TL;DR: Differential privacy gives a mathematical guarantee that a model's output reveals little about any single training example, by adding calibrated noise; the privacy budget (epsilon) trades privacy against accuracy. DP-SGD applies it during training (clip per-example gradients, add noise). Federated learning keeps raw data on devices and shares only model updates, addressing data centralization (and pairs with DP and secure aggregation). Use them when training on sensitive personal data or when you must provably limit memorization, accepting a real accuracy and compute cost.
How to approach it. Define what DP guarantees precisely (it is a property of the algorithm, not just "we anonymized data"), then DP-SGD and federated learning as concrete mechanisms, then the honest tradeoff (privacy budget vs utility). The signal is rigor about the guarantee and candor about the cost.
A strong answer. Differential privacy (the guarantee). DP is a formal definition: an algorithm is differentially private if its output distribution barely changes whether or not any single individual's data is included. Formally, for neighboring datasets differing in one record, the probability of any output differs by at most a factor of e^epsilon (plus a small delta). The practical meaning: an attacker cannot tell from the model whether your record was in the training set, which bounds memorization and re-identification. Epsilon is the privacy budget: smaller epsilon means stronger privacy, more noise, lower accuracy. DP is a property of the mechanism (you add calibrated noise), not a vague "we removed names"; ad-hoc anonymization is not DP and is often re-identifiable via linkage.
DP-SGD. The standard way to train a model with DP: during each step, clip each example's gradient to a bounded norm (limit any one example's influence), then add Gaussian noise to the aggregated gradient before the update. Over training you track cumulative privacy spend with a privacy accountant against your epsilon budget. The cost is real: noise and clipping reduce accuracy and slow training, and the hit is worse for small datasets and minority subgroups.
Federated learning. Instead of centralizing raw data, train on-device and send only model updates to a server that aggregates them; raw data never leaves the device. It addresses data-centralization risk (Apple and Google use it for keyboard and on-device models). On its own it is not private (updates can leak information), so it is combined with secure aggregation (the server sees only the sum of updates, not individuals) and often DP (noise on the updates) for a real guarantee.
How the three pieces combine in federated training:
When to use. Sensitive personal data (health, on-device behavior), regulatory or contractual requirements to provably limit memorization, or releasing a model or statistic trained on individuals. For LLMs specifically, DP and data filtering reduce memorization of training data (a real leakage risk: models can regurgitate PII or secrets seen in training). The decision is a tradeoff: privacy guarantees cost accuracy and compute, so apply them where data sensitivity or law justifies it, not by default.
| Technique | Protects against | Standalone guarantee? | Main cost |
|---|---|---|---|
| Differential privacy | Membership inference, memorization | Yes (bounded by epsilon) | Accuracy loss from noise |
| DP-SGD | Per-example influence during training | Yes (DP at the mechanism) | Slower training, subgroup hit |
| Federated learning | Centralizing raw data | No (updates can leak) | Coordination, stragglers |
| Secure aggregation | Server seeing individual updates | No (privacy of values, not info leak) | Crypto overhead |
The honest framing: DP gives a provable, tunable privacy guarantee at a measurable utility cost; federated learning decentralizes data but needs DP and secure aggregation to actually be private. Neither is free, and "anonymized" without a formal mechanism is not a guarantee.
Key takeaways.
- DP is a property of the algorithm with a tunable budget (epsilon), not a synonym for redaction or anonymization.
- DP-SGD enforces it by clipping per-example gradients and adding Gaussian noise, tracked by a privacy accountant.
- Federated learning decentralizes data but leaks via updates; pair it with secure aggregation and DP for a real guarantee.
- Privacy costs accuracy and compute and hits rare subgroups hardest, so apply it where sensitivity or law demands, not by default.
What interviewers probe next.
- "What does epsilon mean concretely?" The privacy-loss bound; lower is more private. There is no universal safe epsilon; it is a policy choice trading privacy vs utility, and you report it.
- "Why isn't anonymization enough?" Re-identification via linkage and auxiliary data defeats naive anonymization; DP bounds any single record's influence regardless of side information.
- "DP-SGD's cost?" Lower accuracy (noise plus clipping), more compute, and disproportionate impact on rare subgroups; mitigate with more data and careful tuning.
- "Is federated learning private by itself?" No; shared updates can leak. Add secure aggregation and DP for a guarantee.
- "LLM memorization?" Models can memorize and emit training data (PII, secrets); DP, dedup, and filtering reduce it.
Common mistakes.
- Calling data "anonymized" and treating it as DP; DP is a formal mechanism with a budget, not redaction.
- Ignoring the accuracy and compute cost and the disparate impact on minority groups.
- Claiming federated learning is private on its own, ignoring update leakage.
- Not being able to state what epsilon trades off.