Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
review_content: summary: This paper considers the roles of privacy and personalization in cross-silo federated learning (FL) setting, which has less explored than in cross-device setting. This paper firstly shows why existing privacy solutions (employing differential privacy) are less appropriate to cross-silo FL with three key properties of silo-specific privacy. Then, it empirically shows that two notable phenomena under silo-specific item-level DP with two extreme baselines, local fine-tuning and federated average, which provides fundamental trade-off among privacy, utility and heterogeneity. It further shows mean-regularized multi-task learning (MR-MTL) is good interpolation between of the two extreme baselines while providing better trade-off between privacy and cross-silo data heteroneneity. Theoretical analysis of the MR-MTL is also included.

strengths_and_weaknesses: Overall, even though this paper does not provide new algorithm for cross-silo privacy protection, it raises the new notion of privacy suitable for cross-silo FL, and proposes interesting trade-off among privacy and data heterogeneity by exploring state-of-the-art personalized FL techniques. This paper is organized and written well, and hence it is easy to understand the difference between the notion of privacy in cross-device and cross-silo FL settings; characteristics of cross-silo privacy; and fundamental trade-off between privacy and heterogeneity in cross-silo FL with the strong baseline (MR-MTL). The role of the important hyper-parameter in the MR-MTL is well explored with empirical and theoretical analysis.  
questions: Please explain more detailed reason that MR-MTL outperforms Ditto with a certain level of privacy budget ($epsilon=0.5 in Figure 5)
limitations: This paper has no negative societal impact as it studies the privacy protection in collaborative ML training.
review_title: null

final_score: rating: 4: Borderline reject: Technically solid paper where reasons to reject, e.g., limited evaluation, outweigh reasons to accept, e.g., good evaluation. Please use sparingly.
review_content: summary: The paper studies differential privacy (DP) in cross-silo (where participants share different attributes of the same data subjects) federated learning (FL). The authors propose a silo-specific item-level privacy (although it is unclear to me what it means and how it is connected to the methods used to achieve this privacy, see Question section) which is more suitable in cross-silo FL mainly because it can allow different silos (organizations/participants) apply their individual privacy policy (i,e. DP budgets). The paper uses FL personalization methods to achieve this privacy, and empirically finds that MR-MTL (encouraging the mean of each local model's weights to be close to the mean of all local models') lead to the best privacy-utility tradeoff. Then the paper justifies this observation with some theoretical analysis on MR-MTL.
strengths_and_weaknesses: Strength
- Topic and problem are important. Privacy concerns in cross-silo FL are indeed different from cross-device FL. The motivation that different silos might want to enforce different privacy policies/budgets is, in my opinion, reasonable, and it is a practical problem in the real-world cross-silo FL deployments

Weaknesses
- The proposed silo-specific item-level privacy is not clearly defined (see Questions section)
- There is no novelty in the methodology, the paper only uses existing methods
- The experiments only include two datasets, and performance difference is not very significant. It is unclear how solid the conclusion that MR-MTL is the best can be hold in general
questions: My major concern that needs clarifications is about the definition of proposed silo-specific item-level privacy. First, what is meant by "item"? From definition 2.1, it seems to mean sample. If so, I strongly recommend the authors to call it "sample" instead because the meaning of "item" is quite unclear. Furthermore, it would be helpful if the authors can provide a formal DP definition of the silo-specific item-level privacy like the definition 2.1.

More importantly, if I understand it correctly, the proposed privacy aims to protect data subjects. If that is the goal, shouldn't the privacy guarantee be data-subject-level rather than sample(or so-called item)-level? I find it hard to understand the proposed privacy definition given the motivation of protecting data subjects because what the paper actually protects is samples in each silo rather than the data subjects. Please let me know if I misunderstand anything.

In addition, if the goal is to protect data subjects, I do not understand why letting each silo adds its own noise, instead of protecting the combined datasets (from all silos), can mitigate the privacy risk since each data subject's full information can only be found in the combined datasets. I would imagine if you want to protect data-subject-level privacy, you would need to operate on the combined dataset. Therefore, it seems to me the proposed solution and privacy definition are disconnected from the motivation of "concern in-silo data subjects". Please let me know if I have a high-level misunderstanding.

