SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Figure 5: Our work,  $\star$ , uniquely satisfies all 3 desiderata. When parties share information computed from their data, we ensure that every party has at least its required DP w.r.t. the mediator, receives a collaboratively trained model, and receives a higher reward for sharing higher-quality data than the others.
It is not trivial to (i) add DP to  $\triangleleft$  while simultaneously enforcing a privacy-valuation trade-off, (ii) add data sharing incentives to  $\nabla$  (i.e., design valuation functions and rewards), and (iii) achieve  $\triangleright$  as access to a party's dataset (or a coalition's datasets) is still needed for its valuation in [57].
Difference with existing data valuation and collaborative ML works considering incentives. Our work aims to additionally (A) offer parties assurance about privacy but (B) deter them from selecting excessive privacy guarantees. We achieve (A) by ensuring differential privacy (see definitions in App. A.2) through only collecting the noisier/perturbed version of each party's sufficient statistics (see App. A.1). To achieve (B), we must assign a lower valuation (and reward) to a noisier SS. Our insight is to combine noise-aware inference (that computes the posterior belief of the model parameters given the perturbed SS) with the Bayesian surprise valuation function. Lastly, (C) we propose a mechanism to generate model rewards (i.e., posterior samples of the model parameters) that attain the target reward value and are similar to the grand coalition's model.
Difference with federated learning and differential privacy works. Existing FL works have covered learning from decentralized data with DP guarantees. However, these works may not address the question: Would parties want to share their data? How do we get parties to share more to maximize the gain from the collaboration? Our work aims to address these questions and incentivize (A) parties to share more, higher-quality data and (B) select a weaker DP guarantee. To achieve (A), it is standard in data valuation methods [18, 25, 46] to use the Shapley value to value a party relative to the data of others as it considers a party's marginal contribution to all coalitions (subsets) of parties. This would require us to construct and value a trained model for each coalition  $C \subseteq N$ : To ease aggregation (and to avoid requesting more information or incurring privacy costs per coalition), we consider
sufficient statistics (see App. A.1). To achieve (B), we want a valuation function that provably ensures a lower valuation for a stronger DP guarantee. Our insight is to combine noise-aware inference (that computes the posterior belief of the model parameters given perturbed SS) with the Bayesian surprise valuation function. Lastly, like the works of [47, 51], (C) we generate a model reward that attains a target reward value (which parties can use for future predictions). Our model reward is in the form of posterior samples of the model parameters instead. We propose a new mechanism to control/generate model rewards that work using SS and preserve similarity to the grand coalition's model.
Fig. 5 shows how our work in this paper fills the gap in the existing works.
C Characteristic/Valuation Function
C.1 Proofs of properties for valuation function
In this section, we will use the random variable notations defined in App. A. Moreover, we abbreviate the set of perturbed SS random variables corresponding to a coalition  $C$  of parties as  $O_{C} \triangleq \{O_{i}\}_{i \in C}$ . Let  $\mathbb{H}(a)$  denote the entropy of the variable  $a$ .
Relationship between KL divergence and information gain.
$$
\begin{array}{l} \mathbb {I} (\theta ; O _ {C}) = \mathbb {E} _ {\boldsymbol {o} _ {C} \sim O _ {C}} \left[ D _ {\mathrm {K L}} \left(p (\theta | \boldsymbol {o} _ {C}); p (\theta)\right) \right] \\ = \mathbb {H} (\theta) - \mathbb {E} _ {\boldsymbol {o} _ {C} \sim O _ {C}} [ \mathbb {H} (\theta | O _ {C} = \boldsymbol {o} _ {C}) ] . \\ \end{array}
$$
Party monotonicity (V2). Consider two coalitions  $C \subset C' \subseteq N$ . By taking an expectation w.r.t. random vector  $O_{C'}$ ,
$$
\mathbb {E} _ {\boldsymbol {o} _ {C ^ {\prime}} \sim O _ {C ^ {\prime}}} [ v _ {C} ] = \mathbb {E} _ {\boldsymbol {o} _ {C} \sim O _ {C}} [ D _ {\mathrm {K L}} (p (\boldsymbol {\theta} | \boldsymbol {o} _ {C}); p (\boldsymbol {\theta})) ] = \mathbb {I} (\boldsymbol {\theta}; O _ {C}) = \mathbb {H} (\boldsymbol {\theta}) - \mathbb {H} (\boldsymbol {\theta} | O _ {C})
$$
$$
\mathbb {E} _ {\boldsymbol {o} _ {C ^ {\prime}} \sim O _ {C ^ {\prime}}} [ v _ {C ^ {\prime}} ] = \mathbb {E} _ {\boldsymbol {o} _ {C ^ {\prime}} \sim O _ {C ^ {\prime}}} [ D _ {\mathrm {K L}} (p (\theta | \boldsymbol {o} _ {C ^ {\prime}}); p (\theta)) ] = \mathbb {I} (\theta ; O _ {C ^ {\prime}}) = \mathbb {H} (\theta) - \mathbb {H} \big (\theta | O _ {C}, O _ {C ^ {\prime} \backslash C} \big).
