SlowGuess/NeurIPS_2023_OCR huggingface dataset:
$$
\gamma_ {z c} \left(\sigma_ {Z}, \sigma_ {C}\right) \leq - 1 + 2 \sqrt {1 + B _ {1}} \tag {34}
$$
where  $B_{1} = \frac{\epsilon}{2} -\max_{i}\frac{1}{4}\left[\max_{k}(K_{ik}^{inter}) - \min_{k}(K_{ik}^{intra})\right]$  and  $\gamma_{zc}(\sigma_Z,\sigma_C)$  is exactly the  $\gamma_{zc}$  in Theorem 3.8 and is clearly a non-decreasing function with respect to  $\sigma_Z$  and  $\sigma_C$ , respectively. Therefore, it is a valid upper bound on both  $\sigma_Z$  and  $\sigma_C$ .
Proof. By Theorems 3.8 and 3.6, we have
$$
\gamma_ {z c} \left(\gamma_ {z c} + 2\right) \leq B _ {1} \tag {35}
$$
That is, we need to solve a quadratic equation  $\gamma_{zc}^2 + 2\gamma_{zc} - B_1 = 0$  with both  $\gamma_{zc} \geq 0$  and  $B_1 \geq 0$ . Since the discriminant  $\Delta = 4 + 4B_1 \geq 0$ , we have two roots  $-1 \pm 2\sqrt{1 + B_1}$  for this equation. Thus, it has  $0 \leq \gamma_{zc} \leq -1 + 2\sqrt{1 + B_1}$  as desired.
This bound indicates that the intensity of noise should not be too strong otherwise it may seriously affect the performance of federated spectral clustering. But, at least under this bound, one can choose to inject as much noise as possible into the raw data to ensure data security and privacy.
Based on Theorem 3.9 and (34), we obtain the following privacy-utility trade-off:
$$
\left\{ \begin{array}{l} \gamma_ {z c} \left(\sigma_ {Z}, \sigma_ {C}\right) \leq - 1 + 2 \sqrt {1 + B _ {1}} \\ \sigma_ {Z} \geq \sqrt {\left(8 S \Delta^ {2} \left(g _ {Z}\right) \log \left(e + \left(\varepsilon_ {Z} / \delta_ {Z}\right)\right) / \varepsilon_ {Z} ^ {2}\right)} \\ \sigma_ {C} \geq 2 c \lambda^ {- 1} \sqrt {d} \tau_ {X} \left(\tau_ {X} + \Upsilon\right) / \left(r ^ {2} \varepsilon_ {C}\right) \end{array} \right. \tag {36}
$$
This ensures both clustering performance and  $(\varepsilon, \delta)$ -differential privacy. In particular, if we increase the intensity of either  $\sigma_Z$  or  $\sigma_C$  to reach the upper bound of  $\gamma_{zc}$ , we can get a strong level of privacy but the worst utility. By the way,  $B_1$  is related to the property of the data. A larger  $B_1$  means a better property for clustering, which further provides a larger upper bound for the noise level, yielding a stronger privacy guarantee.
C More discussion on the privacy-utility trade-off of FedSC
Although theoretical results are presented in our study to ensure the security of FedSC, we still provide here some insight into methods of using Secure Aggregation or other cryptographic techniques to handle pair-wise client functions (i.e., kernel function in our study). Even though the communication cost will be high, it might be an alternative to reduce the DP noise levels. Specifically, it can be performed as follows.
- Step 1:  $\mathbf{Z}_p^S$  is posted to the central server;
- Step 2: Central server aggregates  $\mathbf{Z}_p^S$  to get the global  $Z^S$ ;
- Step 3: Central server computes  $\mathcal{K}_{ZZ} = \mathcal{K}(\pmb{Z}^S, \pmb{Z}^S)$  and broadcast it to clients;
- Step 4: For client  $p$  and  $c_{i} \in C_{p}$ , if  $c_{j} \in C_{p}$ , then client  $p$  directly calculate  $\hat{\mathcal{K}}_{ij} = c_{i}\mathcal{K}_{ZZ}c_{j}$ ; if  $c_{j} \in C_{p'}$ , then client  $p$  firstly encrypts and transfers its  $c_{i}$  to client  $p'$ , and then client  $p'$  also encrypts its  $c_{j}$  and use the cipher text to compute  $enc(\hat{\mathcal{K}}_{ij}) = enc(c_i^T)enc(\mathcal{K}_{ZZ})enc(c_j)$ ; Client  $p'$  transfers the result  $enc(\hat{\mathcal{K}}_{ij})$  back to client  $p$ ; Client  $p$  decrypts  $enc(\hat{\mathcal{K}}_{ij})$  to get  $\hat{\mathcal{K}}_{ij}$ .
