SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Xiyuan Yang $^{1*}$  Wenke Huang $^{1*}$  Mang Ye $^{1\dagger}$
$^{1}$ National Engineering Research Center for Multimedia Software, Institute of Artificial Intelligence,
Hubei Key Laboratory of Multimedia and Network Communication Engineering,
School of Computer Science, Hubei Luojia Laboratory, Wuhan University, Wuhan, China.
{yangxiyuan,wenkehuang,yemang}@whu.edu.cn
https://github.com/xiyuanyang45/DynamicPFL
Personalized federated learning with differential privacy has been considered a feasible solution to address non-IID distribution of data and privacy leakage risks. However, current personalized federated learning methods suffer from inflexible personalization and convergence difficulties due to two main factors: 1) Firstly, we observe that the prevailing personalization methods mainly achieve this by personalizing a fixed portion of the model, which lacks flexibility. 2) Moreover, we further demonstrate that the default gradient calculation is sensitive to the widely-used clipping operations in differential privacy, resulting in difficulties in convergence. Considering that Fisher information values can serve as an effective measure for estimating the information content of parameters by reflecting the model sensitivity to parameters, we aim to leverage this property to address the aforementioned challenges. In this paper, we propose a novel federated learning method with Dynamic Fisher Personalization and Adaptive Constraint (FedDPA) to handle these challenges. Firstly, by using layer-wise Fisher information to measure the information content of local parameters, we retain local parameters with high Fisher values during the personalization process, which are considered informative, simultaneously prevent these parameters from noise perturbation. Secondly, we introduce an adaptive approach by applying differential constraint strategies to personalized parameters and shared parameters identified in the previous for better convergence. Our method boosts performance through flexible personalization while mitigating the slow convergence caused by clipping operations. Experimental results on CIFAR-10, FEMNIST and SVHN dataset demonstrate the effectiveness of our approach in achieving better performance and robustness against clipping, under personalized federated learning with differential privacy.
Federated learning (FL) [32] has shown great potential in facilitating collaborative machine learning across distributed devices. However, in real-world scenarios, local data normally present non-IID [40, 44, 43, 10, 16, 27, 26], (non-independent and identically distributed), posing data heterogeneity challenges [19, 22, 14, 9, 37] in FL. To address these challenges, various personalized federated learning (PFL) algorithms have emerged [39, 2, 30, 28], demonstrating significant effectiveness by incorporating personalized components that cater to the local data characteristics of each client. Despite their success, PFL faces severe privacy leakage issues, as client-local training data may be reconstructed through inference attacks [11, 33, 18, 42] during the collaborative updating phase. As a
*Equal contribution. † Corresponding author.
result, it is essential to adopt user-level differential privacy (DP) techniques [12, 8, 41, 38] to provide more stringent privacy protection to PFL against potential privacy leaks, a.k.a, personalized federated learning with differential privacy.
Despite its pilot progress, personalized federated learning with differential privacy still faces numerous challenges. Most existing PFL approaches [30, 28, 3, 2] primarily rely on strong prior assumptions to perform parameter partitioning, personalizing a fixed portion of the model parameters and sharing the remaining ones. However, this approach lacks flexibility in parameter partitioning and cannot fully adapt to the diverse data characteristics of different clients, thereby affecting the personalized model performance. Besides, adding noise is an indispensable aspect in the differential privacy setting to ensure privacy protection in PFL. However, previous methods [8, 38, 3] directly add noise to all the network parameters, which unavoidably causes performance degradation. Considering that partial personalized parameters might not rely on the feedback from the server, this provides potential to reduce the noise impact. In light of these limitations, an essential issue that has long been overlooked is  $\mathbf{0}$  how to develop a flexible personalization approach that enhances the learning capability of model while mitigating the impact of noise on the model.
In order to achieve comprehensive user-level differential privacy, it is also crucial to implement a clipping operation targeting the L2 norm of each local update [12, 41]. These updates are sent to the server upon the completion of local training, ensuring that their magnitudes are bounded by the clipping bound. However, traditional optimization methods [12, 38] primarily focus on minimizing empirical risk, disregarding constraints on the L2 norms. Consequently, the local updates accumulated by gradients are susceptible to clipping, leading to distortion phenomena that can adversely affect model convergence. Existing methods for enhancing robustness [8, 23] against clipping often apply a uniform L2 regularization strength to all parameters. Such approaches neglect the inherent differences in parameter magnitudes, constraining the model learning capacity. This raises another crucial question: how can we devise a dynamic constraint mechanism that maintains the learning capacity of the model as well as augments clipping robustness?
