HOW IT WORKS
Local models, one shared model
The ICO describes parties training local models on their own information, then combining the patterns they found, known as gradients, into a single global model.
What is shared?Start
HOW LOCAL TRAINING WORKS
Send the model out,
keep the data home.
Most AI is trained by gathering data in one place.
Federated learning turns that round. A copy of the model trains on each phone, hospital or office, and only what it learned is combined into one shared model. The raw data never has to be pooled.
DATA STAYS PUTupdates travel
Check what is sharedKeep in mind
- Train on each device
- Share updates, not data
- Add more protection
- Federated learning in three ideas
THE SHORT ANSWER
The model travels,
the data does not.
Three things to know about federated learning,
from the research and the ICO.
ON PHONES
Idle, charging, on Wi-Fi
In a large production system described by its engineers, a phone only joins a training task when it is idle, charging and on an unmetered network such as Wi-Fi.
See the numbers
THE CATCH
Updates can still reveal
The ICO warns that shared updates may indirectly expose private information, and advises combining federated learning with other privacy-enhancing technologies.
The risksA QUICK SHARING CHECK
What leaves
the device?
Pick a way of training a shared model to see what the guidance and research say about it. The bar shows how much personal information is exposed.
Based on ICO guidance on privacy-enhancing technologies and the research papers listed below. General information, not legal advice.
TWO NUMBERS WORTH KNOWING
Fewer rounds,
millions of devices.
One figure from the paper that named federated learning,
one from a system built to run it.
10–100× fewer
Fewer communication rounds than synchronised SGD
The 2016 paper that coined the term found that averaging locally trained models cut the communication rounds needed by 10 to 100 times, across five model types and four datasets.
COMMUNICATION · MCMAHAN ET AL.
Tens of millions
Real-world devices in a production system
Engineers described a federated learning system for mobile devices used on applied problems over tens of millions of real-world devices, with populations ranging from tens of devices in development to hundreds of millions.
SCALE · BONAWITZ ET AL. 2019
The original paper identifies communication cost, not computing power, as the principal constraint for training across phones.
FOUR QUESTIONS TO ASK
Is it really
private by design?
The ICO's guidance suggests a handful of checks for any organisation using federated learning. They make good questions for anyone reading a privacy claim, too.
Step 1
What exactly is shared?
Model updates or gradients can still carry information about the data they came from.
Step 2
Is there a coordination server?
Centralised designs need a trusted party; decentralised ones avoid a single point of failure.
Step 3
Which other protections are added?
Look for secure aggregation, homomorphic encryption or differential privacy alongside it.
Step 4
Are the connections secured?
The ICO points to secure protocols such as TLS to stop eavesdropping and tampering.
WHY UPDATES ARE NOT ANONYMOUS
Gradients can
give data away.
For a long time people believed gradients were safe to share. A 2019 study showed it is possible to recover private training data from shared gradients, pixel-wise accurate for images and token-wise matching for text.
That is why the ICO says federated learning alone may not protect personal information, and that it reduces risk best alongside other privacy-enhancing technologies.
Questions
Questions on the way
What is federated learning?
A way of training a shared AI model across many devices or organisations. Each trains a local copy on its own data and sends back what it learned, which is combined into a global model without pooling the raw data.
Who invented the term?
It was introduced in a 2016 paper, Communication-Efficient Learning of Deep Networks from Decentralized Data, which proposed leaving training data on mobile devices and averaging locally computed updates.
Has it been used on phones?
Yes. A study trained a next-word prediction model for a smartphone keyboard on devices and found better prediction recall than server-based training, without exporting sensitive user data.
Does federated learning make data anonymous?
No. The ICO says local models can still contain personal information and shared updates can indirectly expose it, so it should be combined with other privacy-enhancing technologies.
Is it cheaper than central training?
Not always. The ICO says decentralised federated learning can be cheaper but still has significant computational cost, which may make it unsuitable for very large processing operations.
Destination
Where the facts come from
- ICO: Privacy-enhancing technologies, federated learning
- McMahan et al. (2016), Communication-Efficient Learning of Deep Networks from Decentralized Data, arXiv
- Bonawitz et al. (2019), Towards Federated Learning at Scale: System Design, arXiv
- Hard et al. (2018), Federated Learning for Mobile Keyboard Prediction, arXiv
- Zhu et al. (2019), Deep Leakage from Gradients, arXiv
Updated