Secure Federated Learning of User Verification Models
Authors: Hossein Hosseini
Hyunsin Park
Sungrack Yun
Christos Louizos
Joseph Soriaga
Max Welling
Venue:  (2021)
Keywords: Federated learning
User verification models

Abstract: We consider the problem of training User Verification (UV) models in federated setup, where the conventional loss functions are not applicable due to the constraints that each user has access to the data of only one class and user embeddings cannot be shared with the server or other users.  To address this problem, we propose Federated User Verification (FedUV), a framework for private and secure training of UV models. In FedUV, users jointly learn a set of vectors and maximize the  correlation  of  their  instance  embeddings  with  a  secret  user-defined  linear combination of those vectors. We show that choosing the linear combinations from the codewords of an error-correcting code allows users to collaboratively train the model without revealing their embedding vectors.  We present the experimental results for user verification with voice, face, and handwriting data and show that FedUV is on par with existing approaches, while not sharing the embeddings with other users or the server.

Under review as a conference paper at ICLR 2021
SECURE FEDERATED LEARNING OF USER VERIFICATION MODELS
Anonymous authors Paper under double-bling review
ABSTRACT
We consider the problem of training User Verification (UV) models in federated setup, where the conventional loss functions are not applicable due to the constraints that each user has access the data of only one class and user embeddings cannot be shared with the server or other users. To address this problem, we propose Federated User Verification (FedUV), a framework for private and secure training of UV models. In FedUV, users jointly learn set of vectors and maximize the correlation of their instance embeddings with a secret user-defined linear combination of those vectors. We show that choosing the linear combinations from the codewords of an error-correcting code allows users to collaboratively train the model without revealing their embedding vectors. We present the experimental results for user verification with voice, face, and handwriting data and show that FedUV is on par with existing approaches, while not sharing the embeddings with other users or the server.
INTRODUCTION
There has been recent increase in the research and development of User Verification (UV) models with various modalities such as voice (Snyder et al., 2017; Yun et al. 2019), face (Wang et al. 2018). fingerprint (Cao & Jain 2018), iris (Nguyen al. 2017). Machine learning-based UV features have been adopted by commercial smart devices such as mobile phones, Al speakers and automotive infotainment systems for variety of applications such unlocking the system or providing user-specific services, c.g., music recommendation, schedule notification, or other configuration adjustments (Matei 2017 Barclays 2013 Mercedes (020).
User verification is binary decision problem of accepting or rejecting a test example based on its similarity to the user's training examples. We consider embedding- test example is accepted if its embedding is close enough to a reference embedding, and otherwise rejected. Such classifiers are usually trained with loss function that is composed of two terms, 1) positive loss that minimizes the distance of the instance embedding to the positive class embedding, and 2) a negative loss that maximizes the distance to the negative class embeddings. The negative loss term is needed to prevent the class embeddings from collapsing into single point (Bojanowski & Joulin 2017).
classifiers, in which
Verification models need to be trained with a large variety of users' data so that the model learns different data characteristics and can reliably reject imposters. However, due to the privacy-sensitive nature of the biometric data used for verification, it is not possible to centrally collect large training datasets. One approach to address the data collection problem to train the model the federated setup, which is framework for training models by repeatedly communicating the model weights and gradients between a central server and a group of users (McMahan et al.) 2017a)) Federated learning (FL) allows training models without users having to share their data with the server or other users and, hence, helps enable private training of verification models.
Training UV models in federated setup, however, imposes additional constraints that each user has access to the data of only one class, and cannot share their embedding vector with the server or other users due security reasons. Specifically, sharing embeddings with others can lead to both training- and test-time attacks. For example, the server or other users can run a poisoning attack (Biggio et al.) 2012) and train the model so that it verifies fake examples as the examples generated by particular

---

Under review as a conference paper at ICLR 2021
user. They can also earry out evasion attacks at test time (Biggio et al. 2013 Szegedy et al. 2013) to fool the model to verify impostors as a target user.
Without having access to embedding vectors of others, users cannot compute the negative loss term for training the model in the federated setup. recent work (Yu et al., 2020) studied the problem of federated learning with only positive labels and proposed FedAwS, method that allows users and the server to jointly train the model. In FedAwS, at each round, users train the model with the positive loss function and send the new models to the server. The server then updates the averaged model using an approximated negative loss function that maximizes the pairwise distances between user embeddings. FedAwS keeps the embedding of each user private from other users but reveals all embeddings to the server, which, as mentioned earlier, undermines the security of verification models in real-world applications.
In this paper, we propose Federated User Verification (FedUV), a framework for training UV models in federated setup using only the positive loss term. Our contributions are summarized in the following.
We propose method where users jointly learn set of vectors, but each user maximizes the correlation their instance embeddings with a secret linear combination those vectors. We show that, under a condition that the secret vectors are designed with guaranteed minimum pairwise correlations, the model can be trained using only the positive loss term. Our framework, hence, addresses the problem of existing approaches where embeddings are shared with other users or the server (Yu et al. 2020).
We propose to use error-correcting codes to generate binary secret vectors. In our method, the server distributes unique IDs the users, which they then construct unique vectors without revealing the selected vector to the server or other users.
We present a verification method, where a test example is accepted if the correlation of the predicted embedding with the secret vector is more than threshold, and otherwise rejected. We develop a "warm-up phase" to determine the threshold for each user independently, in which of inputs is collected and then the threshold is computed Positive Rate (TPR).
obtain desired True
We present the experimental results for voice, face and handwriting recognition using Vox- Celeb (Nagrani et al. 2017), CelebA (Liu et al. 2013) and MNIST-UV datasets, respectively. where MNIST-UV is a dataset we created from images of the EMNIST dataset (Cohen et al. 2017). Our experimental results show that FedUV performs par with FedAwS, while not sharing the embedding vectors with the server.
BACKGROUND
Algorithm 1 (McMahan et al. 2017a) FedAvg.
2.1 FEDERATED LEARNING
O:: model parameters at round t, K: number of users,
Consider a setting where K users want to train model on their data. Federated learn- ing (FL) allows users to train the model by the help of a central coordinator, called server, and without sharing their local data with other users (or the server). The most commonly-used algorithm for FL is Fed- erated Averaging (FedAva) described Algorithm (MeMahan al. 2017a)
fraction of users selected each round, D,; dataset of user u with n., examples.
FedAvg:
Server: Initialize 0g
Server: max(c- K,
for each global round t = 1, 2, do
Server: S. f- (random set of users)
Server:
Send 0,-1 to users u E S, Users E S₁; 6t n, + UsserUddate(0--1.1 D.)
Server: O, Lues, n.0"" -ues, nh
2.2 USER VERIFICATION WITH MACHINE LEARNING
UserUpdate(0, D): // Done by users
B <- (split D into batches of size B) for each local epoch from E do for batch b E B do
User verification (UV) is binary decision problem where a test example is accepted (reference user) rejected (impostor user) based on its similarity to the training data. We consider anbedding-based classifiers,
0 T)Ve(0;)) b) return 0 and [D] to server
2