$$
Then,  $\mathbb{E}_{\pmb{o}_{C^{\prime}}\sim O_{C^{\prime}}}[v_{C^{\prime}}] > \mathbb{E}_{\pmb{o}_{C^{\prime}}\sim O_{C^{\prime}}}[v_{C}]$  as conditioning additionally on  $O_{C^{\prime}\backslash C}$  should not increase the entropy (i.e.,  $\mathbb{H}\big(\theta |O_C,O_{C'\backslash C}\big)\leq \mathbb{H}(\theta |O_C)$ ) due to the "information never hurts" bound for entropy [10].
Figure 6: Graphical model to illustrate privacy-valuation trade-off (V3) where  $O_{i} \triangleq S_{i} + Z_{i}^{1}$  and  $O_{i}^{s} \triangleq O_{i} + Z_{i}^{2}$ .
Privacy-valuation trade-off (V3). Let  $\epsilon_i^s < \epsilon_i$ , and  $Z_i^1$  and  $Z_i^2$  be independent Gaussian distributions with mean 0 and, respectively, variance  $a_i / \epsilon_i$  and  $(a_i / \epsilon_i^s) - (a_i / \epsilon_i) > 0$  where  $a_i \triangleq 0.5\lambda \Delta_2^2(g)$ , function  $g$  computes the exact SS  $s_i$  from local dataset  $\mathcal{D}_i$ , and  $\Delta_2(g)$  denotes its  $\ell_2$ -sensitivity. Adding  $\tilde{Z}_i^1$  to  $S_i$  will ensure  $(\lambda, \epsilon_i)$ -DP while adding both  $Z_i^1$  and independent  $Z_i^2$  to  $S_i$  is equivalent to adding Gaussian noise of variance  $a_i / \epsilon_i^s$  to ensure  $(\lambda, \epsilon_i^s)$ -DP. $^{18}$  From the graphical model
18Adding or subtracting independent noise will lead to a random variable with a higher variance. Thus, we cannot model the random variable  $O_{i}$  of a lower variance  $a_i / \epsilon_i$  to ensure  $(\lambda ,\epsilon_{i})$  -DP as  $O_{i}^{s} - Z_{i}^{2}$
in Fig. 6 and the Markov chain  $\theta \to O_i \to O_i^s$ , the following conditional independence can be observed:  $\theta \perp O_i^s \mid O_i$ . By the data processing inequality, no further processing of  $O_i$ , such as the addition of noise, can increase the information of  $\theta$ . Formally,  $\mathbb{I}(\theta; O_i) \geq \mathbb{I}(\theta; O_i^s)$ . Simultaneously,  $\theta \nVdash O_i \mid O_i^s$ . Hence,  $\mathbb{I}(\theta; O_i) \neq \mathbb{I}(\theta; O_i^s) \Rightarrow (\mathbb{I}(\theta; O_i) > \mathbb{I}(\theta; O_i^s))$ .