In response to ①, we propose an adaptive method that dynamically determines the personalized parameter portion for each client, while simultaneously mitigating the influence of noise. Our approach is inspired by the Fisher information matrix, which reflects the contribution of parameters to the curvature of the loss function by computing the square of the first-order derivatives of log-likelihood function. This mathematical process can also be intuitively understood as the information content carried by the parameters. Following this concept, we further introduce layer-wise Fisher information to measure the information content of client parameters. Prior to client training, we retain essential parameters as personalized components, implementing personalization by preventing them from being overwritten by the corresponding noisy global parameters. By employing this adaptive personalization strategy, our method ensures that locally retained parameters remain unaffected by the noise introduced for privacy protection, effectively overcoming the challenges associated with inflexible personalization and the impact of noise.
To tackle the issue of local update robustness to 2, we introduce an adaptive method that determines different constraint strengths for different parameters. Taking into account the inherent differences in parameter magnitudes, we only apply L2 norm regularization constraints to the updates of personalized parameters selected on account of layer-wise Fisher information, which preserves more unique knowledge of local data, to maintain local knowledge effectively. While for the shared parameter updates, we ensure that their L2 norm values approach the clipping bound through a bounded regularization term, effectively mitigating the impact of clipping operation. By adopting these strategies, we enhance the robustness to clipping while addressing the limitations of uniform regularization successfully.
In this work, we propose a novel personalized federated learning method under differential privacy named FedDPA via Dynamic Fisher Personalization (DFP) and Adaptive Constraint (AC). Our main contributions are summarized as follows:
- We propose a dynamic personalization strategy using layer-wise Fisher information values, enabling flexible personalization and reduced noise impact.
- We present an adaptive method for enhancing clipping robustness by adjusting constraint strengths for different parameters, balancing client-specific features and global knowledge while minimizing clipping effects.
- We conduct extensive experiments under multiple tasks and settings. Accompanied with a set of ablative studies, promising results validate the efficacy of our proposed methods and indispensability of each module.
2.1 Personalized Federated Learning
Federated Learning is a distributed machine learning approach that allows data to remain on local devices while training a global model, with the FedAvg algorithm [32] as its most representative example. Despite its revolutionary approach, the inherent non-Independent and Identically Distributed (non-IID) nature of local data [19, 22, 40, 44, 17, 13, 15] poses significant challenges, thus leading to the advent of personalized federated learning (PFL). In PFL, a portion of the model is personalized to learn client-specific knowledge, while the remaining parts aim to capture the global patterns across all clients. The mainstream PFL methods include LG-FedAvg [28], FedPer [2], PPSGD [3], and FULR [5]. The LG-FedAvg [28] and FULR [5] methods both leverage a fixed local parameter to extract a representation of the local data, thereby achieving personalization, but their static partitioning approach lacks flexibility in adapting to diverse data characteristics. Besides, the FedPer [2], FedBABU [35] and PPSGD [3] algorithms achieve personalization by retaining specific layers locally, which can better cater to local data characteristics, but suffer from potential inflexibility in model personalization. Additionally, another work [36] introduces FedSim and FedAlt, which analyze different update paradigms of local and global parameters, contributing to the understanding of the trade-offs between local data specificity and global data commonality. These approaches, while effective to a certain extent, still bear limitations in their inflexible of personalization methods and the potential performance degradation due to the direct training with noisy global parameters under DP mechanism. We introduce an innovative approach to personalized federated learning. Our method, based on layer-wise Fisher information values, allows for dynamic personalization that surpasses the inflexibility of fixed parameter partitioning while mitigating the noise impact.
2.2 Differential Privacy
Differential Privacy (DP) provides substantial privacy in federated learning [12, 8, 41, 38, 25, 24], by minimizing the impact of individual data changes on computation outputs. This privacy level is quantified via  $(\varepsilon, \delta)$ -differential privacy. Smaller  $\varepsilon$  and  $\delta$  offer stronger privacy but introduce more noise into the learning algorithm, which could degrade performance.