---

Under review as a conference paper at ICLR 2021
in which both the classes and the inputs are mapped into embedding space such that the embedding of each input is closest to the embedding of their corresponding class. Let wy E R" be the embedding vector of class and 90 X' - R be network that maps imput from the input space X' to an ne n.-dimensional embedding () Let be a distance function. The model trained on (xr y) so to have y arg min, ((go(x), w.) or, equivalently
d(go (z), wg) < min d(go( (z), w.).
u#y
Hence, the loss function can be defined as follows:
f(2, yr 0, w) = (z))(x), wy) - min d(go (x), w.).
uzy
Minimizing the loss function reduces to minimizing the distance of the instance embedding to the true class embedding and maximizing the distance to the embeddings of other classes. The two terms are called positive and negative loss terms, respectively. The negative loss term is needed to ensure that the training does not lead to trivial solution that all inputs and classes collapse a single point in the embedding space (Bojanowski & Joulin 2017
2.3 ERROR-COREE CORRECTING CODES
Error correcting codes (ECCs) are techniques that enable restoring sequences from noise. A binary block code is an injective function C' : {0, 1) + {0, 10, 2 m, that takes a binary message vector and generates the corresponding codeword by adding structured redundancy, which can be used to obtain the original message from the corrupted codeword. In ECCs, each message bit affects many transmitted symbols in such way that the corruption of some symbols by noise usually allows the original message bits to be extracted from the other, uncorrupted received symbols that also depend on the same message bits.
ECCs are designed to maximize the minimum Hamming distance, dmin. between distinct codewords, where Hamming distance between two sequences is defined the number of positions which they differ. A code with minimum distance 5 allows correcting up to (ō 1)/2 errors (Richardson & Urbanke 2008). Also, with the same code length, c, the minimum distance decreases as the message length, m. increases. In this paper, we use binary BCH codes which are class of block codes with codewords of length 2 1, 2 (Bose&
-hyhChhud 1960). Note that the choice of the coding algorithm is not crucial to our work and our method works with any ECC algorithm.
3 USER VERIFICATION WITH FEDERATED LEARNING
In this section, we outline the privacy and security requirements of the training UV models and describe the challenges of training UV models in the federated setup.
3.1 PRIVACY AND SECURITY REQUIREMENTS OF TRAINING UV MODELS
Verification models need to be trained with a large variety of users' data so that the model learns different data characteristics and can reliably verify users. For example, speaker recognition models need to be trained with the speech data of users with different ages, genders, accents, etc., to be able to reject impostors with high accuracy. One approach for training UV models is to collect the users' data and train the model centrally. This approach is, however, not to have direct access to the users' biometric data.
due to the need
An alternative approach using FL framework, which enables training with the data of a large number of users while keeping their data private by design. Training UV models in federated setup, however, poses its own challenges. As stated in Section (2.2). training embedding- based classifiers requires having access to all class embeddings compute the loss function in ( In UV applications, however, class embeddings are used for the verification and, hence, are considered security-sensitive information and cannot be shared with the server other users.
Providing security is particularly important in UV applications, where the model might be trained and deployed in adversarial settings. Specifically, the leakage of the embedding vector makes the verification model vulnerable to both training- and test-time attacks, examples of which are provided in the following.
3

---

Under review as a conference paper at ICLR 2021
Poisoning attack (Biggio al. 2012): The server participates in training and trains the model with the loss function dg ( Wa) for some z; At test time, the model generates Wy for the imput z and thus wrongly verifies x as a true example from user
Evasion attack (Biggio et al. 2013 Szegedy al. 2013): Attacks based on adversarial examples are known to be highly effective against deep neural networks (Carlini & Wagner (017). In the context of UV models, when target embedding vector is known, evasion attack can be performed to slightly perturb any given input such that the predicted embedding matches the target embedding and thus is accepted by the model.
3.2 PROBLEM STATEMENT
Without the knowledge of the embedding vectors of other users, users cannot compute the negative loss term in 2 for training the model in federated setup. Training only with the positive loss function also causes all class embeddings to collapse into a single point. this paper, we address the following questions: 1) how to train embedding-basee classifiers without the negative loss term? and 2) how this can be done in the federated setup?
3.3 RELATED WORK: FEDERATED AVERAGING WITH SPREADOUT (FEDANS)
In gabbedding-based elassifiers, the negative loss term maximizes the distance of instance embeddings to the embeddings of other classes. A recent paper Yuu et al. (0200) observed that, alternatively, the model could be trained maximize the pairwise distances of class embeddings. They proposed Federated Averaging with Spreadout (F (F) framework, where the server, in addition to averaging the gradients, performs an optimization step to ensure that embeddings are separated from each other by least margin of v. Formally, in each round of training, the server applies the following geomet- ric regularization regap. (W)) = Σxe(k] Enrgu (max(0, v d(w.,, W.r war))) )))² FedAwS eliminates the need for users to share their embedding vector with other users but still requires sharing it with the server, which seriously undermines the security of the real-world verification models.
4 PROPOSED METHOD
4.1 TRAINING WITH ONLY POSITIVE LOSS
Training UV models using the loss function in (2) requires users to jointly learn the class embeddings, which causes the security problem of sharing the embeddings with other users. To address this problem, we propose method where users jointly learn a set of vectors, but each user maximizes the correlation of their instance embedding with a secret linear combination of those vectors. The same linear combination also used for user verification test time.
Let W E Rexa be a set of vectors and Eu E { 1) be the secret vector of user u. We modify the loss function in (2) as follows:
E(x, y, 0, W) Epos + >lneg:
where fpos d(go(x), WT and Eneg min d(go( (2), W WTo)).
w
Let us call s. W Un the secret embedding of user u. Note that users still need know the secret vector, Vu, or the secret embedding, su. of other users to compute the negative loss term. We, however, show that under certain conditions, the model can be trained using only the positive loss term.
Let us define the positive and negative loss terms as follows:
fpus max (0, - W go())) and bnog max wey
1
v. W (z)).
The positive loss term maximizes the correlation of the instance embedding with the true secret embedding, while the negative loss term minimizes the correlation with secret embeddings of other users. We have the following Lemma.
Lemma 1. Assume |[ (x)) Vc and vy E 13. For fpos defined in (4) we have E = and only if W go (0(x) Ug.
4

