WAFFLe: Weight Anonymized Factorization for Federated Learning
Authors: Weituo Hao
Nikhil Mehta
Kevin J Liang
Pengyu Cheng
Mostafa El-Khamy
Lawrence Carin
Venue:  (2021)
Keywords: Federated Learning
Fairness
Privacy

Abstract: In domains where data are sensitive or private, there is great value in methods that can learn in a distributed manner without the data ever leaving the local devices. In light of this need, federated learning has emerged as a popular training paradigm. However, many federated learning approaches trade transmitting data for communicating updated weight parameters for each local device. Therefore, a successful breach that would have otherwise directly compromised the data instead grants whitebox access to the local model, which opens the door to a number of attacks, including exposing the very data federated learning seeks to protect. Additionally, in distributed scenarios, individual client devices commonly exhibit high statistical heterogeneity. Many common federated approaches learn a single global model; while this may do well on average, performance degrades when the i.i.d. assumption is violated, underfitting individuals further from the mean and raising questions of fairness. To address these issues, we propose Weight Anonymized Factorization for Federated Learning (WAFFLe), an approach that combines the Indian Buffet Process with a shared dictionary of weight factors for neural networks. Experiments on MNIST, FashionMNIST, and CIFAR-10 demonstrate WAFFLe's significant improvement to local test performance and fairness while simultaneously providing an extra layer of security.

Under review as a conference paper at ICLR 2021
WAFFLE: WEIGHT ANONYMIZED FACTORIZATION FOR FEDERATED LEARNING
Anonymous authors Paper under double-blind review
ABSTRACT
In domains where data sensitive private, there is great value in methods that can learn in a distributed manner without the data ever leaving the local devices. In light of this need, federated learning has emerged as a popular training paradigm. However, many federated learning approaches trade transmitting data for communicating updated weight parameters for each local device. Therefore, a successful breach that would have otherwise directly compromised the data instead grants whitebox access to the local model, which opens the door to a number of attacks, including exposing the very data federated learning seeks to protect. Additionally, in distributed scenarios, individual client devices commonly exhibit high statistical heterogeneity. Many common federated approaches learn single global model; while this may do well on average, performance degrades when the i.i.d. assumption is violated, underfitting individuals further from the mean and raising questions of fairness. To address these issues, we propose Weight Anonymized Factorization for Federated Learning (WAFFLe), approach that combines the Indian Buffet Process with a shared dictionary of weight factors for neural networks. Experiments on MNIST, FashionMNiST, and CIFAR-10 demonstrate WAFFLe's significant improvement to local test performance and fairness while simultaneously providing an extra layer of security.
INTRODUCTION
With the rise of the Internet of Things (IoTT,, the proliferation of smart phones, and the digitization of records, modern systems generate increasingly large quantities of data. These data provide rich information about each individual, opening the door to highly personalized intelligent applications, but this knowledge can also be sensitive: images of faces, typing histories, medical records, and survey responses are all examples of data that should be kept private. Federated learning (McMahan et al. 2017) has been proposed as a possible solution to this problem. By keeping user data on each local client device and only sharing model updates with the global server, federated learning represents a possible strategy for training machine learning models on heterogeneous, distributed networks in privacy-preserving manner. While demonstrating promise in such paradigm, number of challenges remain for federated learning (Li et al. 2019).
As with centralized distributed learning settings (Dean al. 2012), many federated learning algo- rithms focus on learning single global model. However, due to variation in user characteristics or tendencies, personal data are highly likely to exhibit significant statistical heterogeneity. To simulate this, federated learning algorithms are commonly tested in non-i.i.d. settings (McMahan et al. 2017] Smith 2017 Li Wang 2019 Peterson et al.. 2019), but data are often equally represented across clients and ultimately single global model is typically learned. As is usually the case for one-size-fite all solutions, while the model may perform acceptably on average for many users, some clients may very poor performance. Questions of fairness (Mohri et al.) 2019 Li et al.) 2020) may arise if performance is compromised for individuals in the minority in favor of the majority.
Another challenge for federated learning is security. Data privacy is the primary motivation for keeping user data local on each device, rather than gathering it in a centralized location for training. In traditional distributed learning systems, data exposed to additional vulnerabilities while being transmitted to and while residing in the central data repository. In lieu of the data, many federated learning approaches require clients to send weight updates train the aggregated model.