To extend to any coalition  $C$  containing  $i$ , by the chain rule of mutual information,
$$
\begin{array}{l} \mathbb {I} \left(\theta ; O _ {i}, O _ {i} ^ {s}, O _ {C \backslash \{i \}}\right) = \mathbb {I} \left(\theta ; O _ {i}, O _ {C \backslash \{i \}}\right) + \mathbb {I} \left(\theta ; O _ {i} ^ {s} | O _ {i}, O _ {C \backslash \{i \}}\right) \\ = \mathbb {I} \left(\theta ; O _ {i} ^ {s}, O _ {C \backslash \{i \}}\right) + \mathbb {I} \left(\theta ; O _ {i} | O _ {i} ^ {s}, O _ {C \backslash \{i \}}\right). \\ \end{array}
$$
As conditional independence  $\theta \perp O_i^s \mid O_i, O_{C \setminus \{i\}}$  and dependence  $\theta \not\perp O_i \mid O_i^s, O_{C \setminus \{i\}}$  still hold,  $\mathbb{I}\big(\theta; O_i^s | O_i, O_{C \setminus \{i\}}\big) = 0$  and  $\mathbb{I}\big(\theta; O_i | O_i^s, O_{C \setminus \{i\}}\big) > 0$ , respectively. It follows from the above expression that  $\mathbb{I}(\theta; O_C) > \mathbb{I}\big(\theta; O_i^s, O_{C \setminus \{i\}}\big)$ , which implies  $\mathbb{E}_{O_C}[v_C] > \mathbb{E}_{O_{C \setminus \{i\}}, O_i^s}[v_C^s]$ . For future work, the proof can be extended to other DP mechanisms.
C.2 Proof of Remark in Sec. 3
Let the alternative valuation of a coalition  $C$  be  $v_{C}^{\prime} \triangleq D_{\mathrm{KL}}(p(\theta | \mathbf{o}_{N}); p(\theta)) - D_{\mathrm{KL}}(p(\theta | \mathbf{o}_{N}); p(\theta | \mathbf{o}_{C}))$ . Then,  $v_{\emptyset}^{\prime} = 0$  and  $v_{N}^{\prime} = D_{\mathrm{KL}}(p(\theta | \mathbf{o}_{N}); p(\theta))$ . It can be observed that
- Unlike  $v_{C}, v_{C}^{\prime}$  may be negative.
- Unlike  $v_{N}$ ,  $v_{N}^{\prime}$  is guaranteed to have the highest valuation as the minimum KL divergence  $D_{\mathrm{KL}}(p(\theta | o_{N}); q(\theta))$  is 0 only when  $q(\theta) = p(\theta | o_{N})$ . This is desirable when we want the grand coalition to be more valuable than the other coalitions but odd when we consider the non-private posterior  $q(\theta) = p(\theta | s_{N})$ : Intuitively, the model computed using  $s_{N}$  should be more valuable using  $v^{\prime}$  than that computed using the perturbed SS  $o_{N}$ .
By taking an expectation w.r.t.  $\pmb{O}_N$
$$
\begin{array}{l} \mathbb {E} _ {p (O _ {N})} \left[ v _ {C} ^ {\prime} \right] = \mathbb {I} (\theta ; O _ {N}) - \mathbb {E} _ {\boldsymbol {o} _ {C} \sim p (O _ {C})} \left[ \mathbb {E} _ {\boldsymbol {o} _ {N \setminus C} \sim p (O _ {N \setminus C} | \boldsymbol {o} _ {C})} \left[ D _ {\mathrm {K L}} \big (p (\theta | \boldsymbol {o} _ {N} = \{\boldsymbol {o} _ {N \setminus C}, \boldsymbol {o} _ {C} \}); p (\theta | \boldsymbol {o} _ {C}) \big) \right] \right] \\ = \mathbb {I} (\theta ; O _ {N}) - \mathbb {E} _ {\boldsymbol {o} _ {C} \sim p (O _ {C})} \left[ \mathbb {E} _ {\boldsymbol {o} _ {N \backslash C} \sim p (O _ {N \backslash C} | \boldsymbol {o} _ {C})} \left[ \mathbb {E} _ {\theta \sim p (\theta | \boldsymbol {o} _ {N \backslash C}, \boldsymbol {o} _ {C})} \left[ \log \frac {p (\theta | \boldsymbol {o} _ {N \backslash C} , \boldsymbol {o} _ {C})}{p (\theta | \boldsymbol {o} _ {C})} \right] \right] \right] \\ \stackrel {(i)} {=} \mathbb {I} (\theta ; O _ {N}) - \mathbb {E} _ {\boldsymbol {o} _ {C} \sim p (O _ {C})} \left[ \mathbb {E} _ {\theta , \boldsymbol {o} _ {N \setminus C} \sim p (\theta , O _ {N \setminus C} | \boldsymbol {o} _ {C})} \left[ \log \frac {p (\theta , \boldsymbol {o} _ {N \setminus C} | \boldsymbol {o} _ {C})}{p (\theta | \boldsymbol {o} _ {C}) p (\boldsymbol {o} _ {N \setminus C} | \boldsymbol {o} _ {C})} \right] \right] \\ = \mathbb {I} (\theta ; O _ {N}) - \mathbb {E} _ {\boldsymbol {o} _ {C} \sim p (O _ {C})} \left[ D _ {\mathrm {K L}} \left(p (\theta , O _ {N \backslash C} | \boldsymbol {o} _ {C}); p (\theta | \boldsymbol {o} _ {C}) p (O _ {N \backslash C} | \boldsymbol {o} _ {C})\right) \right] \\ \stackrel {(i i)} {=} \mathbb {I} (\theta ; O _ {N}) - \mathbb {I} \left(\theta ; O _ {N \backslash C} \mid O _ {C}\right) \\ = \mathbb {I} (\theta ; O _ {C}) = \mathbb {E} _ {p (O _ {N})} [ v _ {C} ]. \\ \end{array}
$$
In equality (i) above, we multiply both the numerator and denominator within the log term by  $p(\pmb{o}_{N\backslash C}|\pmb{o}_C)$  and consider the expectation of the joint distribution since by the chain rule of probability,  $p(\theta ,O_{N\backslash C}|o_C) = p(O_{N\backslash C}|o_C)p(\theta |O_{N\backslash C},o_C)$ . Equality (ii) is due to the definition of conditional mutual information.
C.3 KL Estimation of Valuation Function
KL estimation is only a tool and not the focus of our work. Our valuation will become more accurate and computationally efficient as KL estimation tools improve.
Recommended - nearest-neighbors [45, 54]. Given  $\Theta^{\mathrm{post}}$  and  $\Theta^{\mathrm{prior}}$  which consists of  $m$  samples of  $\theta$  (with dimension  $d$ ) from, respectively, the posterior  $p(\theta | o_{C})$  and prior  $p(\theta)$ , we estimate the KL divergence as
$$
\frac {d}{m} \sum_ {\theta \in \Theta^ {\text {p o s t}}} \log \frac {\delta_ {k} ^ {\text {p r i o r}} (\theta)}{\delta_ {k} ^ {\text {p o s t}} (\theta)} + \log \frac {m}{m - 1}
$$
where  $\delta_k^{\mathrm{post}}(\theta)$  is the distance of the sampled  $\theta$  to its  $k$ -th nearest neighbor in  $\Theta^{\mathrm{post}}$  (excluding itself) and  $\delta_k^{\mathrm{prior}}(\theta)$  is the distance of the sampled  $\theta$  to the  $k$ -th nearest neighbor in  $\Theta^{\mathrm{prior}}$ .
The number  $k$  of neighbors is tunable and analyzed in the follow-up work of [49]. As the number  $m$  of samples increases, the bias and variance decrease. The convergence rate is analysed by [66]. Moreover, the estimate converges almost surely [45] and is consistent [54] for independent and identically distributed (i.i.d.) samples. Furthermore, as the KL divergence is invariant to metric reparameterizations, the bias can be reduced by changing the distance metric [42, 54].
To generate i.i.d. samples, we suggest the usage of the NUTS sampler or thinning (keeping only every  $t$ -th sample). We observe that if the samples from  $\theta \mid o_{C}$  are non-independent, i.e., correlated and close to the previous sample, we may underestimate its distance to the  $k$ -th distinct neighbor in  $\theta \mid o_{C}, \delta_{k}^{\mathrm{post}}(\theta)$ , and thus overestimate the KL divergence. This is empirically verified in Table 2. We have also observed that the KL divergence may be underestimated when the posterior is concentrated at a significantly different mean from the prior.