---

Under review as a conference paper at ICLR 2021
Proof. Let (1) The term &pos 0 is equivalent to 2 2 1. We have 2 I d || = 1 and the equality holds if and only if aly. Since || ||0y|| vc, then 1 and, hence, we have ppss 0 if and only if By.
The following Theorem links the positive and negative loss terms of (4) when secret vectors are chosen from ECC codewords.
Theorem 1. Assume || [=9((>)]== ve and by E f-1,1] Assume v; 's are chosen from ECC codewords. For eos and Eneg defined in 4.) minimizing fos also minimizes fneg-
Proof. Since v/ E {-1,1} the Hamming distance between Buy and Ueg is defined as
1
1 (11 112 + ||ung 122 20 Uug) 2 Uay Waz).
Aur,uz |000 uu 11 4
The minimum Hamming distance between codewords is obtained as dman = minu, Aur As stated in Section 2.3 ECCs are designed to maximize dmin or, equivalently, minimize maXu, s/v2 uu Vug. Using Lemma (1) we have 6pos 0 if and only if = = Uy: which results in l fneg maxugv "u f'y. As result, fneg is at its minimum when fpss = 0 and ej are chosen from ECC codewords.
Theorem [ states that the negative loss term in 3 is redundant when [>])l=> vč and the secret vectors are chosen from ECC codewords, enabling the embedding- based classifiers be trained with only the positive loss defined in (4. Note that it will still help to use fneg for training especially early epochs, but the effect of nng gradually vanishes
fpos becomes smaller and eventually gets close to zero. To illustrate this, we show an example of the training and test accuracy with and without neg in Figure in Appendix C As can be seen, using neg results in better accuracy at early epochs but does not have significant impact on the final accuracy.
4.2 FEDERATED USER VERIFICATION (FEDUV)
In this section, present Federated User Verification (FedUV), a framework for training UV models in the federated setup. FedUV consists of three phases of choosing unique codewords, training, and verification, details of which are provided in the following.
Choosing Unique Codewords. To train the UV model with the positive loss function defined in (4 users must choose unique codewords without sharing the vectors with each other or the server. To do so, we propose to partition the space between users by the server and let users select a random message in their assigned space. Specifically, the server chooses unique binary vectors b, of length l. for each user u E [K] and sends each vector to the corresponding user. Each user u then chooses a random binary vector, Tu. of length 4,, constructs the message vector m. b.llrr.. and computes the codeword U. = Cmm,), where is the block code.
The length of the base vectors is determined such that the total number of vectors is greater than or equal to the number of users, i.e., 4, 2 log, K. In practice, the server can set l >> log, K so that new users can be added to the training after training started. In experiments, sufficient for most practical purposes. The code length is also determined by the server based on the number of users and the desired minimum distance obtained according to the estimated difficulty of the task. Using larger codewords improves the performance the model but also increases the training complexity and communication cost of the FedAvg method. The proposed method has the following properties.
set = 32, which is
It ensures that codewords are unique, because the base vectors b, 's and, in turn, m. are unique for all users. Moreover, due to the use of the ECC algorithm, the minimum distance between codewords are guaranteed to be more than threshold determined by the code characteristics.
The final codewords are not shared among users with the server. Moreover, there are 2 vectors for each user to choose their codeword from. Increasing 4, improves the security of the method by making it harder to guess the user's codeword but reduces the minimum distance of the code for given code length. In experiments, we set 1, 2 32, which sufficient for most practical purposes.
5

