Venue: ICLR 2022 Conference

Reviews:

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: This paper considers the problem that differential privacy disproportionally degrades the performance of minority groups in the federated learning context. To mitigate this problem, the paper introduces a novel method for enforcing group fairness constraints via the modified method of differential multipliers. The paper then shows how to generalize this method to the differentially private federated learning setting. Finally, the paper empirically evaluates the method on two real-world datasets, demonstrating that it achieves high accuracy while significantly reducing various group fairness metrics.
main_review: **Strengths**

- `The paper investigates a relevant problem.` Prior work on fair federated learning has mostly considered achieving uniform performance. In contrast, this work proposes a method for group fairness (in private federated learning), which is a relevant problem (as also empirically evidenced in the paper).
- `The method is novel, technically sound, and achieves its goal.` In contrast to prior work, the proposed approach enforces group fairness constraints via the modified method of differential multipliers. Concretely, it augments the parameter update with a term that encourages the neighborhood of the solution subspace to be quadratic, which guarantees the reachability of a local minimum. The experimental evaluation shows that the proposed method reduces various group fairness gaps while maintaining high accuracy.

**Weaknesses**

- `The method is not compatible with federated averaging.` As explained in section A.2, the proposed method is incompatible with federated averaging, which is quite a big limitation in federated learning. However, this crucially limits the practical applicability of the proposed approach, since federated settings are typically characterized by a communication bottleneck. In contrast to federated SGD, federated averaging avoids this bottleneck by exploiting the availability of local computational resources to learn a global model with significantly fewer communication rounds. I am thus uncertain whether the proposed algorithm would be practically relevant for real-world federated learning applications.
- `The paper does not compare to prior work on group fairness.` While the paper shows that the proposed method can reduce various group fairness metrics in the federated setting, it would be interesting to see how it compares to other methods for group fairness in the centralized setting (e.g., Zafar et al., (2017)). If the method does not outperform prior work in the centralized setting, then it might not be the most promising candidate to consider for the federated setting. An in-depth experimental evaluation of this aspect is definitely needed to motivate the proposed approach. Of course, it may be possible (but unlikely) that prior group fairness methods cannot be extended to the federated setting, but even in that case, the paper should include a detailed discussion to point out the specific limitations.
- `Various aspects of the experimental section are unclear.` See the questions below for some ambiguities. Moreover, section B.1.1 states that delta is approximately 5 * 10^-5, while section B.2 states that delta is approximately 2.5 * 10^-5.
- `The proposed method may be susceptible to a potential privacy violation.` The statistics that need to be shared at every round include the number of individuals per protected attribute for every client. Thus, if the server would set the cohort size to 1 and always select the same user, it would be able to reconstruct the number of individuals per protected attribute for that client (even after the addition of noise when using multiple rounds). This presents a potential privacy leak and could be exploited to learn an unfair model with respect to certain sensitive attributes.
- `Incorrect characterization of prior work.` The paper refers to prior fair federated learning approaches (e.g., Li et al. (2019)) as individual fairness methods. However, these methods enforce uniform performance across all devices, which is neither individual nor group fairness, but a novel notion tailored to the federated learning setting. To view prior work in the individual fairness context, which requires that similar individuals be treated similarly, one would have to consider all clients similar, which beats the purpose of having a similarity notion in the first place. However, I do agree that prior work has not yet studied group fairness in the federated setting (apart from Du et al. (2021), which the paper mentions).

**Questions**

- It is well-known that there is a tradeoff between accuracy and fairness when imposing fairness constraints in machine learning. I believe there is also such a tradeoff in the proposed approach. However, table 2 seems to indicate that fairness can be attained “for free” without losing accuracy (or even increasing accuracy). How can this happen? I suggest conducting more experiments to examine the impact of the various hyperparameters (e.g., the Lagrange multipliers) to better understand this tradeoff.
- Is the accuracy of 9.3% for FPFL with m = 100 in table 3 a typo or does the method break down completely in this case?
- How can you increase K in table 3 to 100K if K denotes the population size?
summary_of_the_review: While the proposed approach is novel and interesting, various motivational aspects (e.g., comparison with prior work) are unclear or lacking. Moreover, the method is crucially limited by its incompatibility with federated averaging. Thus, the paper does not meet the bar for acceptance in its current form. However, I am willing to increase my score if my concerns are addressed.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper studies the problem of training neural networks with differential privacy and fairness guarantees. The authors proposed an algorithm using a modified method of differential multipliers. In terms of group fairness, the authors focus on false negative rate parity and accuracy parity notions. They compare their proposed algorithm with federatedSGD and its variants with clipping and adding noise.
main_review: - The discussion in the last paragraph of page 2 is confusing. What additional term is considered in this paper? 

- The extension to private federated learning seems straightforward. I think the main contribution of the paper is adapting the MMDM algorithm to satisfy fairness constraints. Aggregating $v^k$'s in (11) with clipping and adding Gaussian noise is standard. Similar techniques have been proposed in the federated learning literature.      

- The differentiable estimation of $F(d';w) $ is provided for very special cases without any theoretical guarantees on the estimation error in Section 3.1. 

- The construction of subsets $d'$ and $d'_a$ is confusing. It seems that these subsets may depend on $w$ in general for example for accuracy parity, which makes the optimization problem in (P2) more difficult.