---

Under review as a conference paper at ICLR 2021
Local Devioos
Global Server
Σ
Figure 1: In WAFFLe, the clients share global dictionary of rank-1 weight factors (W W Each client uses sparse diagonal matrix Af, specifying the combination of weight factors that constitute its own personalized model. Neither the client data D. nor factor selections A& leave the local device.
However, the threat membership inference attacks (Shokri al. 2017 Nasr et 2019) or model inversion (Fredrikson et al. 2015 Zhu et al., 2019) mean that private data each device can still be compromised if federated learning updates are intercepted or the central server is breached.
We propose Weight Anonymized Factorization for Federated Learning (WAFFLe), leveraging Bayesian nonparametrics and neural network weight factorization to address these issues. Rather than learning single global model, we learn dictionary of rank-1 weight factor matrices. By selecting and weighting these factors, each local device can have a model customized to its unique data distribution, while sharing the learning burden of the weight factors across devices. We employ the Indian Buffet Process (Ghahramani & Griffiths, 2006) as a prior to encourage factor sparsity and reuse of factors, performing variational inference infer the distribution of factors for each client. While updates to the dictionary of factors are transmitted to the server, the distribution capturing which factors client uses are kept local. This adds extra insulating layer of security by obfuscating which factors a client is using, hindering an adversary's ' ability to perform membership inference attacks dataset reconstruction.
We perform experiments on MNIST (LeCun et al. 1998). FMNIST (Xiao et al. 2017), and CIFAR- 10 (Krizhevsky] 2009) in settings exhibiting strong statistical heterogeneity. observe that the model customization central to WAFFLe's design leads to higher performance for each client's local distribution, while also being significantly fairer across all clients. Finally, we perform membership inference (Shokri al.) (2017) and model inversion (Fredrikson et al. 2015) attacks on WAFFLe, showing that is much harder to expose user data than with FedAvg (McMahan et al. 2017).
2
METHODOLOGY
2.1
LEARNING A SHARED DICTIONARY OF WEIGHT FACTORS
Single Global Model Consider client devices, with the 7th device having data distribution D,, which may differ as function of In many distributed learning settings, a single global model is learned and deployed to all N clients. Thus, assuming a multilayer perceptron (MIP) architecture with layers
...: L, the set of weights 0 [WEIL Ji=1 1 is shared across all clients. To satisfy the global objective, 0 is learned to minimize the loss on average across all clients. This is the approach
of many federated learning approaches. For example, FedAvg (McMahan al. 2017 minimizes the following objective:
N
min (()) -1:--Pee P.C,(0)
(1)
1=1
where (0) = EL,-D, (4(x;; 0)] the local objective function, N the number of clients, and P: is the weight of each device However, given statistical heterogeneity, such one-size-fits-l
While restrict our discussion to fully connected layers here for simplicity, this can be generalized to other types of layers as well. See Appendix A for 2D convolutional layers.
2