---

Under review as a conference paper at ICLR 2021
Algorithm 2 Federated User Authentication (F (FedUV), K: number of users, C: block code, 0, W: model parameters, a: function that scales its input to have norm of vc, y: TPR.
Codeword Selection:
Server: Send a unique binary vector, bu, u E [K], of length 4, 2 loga to user u
User E [K]:
Choose a random binary vector, Tu. of length 4. Construct message vector my by |r=
Compute codeword Un = ((m.)
Training:
Server and users: Train UV model using FedAvg algorithm I and with the loss function lpos = max(0, Lo oW ge(()))))
Warm-up Pf W, Ugg. q): // Done by users
Collect inputs z/ [m)], and compute e, = 1 oW go (21))) Set equal to the i-th smallest value in where = n (1 9)
Verification(8, W, eg, T,x'): II Done by users " ( (2))) if e 2 7 then ACCEPT else REIECT
The method adds only small overhead vanilla FL algorithms. Specifically, the assigns and distributes unique binary vectors to users and users construct message vectors and compute the codewords.
Training. Figure D shows the model structure used in FedUv method. The model is trained using the FedAvg algorithm and with the loss function fpss max(0, 1 " a (W go (x))), where a is function that scales its input to have norm of Vc.
X
go
W
Scale
Z
[iil -
Figure 1: Model structure for FedUV.
Verification. After training, each user deploys the model binary classifier to accept or reject test examples. For an input x', the verification is done as
y (Wgo(a')
(5)
where 7 is the verification threshold. The threshold is determined by each user independently such that they achieve True Positive Rate (TPR) more than value, say 90%. The TPR is defined as the rate that the reference user is correctly verified. To do so, in a warm-up phase, n inputs x'y.j E [m]. are collected and their corresponding scores are computed as b. ( go (xrg). The threshold is then set such that a desired fraction g of inputs are verified.
Our proposed framework, FedUV, is described in Algorithm
4.3 COMPARING COMPUTATIONAL COST OF FEDUV AND FEDAWS
FedUv has similar computational cost to FedAwS on the user side as both methods perform regular training of the model local data (with different loss functions). On the server side, however, FedUV is more efficient, since, unlike FedAwS, it does not require the server to do any processing beyond averaging the gradients.
5 RELATED WORK
The problem of training UV models in federated setup has been studied in (Granqvist et al. 2020) for on-device speaker verification and in (Yu et al., (0200) as part of a general setting of FL with only positive labels. However, to the best of our knowledge, our work is the first to address the problem of training ambedding-basee classifiers federated setup with only the positive loss function. Our proposed framework trains the model without sharing the secret embedding vector with the server

---

Under review as a conference paper at ICLR 2021
or other users. is, however, not designed to defend against generic attacks in the federated setup. such as the poisoning and backdoor attacks presented in (Bhagoji et al. 2019 Bagdasaryan et al. 2020). Our method also inherits potential privacy leakage of FL methods, where users' data might be recovered from a trained model or the gradients (Melis et al. 2019). It has been suggested that adding noise gradients using secure aggregation methods improve the privacy of FL. (McMahan ct al. 2017b Bonawitz et al. 2017). Such approaches can be applied to our framework as well.
Our approach of assigning codeword to each user is related to distributed output representa- tion (Sejnowski & Rosenberg. [987). where a binary function is learned for each bit position. follows (Hinton et al., (986) in that functions are chosen be meaningful and independent, so that each combination of concepts can be represented by a unique representation. Another related method Bakiri, 1991 1994). which uses ECCs to improve the
distributed output coding (Dietterich generalization performance of classifiers. We, however, use ECCs to enable training unbedding-basee classifiers with only the positive loss function.
6 EXPERIMENTAL RESULTS
6.1 DATASETS
VoxCeleb (Nagrani et al. 2017) is created for text-independent speaker identification in real environ- ments. The dataset contains 1, 251 speakers' data with 45 to 250 number of utterances per speaker, which are generated from You videos recorded in various acoustic environments. We selected 1, 000 speakers and generated 25 training. 10 validation and 10 test examples for each speaker. The examples are 2-second audio clips obtained from videos recorded in one setting. We also generated a separate test set of 1, 000 examples by choosing utterances from 200 of the remaining speakers that were not selected for training. All 2-second audio files were sampled at 8 kHz to obtain vectors of length 214 for model input.
CelebA [Liu et al. 2015) contains more than 200, 000 facial images from 10, 177 unique individuals, where each image has the annotation of 40 binary attributes and 5 landmark locations. We use CelebA for user verification by assigning the data of each individual to one client and training the model to recognize faces. We selected 1, 000 identities from those who had at least 30 images, which we split into 20, 5 and 5 examples for training, validation, and test sets, respectively. We also generated separate test set with 1, 000 images from individuals that were not selected for training (one example per person). All images were resized to 64 x 64.
MNIST-UV. We created MNIST-UV dataset for user verification based on handwriting recognition. MNIST-UV examples are generated using the EMNIST-byclass dataset (Cohen et al. 2017). which contains 814, 255 images from 62 unbalanced classes (10 digits and 52 lower- and upper-case case letters) written by 3, 596 writers. A version of this dataset, called FEMNIST, has been used train 62-class classifier in federated setup by assigning the data of each writer to one client (Caldas et al. 2018). In FEMNIST, the difference in handwritings is used to simulate the non-iid nature of the clients' data in federated setup.
We repurpose EMNIST for the task of user verification by training classifier that recognizes the handwritings., i.e., similar to FEMNIST, the data of each writer is assigned to one client but the model is trained predict the writer Ilss. To this end, we created MNIST-UV dataset that contains data of 1, 000 writers each with 50 training, 15 validation, and 15 test examples. Each example in the dataset of size 28 x 28 4 and is composed of images of digits 2, 3, 4 and 5 obtained from one writer. For each writer, the training examples are unique; however, the same sub-image (images of digits 2, 3, or 5) might appear in several examples. This also holds for validation and test sets. The sub images are, however, not shared between training, validation, and test sets. We also generated a separate test set with 1, 000 examples from writers that were not selected for training (one example per writer). Figure 3 in Appendix shows few examples of the MNIST-UV dataset.
6.2 EXPERIMENT SETTINGS
Training setup. We train UV models using the FedAvg method with 1 local epoch and 20, 000 rounds with 0.01 of users selected each round. The model structures are provided in Appendix B
7

