Federated learning (FL) is a paradigm that allows several client devices and
a server to collaboratively train a global model, by exchanging only model
updates, without the devices sharing their local training data. These devices
are often constrained in terms of communication and computation resources, and
can further benefit from model pruning -- a paradigm that is widely used to
reduce the size and complexity of models. Intuitively, by making local models
coarser, pruning is expected to also provide some protection against privacy
attacks in the context of FL. However this protection has not been previously
characterized, formally or experimentally, and it is unclear if it is
sufficient against state-of-the-art attacks.
In this paper, we perform the first investigation of privacy guarantees for
model pruning in FL. We derive information-theoretic upper bounds on the amount
of information leaked by pruned FL models. We complement and validate these
theoretical findings, with comprehensive experiments that involve
state-of-the-art privacy attacks, on several state-of-the-art FL pruning
schemes, using benchmark datasets. This evaluation provides valuable insights
into the choices and parameters that can affect the privacy protection provided
by pruning. Based on these insights, we introduce PriPrune -- a privacy-aware
algorithm for local model pruning, which uses a personalized per-client defense
mask and adapts the defense pruning rate so as to jointly optimize privacy and
model performance. PriPrune is universal in that can be applied after any
pruned FL scheme on the client, without modification, and protects against any
inversion attack by the server. Our empirical evaluation demonstrates that
PriPrune significantly improves the privacy-accuracy tradeoff compared to
state-of-the-art pruned FL schemes that do not take privacy into account.

我们对模型剪枝技术在联邦学习中隐私保证进行了第一次研究，推导出了剪枝模型泄露信息量的信息论上界，并通过实验验证了这些理论发现，结果显示我们提出的 PriPrune 算法显著改善了隐私和模型性能的平衡。