Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
review_content: summary: The work proposes to outsource model training from low-power and cost-effective end devices to powerful and cloud-based servers, where no access to the private data is given and instead a surrogate dataset is sampled from public data to obtain a proxy dataset. The sampling process was designed to be communication and computation efficient. 

In the ECOS (Efficient Collaborative Open-source/world Sampling - there is a disagreement what ECOS stands for - compare lines 9 and 50) framework, the low-power clients do not send their private data but share features of their data that are used by the high-power server to adaptively find proximal public data for training the model (as a service). This facilitates the outsourcing of the model training without sharing local data by clients. 

It is argued that public data have low sample efficiency in training the model that could be useful on a client's local data. This is due to the fact of including OOD (Out-Of-Distribution) samples from the public domain that degrade the accuracy on the client's data distribution. 


strengths_and_weaknesses: Strengths:
- The authors tackle the important problem of outsourcing model training, which is of practical use. They incorporate the framework of differential privacy to account for the privacy leakage when a client instructs the server on the selection of the proximal dataset.

Weaknesses:
- Regarding the related work, the idea to "generate client-approximated labels for unlabeled public data, on which a model can be trained" was first proposed in https://arxiv.org/abs/1610.05755 and not in Private kNN.
- The definitions of proximity and diversity are omitted but this hinders the understanding of the paper. One has to refer to the related work [19] to find out the corresponding definitions - they should be included in this paper as they are the core of the method. 
- In Tables 2 and 3, the Random method outperforms K-Center in all but 1 case. Isn't there any better baseline to compare with?
- It is not clear how the adaptive model compression works (e.g., presented as subplot (b) in Figure 2).


Typos:
- Line 154: the client uses
- Line 218: repeated three times with the following seeds {1,2,3}
- Line 224: three practical use cases
- Line 241: given higher budgets (not more)
- Line 316: ECOS only needs
questions: - It is very surprising in Table 5 that the random sampling performs better than the proximity objective. Could the proximity part from Equation 2 be further improved? 

- How is the privacy cost computed in Table 4. How is the privacy loss from returning the coverage scores combined with the privacy loss incurred by labeling the proximal data with Private knn?

- Lack of future work or more potential methods. What are the other possible approaches to find which data the server should train the model? Wouldn't it be more practical if a client would point the server to the public data samples that should be used by the server to train the model? These can be also public datasets with labeled examples. The client could simply send links to the public data samples so the communication cost would be limited to the minimum. It seems that the best way to compare images is by applying a self-supervised model and then by comparing the representations from the private set with the representations from the public images. 


limitations: The work assumes that there exist public data samples similar to the client's private data samples.
review_title: null

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: This paper proposes a method of outsourcing client training in a privacy-preserving manner by effectively building and utilizing open-source data in the cloud. Problems with data heterogeneity is tackled by using a collaborative sampling solution. A series of experiments demonstrate the performance of this method.
strengths_and_weaknesses: **Strengths**
- The proposed method appears to perform well under multiple learning scenarios
- Arguments on privacy show that ECOS could provide a viable method for training models in a safe manner.
- Extensive experiments demonstrate ECOS provides empirically well compared to other methods.

**Weaknesses**
- See *limitations* below
questions: - Could ECOS be applied to a Federated Learning scenario, where multiple clients can learn from the proximal/diverse data on the cloud?
limitations: - No theoretical proofs on the convergence of models using ECOS.
review_title: null

