{'fraction_non_alphanumeric': 0.03297322205724233, 'fraction_numerical': 0.008908914034099637, 'mean_word_length': 4.870754433423505, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Secure Distributed/Federated Learning: Prediction-Privacy Trade-Off for Multi-Agent System

Decentralized learning is an efficient emerging paradigm for boosting the computing capability of multiple bounded computing agents. In the big data era, performing inference within the distributed and federated learning (DL and FL) frameworks, the central server needs to process a large amount of data while relying on various agents to perform multiple distributed training tasks. Considering the decentralized computing topology, privacy has become a first-class concern. Moreover, assuming limited information processing capability for the agents calls for a sophisticated \textit{privacy-preserving decentralization} that ensures efficient computation. Towards this end, we study the \textit{privacy-aware server to multi-agent assignment} problem subject to information processing constraints associated with each agent, while maintaining the privacy and assuring learning informative messages received by agents about a global terminal through the distributed private federated learning (DPFL) approach. To find a decentralized scheme for a two-agent system, we formulate an optimization problem that balances privacy and accuracy, taking into account the quality of compression constraints associated with each agent. We propose an iterative converging algorithm by alternating over self-consistent equations. We also numerically evaluate the proposed solution to show the privacy-prediction trade-off and demonstrate the efficacy of the novel approach in ensuring privacy in DL and FL.


I. INTRODUCTION
Understanding uncertain and highly-dynamic environments requires processing in real-time a plethora of large volume of heterogeneous streaming data (e.g., audio, text, video) in a multi-agent fashion (i.e., relying on the collaboration among a team of autonomous agents). In such multi-agent scenarios, the computational complexity has evolved from simple binary object detection to more complex recognition of anomalous (e.g., malicious) activity, localization of mission-relevant entities, actors and targets, inference and prediction of their functions and intentions.
Recent research in distributed multi-agent computing led to introducing the Distributed and Federated Learning (DL and FL) as an emerging machine learning paradigms that use decentralization. On one hand, DL has been widely studied in several works [1]- [3]. Many distributed optimization-based algorithms have been proposed to enhance the performance during the training process [4]- [7]. Based on the topology algorithms, the decentralized learning algorithms can be classified into two categories (fixed topology algorithms [8] and random authors contributed equally. The life-cycle of a secure DL/FL trained model involving K multi-agent system aiming at making inference task. First, the global server forwards the training data to untrustworthy agents upon revealing limited information T 1 to T K and creating minimum inter-agent data sharing. Then, the agents perform local computation, the server aggregates all models to update the global model to be forwarded to all agents. The last two steps will be performed iteratively during the training process. topology algorithms [9]). On the other hand, FL involves training statistical models over decentralized devices [10]- [13]. Contrary to conventional learning algorithms where the training model is computed using a central server, the FL framework proposes a collaborative training model where multiple clients are involved to train the model while the training data is decentralized. More specifically, a central server distributes training data into individual agents and then build a global model based on locally-computed model by every agent. Along with the ongoing research in DL and FL, the reasoning about privacy in the real-world deployment is also rising. In the multi-agent scenario, the privacy concerns arise at the server level when the data center is bound to use computing agents that are untrustworthy. For example, government possessing private health records of citizens wish to distribute the data to computing agents such that they cannot recover the complete information. In another situation, a private firm intending to hire foreign computing centers does not wish to reveal the entire data, but carefully distribute it across various centers. In addition, they want to minimize the chances of foreign collaborations for reconstructing the various partly revealed data. Especially, in the case of an adversarial attack from an outsider, DL and FL have to ensure the privacy, as a defense mechanism against attacks. The limited information transmission can be achieved by soft-clustering of the available data at the data-centers to introduce blurriness. However, the introduced compression (limiting information) often reduces the predictive quality of the data to make inference. Consequently, the problem of privacy-assurance in FL context while achieving good prediction has to be addressed carefully.

