-IID FL benchmarks is an important direction for future work. R EFERENCES [1] Q. Yang, Y. Liu, T. Chen, and Y. Tong, “Federated machine learning: Concept and applications,” ACM Transactions on Intelligent Systems and Technology (TIST), vol. 10, no. 2, pp. 1–19, 2019.

[2] B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Artificial intelligence and statistics. PMLR, 2017, pp. 1273– 1282. [3] M. Nasr, R. Shokri, and A. Houmansadr, “Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning,” in 2019 IEEE symposium on security and privacy (SP). IEEE, 2019, pp. 739–753. [4] P. Kairouz, H. B. McMahan, B. Avent, A. Bellet, M. Bennis, A. N. Bhagoji, K. Bonawitz, Z. Charles, G. Cormode, R. Cummings et al., “Advances and open problems in federated learning,” Foundations and Trends® in Machine Learning, vol. 14, no. 1–2, pp. 1–210, 2021. [5] L. Zhu, Z. Liu, and S. Han, “Deep leakage from gradients,” in Proceedings of the 33rd International Conference on Neural Information Processing Systems, 2019, pp. 14 774–14 784. [6] C. Dwork and A. Roth, “The algorithmic foundations of differential privacy,” Foundations and Trends® in Theoretical Computer Science, vol. 9, no. 3–4, pp. 211–407, 2014. [7] K. Bonawitz, V. Ivanov, B. Kreuter, A. Marcedone, H. B. McMahan, S. Patel, D. Ramage, A. Segal, and K. Seth, “Practical secure aggregation for privacy-preserving machine learning,” in proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, 2017, pp. 1175–1191. [8] W. Wei, F. Nait-Abdesselam, and A. Jammine, “Ddp-sa: Scalable privacy-preserving federated learning via distributed differential privacy and secure aggregation,” arXiv preprint arXiv:2604.07125, 2026. [9] G. Andrew, O. Thakkar, B. McMahan, and S. Ramaswamy, “Differentially private learning with adaptive clipping,” Advances in Neural Information Processing Systems, vol. 34, pp. 17 455–17 466, 2021. [10] B. McMahan, A. Thakurta, S. Deng, and H. Li, “Adaptive clipping and privacy budgeting in differentially private federated learning,” in Proceedings of the 40th International Conference on Machine Learning. PMLR, 2023, pp. 23 650–23 668. [11] J. Fu, Z. Chen, and X. Han, “Adap dp-fl: Differentially private federated learning with adaptive noise,” in 2022 IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom). IEEE, 2022, pp. 656–663. [12] L. Melis, C. Song, E. De Cristofaro, and V. Shmatikov, “Exploiting unintended feature leakage in collaborative learning,” in 2019 IEEE symposium on security and privacy (SP). IEEE, 2019, pp. 691–706. [13] B. Hitaj, G. Ateniese, and F. Perez-Cruz, “Deep models under the gan: information leakage from collaborative deep learning,” in Proceedings of the 2017 ACM SIGSAC conference on computer and communications security, 2017, pp. 603–618. [14] J. Geiping, H. Bauermeister, H. Dröge, and M. Moeller, “Inverting gradients-how easy is it to break privacy in federated learning?” Advances in neural information processing systems, vol. 33, pp. 16 937– 16 947, 2020. [15] K. Wei, J. Li, M. Ding, C. Ma, H. H. Yang, F. Farokhi, S. Jin, T. Q. Quek, and H. V. Poor, “Federated learning with differential privacy: Algorithms and performance analysis,” IEEE Transactions on Information Forensics and Security, vol. 15, pp. 3454–3469, 2020. [16] J. Fu, Y. Hong, X. Ling, L. Wang, X. Ran, Z. Sun, W. H. Wang, Z. Chen, and Y. Cao, “Differentially private federated learning: A systematic review,” arXiv preprint arXiv:2405.08299, 2024. [17] Y. Liu, X. Chen, J. Xu, and X. Luo, “Adaptive noise injection for differential privacy in federated learning,” IEEE Internet of Things Journal, vol. 9, no. 13, pp. 10 234–10 245, 2022. [18] L. Chen, X. Ding, Z. Bao, P. Zhou, and H. Jin, “Differentially private federated learning on non-iid data: Convergence analysis and adaptive optimization,” IEEE Transactions on Knowledge and Data Engineering, vol. 36, no. 9, pp. 4567–4581, 2024. [19] S. Malekmohammadi, Y. Yu, and Y. Cao, “Noise-aware algorithm for heterogeneous differentially private federated learning,” in Proceedings of the 41st International Conference on Machine Learning, 2024, pp. 34 461–34 498. [20] Y. Aono, T. Hayashi, L. Wang, S. Moriai et al., “Privacy-preserving deep learning via additively homomorphic encryption,” IEEE transactions on information forensics and security, vol. 13, no. 5, pp. 1333–1345, 2017. [21] P. Kairouz, Z. Liu, and T. Steinke, “The distributed discrete gaussian mechanism for federated learning with secure aggregation,” in International Conference on Machine Learning. PMLR, 2021, pp. 5201–5212.

Related documents

• An Adaptive Gradient Clipping and Noise Injection Mechanism for Differentially Private Federated Learning#612579
• An Adaptive Gradient Clipping and Noise Injection Mechanism for Differentially Private Federated Learning#611102
• Turning Privacy-preserving Mechanisms against Federated Learning#177333
• Auditing Privacy Defenses in Federated Learning via Generative Gradient Leakage#177295
• Statistical Limits and Efficient Algorithms for Differentially Private Federated Learning#200490