---

Under review as a conference paper at ICLR 2021
VoxCeleb dataset
CelebA dataset
MNIST-UV dataset
1.0
1.0
1.2
0.8
0.0
0..8
sottaax
sohmax
motmaa
Pabtbye
0.6
Fealas
0.6
FodAes
0.4
Fedlws
(wd1M/112))
FeolN1255)
FesUM1255)
FediM/2255)
0.4
0.4
FediM/(113)
02
0.00
0.52
0.04
3.06
0.08
0.30
0.00
0.02
0.04
0.06
0.00
0.02
0.04
3.06
0.00
Fa Podttive Rate
False Footttve Rate
False Posttive Rat
(a) Training set
Thu mosefouiieeee Te-eaaa
0.6
FedN/1127
Thu Fooiliee
0.6
Fed1M/127)
Teidfwss
Fes
FedEMM225))
RodUI15111
0.4
(e11M/(113)
0.2
Falso
False: Footthve
Posttive
(b) Test set with known users
1.0
1.0
1.0
0.8
0.0
0.8
sofmax
sofmax
softmax
Thus Postec
0.6
Fodkes
(1
0.6
Foshws
TeatN(127)
0.6
FedUIV122)
FadAws
FedUV12255
Fod1N1255)
FedUM1233)
0.4
0.2
0.30
0.02
0.24
0.06
0.38
0.10
0.50
0.02
0.04
0.06
0.08
0.10
3.00
0.02
0.04
0.06
0.08
False Posiive Rabe
False Positive Rate
False Positive Rate
(c) Test set with unknown users
Figure 2: ROC curves for models trained in federated setup using softmax, FedAwS and Feduv algorithms. Feduv (c) denotes Feduv with code length of c. It can be seen that FedUV performs par with FedAwS, while softmax outperforming both methods. Also, expected, increasing the code length improves the performance FedUV algorithm.
that, unlike FedUV, both softmax and FedAwS share embeddings with other users and/or the server.
Baselines. We compare our FedUV method with the FedAwS algorithm Yu et al. 2020 and regular federated learning with the softmax cross-entropy loss function, which refer to so ftmax algorithm. Note that softmax and FedAwS share the embedding of each user with other users and/or the server. Similar FedUV, we perform a warm-up phase for the two baselines determine the verification threshold for each user.
Generating codewords. We BCH coding algorithm to generate codewords of lengths 127, 255 and 511. The code lengths are chosen be smaller than the number of users (1, 000) to emulate the setting with a very large num- ber of users. For each code length, we find the message length of greater than or equal to 64 that produces a valid code. Table the code statistics.
Table 1: Statistics of BCH codewords used in experiments.
Code length
Message length
dmin
127
64
21
255
71
59
511
67
175
6.3 VERIFICATION RESULTS
We evaluate the verification performance on three datasets, namely 1) training data, 2) test data of users who participated in training, and 3) data of users who did not participate in training. Figure 2 shows the ROC curves. The verification performance best on training data and slightly degrades when the model is evaluated test data of users who participated in training and further reduces
8

---

Under review as a conference paper at ICLR 2021
on data of new users. All methods, however, achieve notably high TPR, e.g., greater than 80%, low False Positive Rates (FPRs) of smaller than 10%. implying that the trained UV models can reliably reject the impostors. The regular softmax training outperforms both FedAwS and FedUV algorithms in most cases, especially at high TPRs of greater than 90%. FedUV's performance is on par with FedAwS, while not sharing the embedding vectors with the server. Also, expected, increasing the code length in FedUV improves the performance.
7 CONCLUSION
In this paper, we presented FedUV, a framework for private and secure training of user verification models. In FedUV, users first collaboratively choose unique secret vectors from codewords of an crror-corecting code and then train the model using FedAvg method with a loss function that only uses their own vector. After training, each user independently performs warm-up phase to obtain their verification threshold. We show our framework addresses the problem of existing approaches where embedding vectors are shared with other users the server. Our experimental results for user verification with voice, face, and handwriting data show FedUV performs on par with existing approaches, while not sharing the embeddings with other users the server.
REFERENCES
Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. How to backdoor federated learning. In International Conference on Artificial Intelligence and Statistics, 2020.
Barclays. Say goodbye to the pin: voice recognition takes over at Barclays Wealth, 2013. https say bat.pppee.....tciee.rr.reeeeeeer
Arjun Nitin Bhagoji, Supriyo Chakraborty, Prateek Mittal, and Seraphin Calo. Analyzing federated learning through an adversarial lens. In International Conference on Machine Learning, 2019.
Battista Biggio, Blaine Nelson, and Pavel Laskov. Poisoning attacks against support vector machines. In International Conference on Machine Learning, 2012.
Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim Šmndić, Pavel Laskov, Giorgio Giacinto, and Fabio Roli. Evasion attacks against machine learning at test time. In Joint European conference on machine learning and knowledge discovery in databases, 2013.
Piotr Bojanowski and Armand Joulin, Unsupervised learning by predicting noise. In International Conference on Machine Learning, 2017.
Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth. Practical secure aggregation for privacy- preserving machine learning. In ACM SIGSAC Conference on Computer and Communications Security, 2017.
Raj Chandra Bose and Dwijendra K Ray-Chaudhuri. On class of error correcting binary group codes. Information and control, 1960.
Sebastian Caldas, Peter Wu, Tian Li, Jakub Konečný, H Brendan McMahan, Virginia Smith, and Ameet Talwalkar. Leaf: A benchmark for federated settings. arXiv preprint arXiv:1812.0100 1812.01097, 2018.
Kai Cao and Anil K Jain. Automated latent fingerprint recognition. IEEE transactions on pattern analysis and machine intelligence, 2018.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In IEEE symposium on security and privacy, 2017.
Gregory Cohen, Saced Afshar, Jonathan Tapson, and Andre Van Schaik. Emnist: Extending mnist to handwritten letters. In International Joint Conference Neural Networks, 2017.