Recommended for large  $\epsilon$ -approximate  $p(\theta | o_{C})$  using maximum likelihood distribution from the  $p(\theta)$ 's exponential family. When a small noise is added to ensure weak DP, we can approximate  $p(\theta | o_{C})$  with a distribution  $q$  from the same exponential family as  $p(\theta | s_{C})$ . We can (i) determine  $q$ 's parameters via maximum likelihood estimation (MLE) from the Gibbs samples<sup>19</sup> and (ii) compute the KL divergence in closed form.
However, the KL estimate is inaccurate (i.e., large bias) when the distribution  $q$  is a poor fit for the posterior  $p(\theta | o_C)$ . Future work can consider using normalizing flows as  $q$  to improve the fit, reduce the estimation bias, and work for a larger range of DP guarantees  $\epsilon$ . However, this KL estimation method may be computationally slow and risks overfitting.
Probabilistic Classification. Let the binary classifier  $f: \Theta \to [0,1]$  (e.g., a neural network) discriminate between samples from two densities  $q_{1}(\theta)$  (here, the posterior  $p(\theta | o_{C})$ ) and  $q_{0}(\theta)$  (here, the prior  $p(\theta)$ ) and output the probability that  $\theta$  comes from  $q_{1}(\theta)$ . Concretely, we label the  $m$  samples from  $q_{1}(\theta)$  and  $q_{0}(\theta)$  with  $y = 1$  and  $y = 0$ , respectively. By Bayes' rule, the density ratio is
$$
\frac {q _ {1} (\theta)}{q _ {0} (\theta)} = \frac {p (\theta | y = 1)}{p (\theta | y = 0)} = \frac {p (y = 1 | \theta)}{p (y = 0 | \theta)} = \frac {p (y = 1 | \theta)}{1 - p (y = 1 | \theta)}.
$$
Optimizing a proper scoring rule such as minimizing the binary cross-entropy loss should return the Bayes optimal classifier  $f^{*}(\theta) = p(y = 1|\theta)$ . The KL estimate is then computed as the mean log-density ratio over samples from  $q_{1}(\theta)$ . As the log-density ratio is sigmoid $^{-1}(p(y = 1|\theta))$ , when  $f$  is a neural network with sigmoid as the last activation layer, we can use the logits before activation directly.
However, with only limited finite samples  $m$  and a large separation between the distributions  $q_{1}$  and  $q_{0}$ , the density ratio and KL estimate may be highly inaccurate [8]: Intuitively, the finite samples may be linearly separable and the loss is minimized by setting the logits of samples from  $q_{1}(\theta)$  (hence KL) to infinity (i.e., classify it overconfidently with probability 1). As the separation between the distributions  $q_{1}$  and  $q_{0}$  increases, exponentially more training samples may be needed to obtain samples between  $q_{1}$  and  $q_{0}$  [8]. Moreover, as training may not produce the Bayes optimal classifier, there is also an issue of larger variance across runs.
D Reward Scheme for Ensuring Incentives
D.1 Incentives based on Coalition Structure
Instead of assuming the grand coalition  $N$  form, we can consider the more general case where parties team up and partition themselves into a coalition structure  $CS$ . Formally,  $CS$  is a set of coalitions such that  $\bigcup_{C \in CS} C = N$  and  $C \cap C' = \emptyset$  for any  $C, C' \in CS$  and  $C \neq C'$ . The following incentives are modified below:
P2 For any coalition  $C \in CS$ , there is a party  $i \in C$  whose model reward is the coalition  $C$ 's posterior, i.e.,  $q_{i}(\theta) = p(\theta | o_{C})$ . It follows that  $r_{i} = v_{C}$  as in R2 of [47].
P5 Among multiple model rewards  $q_{i}(\theta)$  whose value  $r_{i}$  equates the target reward  $r_{i}^{*}$ , we secondarily prefer one with a higher similarity  $r_{i,C}^{\prime} = -D_{KL}(p(\theta | \mathbf{o}_{C}); q_{i}(\theta))$  to the coalition's posterior  $p(\theta | \mathbf{o}_C)$  where  $i \in C$ .
