  Federated learning (FL) enables edge devices to collaboratively train machine
learning models, with model communication replacing direct data uploading.
While over-the-air model aggregation improves communication efficiency,
uploading models to an edge server over wireless networks can pose privacy
risks. Differential privacy (DP) is a widely used quantitative technique to
measure statistical data privacy in FL. Previous research has focused on
over-the-air FL with a single-antenna server, leveraging communication noise to
enhance user-level DP. This approach achieves the so-called "free DP" by
controlling transmit power rather than introducing additional DP-preserving
mechanisms at devices, such as adding artificial noise. In this paper, we study
differentially private over-the-air FL over a multiple-input multiple-output
(MIMO) fading channel. We show that FL model communication with a
multiple-antenna server amplifies privacy leakage as the multiple-antenna
server employs separate receive combining for model aggregation and information
inference. Consequently, relying solely on communication noise, as done in the
multiple-input single-output system, cannot meet high privacy requirements, and
a device-side privacy-preserving mechanism is necessary for optimal DP design.
We analyze the learning convergence and privacy loss of the studied FL system
and propose a transceiver design algorithm based on alternating optimization.
Numerical results demonstrate that the proposed method achieves a better
privacy-learning trade-off compared to prior work.
