International Journal of Information Security (2022) 21:1349–1359 https://doi.org/10.1007/s10207-022-00614-6 REGULAR CONTRIBUTION PSO + FL = PAASO: particle swarm optimization + federated learning = privacy-aware agent swarm optimization Vicenç Torra1,2 · Edgar Galván3 · Guillermo Navarro-Arribas4 Accepted: 1 September 2022 / Published online: 22 September 2022 © The Author(s) 2022 Abstract In this paper, we present an unified framework that encompasses both particle swarm optimization (PSO) and federated learning (FL). This unified framework shows that we can understand both PSO and FL in terms of a function to be optimized by a set of agents but in which agents have different privacy requirements. PSO is the most relaxed case, and FL considers slightly stronger constraints. Even stronger privacy requirements can be considered which will lead to still stronger privacy- preserving solutions. Differentially private solutions as well as local differential privacy/reidentification privacy for agents opinions are the additional privacy models to be considered. In this paper, we discuss this framework and the different privacy- related alternatives. We present experiments that show how the additional privacy requirements degrade the results of the system. To that end, we consider optimization problems compatible with both PSO and FL. Keywords Particle swarm optimization · Federated learning · Differential privacy · Masking · Differentially private social choice 1 Introduction form, federated learning considers a centralized entity that through a set of iterations computes the model, distributes Privacy is a matter of trust. An agent can conceal some infor- the model back to the agents, and then, the agents send to the mation when she does not trust the recipient of a message, centralized entity the difference between their local models or medium in which this message is transmitted. When the and the global one. One of the advantages of this approach agent trusts both the medium and the recipient, the quality is that is more privacy friendly than sending all agent’s data of the information being transmitted is higher [16] and the to the centralized entity for it to compute the model. message will be more on line of agent’s beliefs. Unfortunately, this privacy-based “guaranteed” federated Federated learning [10] computes machine learning mod- learning is an illusion. The fact that agents only send sum- els without accessing the data of individual agents. In its basic maries or differences between the central model and their own model can be rather sensitive [10,18]. In addition, the B Vicenç Torra final central model can also lead to disclosure [1]. Computing vtorra@ieee.org a differentially private central model can be a solution for the Edgar Galván latter, but not to the former problem. Multi-party computa- Edgar.Galvan@mu.ie tion can be seen as a solution of the former problem. In this Guillermo Navarro-Arribas case, agents need to trust the central entity, the designers of guillermo.navarro@uab.cat the protocol, as well as that there is no coalition between this 1 Department of Computing Science, Umeå University, Umeå, entity and the agents, or a large enough coalition of agents, Sweden to make disclosure possible. 2 School of Informatics, Skövde University, Skövde, Sweden Thus, from a privacy perspective, agents need to trust all 3 Naturally Inspired Computation Research Group, Department the other agents as well as the centralized entity, or they of Computer Science, Hamilton Institute, Maynooth need to reduce both their communications and the quality University, Maynooth, Ireland of the information they supply. Additional privacy models 4 Department Information and Communications Engineering – [4,8,13,15] and technology are needed for this purpose. CYBERCAT, Universitat Autònoma de Barcelona, Bellaterra, Catalonia, Spain 123 1350 V. Torra et al. In this paper, we consider a unified framework for particle Definition 1 A randomized query function K gives -differential swarm optimization (PSO) [9] and federated learning, as a privacy if for all S ⊆ Range(K), and for all D1 , D2 such kind of continuum between different privacy levels. Recall that d(D1 , D2 ) = 1, that in PSO we have a set of agents each with its own position in the space of solutions, and their global goal is to jointly Pr [K(D1 ) ∈ S] ≤ e × Pr [K(D2 ) ∈ S] (1) find an optimal solution. All share their positions, and the best of their positions is stored and shared, and is the basis of Broadly speaking, it states that the addition or deletion of a how each agent updates its own position. In our approach, we single record should not be noticeable from the answers to range from the situation in which agents do not mind to share the query K up to a given bound determined by . Lower all the information (i.e., PSO) to a strong privacy-preserving values of  provide more privacy, usually and as expected, at PSO-like environment aligned with federated learning. In expenses of higher information loss. this latter scenario, agents do not share their position, and We usually assume that the randomization is performed by the information supplied is locally protected and the final a trusted data curator which has access to all the database. An solution is differentially private. slightly different definition of differential privacy might be Our analysis and experiments are in a two-dimensional more interesting in a federated learning environment, where setting. That is, all agents are located in a two-dimensional each agent generates its own, possibly protected, data. In region. The goal is to minimize an optimization function in R. this case, differential privacy can be considered from a local We consider an homogeneous scenario where all agents have point of view giving up to the so called -local differential the same behavior. All use the same rules for updating their privacy. The