19The distribution  $q$  from MLE minimizes the KL divergence  $D_{\mathrm{KL}}(p(\theta |o_C);q(\theta))$
D.2 Fairness Axioms
The fairness axioms from the work of [47] are reproduced below:
F1 Uselessness. If including the data or sufficient statistic of party  $i$  does not improve the quality of a model trained on the aggregated data of any coalition (e.g., when  $\mathcal{D}_i = \emptyset$ ,  $c_i = 0$ ), then party  $i$  should receive a valueless model reward: For all  $i \in N$ ,
$$
(\forall C \subseteq N \setminus \{i \} v _ {C \cup \{i \}} = v _ {C}) \Rightarrow r _ {i} = 0.
$$
F2 Symmetry. If including the data or sufficient statistic of party  $i$  yields the same improvement as that of party  $j$  in the quality of a model trained on the aggregated data of any coalition (e.g., when  $\mathcal{D}_i = \mathcal{D}_j$ ), then they should receive equally valuable model rewards: For all  $i, j \in N$  s.t.  $i \neq j$ ,
$$
\left(\forall C \subseteq N \backslash \{i, j \} v _ {C \cup \{i \}} = v _ {C \cup \{j \}}\right) \Rightarrow r _ {i} = r _ {j}.
$$
F3 Strict Desirability [33]. If the quality of a model trained on the aggregated data of at least a coalition improves more by including the data or sufficient statistic of party  $i$  than that of party  $j$ , but the reverse is not true, then party  $i$  should receive a more valuable model reward than party  $j$ : For all  $i, j \in N$  s.t.  $i \neq j$ ,
$$
\left(\exists B \subseteq N \setminus \{i, j \} v _ {B \cup \{i \}} > v _ {B \cup \{j \}}\right) \wedge
$$
$$
(\forall C \subseteq N \backslash \{i, j \} v _ {C \cup \{i \}} \geq v _ {C \cup \{j \}}) \Rightarrow r _ {i} > r _ {j}.
$$
F4 Strict Monotonicity. If the quality of a model trained on the aggregated data of at least a coalition containing party  $i$  improves (e.g., by including more data of party  $i$ ), ceteris paribus, then party  $i$  should receive a more valuable model reward than before: Let  $\{v_{C}\}_{C \in 2^{N}}$  and  $\{\tilde{v}_{C}\}_{C \in 2^{N}}$  denote any two sets of values of data over all coalitions  $C \subseteq N$ , and  $r_{i}$  and  $\tilde{r}_{i}$  be the corresponding values of model rewards received by party  $i$ . For all  $i \in N$ ,
$$
\left(\exists B \subseteq N \setminus \{i \} \tilde {v} _ {B \cup \{i \}} > v _ {B \cup \{i \}}\right) \wedge
$$
$$
\left(\forall C \subseteq N \setminus \{i \} \tilde {v} _ {C \cup \{i \}} \geq v _ {C \cup \{i \}}\right) \land
$$
$$
(\forall A \subseteq N \setminus \{i \} \tilde {v} _ {A} = v _ {A}) \wedge (\tilde {v} _ {N} > r _ {i}) \Rightarrow \tilde {r} _ {i} > r _ {i}.
$$
D.3 Remark on Rationality
Let  $v_{s_i}$  denote the Bayesian surprise party  $i$ 's exact SS  $s_i$  elicits from the prior belief of model parameter. We define Stronger Individual Rationality (SIR, the strengthened version of P4) as: each party should receive a model reward that is more valuable than the model trained on its exact SS alone:  $\forall i \in N r_i^* \geq v_{s_i}$ .
We consider two potential solutions to achieve stronger individual rationality and explain how they fall short.