- Step 5: Each client  $p$  sends its estimated results  $\hat{\mathcal{K}}_{ij}$  back to the central server without sending its own  $C_p$ ;
- Step 6: Central Server checks whether these posted results from clients are compatible with each other in case of injection attacks and then performs spectral clustering.
This alternative does not send clients'  $C$  to the central server and gives an extra cross-validation process in the central server which may be useful to enhance security.
D More details and results of the experiments
It should be pointed out that in Table 2 of the main paper, the signal-noise ratio is as high as  $12\mathrm{dB}$ , which means the noise is tiny. The parameter  $d$  in our FedSC was automatically determined and has a much larger value than that in the noiseless case. That is why the performance of FedSC in the noisy case is even better than that in the noiseless case of some datasets. In this appendix, we increase the noise level  $(\sigma_{e} = \beta \sigma)$ , where  $\sigma$  denotes the standard deviation of the clean data) and consider one more real dataset.
D.1 Dataset description
Synthetic data The synthetic data is generated from concentric circles. For  $\theta_{i}\in [0,2\pi ]$ $i = 1,2,\ldots ,1258$  , all the points of this synthetic dataset  $\pmb {X}\in \mathbb{R}^{2\times 1258}$  are generated by
$$
\boldsymbol {x} _ {i} = \left(x _ {i 1}, x _ {i 2}\right): \left\{ \begin{array}{l} x _ {i 1} = r \cos \left(\theta_ {i}\right) + e _ {i 1} \\ x _ {i 2} = r \sin \left(\theta_ {i}\right) + e _ {i 2} \end{array} \right. \tag {37}
$$
where  $\theta_0 = 0$ ,  $\theta_{1258} = 2\pi$ , and the remaining  $\theta_{i}$  are evenly spaced points between  $\theta_0$  and  $\theta_{1258}$ . The additive noise  $e_{i1}$  and  $e_{i2}$  are drawn from  $\mathcal{N}(0,\sigma_e^2)$ . We let  $\sigma_{e} = 0.1\sigma_{x}$ , where  $\sigma_{x}$  denotes the standard deviation of the data without the additive noise  $e$ . In our experiment, we set the hyperparameter  $r$  in (37) to 2 and 4.
(a)
Figure 4: Synthetic dataset of 2 concentric circles: (a) ground truth; (b) noisy data perturbed by Gaussian noise with mean zero and standard deviation  $0.2\mathrm{std}(\mathbf{X})$
Real-world data Both iris and banknote authentication are from the UCI machine learning library. COIL20 is an image dataset from Columbia Imaging and Vision Laboratory. USPS is a dataset for handwritten text recognition research. The details of the mentioned datasets are shown in Table 2.
Table 2: Summary of four real-world datasets
# of clusters	# of attributes	# of instances
Iris	3	4	150
COIL20	20	20×20	1440
Bank	2	5	1372
USPS	10	16×16	9298
ORL	40	92×112	400
The visualizations (by t-SNE [Van der Maaten and Hinton, 2008]) of three real-world datasets are shown in Figure 5.
(a) Iris
(b) COIL20
Figure 5: t-SNE visualization of some real-world datasets
D.2 Evaluation metrics
We use two metrics to evaluate the clustering performance of our method: accuracy and normalized mutual information (NMI). Between them, accuracy is affected by the misclassification rate of cluster assignment. The smaller the misclassification rate, the greater the accuracy. In this study, given data matrix  $\mathbf{X} \in \mathbb{R}^{m \times n}$  with  $n$  sample points of  $m$  features, let  $L_{i}$  and  $Lr_{i}$  for  $i = 1,2,\dots,n$  be the true labels and predictive labels, respectively, the accuracy of predictive cluster assignment  $Lr$  is computed by
$$
\text {a c c u r a c y} = \frac {1}{n} \operatorname {c a r d} \left(\{i \mid L _ {i} = L r _ {i}, i = 1, \dots , n \}\right). \tag {38}
$$
NMI is a normalized version of mutual information that measures the agreement of two cluster assignments without considering their permutations.
$$
\mathrm {N M I} = \frac {2 I (L ; L r)}{H (L) + H (L r)} \tag {39}
$$
where  $I(L; Lr)$  is the mutual information between  $L$  and  $Lr$ , and  $H(L)$  and  $H(Lr)$  are the entropy of  $L$  and  $Lr$ , respectively.
