Venue: ICLR 2022 Conference

Reviews:

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: The paper considers the problem that personalization methods in federated learning may cause the personalized models to overfit on spurious features, thereby increasing the accuracy disparity compared to the global model. To mitigate this accuracy disparity, the paper investigates adversarial transferability, which is shown to correlate with disparity. Thus, the paper proposes a federated personalization approach based on adversarial transferability and catastrophic forgetting that reduces accuracy disparity to the level of the global model while maintaining the higher accuracy of prior personalization methods. The paper evaluates the approach on three real-world datasets.
main_review: **Strengths**

- `The paper identifies a relevant problem.` The paper empirically shows that prior work on personalized federated learning induces high accuracy disparity, which is a relevant problem to the fairness community.
- `The method is somewhat novel and technically sound.` The paper demonstrates a link between adversarial transferability and accuracy disparity of personalized models. Thus, the paper employs adversarial transferability and weight regularization (which has already been proposed by prior work, as the paper acknowledges) to learn personalized federated models that achieve high accuracy and lower accuracy disparity than prior work. 

**Weaknesses**

- `Certain presentational aspects could be improved.` For example, "bias-conflicting examples" are mentioned in the introduction but only defined in section 4 (leaving the reader to guess what these "bias-conflicting examples" are). Furthermore, the experimental setup for figures 4 and 5 is not provided (e.g., which personalization method was used?). Moreover, in section 6.1 two sentences are repeated (“there are 650 blond…” and “there are 650 blond...”). Finally, there are a few typos (Section 4.1 “models on bias**ed** and bias-conflicting”, section 6.1 “through**out** our experiments”, section 6.1 “residu**a**l”).
- `The method lacks key motivation.` Adversarial transferability is introduced to reduce the accuracy disparity of the personalized models by forcing them to be vulnerable to the same adversarial examples as the global model. However, the adversarial transferability between the global and local models is just a proxy for the similarity of the two models, similar to, e.g., KL divergence.
- `Baselines are misrepresented.` In figure 3, the centralized model is trained on a dataset where the spurious correlations are fixed, whereas the federated model is trained on multiple client datasets, each with different spurious correlations. Accordingly, it is unsurprising that the centralized model has a significantly lower accuracy on the bias-conflicting dataset, as it was not exposed to the same data distribution shifts during training as the federated model. I would expect the centralized model to perform on par with the federated model when trained on the same data, invalidating the paper’s claim.
- `Results are misrepresented.` In section 5, the paper states that low adversarial transferability indicates high accuracy disparity for the personalized models. However, the paper merely shows a correlation between the two metrics (as they both estimate the similarity between the global and personalized models). I would be very surprised if one could not train global and personalized models that achieve “high transferability and high disparity” or “low transferability but high disparity” (as I believe that transferability and accuracy disparity are only weakly correlated). Unfortunately, the paper does not provide empirical evidence to substantiate these claims. (In fact, it provides evidence for the opposite as “accuracy disparity still increases, even if the adversarial transferability remains high”).
- `The paper makes unsubstantiated claims.` In section 5, the paper claims that “Both methods are relatively light-weight from a computational perspective” but does not provide any further evidence for or analysis of this statement. 
- `Results are unclear.` Figure 7 compares the losses on the biased and bias-conflicting datasets. However, the loss is only an approximation of the accuracy, which is the quantity that we are ultimately interested in. Therefore, it would be more meaningful to compare the accuracies on the different datasets.
- `Results are insignificant.` Comparing the results for the global model and the proposed method in table 1, the method achieves roughly the same accuracy on the bias-conflicting dataset and only a minor increase in accuracy on the biased dataset (except for the MNIST dataset). Moreover, the prior personalization approaches achieve significantly higher accuracies on the biased datasets. Thus, the method just provides a “little less” personalization, yielding personalized models that are more similar to the global model (with corresponding performance).
summary_of_the_review: The paper identifies an interesting shortcoming of prior personalization approaches. However, given the various weaknesses outlined above (e.g., insignificant results, misrepresentation of results) and the limited novelty, I do not believe that the paper meets the bar for publication in its current form.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This work explores the possibility of personalisation methods entangling spurious features that can undermine their generalization in case of federated learning. It proposes to use a combination of a consistency term for adversarial transferability and an L2 regularisation term to help reduce this disparity.  The approach is evaluated on artificial settings with spurious features.  
main_review: Strength
- The work exposes a possible generalisation issues in personalised federated learning and proposes a novel approach to tackle it
- The idea is well motivated, paper is generally well written and experiments are provided to substantiate the claims

Weakness
- Use of some non-standard hyperparams like 0.031 eps budget for MNIST and the batches of 96, 40, 30. Similarly the 5 epochs of local training seem larger than the conventional 1 or 2. Could the authors provide an explanation?
- Doesn’t include exploration for other modalities like text or large scale setups like FEMNIST 

Few open questions
- Any thoughts on how the method could compare to say the adversarial training objective in combination with personalisation?

summary_of_the_review: I think this work tackles an interesting hypothesis that can limit generalization in case of personalised FL. The proposed solution is principled and well motivated with appropriate ablation study. The only drawback would be lack of experimentation on large scale problems which would certainly make this a valuable piece of work.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: The authors have proposed a new FL training strategy to reduce the performance discrepancy between the central model and the client models. The PGD generated adversarial examples are fed into both central model and client models and their outputs are used to minimize the entropy loss. The computation is further simplified using Taylor expansion.
main_review: Strength:
- The idea of using adversarial examples and minimizing entropy loss of global and local models' outputs is normal. The intuitions are straightforward to understand.
- Authors have spent a decent amount of effort explaining the relationship between the spurious features and adversarial transferability. It is helpful for audiences.
- The results do show certain improvements over the other baselines.

Weakness:
- The presentation has space for improvement, please explicitly explain all the critical terms (accuracy disparity, bias-conflicting, etc) at the first occurrence in this paper.
- Many subjective descriptions exist in the paper, e.g., if you claim the distribution shift of spurious features is a major effect of accuracy disparity, it would be really important that you give theoretical proof and/or empirical support to verify your claim.
- It seems like the spurious features are handcrafted, and we don't have a clear solution of how to automatically choose the spurious features in real applications. 
- The adversarial examples are generated using a global model, however, the way of generating adversarial examples in FL worth a lot of analysis and description of the details. There exist some papers that discuss the best way of improving adversarial robustness with adversarial training. Here, the same strategy should be applied to compare.
- The experiments are a bit disappointing. Without a comprehensive comparison, a replication of the results is almost impossible. So many factors in FL can dramatically change the results. The authors didn't provide a fair and reproducible setting for the results. The experiment is incomplete and the results are not convincing. 


summary_of_the_review: The idea is good and novel, however, the presentation is disappointing and the experiments are weak. I recommend rejection.
review_title: null

Meta-review: The paper talks about a novel setting in Federated Learning and argues that personalization methods may cause the personalized models to overfit on spurious features, thereby increasing the accuracy disparity compared to the global model. To this end the authors propose a debiasing strategy using a global model and adversarial tranferability. 

 There were some positive opinion about the problem being interesting .However reviewers had several concerns about the validity of assumption and hand wavy arguments used in the solutions for existence adversarial tranferability. Overall, the settings and the need for removing personalization bias needs to be validated more convincingly and rigorously, with concrete real scenarios and experiments.
Decision: Reject