In federated learning, user-level DP is achieved by a two-step process intrinsic to the DP mechanism: adding noise and clipping local updates before server transmission. The noise scale is calibrated according to the function sensitivity. Clipping, which bounds the impact of local update, further reinforces privacy. Although these essential steps ensure substantial privacy, they present challenges, such as performance degradation and slower convergence, due to the unavoidable noise and clipping operation. While user-level DP ensures robust privacy, it introduces challenges such as performance degradation from added noise and slower convergence due to clipping. These challenges have been addressed by several methods, including LUS [8], BLUR [8], DP-FedSAM [38], and PPSGD [3]. LUS and BLUR employ sparsification and unified regularization techniques to mitigate the effects of added noise and enhance model convergence. DP-FedSAM [38] utilizes the SAM optimizer to bolster parameter robustness against noise, aiming to identify more stable convergence points. Besides, PPSGD [3] capitalizes on personalization to improve performance while maintaining privacy. Despite their promising solutions, these methods don't sufficiently address the issues caused by noise and clipping in differential privacy. They failed to find the essence of the problem of noise perturbation, all parameters will be affected by noise during training, leading to the degradation of model performance. Furthermore, their uniform handling of clipping constraints fails to adapt to the dynamic nature of local updates, which further hinders model learning and convergence. To tackle these challenges, we propose a novel method that leverages layer-wise Fisher information to dynamically personalize and protect parameters of high information content from noise impact. Simultaneously, we introduce an adaptive regularization strategy to enforce differential constraints on personalized and shared parameters, enhancing the model learning capacity and robustness to clipping.
2.3 Fisher Information Matrix
The Fisher Information Matrix [29, 1], a pivotal concept in statistical estimation theory, encapsulates the information an unknown parameter possesses about a random distribution. In the realm of deep learning, FIM has been employed to study the curvature of loss functions, guide optimization and evaluate the information content of parameters [31, 4, 20]. For instance, the Kronecker-Factored Approximate Curvature (K-FAC) method [31] utilizes a Kronecker product approximation to the FIM for more efficient natural gradient computations. The layer-wise relevance propagation method [4] uses the diagonal of the FIM to quantify the importance of features, thereby enhancing model interpretability. The Elastic Weight Consolidation algorithm [20, 7] employs FIM to guard important parameters during the learning of new tasks, mitigating catastrophic forgetting. All these methods utilize the diagonal of the FIM for approximation, reducing computational complexity and facilitating more efficient learning processes. Although these methodologies have made significant strides, their application in personalized federated learning with differential privacy constraints, remains largely unexplored. These methods are not directly applicable to personalized federated learning, as they don't account for the unique challenges posed by non-IID data distribution and privacy constraints. Our novel approach integrates layer-wise Fisher information into personalized federated learning, leveraging it to dynamically determine the personalization parameters, thus protecting informative ones from noise perturbation induced by differential privacy. This strategy effectively minimizes the impact of noise, enhancing model performance in personalization. Additionally, we introduce an adaptive method that dynamically adjusts L2 norm constraints based on their fisher information value magnitudes. This method enhances the robustness to clipping operations, offering a more flexible solution to balance between model learning and privacy protection under the PFL with differential privacy.
Personalized Federated Learning. Personalized Federated Learning (PFL) extends Federated Learning (FL) by addressing the non-IID nature of real-world data distributions. In PFL, parameter vector of client model is decomposed into a local part,  $u$ , that caters to the individual data peculiarities, and a global part,  $v$ , which is universally shared.
Assume we have  $M$  clients, Each client possesses a unique private dataset, denoted by  $D_{m} = (x_{i},y_{i})_{i = 1}^{N_{m}}$ , where  $N_{m}$  signifies the size of the local dataset of client  $m$ . The parameter vector  $w\in \mathbb{R}^{d_w}$  of model of client  $i$  is separated into local and global parts, forming  $w_{i} = (v,u_{i})$ , by personalization techniques.