---

Under review as a conference paper at ICLR 2021
Thomas G Dietterich and Ghulum Bakiri. Error-correcting output codes: A general method for improving multiclass inductive learning programs. In Conference on Artificial Intelligence, 1991.
Thomas G Dietterich and Ghulum Bakiri. Solving multiclass learning problems via error-correcting output codes. Journal of artificial intelligence research, 1994.
Filip Granqvist, Matt Seigel, Rogier van Dalen, Áine Cahill, Stephen Shum, and Matthias Paulik. Improving on-device speaker verification using federated learning with privacy. In INTERSPEECII, 2020.
Geoffrey E Hinton et al. Learning distributed representations of concepts. In Anmual conference of the cognitive science society, 1986.
Kevin Hsich, Amar Phanishayee, Onur Mutlu, and Phillip B Gibbons. The non-iid data quagmire of decentralized machine learning. arXiv preprint
2019.
Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In International Conference on Computer Vision, 2015.
Mihai Matei.
Voice
Match
Will
Allow Google Home To
Recognize Your
Voice, 2017.
voice-mate mice-match-wii 11
ze your- cec.cee... htm)
H Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication efficieef learning of deep networks from decentralized data. In International Conference Artificial Intelligence and Statistics, 2017a.
Brendan McMahan, Daniel Ramage, Kunal Talwar, and Li Zhang. Learning differentially private recurrent language models. In International Conference on Learning Representations, 2017b.
Luca Melis, Congzheng Song, Emiliano De Cristofaro, and Vitaly Shmatikov. Exploiting unintended feature leakage in collaborative learning. IEEE Symposium on Security and Privacy, 2019.
Mercedes.
Mercedes Updated
Infotainment
System
Features
Bio-
metric Security,
2020.
https://E htt.:/iindmommrrr.e../ com
herccedesuupated
i nf aotoaaiiii www.mmettttttttemmmmme feettnefftuuuu-sueee omet wtw.uuees-bbmmetrr-ssssuuuuu
Arsha Nagrami, Joon Son Chung, and Andrew Zisserman. VoxCeleb: A large-scale speaker identifica- tion dataset. In INTERSPEECH, 2017.
Kien Nguyen, Clinton Fookes, Arun Ross, and Sridha Sridharan. Iris recognition with off-the-shelf cnn features: A deep learning perspective. IEEE Access, 2017.
Tom Richardson and Ruediger Urbanke. Modern coding theory. Cambridge university press, 2008.
Terrence J Sejnowski and Charles Rosenberg. Parallel networks that learn pronounce english text. Complex systems, 1987.
David Snyder, Daniel embeddings for text-independent speaker verification. INTERSPEEČH, 2017.
Daniel Povey, and Sanjeev Khudanpur. Deep neural network
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In International Conference Learning Representations, 2013.
Feng Wang, Jian Cheng, Weiyang Liu, and Haijun Liu. Additive margin softmax for face verification. IEEE Signal Processing Letters, 2018.
Felix X Yu, Ankit Singh Rawat, Aditya Krishna Menon, and Sanjiv Kumar. Federated learning with only positive labels. In International Conference on Machine Learning, 2020.
Sungrack Yun, Janghoon Cho, Jungyun Eum, Wonil Chang, and Kyuwoong Hwang. An end-to- end text-independent speaker verification framework with keyword adversarial network. In INTERSPEECH, 2019.
10

---

Under review as a conference paper at ICLR 2021
A MNIST-UV DATASET
Figure shows examples from MNIST-UV dataset. Note that, in figure, sub-images are placed in 2 x 2 grid for clarity.
Training
Validation
Test
23 2 3 23
2 23 2 3
User 0
5
4
5
5
4 5
4
5
3
23 3
23
23
2
3
User 1
5 4
5
5
5
45
4
23
2 3
2 3
2 3 23 4 5
from unseen users
45 4
5
4
5
4
5
Figure 3: Examples from MNIST-UV dataset created for user verification by handwriting. Each example in the dataset is of size 28 28 x 4 and is composed of images of digits 2, 4 and obtained from writer. In ligure, sub-images are placed
x grid for clarity. MNIST-UV dataset contains data of 000 writers each with 50 training, 15 validation, and 15 test examples. also contains a separate test set with 1, 000 examples from writers that were not selected for training (one example per writer).
B EXPERIMENTAL SETUP
Table shows network architectures used for each dataset. In models, use Group Normalization (GN) instead of batch-normalization (BN) following the observations that BN does not work well in non-iid data setting of federated learning (Hsieh al. 2019). The models trained with SGD) optimizer with learning rate of 0.1 and learning rate decay of 0.01.
Table 2: Network architectures for training UV models with different datasets. convxd(cl, c2, k p) is x- dimensional convolutional layer with el and c2 input and output channels, respectively, kernel size of and padding of The default value of is 1. GN(G) is group normalization layer with G groups. Scal 1 i ng layer scales its input to have norm of Ve. cis the code length FedAwS algorithms.
of FedUV and the number of users softmat
VoxCeleb
CelebA
MNIST-UV
convld(1, 61, & 15)
conv2d(3, 64, k 3)
comv2d(4, 61, 3,p relu, max pool2d(2). GN(2)
rolu, max poolld GN(2)
relu, max p2)) GN(2)
conv1d(64, 128,
comv2d(64, 128, relu, mwx.paolldd())..mmmmomomoom))))) GN(2)
comv2d(64, 128, & 3, relu, mox.poolld((). GN(2)
relu, max max.poolldd{S) GN(2)
1d128, 256, 7)
conv2d(128, 256, 3)
conv2d( 256, & relu, mox_pool2d(2). GN(2)
relu, max.poolld(8). GN(2)
relu, max_pool2d(2)). GN(2)
conv1d[256,
5)
conv2d(256, 512, 3)
comr2d relu, mmx.pool2d()). (N(2)
3,
relu, max.poolld(8)). GN(2)
relu, mox. GN(2)
convld[512, 1024,
conv2d(512, 1024, 3)
conv2d
1)
relu, max po)ll GN(2)
relu, max pool2d(4) ()), GN(2)
relu, max pool2d(2). GN(
FC FC(1021,
FC(1024,e)
FC(1021,
Scaling Lin FecDV
Scalin Lng FedUV
Soal ing for FedUv
11