- Problem (P2) introduces additional hyperparameters such as $c$ and $\gamma$. It is not clear how those parameters are set. In practice, tuning additional hyperparameters is challenging. It is important to understand how sensitive the accuracy and gaps reported in Section 4 are to the choice of additional hyperparameters.  

-  The authors introduces cohort size in Section 3.2 without providing much explanation. It will be nice if the authors provide further clarifications. 


Minor comments: 
Equation (11): what is $k'$? should it be $k$ instead?


summary_of_the_review: Several aspects of the proposed method should be clarified, and I think that the extension of the MMDM with fairness constraints to the federate learning is marginally significant.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The fact that DP (and in particular DP-SGD) makes models unfair (e.g. disparate impact on accuracy for minor groups) is well known (Bagdasaryan et al., 2019), however it is possible to have a satisfying trade-off between these ethical measures (Jagielski et al., 2019; Cummings et al., 2019).
I think this seems like an elegant solutions for forcing fairness in DP gradient optimisation trained models.The solution uses classical constrained optimisation (the modified method of differential multipliers) and directly uses an empirical estimate of the group fairness to form the differentiable constraint function.

main_review: Pros:

I think the solution is very elegant as the empirical version of the group fairness (as considered e.g. by Agarwal et al., 2018; Fioretto et al., 2020) can be just added to the DP-SGD training. 

The empirical results are convincing: there only a small drop in test accuracy for considerable increase in fairness (as measured by the 'FNR Gap').

The paper is very well written (except for few parts detailed below) :

Cons:

Some weaknesses regarding the presentation (these are fixable I believe) :
-I cannot find there EO Gap, DemP Gap and PP Gap of Tables 1 and 2 explained anywhere. What are those?
-I cannot find any parameters for the DP training in the main text (what was the epsilons / noise level etc.?)

The role of hyperparameter tuning does not seem to be addressed really (at least in the main text). I would be slightly concerned about the fact that the constrained optimisation adds (as far as I see) two hyperparameters (for both SGD and DP-SGD). Especially in DP case this might cause problems (cf. DP hyperparameter tuning, e.g. Liu and Talwar (2019)).

Questions:

-How does the size of the model affect the results? In DP, things get more difficult as the dimension increases, does it affect here?

-There now two additional parameters compared to DP-SGD (for which rigorous hyperparameter tuning already
seems quite difficult). How would you tune the parameters in practice? How sensitive are they?


Other:
This sounds a bit funny:
“where each sample $z_i$ belongs to a group $a_i \in A$. “
perhaps simply “belongs to a group $A$”. ?

-I think that Table 3 would be much more readable if you would write out those abbreviations the way you do in Tables 1 and 2.

- I did not check all the details from the supplementary material, but I think it would be good to add more description of the models (e.g. number of parameters, number of layers etc.) to the main text. 

summary_of_the_review: All in all very nice and elegant looking contribution. However quite a few questions remain, I would be happy to see this paper accepted in case the authors can make those small modifications (that I have listed) and also address my questions.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: In this paper, authors propose a federated learning algorithm that is able to satisfy group fairness while maintaining privacy.
main_review: The paper considers a timely and important problem that considers both fairness and privacy; however, the paper has a lot of room for improvement and also the experimental section and results obtained have some flaws and a lot of room for improvement.

Strengths:
1. Paper is considering a timely and important problem.
2. Paper is easy to follow and clear.

Weaknesses:
1. Some important literature review is missing and more importantly these could have been considered as a baseline for comparing their method against methods that are trying to enforce group fairness in FL such as: Cui et al. 2021 Fair and Consistent Federated Learning.
2. Not enough baselines for Fair FL is considered to compare against. It is true that they might not satisfy privacy considerations, but they could still be included for the reader to have intuition of how your method compares against such methods especially that the results are not promising in the paper. Some baselines to consider is Cui et al or Tran et al. Authors claim that they do not compare with Tran et al since Tran et al does not consider privacy, but still I believe these types of results should be included as I am not sure now how effective your approach is in enforcing fairness compared to such baselines.
3. How do authors justify some of the incompatibility results shown in previous work between fairness and privacy?
4. Algorithm 1 can be improved. e.g., What do clients do? What is UpdateMultiplier? What is UpdateParameters? What is Calculate noiseScale?
5. Results are not promising for predictive parity among groups! Discuss why? There is also reduction in accuracy. Perhaps having the baselines that I suggested could improve and give us a sense of what other methods achieve in terms of loss in accuracy etc.
6. In Table 2 put the results for the central setting as well.
summary_of_the_review: I think the paper is missing discussion on important previous and related work as well as not including them in the results as baselines. Baselines should be added along with discussion around some of the results which does not seem to be promising. More details can be found under weaknesses discussed above.
review_title: null

Meta-review: This paper continues the investigation on fairness and privacy in the context of federated learning. We appreciate the detailed response from the authors. During the rebuttal period, the authors have largely updated the set of experiments, since there was an identified bug in the previous implementation. Another drawback that the AC identified is that there is a lack of formulation and formal guarantees in the paper. In particular, is the proposed algorithm trying to satisfy example-level or client-level data privacy? The resulting noise scale can be quite different. Unlike prior work (e.g. Jagielski et al), the proposed algorithm does not seem to provide any fairness guarantee. Thus, it is not clear why the proposed approach is justified (even under some assumptions). In a similar vein, perhaps the authors could consider a more in-depth discussion that compares their approach with prior work and articulate what advantages does their new method offers. Overall, the paper is not ready for publication at ICLR.
Decision: Reject