The optimization problem in PFL is defined as follows:
$$
\min  _ {v, u _ {1: m}} \left\{f (v, u _ {1: m}) := \frac {1}{m} \sum_ {i = 1} ^ {M} f _ {i} (v, u _ {i}) \right\}, \tag {1}
$$
where  $u_{1:m}$  represents  $(u_1, \dots, u_m) \in (\mathbb{R}^{d_u})^M$  and the  $f_i(v, u_i) \coloneqq \mathbb{E}_{D_i \sim P_i}[f_i(v, u_i, D_i)]$  is the expected risk of client  $i$ , where  $i = 1, \dots, N_m$ . PFL use a iteration of two steps to solve this problem:
- Local Update: During the local update phase, each client  $i$  adopts the latest global parameter  $v^t$  while retaining its local  $u_i^t$  from previous round to initialize the model  $w_i^t = (v^t, u_i^t)$ , and then performs  $E_{local}$  iterations of local updates to obtain new parameters  $w_i^{t+1} = (v_i^{t+1}, u_i^{t+1})$ . Subsequently, they compute the local update  $\Delta v_i^{t+1}$  by calculating the difference between  $v_i^{t+1}$  and  $v_i^t$ .
- Collaborative Update: In the collaborative update phase, all clients send their local updates  $\Delta v_{i}^{t + 1}$  to the server. The server then averages these parameters to update the parameters  $v^{t + 1} = v^t +\frac{1}{M}\sum_{i = 1}^{M}\Delta v_i^{t + 1}$ , which are then distributed back to all clients for the next round of local updates. In our methods, since the shared part of parameters is selected dynamically and cannot be previously determined, all clients send their whole updates  $\Delta w_{t + 1}^{t}$  to server.
User-Level Differential Privacy. In the context of Personalized Federated Learning (PFL), it is essential to employ differential privacy technique to prevent potential privacy leakage. One strong privacy-preserving mechanism used in this setting is Differential Privacy (DP).
Differential Privacy (DP) [12, 41] is a formal privacy framework that provides theoretical guarantees against the identification of private data in a dataset. In the DP framework,  $\epsilon$  is known as the privacy budget, which quantifies the privacy protection level, and  $\delta$  is the probability of the privacy guarantee being violated. A randomized algorithm  $M$  satisfies  $(\epsilon, \delta)$ -DP if for any pair of adjacent datasets  $D$  and  $D'$  differing by only one record, and for any subset of outputs  $S$  in the range of  $M$ , it holds that:
$$
\Pr [ M (D) \in S ] \leq e ^ {\epsilon} \Pr [ M \left(D ^ {\prime}\right) \in S ] + \delta \tag {2}
$$
This property implies that the probability distribution of the output of  $M$  changes only slightly when a single record in the input dataset is modified, thus protecting individual privacy.
User-Level Differential Privacy (DP) is extensively used as an application of DP mechanism in the context of personalized federated scenarios. User-Level DP refers to the privacy guarantee for the participation information of a single client in the learning process. Based on the aforementioned theory, user-level DP makes the global model updates indistinguishable whether a particular client participates in the learning or not. This is achieved by implementing two crucial operations: clipping and noise addition.
Clipping is done to control the maximum contribution of a single client to the global update, ensuring that the DP property holds even in the presence of outliers. This is crucial for maintaining the privacy of individuals in the learning process. Besides, noise addition (typically sampled from a zero-mean Gaussian distribution) is performed to satisfy the randomness requirement of DP, making it harder to infer specific information about any individual client. The combined effect of these two operations is expressed as:
$$
\Delta w _ {C} = \Delta w / \max  \left(1, \frac {\left| \left| \Delta w \right| \right| _ {2}}{C}\right), \quad \Delta w _ {C, N} = \Delta w _ {C} + \mathcal {N} \left(0, C ^ {2} \sigma^ {2} / \left| M _ {t} \right|\right), \tag {3}
$$
where  $\Delta w$  represents the original local update from the client,  $|M_t|$  represents the available client in round  $t$ ,  $C$  is the clipping threshold that controls the maximum contribution of a client to the global update,  $\Delta w_{C}$  is the local update after clipping,  $\Delta w_{C,N}$  is the final local update after clipping and adding noise,  $\mathcal{N}$  is the Gaussian noise added to ensure DP, and  $\sigma$  is a noise multiplier computed by privacy accountant and composition mechanism with respect to  $\epsilon$  and  $\delta$ .