difference is given by the fact that each user position and for deciding what and when information is trans- randomizes its own data which is then stored in the database. mitted. In heterogeneous environments, different agents will The definition is analogous to differential privacy, but in the have different privacy preferences. That is, different agents local case we consider that the randomized function K takes will apply different strategies in their communication with as input data from a single user instead of taking the whole a central authority. We can represent this situation in our database. scenario. It corresponds to a mixture of strategies. Agents In our case, we consider the privacy that can be achieved can then reason on what and when to disclose i.e. their own by a particle swarm optimization in a federated learning sce- strategy. nario. To provide a broad privacy analysis, we can establish This paper introduces and evaluates privacy-aware swarm different disclosure dimensions in the proposed framework. optimization (PAASO) in the context of federated learning Information can be disclosed in several stages as described (FL). To this end, we consider and evaluate different pri- next. vacy alternatives within this framework and study how they affect the PSO optimization problem. Our results show that, 2.1 Avoiding disclosure from the computation in general, the use of privacy mechanisms does not avoid convergence although they make it slower. It is relatively common to rely on secure multiparty compu- The structure of the paper is as follows. In Sect. 2, we tation (SMC) to provide privacy preserving computations in review some definitions related to data privacy. In Sect. 3, we federated learning scenarios [17]. Secure multiparty compu- introduce our approach. In Sect. 4, we describe our experi- tation provides a safe tool for agents to jointly compute any ments and results. Finally, Sect. 5 draws some conclusions. desired function without revealing each agent input. Formally, given a function to be computed jointly by several agents, a protocol is defined that specifies how the 2 Some privacy definitions function is computed. In typical secure multiparty scenarios, the final result is then transferred to the agents. From a pri- We consider privacy from different perspectives or dimen- vacy point of view, no agent learns more than what can be sions. In general, we would like to avoid the disclosure of inferred from its own data and the output of the computation. private data and information in all possible stages of the fed- Partial computations and any information on the transmission erated learning process. This includes the computations that do not lead to additional knowledge. need to be performed, the final and partial outputs generated Honest but curious, and malicious intruders are the usual by the process, and the data exchanged between the agents. type of attacks considered. Honest but curious agents follow We rely in the well-known model of differential privacy the protocol. They try to acquire knowledge by means of [5,6]. The classical definition of differential privacy considers observing when the communications take place and analyz- two databases D1 , D2 that differ only in one record (denoted ing any information being transmitted (even encrypted ones). as d(D1 , D2 ) = 1) and an interactive scenario where the user Malicious intruders do not necessarily follow the protocol sends queries to the database. and can e.g. inject noise to transmissions, provide wrong 123 PSO + FL = PAASO: particle swarm optimization + federated learning = privacy-aware agent… 1351 information, or just sent meaningless messages to acquire 2.3 Avoiding disclosure from communication’s knowledge. Coalitions of agents are other types of attacks content because, naturally, joining their efforts a set of agents can be able to acquire information on other ones. Agents need to communicate, for instance, in order to con- It might seem that SMC techniques in general introduced duct the voting scheme described in the previous section. In important penalties both in terms of efficiency and commu- such case, agents send their data, which as we will see is a nication overhead. Despite this initial impression, currently direction based on their local position. Assuming agents want there are relatively efficient general solutions for secure mul- to keep their position private, the direction helps in conceal- tiparty computation [2], and it has been successfully used in ing the position but might not be enough. In order to provide federated learning [3]. stronger privacy warranties, agents can mask the data they In our case, the computations to be performed are rel- send. atively simple and can be addressed by well-known SMC PRAM (Post-RAndomization Method) [4,7] is a well- protocols. We will not get into detail about the actual tools known statistical disclosure control technique, initially defined used in order to focus on the description and scope of our for categorical data. Given a set of categories C = {c1 , . . . , cc }, proposal in disclosure from the output and communication’s we define a c × c stochastic matrix (or Markov matrix) P so  content and the privacy guaranties provided in terms of dif- c j ∈C P(ci , c j ) = 1. Then, the masking is produced by ferential privacy. replacing each ci for c j with probability P(ci , c j ). When this technique is performed by the respondent, it is usually referred as randomized response (RR). The application by the 2.2 Avoiding disclosure from the output respondent has a drawback. The respondent can only access its own data and protection is done in real time. Therefore, When several agents need to decide on a given output, e.g. the stochastic matrix cannot be generated taking into account based in a voting scheme, the whole procedure as well as the distribution of the whole data set, but on