Minor concerns
- Define "local training"
- Fig.2, the right figure, explain what is meant by the semi-transparent plot line
limitations: In additions to the limitations shown in Section 7, I would suggest the authors to include a discussion on the proposed privacy definition. What might go wrong if practitioners go with this less stringent definition? What are the trade-offs between this definition and other DP definitions in cross-silo FL? Under which real-world scenarios, practitioners would be most likely to benefit from the proposed definition?
review_title: null

final_score: rating: 3: Reject: For instance, a paper with technical flaws, weak evaluation, inadequate reproducibility and incompletely addressed ethical considerations.
review_content: summary: This paper proposes a mean-regularized multi-task learning based cross-silo federated learning for privacy and model personalization.
In cross-silo federated learning, each silo has different item-level different privacy budget on its local dataset
The paper empirically shows that local finetuning fails to achieve the high average silo test accuracy (model personalization) with differential privacy noise after FedAvg steps. 
To achieve model personalization under data heterogeneity with differnetial privacy, a network is trained with a mean-regularization penalty.
This penalty is controlled by the hyperparameter \lambda, and the authors propose an optimal value of \lambda in \mu-strongly convex scenario with theoretical analysis. 

strengths_and_weaknesses: Strength
* The proposed approach for personalized FL with guaranteeing differential privacy is simple
* The empirical analysis on several simple benchmark datasets is well demonstrated to help readers to understand.

Weakness
* The paper only provides a theoretical analysis for the convex setting, which may not be directly applied to deep learning scenarios. If it is hard to find the optimal \lambda for a nonconvex setting, the authors may need to give empirical evaluation at least for CIFAR-10/100.
* The references [32] in this paper has already analyzed the personalized federated learning with mean-regularization penalty. This paper simply extends this to the case with the concept of differential privacy. For example, the references [26], [32] in this paper proposed personalized FL algorithms with theoretical guarantee in a nonvex setting, and demonstrated the empirical evaluation for harder cases such as CIFAR-10/100. Therefore, the novelty is not enough to satisfy the standard of this venue. 

questions: I wonder that the same regularization effect will hold for CIAFR-10/100.
limitations: The paper shows an interesting observation in personalized federated learning with guranteeing diffrential privacy. Mean-regularized multi-task learning method has already been used in personalized FL widely, so I think it will be great if the authors prove the lower bounds of convergence in a nonconvex setting.
review_title: null

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: The paper discusses personalization under differential privacy (DP) in federated learning (FL). The key observation in the paper is that with DP, there is a potential trade-off between the amount of federation, that can mitigate DP noise effect, and personalization, which can mitigate problems due to data heterogeneity. The authors then discuss the desiderata for a good personalization approach under DP, and explore the performance of mean-regularized multi-task learning, both theoretically and experimentally.
strengths_and_weaknesses: ### Update after the discussions

I raise my score to recommend acceptance. In case the paper is still not accepted, I would give it a higher score in the future if the following are addressed: 1) make further improvements in the main content (e.g. how to choose lambda under DP, run still more experiments to check how robust the current results are, especially are there cases which go against the current understanding), 2) improve writing clarity (see the discussions, give less weight to sample-level DP discussion and more to the utility trade-off results)

### Strenghts

+ The observation about a possible trade-off between mitigating utility loss due to DP noise by federation and mitigating utility loss due to data heterogeneity by personalization is a nice one and, to my knowledge, a novel perspective on the problem.
+ The theoretical analysis, although under simplifying assumptions, seems to support the argument nicely.
+ The discussion about the price of addional hyperparameters under DP points to an important problem.
+ The paper is mostly clearly written and easy to read.


### Weaknesses

- There seems to be some possible misunderstandings about (client-level) DP in FL, which leads to a number of strange claims in various parts of the paper (see questions for authors for details).
questions: 1) Reading the current paper, especially lines 24-28, 35-37, 50-51, 109-110, one could be lead to think that this is the first paper to consider sample or item-level DP in cross-silo FL. Please add cites to relevant papers when introducing the problem to remedy this.