---

Under review as a conference paper at ICLR 2021
approach may lead to the global model underfitting certain clients; often this translates to how close a particular client's ' local distribution is to the population distribution. As a result, this model may be viewed as less fair to these clients with less common traits.
Individual Local Models On the other extreme, we may alternatively consider learning N local models 0g ( 1/ each only trained on D;. In this case, each set of weights 8; is maximally specific to the data distribution of each client i. However, each client typically has limited data, which may be insufficient for training a full model without overfitting; the total number of parameters that must be learned across all clients scales with N. Additionally, learning N separate models does not take advantage of similarities between client data distributions or the shared learning task.
Shared Weight Factors To make more efficient use of data, we instead propose compromise between a single global model and N individual local models. Specifically, we allow each client's model to be personalized to the client's s local distribution, but with all models sharing dictionary of jointly learned components. Using a layer-wise decomposition (Mehta al. 2020). we construct each weight matrix with the following factorization:
W = W
(2)
A )
(3)
where Wh E J and W E RRXM are global parameters shared across clients and X E IR is client-specific vector. This factorization can be equivalently expressed as
F. >>AA R=1
W
Ni. (w w(,k)
(4)
where wh, is the hthh column of W'E, a. w/, is the hMth row of W. and @ represents an outer product. Written in this way, the interpretation of the corresponding pairs of columns and rows w and wf, as weight factors is more apparent: W and Wa together comprise global dictionary of the weight factors, and X can be viewed as the factor scores of client Differences in X between clients allows for customization of the model to each client's 's data distribution (see Figure D. while sharing of the underlying factors W and W enables learning from the data of all clients.
We constitute each of the client's factor scores X the element-wise product:
X rf by
(5)
where r' E R indicates the strength of each factor and by E [0, 1) is a binary vector indicating the active factors. As explained below, by is typically sparse, so in general each client only uses small subset of the available weight factors. Throughout this work, we use the absence of the E superscript (e.g., X₂) to refer to the entire collection across all layers for which this factorization is done. We leam pointeestimate for W.. Wi and r.
2.2 THE INDIAN BUFFET PROCESS
Desiderata Within the context of federated learning with statistical heterogeneity, there are number of desirable properties we wish the client factor scores to have collectively. Firstly, A; should be sparse, which encourages consolidation of related knowledge while minimizing interference: client A should be able to update the global factors during training without destroying client B's ability to perform its own task. This encourages fairness, as in settings with multiple subpopulations, this interference is most likely to be at the smaller groups' expense. On the other hand, we would also like factors to be reused among clients. While data may be non-i.i.d. across clients, there are often some similarities or overlap; thus, shared factors distribute learning across all clients' data, avoiding the N independent model's s scenario. Finally, in the distributed settings considered in federated learning, the total number of nodes is rarely pre-defined. Therefore, there needs to be way gracefully expand to accommodate new clients to the system without re-initializing the whole model. This includes both increasing server-side capacity if necessary and initializing new clients.
Prior Given these desiderata, the Indian Buffet Process (IBP) GGhhhammaii & Griffiths 2006 is natural choice. As prior, the IBP regularizes client factors to be sparse, and new factors introduced but at a harmonic rate, preferring reusing factors as much as possible over initializing new ones. This Bayesian nonparametric approach allows the data to dictate client factor assignment,
3

