Security

Federated Learning with Differential Privacy

Train a shared model across several simulated clients that never send their raw data, add calibrated noise for a formal privacy guarantee, and measure exactly what that guarantee costs in accuracy. The measured privacy and utility trade off is the result.

Difficulty

Advanced

Needs a team, real planning, and a supervisor who knows the area.
Effort

1 semester, 2 to 3 students

Deliverables

5 to ship

3 optional extras

Suggested stack

PythonPyTorchgRPCDockerNumPy
A suggestion, not a requirement. Swap anything for what you already know.

What you should ship

  • Federated training loop with a central aggregator and at least 10 simulated clients
  • Non-identically distributed client data, since realistic clients do not hold similar samples
  • Differentially private updates with gradient clipping and calibrated noise, with the privacy budget tracked
  • Accuracy measured across a range of privacy budgets against a centrally trained baseline
  • A demonstrated inference attack against the undefended version, showing the defence reduces its success

If you have time left

  • Secure aggregation so the server cannot inspect individual client updates
  • Client dropout and stragglers handled realistically
  • Communication cost measured and reduced through update compression

The problem

Useful models need data that is often too sensitive to centralise, such as medical records or messages. Federated learning trains without moving the data, and on its own it is not private, because model updates leak information about the data that produced them.

What you build

A federated training loop, non-identically distributed client data, differentially private updates with a tracked privacy budget, and an attack demonstrating the difference the defence makes.

The result that makes the project

The trade off curve. Accuracy against privacy budget, with the centrally trained model as the upper bound. A concrete statement such as a strong privacy guarantee costing eleven points of accuracy on this task is exactly what the field needs more of and what your report should lead with.

Why the attack matters

Implementing a membership inference attack against the undefended system, and showing its success rate drop as noise increases, turns an abstract mathematical guarantee into a demonstrated one. This is the most convincing thing you can put in the report.

The realism detail people skip

Non-identically distributed data. If every simulated client holds a random sample, federated learning works easily and your results mean nothing. Partition so clients hold skewed distributions, which is what real deployments face.

Scope warning

Simulated clients on one machine is correct. Do not attempt real device deployment; the privacy and utility measurement is the contribution.

Ideas and guidance, not finished projects

These are project ideas and scoping guidance, published free for students to use as a starting point. I do not build, write, or sell final-year projects, and I do not complete coursework for anyone. Take an idea, make it yours, and build it.

Not sure this one fits you?

I help students pick an idea that matches their skills and their deadline, then scope it down until it is finishable. Guidance only, never done for you.

Get guidance
Work with me

Stuck on something specific?

Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Every session is free; a few slots open each week.

Follow along

New writing, resources and project ideas land here first.