our expectations the output can disclose information about the agents. In the of this distribution. In our case, agents will apply RR to the case of PSO, as we will see, agents need to agree in a global data they need to send (i.e., a discretized version of direc- best position, which could likely yield information about the tion) in order to establish the global parameter of the PSO. actual position of some agents. Sections 3.4 and 3.3 will provide more detail on the use of In [14], it is shown that a differentially private consen- PRAM in our proposal. sus can be achieved based on a random dictatorship voting It is know that RR provides -local differential privacy if scheme. The standard non-privacy preserving random dicta- maxc j P(ci , c j ) torship considers that a set of agents I vote on a given set of e ≥ max (3) alternatives A, so each agent i ∈ I has a defined preference ci minc j P(ci , c j ) i defined in terms of A× A. An agent i is selected according to a uniform distribution on the whole set of agents I , and This means that we can provide strong privacy require- then, i is used to select the alternative outcome (i.e., agent ment in the data locally released by agents. i is randomly chosen as the dictatorship). We will apply PRAM where the matrix is defined in terms An alternative voting procedure that achieves differential of a probability parameter ( pm ). Then, given the value ci , we privacy is defined in [14] as: have that P(ci , ci ) = pm and P(ci , c j ) = (1 − pm )/(c − 1). In other words, the probability that the masking does not modify a category is pm . Then, with probability 1 − pm the Definition 2 Let A = {a1 , . . . , am } be the set of alternatives. category will be replaced by any other. The selection of any Then, given the set of agents I with the corresponding pref- other category follows a uniform distribution. Naturally, this erence relations i for i ∈ I on the alternatives A, enlarge I definition applies to all i. Therefore, the Markov transition with a set of agents I0 = {e1 , . . . , em } such that i for i ∈ I0 matrix has the value pm in each element of the diagonal and has as its preferred alternative the ith alternative in A. Then, (1− pm )/(c−1) in all other positions. If pm > (1− pm )/(c− apply uniform random dictatorship on I ∪ I0 . 1), then  ≥ ln(c − 1)/(1 − pm ). In this last definition, it can be shown that differential privacy is achieved for any 3 An scenario Our starting point is to observe particle swarm optimiza- 2|I ∪ I0 | tion (PSO) and see that it fits well in the federated learning  ≥ log (2) |I ∪ I0 | + 1 (FL) framework. This is so because in both PSO and FL 123 1352 V. Torra et al. we are optimizing a function that is defined by means of value of the function evaluated at them. Therefore, we can the behavior of a set of independent agents (i.e., the parti- follow without any problem the PSO protocol. cles in PSO and different devices in FL). This observation permits to define a PSO à la FL. Then, these agents have privacy requirements. They are local ones, that can be imple- 3.2 PSO lacking trust: PSO à la FL mented locally by each agent, and global ones, that need agreement. Taking these requirements into consideration, we When the agent trusts the central entity, and the multiparty define privacy-aware agent swarm optimization (PAASO). computation protocol, the agent presumes that all the sup- plied information will not lead to a direct inference from the central entity i.e. that disclosure will not take place. There- 3.1 No-privacy PSO fore, we can build a cryptographic protocol using secure multiparty computation that computes the minimum func- Let us start reviewing particle swarm optimization and con- tion from the values supplied by the agents at any time and sider an example. To make the case simple, we consider in our stores the corresponding position if the evaluation is better experiments functions in the two dimensional space. Never- than the last stored one. theless, our proposal is general. Then, each agent has its own Still, lack of trust may prevent an agent to send its posi- position in the space and each agent knows the value of the tion and its evaluation. Also, it is not only a lack of trust on function to be optimized on its current own position (and in the central entity and the multiparty computation model; it previous positions as well, if the agent has not forgotten). is also about the trust to other agents that matters. For exam- Standard PSO follows the following schema. ple, a coalition of all but one agent can of course be used to determine the position of the one left out. Smaller coali- tions can build estimations of other agents positions. This – l1 Assign agents positions xi to agents i = 1, . . . , s; would correspond to honest but curious intruders. Malicious – l2 pi := xi ; # Assign best agent position to xi intruders and dynamic adversaries (that can fool the proto- – l3 g = arg min pi f ( pi ); # g is the best known position col and/or make others to also fool the protocol) may have – l4 Assign agents velocities vi to agents i = 1, . . . , s; greater advantage. – l5 iterate An approach more privacy-friendly and in line with fed- – l5.1 for each agent i = 1, . . . , s erated learning would be that agents do not supply their own • l5.1.1 (r p , r g ):= random numbers, uniform in position but a direction between the current global best one ([0, 1], [0, 1]) and their own. Recall that in federated learning agents do not • l5.1.2 vi := ωvi +φ p r p ( pi − xi )+φg r g (g − xi ); share data but gradients. In our context, that is, each agent • l5.1.3 xi := xi + vi ; supplies the direction di = pi − g as well as f ( pi ). This con- • l5.1.4 if ( f (xi ) < f ( pi )) then pi := xi ; ceals pi and avoids any unintentional disclosure of agent’s • l5.1.5 if ( f ( pi ) < f (g)) then g := pi ; # pi is position. To do so, we need to revise the previous PSO