D.3 Parameter settings
In our experiments, we set some hyperparameters including  $\lambda_C$ ,  $d$ ,  $r$ , and  $k$  for implementing the proposed FedSC. Among them,  $\lambda_C$  as the penalty parameter of the regularization term is set to  $1e - 2$ .  $k$  is the hyperparameter of the KNN-based operation on the similarity matrix. We set  $k$  to  $\max(\mathrm{ceil}(\log(n)), 1)$  based on [Von Luxburg, 2007]. The details of methods to set the remaining two parameters are as follows.
Setting of hyperparameter  $r$  The hyperparameter  $r$  controls the smoothness of Gaussian kernel function. Due to the distinct characteristics of the datasets, we adopt the following adaptive method to determine the value of  $r$ :
$$
r = c * \operatorname {M e a n} (\operatorname {R e} (\sqrt {D})) \tag {40}
$$
where  $c = 1$  and  $D$  is the distance matrix of data points, of which its element
$$
\boldsymbol {D} _ {i j} = \left\| \boldsymbol {x} _ {i} - \boldsymbol {x} _ {j} \right\| _ {2} ^ {2}, \quad \text {f o r} i, j = 1, 2, \dots , n. \tag {41}
$$
In reality, the global  $D$  cannot be obtained because FedSC does not allow data transmission. Then we compute  $D_{p}$  for each client  $c_{p}, p = 1,\dots ,P$  and then determine  $r$  as follows
$$
r = \frac {c}{P} \sum_ {p = 1} ^ {P} \mathbf {M e a n} \left(\mathbf {R e} \left(\sqrt {\boldsymbol {D} _ {p}}\right)\right), \tag {42}
$$
where  $c$  can be tuned.
Setting of hyperparameter  $d$  The hyperparameter  $d$  controls the complexity of the approximation  $\phi (\pmb {X})\simeq \phi (\pmb {Z})\pmb{C}$ . We adaptively determine the value of  $d$  for each dataset:
$$
d = \inf  _ {k} \left\{k \in \mathbb {N} \mid \sum_ {i = 1} ^ {k} s _ {i} \geq \operatorname {t o l} k \leq n \right\} \tag {43}
$$
where  $s_i$  denotes the  $i$ -th largest eigenvalue of the kernel matrix  $K_{xx}, i = 1, \dots, n$ . In our experiment, we set the threshold tol to 0.99.
It is worth noting that we use the same  $r$  in the vanilla SC and our FedSC for a fair comparison, though  $D$  cannot be obtained in our FedSC. In addition, the setting of  $d$  relies on  $K_{xx}$  that is also not obtainable in our FedSC. We use this setting for convenience and in reality we need to determine  $d$  by other methods such as letting  $d = \gamma m$ , where  $\gamma$  is a hyperparameter.
D.4 Clustering results
NMI results The average results of 10 repeated trials are reported in Table 1 (ACC) and Table 3 (NMI). Note that for the USPS dataset, only 5 trials are performed to save time due to its large number of sample points. We see that our FedSC outperformed Kmeans and DSC significantly in almost all cases and has at least comparable performance as SC in most cases.
Influence of  $d$  The clustering accuracies with different  $d$  are reported in Table 4.
Results of FedSC with perturbed factors The results on COIL20 are reported in Table 5, where  $\sigma_{Z} = \alpha_{z}\mathrm{std}(Z_{p})$  and  $\sigma_{C} = \alpha_{c}\mathrm{std}(C)$ . Through this experiment, it can be observed that perturbing factors can have a more significant impact on the accuracy of clustering results than perturbing raw data. That is, perturbing factors are more sensitive and can achieve a specified level of differential privacy with weaker noise. Furthermore, it can be seen from Table 5 that the clustering performance is more sensitive to  $\sigma_{C}$  than  $\sigma_{Z}$ .
