FLAME: Differentially Private Federated Learning in the Shuffle Model
  Federated Learning (FL) is a promising machine learning paradigm that enables
the analyzer to train a model without collecting users' raw data. To ensure
users' privacy, differentially private federated learning has been intensively
studied. The existing works are mainly based on the \textit{curator model} or
\textit{local model} of differential privacy. However, both of them have pros
and cons. The curator model allows greater accuracy but requires a trusted
analyzer. In the local model where users randomize local data before sending
them to the analyzer, a trusted analyzer is not required but the accuracy is
limited. In this work, by leveraging the \textit{privacy amplification} effect
in the recently proposed shuffle model of differential privacy, we achieve the
best of two worlds, i.e., accuracy in the curator model and strong privacy
without relying on any trusted party. We first propose an FL framework in the
shuffle model and a simple protocol (SS-Simple) extended from existing work. We
find that SS-Simple only provides an insufficient privacy amplification effect
in FL since the dimension of the model parameter is quite large. To solve this
challenge, we propose an enhanced protocol (SS-Double) to increase the privacy
amplification effect by subsampling. Furthermore, for boosting the utility when
the model size is greater than the user population, we propose an advanced
protocol (SS-Topk) with gradient sparsification techniques. We also provide
theoretical analysis and numerical evaluations of the privacy amplification of
the proposed protocols. Experiments on real-world dataset validate that SS-Topk
improves the testing accuracy by 60.7\% than the local model based FL.