defini- shared tion as g cannot be correctly updated. Instead, we introduce the position of the central entity which is now public together – l6 until (end-condition); with its evaluation. We call this position pG . This position is iteratively updated using the directions of the agents. A We denote by xi , vi and pi the position and velocity of multiparty computation protocol would ensure that agent’s the ith agent, and the best position found so far, respectively. directions are not disclosed; the objective function is locally Then, g is the best global position found so far. Function f computed by the central authority. Then, the central author- denotes the function to be optimized (minimized in our study) ity shares the global position and its evaluation (i.e., pG and and s the number of agents. Then, ω is the inertia weight, φ p f ( pG )). and φg are acceleration coefficients. If all agents have as its goal to optimize the same function, Lines l1–l4 correspond to initialization, and lines l.5.* are then they will update all their positions in a similar way. Oth- the iterative process to find the optimal solution to the prob- erwise, if different agents have different objectives, different lem. Lines l5.1.1–l5.1.3 are to establish the new velocity and approaches can be used for moving to the next position. In position of the agent and lines l5.1.4 and l5.1.5 the updating the next algorithm, we consider the case that all agents want of agent’s best position ( pi ) and of the global best position to optimize the same function. (g P ). If we consider situations in which privacy is not an issue, – l5 iterate any agent can send at any time any information about its current and past positions (i.e., xi and pi ), as well as the – l5.1 for each agent i = 1, . . . , s 123 PSO + FL = PAASO: particle swarm optimization + federated learning = privacy-aware agent… 1353 • l5.1.1 (r p , r g ):= random numbers uniform in 3.4 Agents mask their vote ([0, 1], [0, 1]) • l5.1.2 The approach above still assumes that an agent trusts the entire system, the multiparty computation protocol, and that  ωvi + φg r g ( pG − pi ) if f ( pG ) < f ( pi ) neither the central authority nor the other agents are sniffing vi := ωvi + φ p r p (bi − pi ) otherwise. the communications to learn their positions. If this is not the case, an agent can mask its vote using a masking method mm. • l5.1.3 xi := xi + vi ; This corresponds to apply the following: • l5.1.4 if ( f (xi ) < f ( pi )) then pi := xi ; • l5.1.5 vi is transmitted – l5.1.5 αi = vote(mm(vi )) is transmitted; # agent casts  – l5.2 v := (1/s) i vi ; # vi is shared vote – l5.3 pG := pG + ωG v To implement this approach, we will use the masking pro- – l6 until (end-condition); cedure discussed in Sect. 2.3. Nevertheless, also in line with what happens in feder- 3.5 PAASO: Privacy-aware agent (swarm) ated learning: when we send only directions (subtractions), optimization they can lead to disclosure. Agents (and coalitions of agents) can use these directions to learn the position of a particular As a summary, there are the following different protection agent. In addition, the final solution (i.e., the final outcome mechanisms for the agent. of the system with its position and evaluation) can lead to sensitive information. In particular, the solution will not be – An agent votes for a direction within a reduced set of differentially private. Note that when a solution can be used possibilities. to infer the participation (or absence) of an agent, then the – An agent may reduce additional need of communication solution is not differentially private. To see that the approach if the vote is only sent when its own position is better is non-differential privacy, we can consider an agent located than the best current one, in regions of large values of the objective function, while all – An agent can conceal its real vote by means of a masking other agents are in other regions. technique. 3.3 A differentially private solution The last one is the most privacy-friendly for an agent. The first one reduces the information supplied, the second We can solve the problem just reported by reducing the one reduces the information supplied still further, but in dimensionality of the space of agents’ opinions (i.e., in this both cases the information supplied is correct. Differentially case the space of directions / subtractions) and proceeding private voting makes the aggregation private, but the data with a differentially private aggregation procedure. More pre- supplied by agents are unprotected (except for SMC proto- cisely, instead of allowing the agents to provide any direction, cols). The third case introduces randomization (by means of we will only allow for a few finite set of alternatives. In our data masking—local differential privacy). In this paper, we example, we consider a discrete set of directions. For exam- compare these approaches. ple, 4 possible directions would be: front, right, left, back. As a summary, from the lowest to the highest level of So, each agent computes its vote αi and casts it. Then, instead privacy guarantees. We have the following types of privacy- of aggregation, we consider voting. A differentially private aware agents. voting mechanism (as the one described in Definition 2) will provide privacy to agents. We use dpv to denote the differ- entially private voting mechanism, and a function velocity to – Standard PSO (PSO). Agents inform of their position at transform the decision into a velocity. So, we replace lines any time, and the objective function for that position is l5.1.5 and l5.2 above by: shared or computed by the central authority. – Federated learning-like PSO (FL). Agents inform of their direction toward a global/consensus position at any time – l5.1.5 αi = vote(vi ) is transmitted; # agent casts vote and of the objective function for that position. – l5.2 v := velocity(dpv(αi )) – Differentially private PSO (aDRD). Agents inform of their direction toward a global/consensus position using To implement this approach, we consider the differentially a differentially private mechanism. Agent’s decision on private mechanism discussed in Sect. 2.2. whether or not to vote is made according to a probabil- 123 1354 V. Torra et al. ity. Here, DRD stands for Differentially Private Random Dictatorship. – Differentially private PSO voting only when better (bDRD). Similar to the previous case, but vote can only be casted if agent’s solution is preferable. As in the previ- ous case, agent’s decision on whether or not to vote also depends on a probability. – Differentially private and masked voting for PSO (PbDRD). As in the previous case, agents vote when they have a con- tribution to make but in this case they can obfuscate their opinion. The voting procedure is as in the previous case differentially private. 4 Experiments and analysis In this section, we describe the experiments we have con- sidered to evaluate our proposal. In general, as usual in the privacy literature, the more the privacy level, the less the qual- ity of the solution. Although this is so in most of the cases, the literature also shows that in some situations and scenarios, the introduction of privacy constraints does not imply a sig- nificant reduction in the quality of the solutions. In fact, the literature on privacy for databases has shown that some per- turbation on the original data to guarantee some privacy level can have no effect on data-driven machine learning models, and in some cases [11], the perturbation even increases the accuracy of the models. Unfortunately, this will not be the case in our experiments. We have loss of quality in terms of slowing convergence. Notice that we have evaluated the utility of our proposal by considering the performance of the PSO optimization. This is a specific information loss (or utility) measure commonly used for computation an data-driven protection methods [13]. Other generic utility measures might not be so relevant in this context, where the computation to be performed is clearly Fig. 1 Optimal values (y-axis) achieved for the different Agent Swarm defined. Optimization approaches (PSO, FL, aDRD, bDRD, PbDRD) with In order to evaluate different privacy levels of agent respect to time (x-axis) in two different executions. The parameters (swarm) optimization, we have considered different opti- are as follows: function f 4 , number of voting alternatives kα = 8, 50 mization problems. The global goal of the system is to find agents, ω = 4.00, φ p = φg = 2.00, ωG = 0.005, pc = 1.0, and pm = 0.9 the optimal solution. In addition, agents have also interest on finding this optimal solution and have as their local objective function the same objective function of the whole system. to be considered. Also, different users have different privacy In order to make analysis and computation simple, all preferences and that needs to affect agent’s decisions. agents have the same behavior. That is, all agents apply the In the remaining part of this section, we describe the prob- same approach to update their own position and velocity. lems considered, the parameters of the system, and also the They all apply the same masking technique (if any) and vote results obtained. using the same strategy (in case of voting). In this sense, the multiagent system can be seen as homogeneous. Nat- urally, more complex and heterogeneous scenarios can be 4.1 Problems considered considered. In particular, from a privacy point of view, it is relevant to consider more complex decisions on what infor- As explained above, we have considered functions with two mation needs to be shared and when the information needs inputs and evaluated in R. That is, functions of the form 123 PSO + FL = PAASO: particle swarm optimization + federated learning = privacy-aware agent… 1355 f : R × R → R. All functions are to be minimized. The 4.2 Agent (swarm) optimization eight problems considered are the following: For implementing different types of privacy-aware agent 1. Quadratic function (x1 , x2 ∈ [−100.0, 100.0]): optimization, we have considered different algorithms described in Sect. 3. We will denote them using the names in Sect. 3.5. That is, PSO (no privacy), FL (privacy of posi- f 1 (x1 , x2 ) = x12 + x22 tion), aDRD (directions shared, differentially private voting), bDRD (only voting direction in a better position, differ- 2. Schwefel’s problem 2.22 (x1 , x2 ∈ [−10.0, 10.0]): entially private voting), PbDRD (PRAM-based masking + differentially private voting, if better). The implementation f 2 (x1 , x2 ) = |x1 | + |x2 | + |x1 | · |x2 | of the system is based on differentially private random dicta- torship (as described in Definition 2) for the private voting, 3. Schwefel’s problem 1.2 (x1 , x2 ∈ [−100.0, 100.0]): and PRAM for agent’s individual privacy (and, thus, local differential privacy, Sect. 2.3). f 3 (x1 , x2 ) = x12 + (x1 + x2 )2 The implementation of the system requires fixing a num- ber of parameters. We have selected these parameters heuris- 4. Generalized Rosenbrock’s function (x1 , x2 ∈ tically with the goal of having a generous range of parameters [−2.0, 2.0]): to find good solutions and also being computationally feasi- ble. In particular, we have considered the number of agents f 4 (x1 , x2 ) = 100 ∗ (x2 − x1 ∗ x1 )2 + (x1 − 1)2 to be 50, 100, and 200. Note that the more agents, the most computationally intensive the problem results. A different number of iterations have been considered, up to 1000. In 5. Generalized Schwefel’s problem 2.26 (x1 , x2 ∈ the figures, shorter sequences of values are displayed. [−500.0, 500.0]): As explained above, all agents have the same behavior   and use the same strategy. Therefore, we need a single set of f 5 (x1 , x2 ) = −x1 sin( |x1 |) − x2 sin( |x2 |) parameters for the whole system. In our case, this means that we need to establish ω (the inertia weight), φ p and φg (the 6. Rastrigin’s function (x1 , x2 ∈ [−5.12, 5.12]): velocities), ωG (the global inertia weight), kα is the number of voting options (that is, it permits us to represent the angles f 6 (x1 , x2 ) = 2 · 10 + x12 − 10 cos(2x1 π ) + x22 2π ·i/kα for i = 0, . . . , kα −1 from direction (1, 0)), pc is the −10 cos(2x2 π ) probability to cast a vote and pm the probability associated with the masking method. Not all privacy-aware solutions 7. Ackley’s function (x1 , x2 ∈ [−32.768, 32.768]): use all parameters, as we have seen in the aforementioned definitions.  −0.2 0.5(x12 +x22 ) Then, we have considered for ω and ωG the values f 7 (x1 , x2 ) = − 20e {0.005, 0.001, 0.05, 0.1, 0.2, 0.4}, and we have considered − e0.5 cos(2x1 π )+cos(2x2 π ) + 20 + e φ p = φg and the values {0.01, 0.05, 0.1, 0.2, 0.5, 1.0, 2.0}. These set of values have been found heuristically. They have 8. Griewank function (x1 , x2 ∈ [−600.0, 600]): been selected to include some parameterizations that are suit- able for PSO, other parameterizations that are suitable for FL, f 8 (x1 , x2 ) = 1 + (1/4000)(x12 + x22 ) and other good for other type of privacy-aware solutions. In √ relation to kα , we have used kα = 8 in most of the experi- − cos(x1 ) ∗ cos(x2 / 2) ments. We have also used kα = 4, 16, and 32. The masking method used is PRAM. Then, the probabilities pc and pm These problems are of different complexity. Details on have been selected among the values {0.6, 0.7, 0.8, 0.9, 1.0}. these functions are given in the work by Sengupta et al. [12]. Naturally, when pc = 1, the agent always communicates. In Function f 1 can be considered the simplest one while some addition, a probability of pm = 1 in PRAM means no protec- others are multimodal with some level of deceptiveness. All tion. From a differential privacy perspective, these values of optimal solutions have an objective function equal to zero, pm different to one correspond to  = 2.35, 2.79, 3.33, 4.14. except for function f 5 that has its global minimum with a For each configuration of values, we performed 20 inde- value of −12569.5. We have chosen this functions as they pendent runs. Each run with 1000 iterations and 50 agents are commonly used unimodal and multimodal benchmark has taken 0.033 seconds, and thus, a configuration takes 0.66 functions for PSO [12]. seconds. 123 1356 V. Torra et al. 4.3 Discussion of results As we have mentioned above, we have considered different types of privacy-aware agents, that is, from the PSO solution in which agents share all information to the case of agents masking their votes and considering a differentially private voting mechanism with only a few alternatives. As a first illustration, we show different executions of problem f 4 . Figure 1 (top and bottom) displays the solu- tions of P S O, F L, a D R D, bD R D, and PbD R D with pm = 0.9 for two different executions. The other param- eters correspond to kα = 8, ω = 4.00, φ p = φg = 2.00, and ωG = 0.005. This figure shows this convergence for all methods after 500 iterations. We see the fastest convergence for P S O and the slowest for the most privacy-friendly one (PbD R D with pm = 0.9). Convergence for the federated learning F L solution is slower than the one of P S O but faster than the others. The two alternatives with a differen- Fig. 2 Mean objective function for 20 executions for FL, aDRD, and tial privacy voting strategy are similar. Comparing the two bDRD. Function f 4 , number of voting alternatives kα = 8, 50 agents, figures, we can see the variability of the solution. ω = 4.00, φ p = φg = 2.00, and ωG = 0.005. We use pc = 1.0 Due to this variability of the solution in different execu- tions, Fig. 2 displays the mean objective function achieved for the 20 different executions considered for the same problem f 4 (using the same parameters as above). This figure clearly shows the difference of convergence for the three alternative approaches F L, a D R D, and bD R D. Figure 3 displays mean results for the PbD R D with dif- ferent values of the parameter pm considered. In particular, we have considered pm = {0.6, 0.7, 0.8, 0.9, 1.0}. The stan- dard deviations of the objective function in the last iteration for each of the pm range between 0.03 and 0.05. From the figure, we get the impression that there are no fundamental differences on the parameter used for masking the own data. That is, that a strong protection (i.e., with pm = 0.6) and no protection at all ( pm = 1.0) gives mainly the same results. This is not completely true as a change of scale would show that the convergence is a little bit slower when the protection is higher. Nevertheless, the trend is similar for all values of pm . A consequence of this result is that the use of a masking method / local differential privacy by the agent does not have Fig. 3 Mean objective function for 20 executions for PbD R D and a major influence on the outcome if the final result is obtained different values of the parameter pm . Function f 4 , number of voting using a differentially private voting mechanism. We discuss alternatives kα = 8, 50 agents, ω = 4.00, φ p = φg = 2.00, and the need of applying this masking in Sect. 5.1. ωG = 0.005. We use pc = 1.0 In general, all different privacy-aware strategies converge to the desired solution. What differs is the speed of con- vergence. Among the problems, f 5 is the most difficult and This is a general rule, but different parameterizations have the optimal solution found with any voting mechanism is far different effects and some are not suitable to e.g. achieve the from the optimum. best optimal solution e.g. in Fig. 4 we see that for parameters P S O is the one with the fastest convergence for the prob- ω = 0.005, φ p = φg = 2.00, and ωG = 0.01 the mean lems considered. F L is next, it has a slower convergence, but performance of F L is worse than the other privacy-aware it is quite similar. Other privacy strategies have significantly strategies for the same parameters. In fact, a close look to the slower convergence. 