---

Under review as a conference paper at ICLR 2021
Algorithm Weight Anonymized Factorization for Federated Learning (WAFFLe).
1: Input: Communication rounds T, local training epochs E, learning rate
2: Server initializes global weight factor dictionaries Wa and W,, factor strengths r
3: Clients each initialize variational parameters T C, dg
4: for = 1...... ,T do
5: Server randomly selects subset S of clients and sends { r, Wo}
6: for client E St in parallel do
7: Wa: r. W6, ni. Ct, d, <- CLENTUPDNTE(WW, r, Wo, n. Ct2 d.)
8: Send { W to the server.
9: end for
10: Server aggregates and averages updates (War r, W,}
end for
12:
function CLIENTUPDATERWW..> Wa, T., T,, c;
for e E do
14:
for minibatch b E D, do
Update {Wa r, Wi, T. Ct di3 by minimizing 12 end for end for
16:
18: Return (Wa, v, Wo, Tı, Ci, d
19:
end function
factor reuse, and server-side model expansion. We use the stick-breaking construction of the IBP prior for factor selection:
v Beta(a, 1)
(6)
2 ii
bi Bernoulli(m
with a a hyperparameter controlling the expected number of active factors and the rate of new factors being incorporated, and indexes the factor.
Inference We learn the posterior distribution for the random variables Φ, = {b,, v. Exact inference employ variational inference with mean-field approximation to
of the posterior is intractable, determine the active factors for each client device, using the following variational distributions:
q(b vt) q(b:) ((x))
b ~ Bernoulli(TT))
(10)
2 Kumaraswamy(ce. d;)
(11)
learning the variational parameters { Ci d.} for each queried client using Bayes by Back- prop (Blundell et al. (2015). Needing differentiable parameterization, we use the Kumaraswamy distribution (Kumaraswamy, 1980) replacement for the Beta distribution of e, and utilize a soft relaxation of the Bernouilli distribution (Maddison et al. 2017). The objective for each client is to maximize the variational lower bound:
P. E. log p (1 (1"") (n) W., Wo.r) KL (g (ob:) Ip (+:))
(,)
(12)
KL (((b))ll((((oo)) + KI. (((o))l)(1))
(13)
where 0 ( WA, b.) and [D, is the number of training examples client Note that in the first term provides label supervision and the second term (3 regularizes the posterior not to stray far from the IBP prior.
12
4

---

Under review as a conference paper at ICLR 2021
2.3 CLIENT- COMMUNICATION
Training Before the training begins, the global weight factors {W., Wo} and the factor strengths are initialized by the server. Once initialized, each training round begins with (Wa; Wo. r being sent to the selected subset of clients. Each sampled client then trains the model on their own private dataset D, for E epochs, updating not only the weight factor dictionary {Wa, W and the factor strengths r, but also its also own variational parameters { C2, d.), which controls which factors it uses. Once local training is finished, each client sends (Wa. a. W6. r back to the server, but not {I,, Ct, d,), which remain with the client with data D,. After the server has received back updates from all clients, the various new values for (Wa, W6. r are aggregated with a simple averaging step. The process then repeats, with the server selecting new subset of clients to query, sending the new updated set of global parameters, until the desired number of communication rounds have passed. This process is summarized in Algorithm I
Evaluation When a client enters the evaluation mode, it requests the current version of global parameters (Wa. Wa, r} from the server. If the client has been previously queried for federated training, the local model consists of the aggregated global parameters and the factor score vector generated by its own local variational parameters {T. Otherwise, the client uses only the aggregated {Wa. Wo, r). Note that if a client has been previously queried, the most recently cached copy of the global parameters is an option if a network connection is unavailable or too expensive; in our experiments, assume clients are able to request the most up-to-date parameters.
Security Data security is one of the central tenets of federated learning. Simpler, more standard methods of training model could be utilized if all data were first aggregated at central server. However, sensitive client data being intercepted during transmission or the server's 's data repository being breached by an attacker are major concerns, motivating federated learning's approach of keeping the data on the local device. On the other hand, keeping the data client-side may not be sufficient. Just as data can be compromised in transit or at the central database in non-federated settings, federated training updates are similarly vulnerable. In methods like FedAvg, this update is the entirety of the model's parameters. Effectively, this means that FedAvg trades yielding the data immediately for surrendering whitebox access to the model, which opens the model to wide range of malicious activities (Szegedy et al. 2014, Fredrikson et al. 2015 Shokri et al. 2017 Wang et al.) 2019| Zhu et al., 2019). including, critically, exposing the very data that federated learning aims to protect. With WAFFLe, clients transmit back the entire dictionary of weight factors (Wa, W&} and r. but not {,; C., ). As such, the knowledge of which specific factors that particular client uses is kept local. Therefore, even if messages are intercepted, an adversary cannot completely reconstruct the model, hampering their ability to perform attacks to recover the data.
3 RELATED WORK
3.1 STATISTICAL HETEROGENEITY
Statistical heterogeneity of the data distributions of client devices has long been recognized as challenge for federated learning. Despite acknowledging statistical heterogeneity, many federated learning algorithms focus on learning single global model (McMahan et al.) (0117); such approach often suffers from model divergence, as local models may vary significantly from each other. To address this, number of works break away from the linglegglball-mod
formulation. Several (Smith et al. 2017; Corinzia & Buhmann] 2019) have cast federated learning as a multi-task learning problem, with each client treated as separate task. FedProx (Li et al. 2018) adds a proximal term to account for statistical heterogeneity by limiting the impact of local updates. Others study federated learning within model-agnostic meta-learning framework (Jiang al., 2019 Khodak et al. 2019). Zhao et al. (2018) recognize performance degradation from non-1.i.d data and propose global sharing of a small subset of data, which while effective, may compromise privacy. settings of high statistical heterogeneity, fairness is also natural question. AFL (Mohri et al.) (2099) and q F-FFL (Li et al., (220) propose methods of focusing the optimization objective on the clients with the worst performance, though they do not change the network itself to model different data distributions.
3.2 PRESERVING PRIVACY
While much progress has been made in machine learning with public datasets (LeCun et al. 1998. Krizhevsky 2009: Deng et al. 2009), in real-world settings, data often sensitive, potentially for propriety (Sun et al. 2017). security (Liang et al., 2018), or privacy (Ribli et al., (018)) reasons. Protecting user data is one of the primary motivations for federated learning in the first place.
5