Malicious attack on  $C$  Due to the kernel trick, the optimization problem is nonlinear and nonconvex. Hence, it is very difficult for potential attackers to recover the data  $X$  from the uploaded factors  $Z, C$ , especially when  $X$  or  $Z, C$  are perturbed by noise. Nevertheless, the attacker may perform K-means on the  $\{C_p\}_{p=1}^P$  to obtain clustering results. However, we find that the clustering accuracy
Table 3: Comparison with existing clustering methods (NMI)
NMI
Kmeans	SC	DSC	FedSC
X0	Iris	0.6356 ± 0.0000	0.6647 ± 0.0000	0.2516 ± 0.0707	0.6708 ± 0.0139
COIL20	0.7658 ± 0.0143	0.8809 ± 0.0006	0.1259 ± 0.0225	0.8613 ± 0.0144
Bank	0.1480 ± 0.0000	0.1228 ± 0.0000	0.0122 ± 0.0160	0.4901 ± 0.3050
USPS	0.6125 ± 0.0026	0.8083 ± 0.0000	0.0064 ± 0.0016	0.7972 ± 0.0121
ORL	0.8343 ± 0.0136	0.8980 ± 0.0045	0.3970 ± 0.0045	0.8525 ± 0.0097
Xn with 0.1σ	Iris	0.6267 ± 0.0305	0.6878 ± 0.0764	0.1458 ± 0.0794	0.6666 ± 0.0600
COIL20	0.7721 ± 0.0122	0.8805 ± 0.0012	0.1214 ± 0.0254	0.8529 ± 0.0209
Bank	0.1383 ± 0.0039	0.1314 ± 0.2010	0.0039 ± 0.0081	0.3853 ± 0.2390
USPS	0.6147 ± 0.0022	0.8097 ± 0.0016	0.0076 ± 0.0010	0.7920 ± 0.0133
ORL	0.8280 ± 0.0153	0.8948 ± 0.0019	0.3944 ± 0.0074	0.8554 ± 0.0104
Xn with 0.3σ	Iris	0.5292 ± 0.0528	0.5072 ± 0.0442	0.1403 ± 0.0792	0.5385 ± 0.0594
COIL20	0.7745 ± 0.0185	0.8767 ± 0.0014	0.1174 ± 0.0224	0.8477 ± 0.0188
Bank	0.1327 ± 0.0062	0.1031 ± 0.0211	0.0135 ± 0.0253	0.1489 ± 0.0151
USPS	0.6112 ± 0.0052	0.7927 ± 0.0123	0.0070 ± 0.0016	0.7837 ± 0.0091
ORL	0.8136 ± 0.0067	0.8974 ± 0.0047	0.3987 ± 0.0069	0.8578 ± 0.0147
Xn with 0.5σ	Iris	0.4316 ± 0.0310	0.3912 ± 0.0426	0.0710 ± 0.0421	0.4046 ± 0.0388
COIL20	0.7676 ± 0.0148	0.8721 ± 0.0061	0.1238 ± 0.0286	0.8293 ± 0.0168
Bank	0.1408 ± 0.0133	0.1189 ± 0.0175	0.0059 ± 0.0109	0.1521 ± 0.0113
USPS	0.6088 ± 0.0036	0.8049 ± 0.0164	0.0059 ± 0.0028	0.7951 ± 0.0127
ORL	0.8058 ± 0.0150	0.8970 ± 0.0063	0.3977 ± 0.0095	0.8381 ± 0.0133
Xn with 0.7σ	Iris	0.3025 ± 0.0407	0.2755 ± 0.0381	0.0715 ± 0.0459	0.2773 ± 0.0408
COIL20	0.7589 ± 0.0234	0.8564 ± 0.0141	0.1032 ± 0.0127	0.7772 ± 0.0196
Bank	0.1506 ± 0.0208	0.1420 ± 0.0262	0.0074 ± 0.0114	0.1577 ± 0.0196
USPS	0.6007 ± 0.0051	0.8004 ± 0.0110	0.0042 ± 0.0009	0.7636 ± 0.0184
ORL	0.7877 ± 0.0165	0.8944 ± 0.0043	0.3946 ± 0.0056	0.8236 ± 0.0102
Table 4: Accuracy of the proposed algorithm on COIL20 (K = 20)
d	7K	8K	9K	194 (SVD)	10K	11K	12K
Clean data	Trial 1	0.7806	0.7882	0.7951	0.7944	0.7778	0.7979	0.7694
Trial 2	0.8035	0.7431	0.7819	0.8007	0.7812	0.8049	0.7792
Trial 3	0.7562	0.7896	0.7569	0.8097	0.7708	0.7569	0.7764
Trial 4	0.7444	0.7771	0.7771	0.7889	0.7854	0.7903	0.7958
Trial 5	0.7965	0.7361	0.8014	0.7833	0.7632	0.7264	0.7694
Mean	0.7762	0.7668	0.7825	0.7954	0.7757	0.7753	0.7781
d	10K	20K	30K	749 (SVD)	40K	50K	60K
Noisy data	Trial 1	0.7708	0.7722	0.7764	0.8201	0.7000	0.7306	0.8139
Trial 2	0.7743	0.7889	0.7646	0.7882	0.7694	0.7451	0.7299
Trial 3	0.7375	0.7743	0.7167	0.7493	0.7792	0.7965	0.7299
Trial 4	0.7965	0.7688	0.8014	0.7736	0.7903	0.7382	0.7674
Trial 5	0.7493	0.7507	0.7576	0.7000	0.7792	0.8076	0.8194
Mean	0.7657	0.7710	0.7633	0.7662	0.7636	0.7636	0.7721
on  $C$  is lower than those of Kmeans, SC, and FedSC reported in Table 1. For instance, the clustering accuracy on Iris is reported in Table.