20 executions of FL with these parameterizations shows that convergence almost never takes place. The standard devia- 123 PSO + FL = PAASO: particle swarm optimization + federated learning = privacy-aware agent… 1357 Fig. 4 Mean objective function for 20 executions for P S O, F L, Fig. 5 Mean objective function for 20 executions for bDRD. Function a D R D, bD R D. Function f 4 , number of voting alternatives kα = 8, 50 f 4 , number of voting alternatives kα = 8, ω = 0.005, φ p = φg = 2.00, agents, ω = 0.005, φ p = φg = 2.00, and ωG = 0.01. We use pc = 1.0 and ωG = 0.01. We use pc = 1.0. The figure illustrates different number of agents s = 50, 100, 200 tions of the objective function at the last iteration of each of the curves range between 0 and 0.030. 5 Conclusions We have also compared different values for kα for several combinations of the other parameters. In particular, we have The results of our experiments discussed in the previous sec- considered the following values 4, 8, 16, 32 for kα . For these tion can be summarized in the following terms. values, there is no significant difference in the results. In some cases, even larger options give a slightly worse convergence. A reason for this somehow unexpected behavior can be the – In general, the use of privacy mechanisms does not differentially private voting mechanism. The more possible avoid convergence. These mechanisms make conver- options, the more noise is added by the mechanism. The gence slower. noise is, roughly speaking, linear on the set of options (see – The most effective way in terms of converge is P S O and Definition 2). then F L. What has a clear effect on the convergence is the number of – The use of additional mechanisms as reducing the number agents considered. Most experiments reported here consider of options to a few (i.e., the parameter kα ) and differential a set of 50 agents. Figure 5 shows the results of a problem privacy voting makes convergence more difficult. when the number of agents is s = 50, 100, and s = 200, and – Additional privacy mechanisms as local protection by we clearly see a quicker convergence each time we double means of PRAM do not seem to have a strong effect in the size of the set of agents. the convergence. To conclude this section, we represent in Fig. 6 some of the configurations that achieve the best convergences for the problems f 1 – f 8 considered. The figure represents only the In relation to the parameters of the system. first 400 iterations. As stated above, the solution for f 5 is far from the optimum. For all privacy-aware solutions, we get a minimum value of −7.9, while for P S O we get −837 and as – The exact value of kα has low effect on the convergence. stated above the optimal solution has an objective function – The number of agents in the system is a key factor in the of −12569.5. convergence. We have seen that doubling the number of agents can speed the convergence up significantly. – Optimal values for parameters ω, φ p , φg , and ωG depend on the problem and the type of privacy strategy. There- fore, they need to be optimized for each architecture. 123 1358 V. Torra et al. Fig. 6 Mean objective function for 20 executions for PbDRD with pm = 0.9 for all problems f 1 – f 8 considered and considering s = 50 agents. Function f 4 , number of voting alternatives kα = 8. Parameters ω, φ p = φg , and ωG selected to obtain one of the best convergences 5.1 Local and global privacy data protection. This is so, because among different masking strategies we can select the ones that avoid reidentification We have seen that when we use of a differentially private doing appropriate risk analysis. The analysis of reidentifica- voting mechanism to aggregate the opinions of the agents, tion of a single record will take into account the other records agent’s use of local masking methods does not make a sig- in the database (and their masked counterparts). This is not nificant difference on the result. possible by a single agent without information on the other’s The use of two different approaches (the local one and the agent information. So, PRAM and randomized response may global one) may be seen as a disproportionate zeal to ensure not be enough for ensuring agents privacy. the privacy of agents. We consider that this is not the case. Naturally, more complex processes can be designed for Local privacy is to ensure that the information supplied by agents so that they can collaborate (sharing information to an agent is not revealed if the system is compromised. Thus, trusted agents) so that decisions about their own protection in case of an architecture that is not trusted or that may be is more learned. compromised, local protection is the best option. In this way, Therefore, on the light of the results given and taking into agent’s privacy is not fully in hands of third parties. account that the masking parameter does not affect so much Nevertheless, local protection may not be enough. An the quality of the solution, we consider that the use of masking agent has only partial information on the whole system and is a clear advantage. of other’s information. That is, the agent has its information on itself (e.g., its preferences) and partial information on the others. So, agents’ knowledge on what information is sensi- 5.2 Future work tive is limited. The sensitivity of information can depend on the value itself. For example, reidentification from a trans- One of the conclusions outlined above states that, in general, mitted value can only be done if this value is known to be the use of privacy mechanisms does not prevent the system to unique. So, in general, agents may have not enough global converge into the optimal solution. While in