final_score: rating: 8: Strong Accept: Technically strong paper, with novel ideas, excellent impact on at least one area, or high-to-excellent impact on multiple areas, with excellent evaluation, resources, and reproducibility, and no unaddressed ethical considerations.
review_content: summary: Facing the importance of privacy in machine learning, the paper proposes an efficient and private outsourcing strategy to find surrogate datasets for training classifiers to be adapted to private datasets. The authors identify the limitation of traditional outsourcing strategies in the iid assumption of open-source data or inefficient or non-private data sharing. In addition, they reveal the challenges of outsourcing with non-iid open-source data and therefore propose a private, efficient and compelling solution regardless of the availability of labels in the open-source datasets. Extensive and various experiments demonstrate the effectiveness and flexibility of the proposed methods in practice.
strengths_and_weaknesses: Strengths 
1. (Novelty) To mitigate the high cost of model training, traditional outsourcing methods tends to transfer the local training to public data that are identically distributed to the local dataset. The idea of outsourcing training without uploading reference private data is quite novel with the relaxed non-iid assumption on the public dataset and provides an interesting direction for outsourcing that is both efficient and private. 
2. (Impact) The paper is well motivated by the non-iid nature of open-source data and focuses on improving proximity, diversity and efficiency. Such practical considerations and goals make the method quite applicable in a wide range of real scenarios (with or without labels, label supervisions or model supervisions), and are promised with a high impact on privacy-preserving learning and efficient training outsourcing.
3. (Methodology) The proposed method is intuitive and is clearly guided by the importance of proximity, diversity and efficiency in improving the quality of selected open-source data. The intuition naturally leads to the principled objectives in sampling. Later experiments also demonstrate the importance of the three components. The privacy and efficiency (in terms of communication and computation) are solidly studied by theoretical analysis.
4. (Technical Quality) The paper is technically sound presenting significant improvements in privacy, computation and communication efficiency. 
 - The experiments are extensively executed in various scenarios with different supervisions and the proposed method exhibits outstanding performance in various benchmarks. Due to the high cost of labels in practice, the authors clarifies that it is usually unrealistic to assume the availability of labels in open-source datasets. In the well-designed experiments, the authors provide comprehensive evaluations regarding the forms of training supervisions. It is shown that the method is flexible in multiple scenarios, including the sample selection for reducing the cost of manual labeling, adaptive model compression on calibrated open-source data distributions, and automated client labeling with improved accuracy. 
 - In addition, the qualitative studies are quite helpful for understanding how principled objectives can lead to better performance. The visualization in Fig 3 provides another interesting perspective of the success, as well. The effects of important parameters like compression size and score scale s are well studied.
 - The privacy and efficiency of the method are evaluated not only theoretically but also empirically, which are quite solid.
 - Details of the implementation, including theorem proofs, datasets, and network architectures, are provided in detail meriting the reproducibility.

Weaknesses:
1. The experiments are limited to the domain of image recognition. The method could be considered in more general data assumptions.
2. The measurement of privacy could be described in detail early rather than in the appendix, for the convenience of readers who are not familiar with the notion of differential privacy.

questions: Can the proposed method be extended to other data domains, e.g., language models?
limitations: No obvious ethic issues in the paper. The authors have adequately discussed the limitation of the methods, like the data processing. Though more discussions on automating the data processing could be appreciated, it is an acceptable limitation within the scope of the paper.
review_title: null

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: This paper proposes a method to efficiently sample from open-source data in order to train models that are then transferable to private local datasets. This enables the use of machine-learning-as-a-service (MLaaS) to train models on the cloud without the need to upload confidential data to a remote server. The authors develop a new sampling method, by scoring centroids of clustered features from open-source data samples, which then guides the selection of a proper subset of the open-source dataset for model training. The uploaded scores can further be protected by adding Gaussian noise, in order to account for a desired privacy cost in the context of differential privacy (DP). This then leads to a technique with minimal computational/bandwidth requirements for the client. The proposed method is evaluated for digit and object recognition tasks, trained using pseudo, manual or pre-trained supervisions, and is shown to outperform baseline methods on average. 
strengths_and_weaknesses: This paper addresses an important problem, especially with the growing popularity of MLaaS. The proposed method is sound and well-described. I also appreciate the analysis of the algorithm with regard to different privacy, which allows a user to fine-tune the method according to their privacy cost. In most cases, the performance of the proposed method (in Tables 2-4) is within the confidence interval of another baseline method, and therefore the performance gains are not necessarily statistically significant. Nevertheless, configurable privacy and the computational/bandwidth efficiency of this method are solid contributions.

