Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: This paper tries to tackle the problem of data heterogeneity in federated learning with differential privacy by attempting to divide the features into private and generalizable features. They ask the question of what is necessary to share to learn global models and can the remaining data stay on the client as local models. They provide empirical evaluation of their claims.
strength_and_weaknesses: Strengths:
1. The paper proposes an interesting idea to try and improve federated learning training with differential privacy.
Weaknesses:
1. Theorem 3.4 is the standard adaptive composition result of differential privacy and it is not clearly stated that this is not one of the papers contributions.
2. Theorem 3.5 is an informal statement at best, and in no way shows why the necessary noise to be added is lesser to just the generalizable features. Is the L2 sensitivity lowered in some way?
3. In the experimental evaluations, the high near central training accuracies make it seem like there is some personalization done using the private data on each client $x_s$. Is this the case? If it is the case, the baseline of no local personalization is quite weak. Unfortunately, I couldn't verify this since the code wasn't attached.  

clarity,_quality,_novelty_and_reproducibility: The paper is broadly well written, but lacks rigor where it is required.
The idea is novel, but the theoretical results (as claimed) are non-existent and empirical improvements are not clear.
summary_of_the_review: In light of the strengths and weaknesses mentioned above, the weaknesses outweigh the strengths and I recommend the paper for rejection.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: The paper proposes an algorithm that distill and privatize the generalizable features to improve FL training.
strength_and_weaknesses: Strength:
The paper proposes an interesting idea to distill the generalizable features from samples to improve training.

Weakness:
1. The DP analysis is a bit unclear.
- The paper says that we'll add noise to x_g to form x_p and all the x_p would be sent to the server. That looks like local DP which could usually cause problem to utility. But then the paper says "considering all clients' data as a whole", which seems to suggest something very different from local DP. The authors did not provide a rigorous of sensitivity and privacy analysis.
- It is also unclear whether we're having a per-example privacy or per-user privacy.
- I didn't see the privacy values in the experiments either.
2. The paper claims to separate the generalizable and sensitive features, but it looks more like generalizable vs "non-generalizable" features / the reminder features to me. I don't think the paper has explained much about why the reminder features contain anything sensitive.
clarity,_quality,_novelty_and_reproducibility: Clarity:
The presentation is in general quite clear except for the privacy analysis and specification in the experiments.

Quality:
Again, my main concern is the privacy analysis.

Novelty:
The general idea seems quite novel. 
One minor point: the idea reminds me of https://arxiv.org/pdf/2102.12677.pdf (I might be wrong in understanding either paper though) which decomposes the gradient into a subspace where the majority signal lies in and the orthogonal subspace, and privatized both parts. You might see if there is any connection and anything to borrow there.

Some other comments:
- In "optimization view", the paper mentioned that L in (1) is the cross-entropy loss, but the formalization looks quite general to me that I don't think we need to restrict the loss (or whether the label y should be a scalar or vector).
- The formulations in optimization view and generalization view only focus on the generalizable feature x_g being an accurate approximation to the original data x, but do not contain privacy-related constraints. (The privacy is guaranteed through additive noise.) So it is a bit unclear to me why we should be calling x - x_g the "sensitive features". It looks to me that they are just "ungeneralizable" features and do not necessarily contain sensitive information.
summary_of_the_review: The idea seems interesting, but I'm mostly concerned about the privacy analysis.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: This paper proposes a novel method to tackle data heterogeneity in federated learning. Specifically, the authors proposed viewing the data as an addition of public features and private features and generate a set of public features to construct a globally public dataset to aid training. The empirical results demonstrate significant improvement over prior efforts.
strength_and_weaknesses: Strengths:
- The method is novel and the empirical results look promising.

Weaknesses:
- I'm concerned with the privacy guarantee imposed in the work. It doesn't seem that the authors state the clipping bound for Gaussian/Laplacian Mechanism nor does Theorem 3.4 include any information about how the privacy parameter $\varepsilon$ relates to the noise scale $\sigma$ and the clipping bound. That makes me concerned about whether the experimental results comes from unbounded $x_g$? Could the authors explain how sensitivity is bounded in the experiments and theory?
- I'm confused with the separation of $x_s$ and $x_g$ here. Seems that $x_s$ has never been used alone, it seems that the solution is equivalent to generating synthetic data $x_g$ from true data $x$ using a generative model and send the synthetic data to the server. Could the authors explain the motivation of having $x_s+x_g=x$?
- When communicating the synthetic data to the server, how are the labels communicated? It seems that $p(y|x)$ and $p(y|x_g)$ are the same? If that is the case, how to communicate the label information privately?

clarity,_quality,_novelty_and_reproducibility: The idea is novel conceptually. However, there are missing arguments around the privacy aspect of the proposed method.
summary_of_the_review: Although the experimental results seem good, critical privacy arguments are missing in the current paper (1. bounding sensitivity, 2. communicating label info). Based on current content, justifications and improvements are needed for this work. 