---

Under review as a conference paper at ICLR 2021
Approaches include releasing artificial data Triasteyn & Faltings 2020 Goetz & Tewari 2020
homomorphic encryption (Hardy et al.] 2017), or differential privacy (Dwork et al., 2006 Abadi et al. 2016 Melis et al., 2013). However, artificial data can still strongly resemble the original data, and sharing the model architecture and its parameters presents risks associated with whitebox access, leaving the data vulnerable attacks such membership inference (Shokri al. (017) or model
inversion (Fredrikson et al., 2015 Wang et al. 2019 Zhu et al. 2019)
3.3 BAYESTAN NONPARAMETRIA FEDERATED LEARNING
Several previous works have applied Bayesian nonparameterics to federated learning, primarily as means for parameter matching during aggregation. Instead of averaging the parameters weight-wise without considering the meaning of each parameter, past works have proposed using the Beta- Bernouilli Process (Thibaux & Jordan 2007) for matching parameters, first with fully connected layers (Yurochkin et 2l.12019)) but later also extended by [Wang et al. (2020) to convolutions and LSTMs (Hochreiter Schmidhuber 1997). In contrast, our method utilizes Bayesian nonparametrics for modeling rank-1 factors for multitask learning, instead of the aggregation stage.
EXPERIMENTS
4.1 EXPERIMENTAL. SET-UP
Settings with higher statistical heterogeneity data are i.i.d. across clients, as well as more representative of the real-world, so we focus our experiments on the former. We consider two forms of statistical heterogeneity. The first is the simple non-i..d. construction introduced by McMaahn et al. (017)) in which the data are sorted by class, sharded, and then randomly distributed the N clients such that each client only has data from Z classes; many federated learning works consider the highly non-i.i.d. setting of Z = 2, which we also default to. While this setting can be challenging, has the property that the classes present in every client's s data is equally represented in the global data distribution. As result, single global model may perform reasonably uniformly across all clients. We thus refer to this as unimodal non-i.i.d.
challenging for federated learning than when
However, this assumption of equal representation is generally not true in practice, some character- istics or modes of the global distribution are inevitably less prevalent the overall population than others. In the real world, this can correspond to age, gender, ethnicity, wealth, demographic factors. To emulate this, we modify the above non-i.i.d. setting by first splitting the data and clients into two groups, with more clients in one group than the other. For MNIST (LeCun et al.) 1998) for example, we partition the odd digits to 100 clients and the even digits to 20 clients. As before, each client still receives data from Z 2 classes, with an equal number of data samples per client (the unallocated even digit samples are left unused); the difference is that there is now a 5 ratio of odd even digits the total population, resulting the clients with only even digits being in the minority of the global population. We call this setting multimodal non-i.i.d. Further details on the data allocation process and splits for FMNIST (Xiao et al., 2017) and CIFAR-10 (Krizhevsky) 2009) can be found in Appendix
number of other
In our experiments, the server selects fraction C 0.1 of clients during each communication round, with T = 100 total rounds for all methods. Each selected client trains their own model for E 5
Table 1: Local Test Performance for Z
Dataset
Method
# of parameters 1
Unimodal f
Multimodal
FedAvg
155,800
94.46-0.88
91.57=+1.42
FedProx
155,800
9..44=1.15
91.53
MNIST
q-FFL
155.800
91.46=1.07
18.42-
WAFFLe
120.200
96.23=0.31
95.41=0.36
FedAvg
28,880
83.96-0.91
83.43+2.27
FedProx
28,800
84.19=0.99
83.59+2.30
FMNIST
q-FFL
28,800
83.10=0.36
85.7310.21
WAFFLe
18,155
87.12-0.899
86.09
FedAvg
61,770
52.54
45.46.11.69
FedProx
61,770
52.36_10.11
44.95.11.17
CIFAR-10
q-FFL
61,770
43.82-10.52
38.25
WAFFLe
42,780
71.30=0.92
66.35=0.72

