Training on Data You Are Not Allowed to See

Standard machine learning rests on an assumption so basic it is rarely stated: the data is in one place, and you can sample from it freely.

Every familiar component depends on that. Shuffling assumes you can reorder the whole dataset. Minibatch sampling assumes each batch is an unbiased draw from the full distribution. Normalisation statistics assume you can compute them globally.

A large amount of the world's most valuable data violates the assumption, and not for technical reasons.

Hospitals hold patient records that cannot leave the institution under privacy regulation. Ten hospitals could train a far better diagnostic model together than any could alone, and none may share.

Phones hold typing history, photographs, and voice. Uploading it is a privacy exposure users increasingly reject and regulators increasingly restrict.

Banks hold transaction records where fraud patterns cross institutions, and competition and regulation both forbid pooling.

In each case the data exists, the model would be valuable, and the constraint is legal or ethical rather than an engineering limit you can spend your way past.

Federated learning inverts the usual arrangement. Instead of bringing data to the computation, send the computation to the data.

The canonical formulation comes from Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas in "Communication-Efficient Learning of Deep Networks from Decentralized Data", published at AISTATS 2017, pages 1273 to 1282.

The round structure is simple. The server sends the current model to a set of clients. Each client trains locally on data that never leaves it. Each returns only the resulting model update. The server aggregates those updates into a new global model, and the round repeats.

Martin Jaggi's Machine Learning and Optimization Laboratory at EPFL works on exactly this family of problems, including projects that push it further: building decentralized language models in the browser, where many clients such as phones or hospitals collaboratively train a shared model while respecting data privacy and locality.

The raw data never moves. That is the entire point, and everything difficult about the field follows from it.

The obvious way to distribute training is to have each client compute one gradient and send it. The server averages and steps. That is mathematically clean and communication-catastrophic: every single optimisation step costs a full network round trip, and models take hundreds of thousands of steps.

Federated Averaging fixes this with one change: let each client take many local steps before communicating.

for round in range(num_rounds):
    selected = sample_clients(all_clients, fraction=0.1)
    updates = []

    for client in selected:
        w = global_model.copy()                  # start from global
        for epoch in range(local_epochs):        # many local steps
            for batch in client.data:
                w -= lr * gradient(w, batch)
        updates.append((w, len(client.data)))

    # weighted average by dataset size
    total = sum(n for _, n in updates)
    global_model = sum(w * (n / total) for w, n in updates)

Two details carry the design. Local epochs are the communication lever: more local work per round means fewer rounds. And aggregation is weighted by dataset size, so a client with ten times the data has ten times the influence, matching what centralised training would do.

The empirical result that made the paper influential was that this converges in far fewer communication rounds than one-step-per-round methods.

Federated learning is not distributed training in a datacentre with worse networking. The constraints differ in kind.

Communication is the bottleneck, not computation. In a datacentre, machines are connected by high-bandwidth links. A phone on mobile data has limited, expensive, intermittent bandwidth. So the cost model inverts: local computation is nearly free relative to a round of communication, which is why doing more of it locally is the right trade.

Data is not identically distributed. Datacentre training shards a shuffled dataset, so every worker sees the same distribution. Each phone's data reflects one person. Each hospital's reflects its patient population. Local distributions differ systematically, and this is the deepest problem in the field.

Clients are unreliable and vastly unequal. Devices go offline mid-round, have wildly different data volumes, and differ in compute by orders of magnitude. Typically only a small fraction participate in any round.

Privacy is the requirement, not a feature. The system exists because data cannot move, so anything leaking it defeats the purpose. And model updates leak more than intuition suggests.

The structure looks like ordinary distributed training with an extra hop, but the two labelled constraints are what make it a distinct research area: local data never leaves, and only a sampled subset of unreliable clients participates in any round.

The label covers two settings with different engineering realities, and conflating them causes confusion.

Cross-device federation involves enormous numbers of small, unreliable participants: millions of phones, each with a little data, most offline at any moment, each seen perhaps once. Clients are anonymous and cannot be trusted individually. The canonical deployment is mobile keyboard prediction.

Cross-silo federation involves a small number of large, reliable participants: ten hospitals, a handful of banks. Each holds substantial data, is identifiable, has real compute, and participates in essentially every round under a contractual agreement.

The algorithmic consequence matters. Techniques requiring clients to maintain state across rounds are natural in cross-silo and impractical in cross-device, where a given phone may never be selected twice. That distinction determines which of the methods in the next lesson you can actually use.

Two misconceptions are worth clearing before going further, because both lead to real mistakes.

Federation alone is not privacy. It is data minimisation: raw data stays put, which is genuinely valuable and often what regulation requires. But model updates are a function of the training data, and functions of data carry information about it. Gradients have been shown to permit reconstruction of training examples under some conditions, and membership inference against updates is a live attack class. Federation must be combined with explicit privacy mechanisms to make quantitative guarantees, which the final lesson covers.

Federation does not match centralised accuracy for free. With identical data distributions across clients it comes close. With realistic heterogeneity it can converge slowly, oscillate, or land at a worse solution than pooling the data would have produced.

The useful framing is that federation converts a legal impossibility into an engineering problem. You accept slower convergence, extra system complexity, and some accuracy cost, in exchange for training on data you were never permitted to gather.

The size of that cost depends almost entirely on one thing, and it is the subject of the next lesson.