Influence of  $P$  Table 7 compares the clustering performance between using a single client ( $P = 1$ ) and using multiple ones ( $P = 8$ ). It is clear that the operation of splitting data across multiple clients may lead to an accuracy loss of clustering, which implies that our method is valid.
More results on MNIST and CIFAR10 We have already included datasets of high-dimensional images in Table 1 like USPS and COIL20 with sizes  $16 \times 16$  and  $20 \times 20$ , respectively. Nevertheless, to further improve the experiment, we added the results of MNIST  $(28 \times 28)$  and CIFAR10  $(32 \times 32)$  in Table 8.
Table 5: Clustering accuracy (average over 10 trials) of FedSC with perturbed factors on COIL20.
αc
0	0.05	0.1	0.15
Mean±Std	Mean±Std	Mean±Std	Mean±Std
αz	0	0.7831±0.0268	0.6573±0.0291	0.6012±0.0391	0.4835±0.0526
0.05	0.7824±0.0126	0.6573±0.0243	0.6165±0.0286	0.4998±0.0567
0.1	0.7817±0.0299	0.6625±0.0258	0.6453±0.0186	0.5508±0.0415
0.15	0.7881±0.0223	0.6526±0.0258	0.6219±0.0467	0.5901±0.0326
Table 6: Clustering accuracy among different ways
Kmeans	SC	DSC	FedSC	Attack on C
Iris	0.8920 ± 0.0028	0.9000 ± 0.0000	0.5493 ± 0.1263	0.9027 ± 0.0064	0.6360 ± 0.1557
E Proof for theorem on the convergence of FedSC algorithm
We derive the objective descent with respect to  $C^s$  and  $Z^{s,t}$ , respectively.
Objective descent with w.r.t.  $C$ : Based on the update scheme (14) of  $C$ , we have
$$
\nabla_ {C} f _ {p} \left(\boldsymbol {Z} ^ {s, 0}, \boldsymbol {C} _ {p} ^ {s}\right) = \left(\mathcal {K} \left(\boldsymbol {Z} ^ {s, 0}, \boldsymbol {Z} ^ {s, 0}\right) + \lambda \boldsymbol {I} _ {d}\right) \boldsymbol {C} _ {p} ^ {s} - \mathcal {K} \left(\boldsymbol {Z} ^ {s, 0}, \boldsymbol {X} _ {p}\right) = 0 \tag {44}
$$
where  $Z^{s,0} = Z^{s - 1} = \frac{1}{P}\sum_{p\in \mathcal{A}^{s - 1}}Z_{p}^{s - 1,Q}$
According to the proposed FedSC problem 7, we have
$$
\begin{array}{l} f _ {p} \left(\boldsymbol {Z} ^ {s, 0}, \boldsymbol {C} _ {p} ^ {s}\right) - f _ {p} \left(\boldsymbol {Z} ^ {s, 0}, \boldsymbol {C} _ {p} ^ {s - 1}\right) \\ = \left[ \frac {1}{2} \left\| \phi \left(\boldsymbol {X} _ {p}\right) - \phi \left(\boldsymbol {Z} ^ {s, 0}\right) \boldsymbol {C} _ {p} ^ {s} \right\| _ {F} ^ {2} + \frac {\lambda}{2} \left\| \boldsymbol {C} _ {p} ^ {s} \right\| _ {F} ^ {2} \right] \\ - \left[ \frac {1}{2} \left\| \phi \left(\boldsymbol {X} _ {p}\right) - \phi \left(\boldsymbol {Z} ^ {s, 0}\right) \boldsymbol {C} _ {p} ^ {s - 1} \right\| _ {F} ^ {2} + \frac {\lambda}{2} \left\| \boldsymbol {C} _ {p} ^ {s - 1} \right\| _ {F} ^ {2} \right] \\ = - \operatorname {T r} \left(\left(C _ {p} ^ {s} - C _ {p} ^ {s - 1}\right) ^ {T} \mathcal {K} \left(\boldsymbol {Z} ^ {s, 0}, \boldsymbol {X} _ {p}\right)\right) + \frac {\lambda}{2} \operatorname {T r} \left(C _ {p} ^ {s} \left(C _ {p} ^ {s}\right) ^ {T} - C _ {p} ^ {s - 1} \left(C _ {p} ^ {s - 1}\right) ^ {T}\right) \\ + \frac {1}{2} \operatorname {T r} \left(\left[ \boldsymbol {C} _ {p} ^ {s} \left(\boldsymbol {C} _ {p} ^ {s}\right) ^ {T} - \boldsymbol {C} _ {p} ^ {s - 1} \left(\boldsymbol {C} _ {p} ^ {s - 1}\right) ^ {T} \right] \mathcal {K} \left(\boldsymbol {Z} ^ {s, 0}, \boldsymbol {Z} ^ {s, 0}\right)\right) \tag {45} \\ = - \operatorname {T r} \left(\left(\boldsymbol {C} _ {p} ^ {s} - \boldsymbol {C} _ {p} ^ {s - 1}\right) ^ {T} \left(\mathcal {K} \left(\boldsymbol {Z} ^ {s, 0}, \boldsymbol {Z} ^ {s, 0}\right) + \lambda \boldsymbol {I} _ {d}\right) \boldsymbol {C} _ {p} ^ {s}\right) \\ + \frac {1}{2} \operatorname {T r} \left(\left[ \boldsymbol {C} _ {p} ^ {s} \left(\boldsymbol {C} _ {p} ^ {s}\right) ^ {T} - \boldsymbol {C} _ {p} ^ {s - 1} \left(\boldsymbol {C} _ {p} ^ {s - 1}\right) ^ {T} \right] \left[ \mathcal {K} \left(\boldsymbol {Z} ^ {s, 0}, \boldsymbol {Z} ^ {s, 0}\right) + \lambda \boldsymbol {I} _ {d} \right]\right) \\ = - \frac {1}{2} \underbrace {\operatorname {T r} \left(\left[ \boldsymbol {C} _ {p} ^ {s} - \boldsymbol {C} _ {p} ^ {s - 1} \right] ^ {T} \left[ \mathcal {K} \left(\boldsymbol {Z} ^ {s , 0} , \boldsymbol {Z} ^ {s , 0}\right) + \lambda \boldsymbol {I} _ {d} \right] \left[ \boldsymbol {C} _ {p} ^ {s} - \boldsymbol {C} _ {p} ^ {s - 1} \right]\right)} _ {\text {T . 1}} \\ \leq - \frac {1}{2} \left(\gamma_ {\min } ^ {s} + \lambda\right) \left\| \boldsymbol {C} _ {p} ^ {s} - \boldsymbol {C} _ {p} ^ {s - 1} \right\| _ {F} ^ {2} \\ \end{array}
$$
where  $\gamma_{min}^{s} = \gamma_{min}(\mathcal{K}(\pmb{Z}^{s,0},\pmb{Z}^{s,0}))$
Summing it up from  $p = 1$  to  $P$ , we have
$$
F \left(\boldsymbol {Z} ^ {s, 0}, \boldsymbol {C} ^ {s}\right) - F \left(\boldsymbol {Z} ^ {s, 0}, \boldsymbol {C} ^ {s - 1}\right) \leq - \frac {1}{2} \left(\gamma_ {\text {m i n}} ^ {s} + \lambda\right) \sum_ {p = 1} ^ {P} \omega_ {p} \left\| \boldsymbol {C} _ {p} ^ {s} - \boldsymbol {C} _ {p} ^ {s - 1} \right\| _ {F} ^ {2} \tag {46}
$$
Objective descent with w.r.t.  $Z$ : According to Assumption 2.1, it implies