2) Related to the previous point, some existing work is presented in a manner which seems a bit misleading, especially w.r.t. the sample-level vs client-level privacy: both Truex et al. 2019 and Heikkilä et al. 2020 define neighbourhood on a single-sample level, not on client-level (see Def.1, and first paragragh in Sec.3, respectively) as claimed. The secure primitives in these papers help to reduce the effect of DP noise, they do not change the basic DP neighbourhood definition used. I think this points to a misunderstanding in the client-level DP definition (see next questions as well).

3) Line 105: "Client-level DP canonically defines a shared privacy guarantee for all participants." Client-level vs sample-level privacy typically relates to the granularity of the DP guarantee, i.e., to the neighbourhood definition used, not having a joint vs individual DP budgets for each client (and incidentally, by tuning the granularity one can then also easily define the individual level privacy, where a single individual may have one or several samples in one silo, that sits between silo-level and sample-level). There is no problem in enforcing client-level DP with varying privacy budgets for different clients in FL (e.g., just use different amounts of noise for different clients with parameter perturbation).

4) Related to the previous comment, on lines 117-120 you claim that client-level DP requires some trust to the central server. This is simply not true, there is no problem in each client enforcing client-level DP individually (although the model utility could be awful), this is local DP (LDP) on the client-level, and by post-processing immunity and parallel composition the global model will have DP guarantees as well, including against the central server.

5) Again a related point, lines 122-123 "local training is 'free' under client-level DP." I would claim that this depends on the DP mechanism, not on the neighbourhood definition: e.g. using DP-SGD and client-level LDP is a counter-example where local training is not free with client-level DP.

6) Lines 33-34: "...participation in FL [is] disclosed publicly, nullifying any client-level DP guarantees." Also lines 121-123. I do not understand why knowledge of participation in FL training would nullify DP guarantees.

7) Lines 166-169: how do you choose the total number of iterations for the fair comparisons?

8) Lines 175-176: if you do not even try to tune the hyperparameters properly for all methods, why should I believe that the results are not simply due to chance?

### Minor comments:

9) Figure 6: due to the scale, it is next to impossible to see from the figure what happens around eps=1-2 that is usually the most important region. Please fix this (change scale, add additional plot maybe to appendix or something else).


10) Lines 86,171: DP-SGD was developed and analysed by Song et al. 2013 and Bassily et al. 2014, while the main contribution of Abadi et al. 2016 was the privacy accounting based on cumulants (moments accountant).

11) DP def. 2.1: the definition of neighbourhood seems a bit strange, since x,x' in mathcal X^n explicitly declares the same dataset size for both, but then you mention addition and removal as well. Which one do you actually use?

References:
Abadi et al 2016: Deep learning with DP.
Bassily et al. 2014: Private empirical risk minimization.
Heikkilä et al. 2020: DP cross-silo FL.
Song et al. 2013: Stochastic gradient descent with DP updates.
Truex et al. 2019: A hybrid approach to privacy-preserving FL.
limitations: The paper has a good discussion on some important limitations of the proposed method. There is some separate discussion on the potential negative societal impact in the appendix.
review_title: null

Meta-review: metareview: The paper presents an analysis of item-level or sample-level DP with personalization in cross-silo federated learning.

The reviews are strongly divided with two recommending acceptance and two recommending rejection.

After reading all the reviews and the paper, I find the argument of the "accept" side stronger.

While the paper does not propose new algorithms, it presents a systematic analysis of existing methods that helps explain their properties. I believe this can be a more valuable contribution to the community than yet-another-new-algorithm.

That said, there are also important weaknesses, as noted by the reviewers. It is not clear how to select the optimal $\lambda$, especially in the non-convex setting with no theory as a guide. It is therefore not clear how useful the method would be in actual application where suitable $\lambda$ would have to be found somehow. This seems like an obvious topic of future work. A broader assessment with more data sets and some actual algorithm to select $\lambda$ would clearly strengthen the paper.

Some reviewers were confused by the proposed definition for sample-level cross-silo DP. I would strongly encourage the authors to use a part of the extra space for camera ready for writing this definition explicitly to avoid such confusion.
confidence: Less certain
Decision: Accept