- Each party  $i$  declares the value  $v_{s_i}$  and the mediator selects a smaller  $\rho$  to guarantee SIR. SIR is infeasible when the grand coalition's posterior is less valuable than party  $i$ 's model based on exact SS, i.e.,  $v_N < v_{s_2}$ . In Fig. 2, we observe that when party 2 selects a small  $\epsilon_2$ ,  $v_N$  is less than  $v_{s_2}$  which can be approximated by  $v_2$  under large  $\epsilon_2$ , i.e., the right end point of the blue line. Instead, SIR is only empirically achievable when party 2 and others select a weaker DP guarantee as in Fig. 10 in App. H.5. Note that our work only incentivizes weaker DP guarantees and does not restrict parties' choice of DP guarantees.
- The mediator should reward party  $i$  with perturbed SS  $t_j^i$  (for Sec. 5.1) or  $\kappa_i o_j, \kappa_i c_j, \kappa_i Z_j$  (for Sec. 5.2) for every other party  $j \neq i$ . Party  $i$  can then combine these with its exact  $s_i$  to guarantee SIR.
This approach achieves SIR at the expense of truthfulness. As party  $i$  perturbed SS  $o_i$  is not used to generate its own model reward, party  $i$  may be less deterred (hence more inclined) to submit less informative or fake SS.
SIR is not needed when each party prefers training a DP model even when alone. SIR may be desired in other scenarios. However, our approach does not use alternative solutions to satisfy SIR as we prioritize incentivizing parties to (i) truthfully submit informative perturbed SS that they would use for future predictions, while (ii) not compromising for weak DP guarantees.
E Details on Reward Control Mechanisms
In the subsequent proofs, any likelihood  $p^{\kappa_i}(\cdot)$  should be interpreted as  $[p(\cdot)]^{\kappa_i}$ : We only raise likelihoods (of data conditioned on model parameters) to the power of  $\kappa_i$ .
E.1 Likelihood Tempering and Scaling SS Equivalence Proof
Let  $g$  denote the function that maps any data point  $d_{l}$  or dataset  $\mathcal{D}_k$  to its sufficient statistic. For any data point  $d_{l}$ , we assume that the data likelihood  $p(d_l|\theta)$  is from an exponential family with natural parameters  $\theta$  and sufficient statistic  $g(d_{l})$ . The data likelihood  $p(d_{l}|\theta)$  can be expressed in its natural form:
$$
p \left(d _ {l} \mid \theta\right) = h \left(d _ {l}\right) \exp \left[ g \left(d _ {l}\right) \cdot \theta - A (\theta) \right]
$$
where  $\mathbf{a} \cdot \mathbf{b} \triangleq \mathbf{a}^{\top} \mathbf{b}$  denotes the dot product between two vectors.
Next, we assume that  $p(\theta)$  is the conjugate prior $^{20}$  for  $p(\mathcal{D}_k|\theta)$  with natural parameters  $\eta$  and the sufficient statistic mapping function  $T:\theta \to [\theta^{\top}, - A(\theta)]^{\top}$ . Then, for  $c_{k}$  data points which are conditionally independent given the model parameters  $\theta$ ,
$$
\begin{array}{l} p (\theta | \{d _ {l} \} _ {l = 1} ^ {c _ {k}}) \propto p (d _ {1} | \theta) \dots p (d _ {c _ {k}} | \theta) p (\theta | \eta) \\ \propto \left[ \left(\prod_ {l = 1} ^ {c _ {k}} h (d _ {l})\right) \exp \left[ \underbrace {\sum_ {l = 1} ^ {c _ {k}} g (d _ {l})} _ {g (\mathcal {D} _ {k})} \cdot \theta - c _ {k} A (\theta) \right] \right] [ h (\theta) \exp [ T (\theta) \cdot \eta - B (\eta) ] ] \\ \propto \exp \left[ g \left(\mathcal {D} _ {k}\right) \cdot \theta - c _ {k} A (\theta) + T (\theta) \cdot \eta - B (\eta) \right] \\ \propto \exp \left[ \left(\left[ g (\mathcal {D} _ {k}) ^ {\top}, c _ {k} \right] ^ {\top} + \eta\right) \cdot T (\theta) - C (\eta) \right] \\ \end{array}
$$
where  $C(\eta)$  is chosen such that the distribution is normalized.
Substituting the above SS formulae into (1), the normalized posterior distribution (after tempering the likelihood) is