a standard appli- knowledge to protect the data at an appropriate level. In con- cation, a slow convergence just means more time required. trast, the central authority can have this information available In the case of privacy solutions, we need to take into account when gathers the preferences of all agents. By means of mul- that additional iterations can increase the risk of disclosure. tiparty computation mechanisms (see Sect. 2), the votes of Differential privacy has nice properties with respect to all agents can be aggregated, and using a differential privacy composability. So, if two queries/functions are computed voting mechanism (or any other appropriate mechanism) a with 1 and 2 each, the privacy guarantee of both together (in final decision is made. This global information can then be a sequential composition) is 1 + 2 . Randomization should used to avoid other disclosure. be independent for each query/function. Therefore, we can When databases are protected in a centralized environ- consider a privacy budget and agents only informing of their ment, masking methods such as PRAM can be enough for position when they consider appropriate to do so. Here, with appropriate to do so we mean that agents need to take into 123 PSO + FL = PAASO: particle swarm optimization + federated learning = privacy-aware agent… 1359 account their privacy budget as well as other considerations. 5. Dwork, C.: Differential privacy. In: Proceedings of ICALP 2006. Note here agents supply information related to their trajec- LNCS, vol. 4052, pp. 1–12 (2006) 6. Dwork, C.: Differential privacy: a survey of results. In: Proceedings tory, so, voting for different directions is about releasing of TAMC 2008. LNCS, vol. 4978, pp. 1–19 (2008) information that may lead to reidentification. Privacy bud- 7. Gouweleeuw, J.M., Kooiman, P., Willenborg, L.C.R.J., De Wolf, gets for agents may need to take into account the surface of P.-P.: Post randomisation for statistical disclosure control: theory the function being optimized. and implementation. J. Off. Stat. 14(4), 463–478 (1998). Also as Research Paper No. 9731, Voorburg: Statistics Netherlands (1997) We have worked with an homogeneous architecture where 8. Hundepool, A., Domingo-Ferrer, J., Franconi, L., Giessing, S., all agents have the same set of rules for updating their posi- Nordholt, E.S., Spicer, K., de Wolf, P.-P.: Statistical Disclosure tions and for deciding where and what to communicate. In the Control. Wiley (2012) real world, with agents representing individuals interests, dif- 9. Kennedy, J., Eberhart, R.C.: Particle swarm optimization. In: Proc. IEEE Int. Conf. Neural Networks, pp. 1942–1948 (1995) ferent agents need to consider different privacy preferences 10. Li, T., Sahu, A.K., Talwalkar, A., Smith, V.: Federated learning: and, therefore, different rules about transmitting information. challenges, methods, and future directions. IEEE Signal Process. We need to consider heterogeneous systems. Mag. 37(3), 50–60 (2020) 11. Sakuma, J., Osame, T.: Recommendation with k-anonymized rat- Funding Open access funding provided by Umea University. This ings. Trans. Data Privacy 11, 47–60 (2018) study was partially funded by the Swedish Research Council (Veten- 12. Sengupta, S., Basak, S., Peters, R.A., II.: Particle swarm opti- skapsrådet) (Grant Number VR 2016-03346), the Wallenberg AI, mization: a survey of historical and recent developments with Autonomous Systems and Software Program (WASP) funded by the hybridization perspectives. Mach. Learn. Knowl. Extr. 1, 157–191 Knut and Alice Wallenberg Foundation, and the Spanish Ministry of (2018) Science and Innovation (PID2021-125962OB-C33). 13. Torra, V.: Data Privacy: Foundations, New Developments and the Big Data Challenge. Springer (2017) Data availability Not applicable. 14. Torra, V.: Random dictatorship for privacy-preserving social choice. Int. J. Inf. Secur. 19, 537–545 (2020) 15. Vaidya, J., Clifton, C., Zhu, M.: Privacy Preserving Data Mining. Declarations Springer (2006) 16. Warner, S.L.: A survey technique for eliminating evasive answer bias. J. Am. Stat. Assoc. 60(309), 63–69 (1965) Ethical approval This article does not contain any studies with human 17. Yang, Q., Liu, Y., Chen, T., Tong, Y.: Federated machine learning: participants or animals performed by any of the authors. concept and applications. ACM Trans. Intell. Syst. Technol. 10, 1–19 (2019). arxiv:1902.04885 18. Zhu, L., Liu, Z., Han, S.: Deep leakage from gradients. In: Pro- Open Access This article is licensed under a Creative Commons ceedings of NeurIPS (2019) Attribution 4.0 International License, which permits use, sharing, adap- tation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indi- Publisher’s Note Springer Nature remains neutral with regard to juris- cate if changes were made. The images or other third party material dictional claims in published maps and institutional affiliations. in this article are included in the article’s Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article’s Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copy- right holder. To view a copy of this licence, visit http://creativecomm ons.org/licenses/by/4.0/. References 1. Blanco-Justicia, A., Domingo-Ferrer, J., Martínez, S., Sánchez, D., Flanagan, A., Tan, K.E.: Achieving security and privacy in federated learning systems: survey, research challenges and future directions. Eng. Appl. Artif. Intell. 106, 104468 (2021) 2. Bogdanov, D., Laur, S., Willemson, J.: Sharemind: a frame- work for fast privacy-preserving computations. In: Proceedings of ESORICS 2008, LNCS (2008) 3. Bonawitz, K., Ivanov, V., Kreuter, B., Marcedone, A., McMahan, H. B., Patel, S., Ramage, D., Segal, A., Seth, K.: Practical secure aggregation for privacy-preserving machine learning. In: Proceed- ings of CCS’17 (2017) 4. Duncan, G.T., Elliot, M., Salazar, J.J.: Statistical Confidentiality. Springer (2011) 123