A. Related work
As discussed above, decentralization mitigates some privacy guarantees resulting from discarding the conventional centralized learning assumption. This challenge has motivated many researchers to tackle the privacy problem in FL. Privacy assurance techniques widely used in machine learning are data anonymisation [14], differential privacy (DP) [15], secure multi-party computation (SMC) [16], and homomorphic encryption [17]. In fact, the various proposed approaches to solve the privacy concerns in FL can be classified into two categories; global privacy where the central server is trusted, and local privacy where the central server might be malicious. Indeed, the privacy problem in FL has been addressed using the SMC protocol. In [18], the authors introduce a protocol where the central server is not able to see any local updates, but can still observe the exact aggregated results at each round. Another solution is to use DP which is most widely used privacy approach in machine learning [19]- [25]. The main advantage of DP is that it provides information theoretic guarantees about the data privacy. This technique helps in restraining the knowledge on whether a data sample is involved in the learning process or not. In [26], the authors introduced compression techniques added to DP for limiting the communication between multiples agents while performing stochastic gradient descent during the learning process. In this context, we address the trade-off between privacy and prediction in decentralized scenario via the distributed private FL (DPFL) formulation. More specifically, we propose a novel technique to be used in DL/FL to ensure privacy and to protect data effectively. The objective of the paper is to design an optimal scheme for forwarding the data (i.e., representations of relevant information) from a server to an untrustworthy multi-agent system under privacy constraints. This proposed approach is a key step that has to be done at the server level before performing DL/FL to preserve data privacy against any adversarial attacks. The privacy at the server level is achieved via (i) transmitting limited information to the individual untrustworthy agents (compression), and (ii) ensuring minimum inter-agent data sharing, relying on the principle that "the fewer information sharing between the system's components, the higher its privacy". The privacy is constrained by the requirement of collective information from the agents to recover relevant statistics for the inference task.

B. Motivation and Contribution
In the big data era, the DL and FL paradigms seem promising for improving learning from tremendous complex data streams. However, a critical design issue for decentralized architectures is privacy, especially when the data server does not wish to reveal the entire information to a computing agent. In this paper, we present an information-theoretic framework (i.e., DPFL) that investigates the prediction-privacy trade-off in DL and FL, in an untrustworthy multi-agent system. More specifically, our work deals with the model shown in Fig.1, where a server is trying to create a blurry representation of the data for K untrustworthy agents. Each representation that will be sent to every agent has to (i) satisfy a compression constraint, (ii) minimize the inter-agent data sharing (i.e., we assume that different agents can share the same information up to a given level of privacy to inhibit harmful collaboration), and (iii) carry only relevant information about the data Y of a given terminal. This framework can serve as a first step towards designing a more sophisticated algorithm applicable in cryptography. Besides, our focus in this work is on a multi-agent system with K " 2, although the case of a larger number of agents can be considered and studied similarly as described below by adding the appropriate constraints.
The main contributions are; (i) We present a new approach to tackle the problem of privacy in DL/FL, through the DPFL formulation. (ii) For privacy, we perform soft-clustering of the server's data for processing by the multi-agent system. (iii) For the special case of a Gaussian distribution, we provide closedform expressions for the iterative procedure.

II. PROBLEM FORMULATION
In this section, we formulate the DPFL optimization problem for an architecture consisting of two-agents (i.e., K " 2). We aim at finding the optimal stochastic mappings T 1 and T 2 (related to agents 1 and 2, respectively), that the server should perform. The aim of the server is to reveal limited information to each individual agents (to ensure privacy), as well as, ensure minimum data sharing between T 1 and T 2 to prevent evil collaboration for possible data breach (i.e., by minimizing the mutual information of T 1 and T 2 ). At the same time, the information should be well distributed in the multi-agent setup to ensure collective prediction accuracy for inference task.