$$
\begin{array}{l} F \left(\boldsymbol {Z} ^ {s, t}, \boldsymbol {C} ^ {s}\right) - F \left(\boldsymbol {Z} ^ {s, t - 1}, \boldsymbol {C} ^ {s}\right) \leq \underbrace {\left\langle \nabla_ {Z} F \left(\boldsymbol {Z} ^ {s , t - 1} , \boldsymbol {C} ^ {s}\right) , \boldsymbol {Z} ^ {s , t} - \boldsymbol {Z} ^ {s , t - 1} \right\rangle} _ {\text {T . 2}} \tag {47} \\ + \frac {L _ {Z} ^ {s}}{2} \left\| \boldsymbol {Z} ^ {s, t} - \boldsymbol {Z} ^ {s, t - 1} \right\| _ {F} ^ {2} \\ \end{array}
$$
Table 7: Clustering accuracy between using a single client and using multiple clients
Iris	COIL20	Bank	ORL
P=1	0.9007 ± 0.0086	0.8073 ± 0.0089	0.7536 ± 0.1271	0.7937 ± 0.0084
P=8	0.8993 ± 0.0165	0.8003 ± 0.0049	0.6821 ± 0.1405	0.7112 ± 0.0258
Table 8: Clustering accuracy on MNIST and CIFAR10
Kmeans	SC	DSC	FedSC
X	MNIST	0.5448 ± 0.0257	0.6265 ± 0.0439	0.1292 ± 0.0144	0.6139 ± 0.0464
CIFAR10	0.2171 ± 0.0132	0.2182 ± 0.0133	0.1235 ± 0.0062	0.2134 ± 0.0131
X with 0.3σ	MNIST	0.5402 ± 0.0225	0.5755 ± 0.0366	0.1337 ± 0.0191	0.5606 ± 0.0457
CIFAR10	0.2209 ± 0.0154	0.2198 ± 0.0172	0.1194 ± 0.0051	0.2187 ± 0.0125
X with 0.7σ	MNIST	0.5374 ± 0.0555	0.5711 ± 0.0329	0.1340 ± 0.0135	0.5029 ± 0.0264
CIFAR10	0.2202 ± 0.0147	0.2205 ± 0.0084	0.1209 ± 0.0045	0.2134 ± 0.0152
Now, we give a bound on T.2.
Lemma E.1. For any  $s$  and  $t$ , it holds that
$$
\begin{array}{l} \langle \nabla_ {Z} F \left(\boldsymbol {Z} ^ {s, t - 1}, \boldsymbol {C} ^ {s}\right), \boldsymbol {Z} ^ {s, t} - \boldsymbol {Z} ^ {s, t - 1} \rangle = - L _ {Z} ^ {s} \| \boldsymbol {Z} ^ {s, t} - \boldsymbol {Z} ^ {s, t - 1} \| _ {F} ^ {2} \tag {48} \\ + \left\langle \nabla_ {Z} F \left(\boldsymbol {Z} ^ {s, t - 1}, \boldsymbol {C} ^ {s}\right), \boldsymbol {Z} ^ {s, t} - \boldsymbol {Z} ^ {s, t - 1} \right\rangle \\ \end{array}
$$
Proof. Based on the update schemes of  $Z$ , we have
$$
\begin{array}{l} \boldsymbol {Z} _ {p} ^ {s, t} = \boldsymbol {Z} _ {p} ^ {s, t - 1} - \frac {1}{L _ {Z} ^ {s}} \nabla_ {Z} f _ {p} (\boldsymbol {Z} _ {p} ^ {s, t - 1}, \boldsymbol {C} _ {p} ^ {s}) \\ \Longleftrightarrow \boldsymbol {Z} ^ {s, t} = \boldsymbol {Z} ^ {s, t - 1} - \frac {1}{\bar {P} L _ {Z} ^ {s}} \sum_ {p \in \mathcal {A} ^ {s}} \nabla_ {Z} f _ {p} \left(\boldsymbol {Z} _ {p} ^ {s, t - 1}, \boldsymbol {C} _ {p} ^ {s}\right) \tag {49} \\ \Longleftrightarrow 0 = \frac {1}{\bar {P}} \sum_ {p \in \mathcal {A} ^ {s}} \nabla_ {Z} f _ {p} \left(\boldsymbol {Z} _ {p} ^ {s, t - 1}, \boldsymbol {C} _ {p} ^ {s}\right) + L _ {Z} ^ {s} \left(\boldsymbol {Z} ^ {s, t} - \boldsymbol {Z} ^ {s, t - 1}\right) \\ \end{array}