---

Under review as a conference paper at ICLR 2021
Table 2: Sub-population Local Test Performance Analysis
Dataset
Method
Majority
Minority
Gap +
Variance 4
FedAvg
96.6310.70
67.40:111.26
29.23111.779
1991:106
FedProx
96.43-+0667
68.60:19:44
10.03++00.0
186+192
MNIST
q-FFL
94.93 +0.31
54.20+7..37
40.73+77.55
355+1117
WAFFLe
95.93=0.116
93.87=00.66
2.07=00.77
26+66
FodAvg
19.75=1.776
68. 05.0554443
21.70++4.21
231
FedProx
89.95=1.73
67.50+4.50
22.45=
233+422
FMNIST
q-FFL
88.73:10.17
69.40.11.48
19.33
212:119
WAFFLe
88.91:12.07
1..67::1.52
9.25110.61
145::27
FedAvg
11.98=1.66
16.83:1.422
35.15::..12
3384:59
FedProx
11.26:t1.44
16.56:13.32
32.70-16.99
3184:36
CIFAR-10
q-FFL
42.00++0.29
18. 3..00
23.87++3.00
220-117
WAFFLe
68.37++1011
55.00-+6.00
13.37+22.11
182+227
Fadhwgg 245
Feclng, Olth
Tadkng Jeinal
Fedkeg
Secleg_Shes
Mummee oficceett
WMPFLE NMack
Accuracy
Accuracy
(a)
(b)
(c)
Figure 2: FedAvg and WAFFLe performance distribution across clients in the multimodal non- i..d. setting for (a) MNIST, (b) FMNIST and (c) CIFAR-10.
local epochs with mini-batch size B 10, and the FedProx (Li et al 2018) proximal parameter μ is set to 1.0. For q-FFL (Li et al. 2020),, we searched (0.001, 0.005, 0.01, 0.1, 1, 5) and found q = 0.001 as the best setting, matching the settings oi et al. (2020) on more complex data. Model architectures, settings of F' and a, and training schedules for each of the datasets described in Appendix C Ablation studies over the number of local epochs E, number of classes per client Z, and IBP parameters a and F are provided in Appendix demonstrating robustness.
4.2 LOCAL TEST PERFORMANCE
We compare WAFFLe with FedAvg (McMahan et al. 2017). the fairness-orientee q-FFL (Li et al. 2020 and FedProx (Li et al., 2018), which augments FedAvg with proximal term designed high statistical heterogeneity. We record local test performance averaged across all clients for both types of non-i.i.d. data allocation in Table [ along with the total number of learnable parameters; plots of the training curves can be found in Appendix D WAFFLe performs well despite strong statistical heterogeneity, as each client can learn personalized model by selecting different factors from (Wa: Wo); having model specific to each data distribution results in higher local test performance than the baselines. This advantage is especially apparent when the data are distributed multimodal non-i.i.d., mainly because WAFFLe more effectively models underrepresented clients.
Interestingly, we find that WAFFLe outperforms the haselines particularly significantly for CIFAR-10, the most challenging of the tested datasets. with WAFFLe's 's local test performance outstripping the other methods by 18.8% and 20.9% for unimodal and multimodal settings, respectively. This demonstrates WAFFLe's ability to scale complex tasks beyond MNIST, common federated learning test bed. Notably, even though WAFFLe effectively learns different model for each client, this does lead the computation memory costs typically associated with independent models. WAFFLe's number of communication rounds is largely the same (Appendix DD.. and by sharing rank-1 1 factors, each weight factor can represented compactly, resulting in a total number of parameters that is fewer than the single model used by the basclines, despite using the same architecture.
4.3 FAIRNESS
Average performance over all clients as in Table does reveal the full story. We report subpopulation mean performance and overall population variance
A is a commonly reported metric, but we argue that
7