---

Under review as a conference paper at ICLR 2021
C TRAINING WITH AND WITHOUT Lneg
Figure shows the training and test accuracy with and without Leg for MNIST-UV dataset (For the sake of simplicity, here show the accuracy rather than the TPR and FPR). As seen, using feeg results in better accuracy at early epochs but does not have significant impact on the final accuracy.
1.0
0.8
Accuracy
Train (with L neg)
0.6
Test (with L_neg)
Train (W/o L neg)
0.4
Test (w/o _eg)
0.2
0.0
5000
10000
15000
20000
Round Number
Figure 4: Training and test accuracy with and without Enog for MV dataset.
D AUC
Table 3 shows the Area Under the Curve (AUC) of the ROC curves of Figure 2 As seen, the AUC is above 0.99 most cases, indicating that all methods perform well on different datasets.
Table AUC ROC curves of Figure
Dataset
Dataset type
softmax
MedANS
reduv (127)
FedUv (255)
Feduv (511)
train
0.997
0.998
0.995
0.998
0.998
VoxCeleb
test (known)
0.997
0.998
0.995
0.998
0.998
test (unknown)
0.997
0.998
0.995
0.998
0.998
train
0.999
0.995
0.994
0.996
0.998
CelebA
test (known)
0.999
0.992
0.989
0.994
0.998
test (unknown)
0.996
0.981
0.969
0.986
0.992
train
0.997
0.998
0.993
0.995
0.996
MNIST-UV
test (known)
0.996
0.997
0.993
0.994
0.995
test (unknown)
0.996
0.996
0.992
0.993
0.995
12


Reviews:
[{"review_id": "sEHqaEqb8qc", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 2, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The paper leverages federated learning to train user verification models. The authors claim that their new federated learning addresses the security and privacy issues of previous methods. In particular, for privacy, the users do not need to send their class embedding vectors to server nor other users. For security, the paper claims that the proposed method is secure against poisoning attacks and evasion attacks. \n\nStrengths\n\nI think the major strength of the paper is to design a loss function and a way of modeling embedding vectors for users such that the embedding models can be learnt without sharing the embedded vectors to the server nor other users. \n\nWeaknesses\n\nThe paper is weak on its security and privacy claims. \n\n1. For privacy, can you quantify the privacy leakage of sharing embedded vectors with the server? Without a formal quantification, it is hard to claim your method is more private. \n\n2. Poisoning attack. I don't think the paper addresses the poisoning attacks. The paper considers that the server may poison the learnt model. However, in the proposed method, the server can still poison the model. In particular, the server can send arbitrary new model to each user. In general, it is hard to defend against malicious server who performs poison attacks. \n\nAlso, malicious users can poison the model training, which are more realistic poisoning attacks. But such poisoning attacks are not considered. I don't see how the proposed method can address these poisoning attacks.  Some references on poisoning attacks:\n\nhttps://arxiv.org/abs/1807.00459\n\nhttps://arxiv.org/abs/1911.11815\n\nhttps://openreview.net/forum?id=rkgyS0VFvr\n\n3. Evasion attack. The proposed cannot address evasion attack at all. \n\n4. Experimetal details. Can you add more details on experimental details, e.g., learning rate. How is experiment on softmax loss function implemented. \n\n5. Can you also report AUC to compare different methods, since you already show the true positive rate vs. false positive rate curves?", "extra_scores": {}, "extra_text": {}}, {"review_id": "mk2LVZOWfha", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The authors propose a method that allows training of UV methods without sharing any user (exemplar or class) embeddings with the server or other uses. Models are trained using gradient averaging on the server, so any leakage through that is not addressed in this work. The paper shows experimental results on speaker identification, face and handwriting verification tasks. The authors argue that this is the first work that considers secure training in a federated setup, with neither raw inputs nor exemplar or class embeddings being shared with the server or other users.\n\n#### Pros\n\n* The paper is clearly written and the derivations are sound (for the most part, see questions below). \n* The idea appears to be novel and a significant delta compared to the SoTa in terms of security and the novelty of a secure embedding learning protocol in the federated setup were only (one) positive classes are available for training.\n* The experimental results are promising albeit can't compete with existing less secure methods. \n\n#### Cons\n\n- Clarity of experiments\n  - Especially for the face verification task the code length seems to play a major role. Any discussion giving an understanding of this would be appreciated. Specifically, how and why does $d_{min}$ affect the accuracy. Bottom of page 5 mentions that increasing the code-words and presumably $d_{min}$ increases the performance, but no reasoning is provided.\n  - Additional insights of how the baselines (softmax, FedAws) were trained and what the emedding sizes are would be helpful. Is the embedding size ~64 in all cases?\n\n#### Questions & Comments\n\n- The assumption of $||z|| = \\sqrt{c}$ should be put into context. What are the practical applications for this assumption. Is it merely there for the math to work out?\n- The theorems show that $l_{neg}$ is redundant for when $l_{pos}=0$, however, it is not clear to me that minimizing $l_{pos}$ also corresponds to minimizing $l_{neg}$. In practice, $l_{pos}$ will likely never reach $0$ and a negative loss term could have a significant contribution to the loss surface.\n- Page 6 mentions that increasing $l_r$ reduces the minimum distance of the code for a given code length. Why is this the case? Is it because $r_u$ is sampled by the clients and no guarantees can be made? A more detailed discussion would be helpful.\n\nThis work proposes a new idea that allows training embeddings for verification with only positive classes in a federated setting, while ensuring security. Some areas could be clarified in the paper, especially why it is sufficient to proof the redundancy of the negative loss term only for the global minimum of when $l_{pos}=0$. Assuming the authors can provide a satisfying explanation, I recommend accepting this work.", "extra_scores": {}, "extra_text": {}}, {"review_id": "DwH11bJXjQv", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "**Summary**\nFederated learning takes advantage of the fact that private user data does not need to be transferred and shared across devices or servers. This makes FL particularly attractive for the user verification scenario, where privacy-sensitive biometric data are used to train verification models. One crucial hurdle in this scenario is that per device, only positive data are present, potentially turning the device-wise training objective ill-posed (all embedding are likely to collapse to a single point). As a way to introduce negative examples, FEDAWS has been developed and presented at ICML 2020. This paper recognizes a crucial security risk in the FEDAWS system, that embeddings of user data are transferred to the server, and proposes a more secure training methodology, FEDUV, that involves the error-correcting codes. FEDUV enjoys stronger security guarantees while showing comparable ROC curves as FEDAWS at nearly identical computational costs (though not entirely sure about the computational cost bit ;) ).\n\n**Pros**\nThe motivation is spot on. Having to see any form of negative samples is the itchy point of the FL-based user verification system. FEDUV magically solves this issue by pre-defining a unique prototype vector for each user, which are not shared across users and are by design far apart from each other (this is the crucial trick!) by employing a technique in error-correcting codes (ECC). As a result, each user's endeavour to get closer to the own prototype vector ensures the maximisation of distance from the others' prototype vectors. \n\nThree experiments that are quite close to real-world scenarios (speaker, face, and handwriting-based verification) show that the performance of FEDUV is comparable to FEDAWS, the state of the art framework from ICML 2020 with weaker security guarantees.\n\nWriting is nearly flawless. Highly enjoyable paper.\n\n**Cons**\nNo major cons. Perhaps explain in a bit more depth on the BCH code to illustrate (at least a high-level, hand-wavy description) how it assigns the codes in a distance-maximizing manner. Section 2.3 only explains the desiderata for BCH, rather than *how* BCH achieves it. Please also confirm that FEDUV spends nearly identical computational cost as FEDAWS. Somehow I got this from the paper, but have not found a solid reference that confirms this (if not, please explain, too).\n\nNits: Please add grid lines and row titles (training set, test set with known users, test set with unknown users) in Figure 2 plots. Baslines --> Baselines. Flatten the last part of Section 1 as paragraphs rather than itemize? Yu et al. 2020 (FEDAWS) is an ICML paper, not arXiv - please fix the reference.\n\n**Key reasons for the rating**\nI don't find any major rationale to reject this paper. However, its novelty is also eclipsed by the Yu et al. 2020 (FEDAWS) paper. Though I really like this paper, I believe the best scores should be reserved for more innovative papers.\n\n**After rebuttal & discussion**\nI still tend to think that the paper's scope can be adjusted relatively easily (it is not too difficult to insert more disclaimers and change the title), and we can force apply the adjustment by conferring a conditional acceptance.\n\nBut I'm sold on the point that there is a lack of argumentation on whether undisclosing the user-specific embedding will improve the privacy guarantee. I had taken this argument as granted, but this is indeed not so obvious, given that there exist many attacks that are applicable in this kind of scenario, as R4 has argued. It would be great if the authors could quantify the improved privacy guarantee.\n\nI'm okay with rejecting the paper then. I still like the paper quite a lot, but rejecting it will also give the authors a good chance to assimilate more points of views in the paper.", "extra_scores": {}, "extra_text": {}}, {"review_id": "3OsnLjalnpR", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 7, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "In this paper, the authors focus on designing a federated user verification solution. Specifically, the authors address two fundamental challenges associated with user verification, i.e., one-class data (positive data only), and privacy protection (i.e., the raw data and the embeddings of the users and class). Technically, the authors extend a very recent work called FedAWS by (Yu et al., 2020), and introduce a user-specific codewords, which not only protect users' privacy (i.e., not sharing the embedding with other users or the server) but also do not need the negative samples (i.e., the two loss functions in Eq.(5) reduces to one due to equivalence shown in Theorem 1). We can see that the main idea of re-writing the Eq.(2) into two loss functions in Eq.(4) and Eq.(5), and introducing codewords are novel and effective, which also address the two challenges well.\n\nEmpirical studies on three user verification cases show the effectiveness of the proposed solution FedUV.\n\nOverall, the technique is novel (and I like this idea) and the paper is well presented. I recommend acceptance.\n", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: In this paper, the authors propose to adapt the recent paper by Yu et al. (ICML 2020), namely FedAwS. In that paper, the authors solved a potential failure mode in federated learning, when all the users only have access to one class in their devices. In this paper, the authors extend FedAwS to a setting in which federated learning is used for User Verification (UV), namely FedUV. The authors argue that the previous paper could not be the solution to learning UV because FedAwS share the embedding vectors with the server.
 