3.2 Dynamic Personalization Strategy
Motivation of Fisher Information. The motivation to use Fisher Information stems from its ability to quantify the amount of information that parameters can provide. Parameters that are more informative can represent the knowledge more effectively, playing a crucial role in the model prediction. Therefore, under the same noise perturbation, if the informative parameters are affected, it will lead to a more severe degradation of model performance. In typical personalization work, at the beginning of the local update phase, clients directly place the global parameters in fixed positions into the network for training. This inflexible personalization approach doesn't consider the impact of noise on different parameters, which results in the model being more susceptible to noise interference. Therefore, we need to avoid noise affecting informative parameters. In light of this, our approach considers the hierarchical structure of neural networks and introduces layer-wise Fisher information. We measure layer-wise of each parameter Fisher information, which reflects the sensitivity of the model to the parameter changes, to optimize the model by preventing them from noise.
Construction of Dynamic Fisher Personalization. As discussed in  $\mathbf{0}$ , the current DP-PFL methods struggle with inflexible personalization due to the fixed portion of the model used for personalization. To address this issue, we introduce a dynamic personalization strategy that leverages the Fisher Information to enhance the adaptability of the model to the data distribution of individual clients as follows. We start at the beginning of local update phase of client  $i$  at global epoch  $t$ , with its private dataset  $D_{i}$  and parameters  $w_{i}^{t-1} = (v^{t-1}, u_{i}^{t-1})$  remain from last epoch. We can get the empirical fisher value vector  $F_{i} \in \mathbb{R}^{d_{w}}$  where  $d_{w}$  represents the num of parameters of  $w$  as a good approximation of the diagonal of true fisher value for each parameter indexed by  $j$  in  $w_{i}^{t-1}$  as:
$$
F \left(w _ {i j}\right) = \left(\frac {\partial \log L \left(w _ {i} , D _ {i}\right)}{\partial w _ {i j}}\right) ^ {2}, \tag {4}
$$
where the log  $L(w_{i},D_{i})$  represents log-likelihood function of  $w_{i}$ . Then, the layer-wise fisher value  $\hat{F}_k$  for layer  $k$  by a layer-wise normalization for each parameters indexed by  $j$  in layer  $k$  as:
$$
\hat {F} _ {k, j} = \frac {F _ {k , j} - \operatorname* {m i n} \left\{F _ {k , j} \right\}}{\operatorname* {m a x} \left\{F _ {k , j} \right\} - \operatorname* {m i n} \left\{F _ {k , j} \right\}}. \tag {5}
$$
Given the layer-wise Fisher values for each parameter, we then generate two binary masks,  $M_{1}$  and  $M_{2}$ , for each parameter to conduct our dynamic parameter selection. In each mask, a parameter entry is set to 1 if its corresponding Fisher value is greater than or equal to a threshold  $\tau$ , otherwise, it is set to 0. These masks are defined as follows for each parameter  $j$ :
$$
M _ {1} [ j ] = \left\{ \begin{array}{l l} 1, & \text {i f} \hat {F} _ {i j} \geq \tau \\ 0, & \text {o t h e r w i s e} \end{array} \right. \text {a n d} M _ {2} [ j ] = \left\{ \begin{array}{l l} 0, & \text {i f} \hat {F} _ {i j} \geq \tau \\ 1, & \text {o t h e r w i s e} \end{array} \right., \tag {6}
$$
where  $M_{1}$  and  $M_{2}$  are the entries in the first and second masks, respectively.
We then perform a Hadamard product (element-wise multiplication) between these masks and the parameters to select the appropriate parameters for personalization. Specifically, parameters with a larger Fisher value, which correspond to 1's in  $M_1$ , are retained from the previous epoch, while the remaining parameters, which correspond to 1's in  $M_2$ , are replaced by the global parameters. This operation can be expressed as follows:
$$
w _ {i} ^ {t} = M _ {1} \odot w _ {i} ^ {t - 1} + M _ {2} \odot w ^ {t - 1}, \tag {7}
$$