**UPDATES**: After reading the responses and other reviewers' comments, I still do not find the privacy argument convincing. The main concerns still lies in unbounded sensitivity and unmasked label info. Therefore, I decide to maintain my initial evaluation.
review_title: null

final_score: rating: 1: strong reject
review_content: summary_of_the_paper: This paper studies privacy in a federated learning setting. It aims to improve upon methods that directly privatize data points or gradient updates using differential privacy by instead separating data points into "sensitive" and "generalizable" features and then only requiring the client to publish a noisy version of their generalizable features. Each client then constructs their own model based on all shared noisy data and their own raw data. Intuitively, the scale of noise required to privatize the generalizable features may be substantially smaller than that needed to privatize the raw data (as required for local DP), and this enables more accurate final models. The paper concludes with experimental results .
strength_and_weaknesses: Strengths: The idea of separating useful and sensitive features is conceptually interesting.

Weaknesses: I think the paper has three serious problems.

1. The description of the algorithm is unclear. After reading Section 3.2 several times, I still don't understand how the data distillation process works. Is it performed entirely locally? If so, what is the meaning of the E_{(x,y)} term? As far as I can tell, the paper never makes the actions taken by each client locally explicit. Algorithm 1 abstracts it away as a subroutine in Algorithm 2 in the appendix, and Algorithm 2 abstracts it away as calling an undefined PrivacyDistillation algorithm using Equation 1, though I don't see where the user's actual data point enters into the algorithm. If indeed the distillation process is entirely local, I'm confused about how generalizability is even measured -- how can somebody with one data point reason about which parts of it generalize? Do users have multiple data points? Turning to the privatization step, I do not see which part of the paper actually derives the additive noise scale required to privatize the generalizable features x_g when constructing the globally shared database. The relevant result appears to be Theorem 3.5, which only offers a vague qualitative statement that FedPD's noise standard deviation is "much less than" that of conventional federated learning, without a proof. Overall, the paper's clarity is low.

2. The privacy argument seems wrong. As far as I understand it, the paper does not attempt to ensure that the distillation process itself is private. This makes me question the value of adding noise to the distilled generalizable features. The paper is not precise enough for me to make this argument exact, but it seems plausible that the scale of the generalizable feature is itself private information, i.e., certain data points will produce generalizable features with noticeably larger norms than other data points. If indeed noise is scaled to this norm (as I assume it must be -- if not, what is the advantage over privatizing the entire data point?) then the scale of the noise added alone could leak information. As mentioned above, the paper doesn't seem to actually describe how the noise is scaled, so I can't verify this concern, but I think it's a red flag that the paper does not attempt to reason about this possibility.

3. The paper's Theorem 3.4 comes out of nowhere, its significance is not explained (are users applying it to privatize k of their generalizable points?) and it seems to have been plagiarized from previous work (see "Details of Ethics Concerns" below).
clarity,_quality,_novelty_and_reproducibility: I think the paper scores poorly on all four of these aspects. Specific to reproducibility, the proofs and pseudocode are vague, and no experiment code is provided.
summary_of_the_review: The paper's explanation of its algorithm is unclear, no proofs or code are offered for verifying its reasoning, the privacy guarantee of the algorithm it sketches is suspect even apart from these technical details, and one of the results appears to be plagiarized, with an incorrect proof, from previous work.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: The paper studies statistical (data) heterogeneity in private federated learning. The proposed idea to address this problem is to divide the features into private and generalizable features. The latter can be extracted from different clients and used in federated training to produce better global models. 

Although the idea is natural and interesting, unfortunately, the paper has several major shortcomings. 

The paper lacks rigor. There are no formal proofs are given to support the main claims. There is no formal privacy analysis when the paper central claims are about privacy distillation. No discussion is provided on how the noise magnitude is translated to a formal privacy guarantee. Also, the description of the main algorithm lacks clarity. The presentation and writing quality can be improved in several parts of the paper. 
justification_for_why_not_higher_score: The paper lacks rigor. All central claims, including those about privacy, are not supported by formal reasoning.
Decision: Reject