The authors then show a procedure in which they can learn a classifier in which the embedding vectors are not needed to be shared with the classifier. They use error-correcting codes to make the mapping sufficiently different and that allows the training to succeed without sharing the embedding. The proposed change is only marginally worse than FedAwS and centralized learning. This is the part of the paper that has attracted positive comments and is praised by all the reviewers.
 
The authors take as given that by not sharing the embedding vectors and by using randomly generated error-correcting codes, the whole procedure is privacy-preserving and secure. The 4th reviewer indicates that these guarantees need to be proven and points out several references that hint toward flaws in the argument by the authors. Reviewer 4th does say that not sharing the embeddings might not be enough, but that self-evident arguments are not enough.
 
This paper provides a significant improvement for a federated machine learning algorithm that deserves publication, but the rationale of the paper is flawed from a privacy and security viewpoint. I think if the paper is published as is, especially with the proposed title, it will create a negative reaction by the security and privacy community for not adhering to their standards. We cannot lower those standards. 
 
I suggest to the authors that they can follow two potential paths for publishing this work:
 
1 Change the scope of their algorithm. For example, I can imagine that by not sharing the embedding the communication load with the server might be significantly reduced or that adding new users with new classes can be easier.
 
2 Follow the recommendation from Reviewer 4 and show that the proposed method is robust against the different attacks.
 
Minor comments:
 
For a paper that is trying to solve the AU problem, I would expect a discussion about why learning is better than a private algorithm. In a way, learning is sharing, and that increases the risk of mischief by malicious users.   
 
The discussion about error-correcting codes and the minimum distance is quite old fashion. In high dimensions, the minimum distance is not the whole story. LDPC codes make sense when we stop focusing on minimum distance codes and minimum distance decoding. I would recommend having a look at the Berlekamp’s Bat discussion in David MacKay’s book (Chapter 13).
Decision: Reject