I think the evaluation can be improved in the following regards:
- While the baselines (K-center and random) provide a useful comparison between the authors’ method and more naive approaches, it would also help to include accuracies when a model is trained on the client dataset itself. This would show how much accuracy one would lose (if any) by using a privacy-preserving proxy dataset.
- I also think a sensitivity analysis with respect to the privacy cost (\epsilon) could be very informative. How does changing \epsilon affect the achieved accuracy?
questions: - Do the authors have any insight as to why the random baseline outperforms the authors’ method in some cases? This seems counterintuitive especially since this baseline is perfectly privacy-preserving, and by using random sampling one is polluting the training dataset with out-of-distribution samples.
- Does the K-center baseline require uploading the client dataset (or a transformed version of it) to the server? If so, this should be clarified since Tables 2-4 suggest that it is perfectly privacy-preserving.
- For DomainNet, roughly what portion of the selected proximal data corresponds to the same domain as the client dataset? This could show the effectiveness of the sampling method in picking in-distribution samples.

limitations: The main limitation of this method is that it requires the utilized public dataset to contain samples that are similar in distribution to the private dataset. The authors have adequately discussed this in the paper.
review_title: null

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: The authors considered utilizing public open-source data rather than sensitive private data when outsourcing the computation of machine learning under strong privacy constraints. To tackle the problem that the heterogenous public data from various domains, which may be not IID with the target-domain data and may degrade the model performance, the authors proposed the ECOS framework, which filters the public data according to the local private data.
strengths_and_weaknesses: ### Strengths
**Originality:** The authors considered a new problem of outsourcing machine learning under privacy constraints. This proposed framework clusters the public data and distributes the cluster centroids to the clients. The clients then use the private local data to score the centroids and then use the scores to filter the heterogeneous public data. This new framework works intuitively to alleviate the problem of data heterogeneity.

**Quality:** Compared with existing baselines, the proposed ECOS framework gains accuracy improvement in the evaluation. The authors also provided visualization which illustrate the effects of the ECOS framework.

**Clarity:** The paper is well organized and the proposed method is clear.

### Weaknesses

**Quality:** The theoretical analysis is not very sufficient, e.g., about how much accuracy the data filtering process can improve (compared with using all public data).

**Significance:** Federated learning considers the similar problem: users cannot upload raw data due to privacy concerns. There has been many research work in this field, which may also help address the problem considered by the authors. 

questions: 1. On the one hand, more data benefit training from reducing overfitting risk. On the other hand, out-of-distribution (OoD) samples degrade the model performance. The authors consider filtering public data to get rid of OoD samples, which, however, may reduce the amount of training data. Does the proposed ECOS framework strike a balance between more training data and high-quality training data, theoretically and empirically?

2. Federated learning considers a similar scenario of privacy constraints. We recommend the authors to compare their setting with federated learning in the related work. 

limitations: See my comments on more theoretical analysis and comparison with federated learning.
review_title: null

Meta-review: metareview: This paper presents a novel framework for outsourcing the model training to cloud servers without the need for the clients to upload their data to the cloud. Unlike federated learning, the clients don't even need to perform any local training. In particular, the server relies on a large amount of open-source data to perform model training. To reduce the negative impact of out-of-domain (OOD) open-source data, the server performs **efficient collaborative open-source sampling** (ECOS) with the help of the client. The authors show that ECOS can be performed with a small amount of communication from client to server. Moreover, this communication can be made differentially private, as shown in the paper.  Overall, the proposed framework is novel and interesting. Its efficacy is demonstrated on two vision tasks of digit recognition and object recognition. The proposed framework outperforms a couple of natural baselines. 

Most of the reviewers are positive about this work. Some of the reviewers had asked for some clarification which the authors adequately provided during the rebuttal. Notably, the authors provided a generalization bound,  results on another baseline (where clients train the model locally), and accuracy vs. differential privacy cost experiments. The authors are encouraged to include all these results in the revised paper. 

Even though the presentation of the paper has significantly improved after the author-reviewer discussion, there is still scope for some improvements: 1) Description of the sampling objective in Section 3.2 lacks flow. It's not clear why $\hat{S}$ is introduced. $\hat{S}$ does not even feature in the description of Algorithm 1. Please address this. 2) $\hat{D}^q$ is used to denote the $R$ centroids of the public data, whereas $\hat{D}^p$ (line 4, Algorithm 1) is used to denote the features of client data. Please use consistent notations. 

Even though the authors have mentioned that their framework can potentially work for language models with minimal modifications (e.g., using appropriate representations), it needs to be verified via detailed experiments. The authors should either include results on this or add this as a potential avenue for future work. 
confidence: Certain
Decision: Accept