A. Optimization Problem Setup
Given that the agents are untrustworthy in the multi-agent scenario, our goal is to design two compact representations T 1 and T 2 from the data X to predict Y. In what follows, since T 1 and T 2 are mappings of X, we use the conditional independence conditions T 1 K X ztT 1 u|X, T 2 K X ztT 2 u|X where X is the set of all random variables except X. Similarly, since X has the original information for Y, we take Y K X ztYu|X.
The T 1 and T 2 are such that limited information is revealed individually, which we achieve through bounding the information terms IpX; T 1 q, IpX; T 2 q (i.e., guaranteeing a compression level at each agent). Additionally, to prevent malicious behavior from the collaboration of untrustworthy agents (also, to defend the entire system against an adversarial attack that may affect one agent and propagates progressively to remaining agents), we limit the correlation by forcing IpT 1 ; T 2 q to meet a certain requirement in order to create maximum independence across agents. Recall that the information sent to agents is used to perform the inference task. Hence, the server has to send relevant information to agents for learning purposes. Also, by limiting the amount of information received by each agent due to privacy enforcement, the prediction performed by the multi-agent setup may not be sufficient for the inference task. Consequently, the joint prediction defined as IpY; T 1 , T 2 q has to be maximized. Thus, the optimization problem for the DPFL can be formulated as follows: max ppT1|Xq,ppT2|Xq IpY; T 1 , T 2 q subject to IpX; T 1 q ď r 1 IpX; T 2 q ď r 2 where r 1 and r 2 designate the compression level corresponding to agents 1 and 2, respectively. The parameter ǫ ensures a requirement on the information sharing between agents i.e., privacy level. In the next section, we provide the solution for the aforementioned optimization problem.

III. PROBLEM SOLUTION
The DPFL problem in (1) is solved by writing the Lagrangian functional involving information theoretic terms. The functional for this optimization problem, ignoring constant terms, is written as follows F rppT 1 |Xq, ppT 2 |Xqs "´IpY; T 1 , T 2 q`βIpT 1 ; Xq where β, λ and γ ě 0 are the Lagrange multipliers corresponding to the constraints in (1). We first provide the solution structure for the general discrete case and then also argue to apply it for the Gaussian distribution of the variables. The solution for the discrete case is inspired from the following result.
Theorem 1. The optimal solution that minimizes the functional F in (2) satisfies the following self-consistent equations: where Z 1 and Z 2 are normalizing partition functions and D KL r.s designates the Kullback-Leibler (KL) divergence.
Proof (sketch). We provide a brief outline of the steps involved in deriving the equations (3)-(4). The Lagrangian for solving optimization problem in (1) is written by appending probability simplex constraints in the functional (2). Next, the derivatives of the information terms appearing in the functional in (2) are written as follows.
The computations of the required probabilities appearing in the optimization problem (1) are done by using the selfconsistent equations in Theorem 1. An iterative procedure similar to Blahut-Arimoto algorithm [27], [28] is derived using equations (3), (4), and the conditional independence conditions in Section II-A. The iteration steps are provided in the Appendix A. Next, we show that the proposed iterative procedure is convergent. To see the lower-bounded nature of functional, we observe that it is positive combination of mutual information terms, and IpY; T 1 , T 2 q can be written aś Since IpX; Yq is constant and D KL r.s ě 0, therefore, the functional in (2) is always lower-bounded for positive Lagrange multipliers β, λ, γ. The detailed proof of the monotonicity is skipped due to space limitation, and the idea is inspired from the works of [27], [29]. The value of functional at the tth iteration is denoted as F ptq , and a subsidiary functional Cpt, tq, similar to [27], but with the optimization of functional in (2), can be defined such that the first argument is related to probability functions in (18)- (19) and the second argument to (20)- (22). It can then be showed that where we perform the iterations by using the equations (18)- (22) in this order.
We also show the DPFL for the case of continuous distribution of Gaussian in the following section.

