Federated Learning with Differential Privacy
Train a shared model across several simulated clients that never send their raw data, add calibrated noise for a formal privacy guarantee, and measure exactly what that guarantee costs in accuracy. The measured privacy and utility trade off is the result.
Advanced
Needs a team, real planning, and a supervisor who knows the area.1 semester, 2 to 3 students
5 to ship
3 optional extrasSuggested stack
What you should ship
- Federated training loop with a central aggregator and at least 10 simulated clients
- Non-identically distributed client data, since realistic clients do not hold similar samples
- Differentially private updates with gradient clipping and calibrated noise, with the privacy budget tracked
- Accuracy measured across a range of privacy budgets against a centrally trained baseline
- A demonstrated inference attack against the undefended version, showing the defence reduces its success
If you have time left
- Secure aggregation so the server cannot inspect individual client updates
- Client dropout and stragglers handled realistically
- Communication cost measured and reduced through update compression
The problem
Useful models need data that is often too sensitive to centralise, such as medical records or messages. Federated learning trains without moving the data, and on its own it is not private, because model updates leak information about the data that produced them.
What you build
A federated training loop, non-identically distributed client data, differentially private updates with a tracked privacy budget, and an attack demonstrating the difference the defence makes.
The result that makes the project
The trade off curve. Accuracy against privacy budget, with the centrally trained model as the upper bound. A concrete statement such as a strong privacy guarantee costing eleven points of accuracy on this task is exactly what the field needs more of and what your report should lead with.
Why the attack matters
Implementing a membership inference attack against the undefended system, and showing its success rate drop as noise increases, turns an abstract mathematical guarantee into a demonstrated one. This is the most convincing thing you can put in the report.
The realism detail people skip
Non-identically distributed data. If every simulated client holds a random sample, federated learning works easily and your results mean nothing. Partition so clients hold skewed distributions, which is what real deployments face.
Scope warning
Simulated clients on one machine is correct. Do not attempt real device deployment; the privacy and utility measurement is the contribution.
Ideas and guidance, not finished projects
These are project ideas and scoping guidance, published free for students to use as a starting point. I do not build, write, or sell final-year projects, and I do not complete coursework for anyone. Take an idea, make it yours, and build it.
Not sure this one fits you?
I help students pick an idea that matches their skills and their deadline, then scope it down until it is finishable. Guidance only, never done for you.
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Every session is free; a few slots open each week.
Follow along
New writing, resources and project ideas land here first.