$$
Then, consider the following terms
$$
\begin{array}{l} \langle \nabla_ {Z} F (\boldsymbol {Z} ^ {s, t - 1}, \boldsymbol {C} ^ {s}), \boldsymbol {Z} ^ {s, t} - \boldsymbol {Z} ^ {s, t - 1} \rangle \\ = \left\langle \nabla_ {Z} F \left(\boldsymbol {Z} ^ {s, t - 1}, \boldsymbol {C} ^ {s}\right) - \frac {1}{\bar {P}} \sum_ {p \in \mathcal {A} ^ {s}} \nabla_ {Z} f _ {p} \left(\boldsymbol {Z} _ {p} ^ {s, t - 1}, \boldsymbol {C} _ {p} ^ {s}\right) - L _ {Z} ^ {s} \left(\boldsymbol {Z} ^ {s, t} - \boldsymbol {Z} ^ {s, t - 1}\right), \boldsymbol {Z} ^ {s, t} - \boldsymbol {Z} ^ {s, t - 1} \right\rangle (50) \\ = - L _ {Z} ^ {s} \left\| \boldsymbol {Z} ^ {s, t} - \boldsymbol {Z} ^ {s, t - 1} \right\| _ {F} ^ {2} (50) \\ + \langle \nabla_ {Z} F (\boldsymbol {Z} ^ {s, t - 1}, \boldsymbol {C} ^ {s}) - \frac {1}{\bar {P}} \sum_ {p \in \mathcal {A} ^ {s}} \nabla_ {Z} f _ {p} (\boldsymbol {Z} _ {p} ^ {s, t - 1}, \boldsymbol {C} _ {p} ^ {s}), \boldsymbol {Z} ^ {s, t} - \boldsymbol {Z} ^ {s, t - 1} \rangle \\ \end{array}
$$
Based on Lemma 1, we continue to do the following derivation.
$$
\begin{array}{l} F \left(\boldsymbol {Z} ^ {s, t}, \boldsymbol {C} ^ {s}\right) - F \left(\boldsymbol {Z} ^ {s, t - 1}, \boldsymbol {C} ^ {s}\right) \\ \leq - \frac {L _ {Z} ^ {s}}{2} \left\| \boldsymbol {Z} ^ {s, t} - \boldsymbol {Z} ^ {s, t - 1} \right\| _ {F} ^ {2} \\ + \langle \nabla_ {Z} F (\boldsymbol {Z} ^ {s, t - 1}, \boldsymbol {C} ^ {s}) - \frac {1}{\bar {P}} \sum_ {p \in \mathcal {A} ^ {s}} \nabla_ {Z} f _ {p} (\boldsymbol {Z} _ {p} ^ {s, t - 1}, \boldsymbol {C} _ {p} ^ {s}), \boldsymbol {Z} ^ {s, t} - \boldsymbol {Z} ^ {s, t - 1} \rangle \\ \leq - \frac {L _ {Z} ^ {s}}{4} \left\| \boldsymbol {Z} ^ {s, t} - \boldsymbol {Z} ^ {s, t - 1} \right\| _ {F} ^ {2} \tag {51} \\ + \frac {1}{L _ {Z} ^ {s}} \underbrace {\left\| \nabla_ {Z} F (\boldsymbol {Z} ^ {s , t - 1} , \boldsymbol {C} ^ {s}) - \frac {1}{\bar {P}} \sum_ {p \in \mathcal {A} ^ {s}} \nabla_ {Z} f _ {p} (\boldsymbol {Z} _ {p} ^ {s , t - 1} , \boldsymbol {C} _ {p} ^ {s}) \right\| _ {F} ^ {2}} _ {\text {T . 3}} \\ \end{array}
$$
where we used the fact that  $\langle \pmb{x},\pmb{y}\rangle \leq \| \pmb {x}\| _2^2 +\| \pmb {y}\| _2^2,\forall c > 0$
Now, we give a bound on T.3.
Lemma E.2. For any  $s$  and  $t$ , it holds that