A. Gaussian case
The results obtained in Section III are applied to the Gaussian distribution, where we assume that the input variables X and Y are zero-mean and jointly multivariate Gaussian.
Inspired from prior works [30], [31], we define the two representations T 1 and T 2 that ensure the DPFL to be jointly Gaussian with input X. Consecutively, they can be written as affine transformation of the input as follows: where A, B are input coupling matrices for T 1 , T 2 , respectively. The variables ζ 1 , ζ 2 are mean-centered Gaussian with covariance matrix Σ ζ1 , Σ ζ2 , respectively. For the task of characterizing the DPFL in the Gaussian setup, we realize that it is sufficient to estimate the coupling and associated covariance matrices of the remainder terms. The following result utilizes the general result in Theorem 1 to achieve this task.
Theorem 2. The two Gaussian representations that ensure the DPFL in (9), (10) for given Lagrangian parameters tuple pβ, λ, γq is determined using the following iterative procedure at the t-th iteration.
Proof (sketch). The Gaussian representations in (9), (10) are determined using Theorem 1 and the definition of KLdivergence for Gaussian RVs.
We write the following for the relevant KL-divergence terms in the Theorem 1.
where the definitions of the parameters are provided in the full version of the paper Appendix B. Upon substituting equations (16), (17) in (3) (or iterative equation (18)) and equating both sides, we obtain the iterative procedure of (11) and (12). By symmetry, we obtain the procedure for the mapping T 2 as well.
With the developed theoretical solutions in Section III, we proceed forward to numerical results in the following section.

IV. SIMULATIONS
The solution for DPFL is simulated for the Gaussian distribution case. We take the input variables as X P R NX and Y P R NY , with X and Y being zero-mean jointly Gaussian. The input covariance matrices of appropriate dimensions are designed numerically.
Using the iterative procedure outlined in Theorem 2 with suitable initial values for Σ ζ1 , Σ ζ2 , A and B, we obtain the convergent solution for the DPFL. Upon varying the Lagrange parameters pβ, λ, γq, we obtain the variation of privacy inducing compression levels IpX; T 1 q, IpX; T 2 q for agents 1, 2, respectively, with the collective prediction requirement IpT 1 , T 2 ; Yq from the multi-agent setup. The numerical values of the associated information terms for N X " 10, N Y " 10 are shown in Figure 2. We observe that, by relaxing the compression constraints on the agents (to ensure privacy) by increasing the IpX; T 1 q, IpX; T 2 q, the collective prediction accuracy IpT 1 , T 2 ; Yq increases. The joint effect of the privacy constraint on the net achievable prediction is shown in Figure 2c. We observe the similar trend with relaxation of any agent's privacy constraint improves the multi-agent collective prediction accuracy.
The role of possible correlation across the agents is shown in Figure 2d. We see that enabling small correlation across agents (i.e., IpT 1 ; T 2 q ą 0) helps in achieving higher collective prediction information. However, we see that excess correlation harms the predictive information. Intuitively, if the correlation is high across the agents, then for a given compression constraint, repeated compressed information is present across the agents and hence limits the collective prediction information. But, as observed, a small correlation helps because providing the agents with perfectly uncorrelated compressed information may not always be feasible and could adversely affect the prediction information.
V. CONCLUSION In this paper, we have considered the scenario of DL/FL, and we have addressed the problem of assuring privacy in a two-agent system while maximizing the prediction accuracy. We have formulated the problem for two-agent architecture as an information-theoretic approach. Assuming discrete alphabet, we have derived the stochastic scheme needed to be performed by the source to ensure privacy. The stochastic mappings are determined using a Blahut-Arimoto type of algorithm by alternating over self-consistent equations. Taking advantage of the problem formulation, we have proved that the provided algorithm converges to a stationary point. In addition, we have also extended our analysis to continuous distributions by assuming that the source's probability density function is Gaussian random variable and we have provided closed-form expressions for the alternating equations. As the presented framework shows promising results in assuring privacy in FL, a future direction to this approach is to ensure its scalability under reasonable complexity assumption.

APPENDIX B DEFINITIONS FOR THEOREM 2
The parameters used in Theorem 2 are defined in this Section. For the jointly Gaussian variables X and Y, we denote Θ " Σ Y X Σ´1 X . The rest of the variables are defined as follows.
Also, using the Schur's complement definition, we derive the following.