---

Under review as a conference paper at ICLR 2021
in Table 2 We observe that FedAvg, which learns single global model, focuses on minimizing mean error across the population, resulting in stronger performance for the clients in the majority. However, as result, clients in the minority are severely compromised, ("Gap") between majority and minority values in Table 2 for example, FedAvg's 's performance for the "evens" group of clients is almost 30% lower than that of the "odds" group. This is gap is especially clear when visualizing the distributions of final local test performance for each client in the majority and minority groups (Figure 2) This underfitting can also be seen to exist throughout training from the "Fed/vg_Miiorrty" curve in Figure of Appendix [ which lags far below the "FedAvg "ajoorty""" in all three datasets. On the other hand, because of WAFFLe's shared weight factor dictionary design, different knowledge can be encoded in separate weight factors, which can be used by different parts of the population. As a result, despite certain classes being underrepresented (both in terms of clients, and total samples) in the training set, WAFFLe is able to successfully model them, with performances on par with the overall population. Notably, we achieve this without explicitly enforcing fairness through client sampling during training (Mohri et al. 2019 Li et al. 2020), which can be incorporated to further encourage uniform performance across clients.
evidenced by the large difference
4.4 PRIVACY ATTACKS
A primary objective of federated learning is to keep data safe. However, as mentioned in Section 2.3 the predominant federated learning strategy of each client sending their entire updated model's weights still leaves the client's 's data vulnerable. We demonstrate this with both membership inference and model inversion attacks.
Table 3: Membership Inference Attacks
Membership inference attacks (MIAs) (Shokri al. 2017: Nasr et al.] 2019) can be used to infer whether a given data query was used for model training, leveraging the tendency of machine learning to overfit or memorize training data. As such, a successful MIA can be used by an attacker to surmise the content of a client's private data from the model. We compare a LeNet (LeCun et al. 1998) FedAvg (MMMahan et al.) (017) model with an analogous WAFFLe model, training both on 1000 CIFAR- samples per client. We attack both with a MIA inspired by Shokri et al. (2017). using a small ensemble of "shadow" models. As shown in Table 3 this simple attack achieves a high success rate at identifying a FedAvg client's 's training data, as intercepting the training update gives the full model. On the other hand, WAFFLe's training update only send partial model information, as the identity of the active factors is kept private. As result, MIA success rate on WAFFLe is only moderately higher than random chance (50%). This means it is significantly harder to identify the private training data for WAFFLe, relative to FedAvg.
Methods
Accuracy
F1-score
FedAvg WAFFLe
83.85 1.62
83.72 + 2.19
56.20 + 1.40
54.39 + 1.85
We also perform a model inversion attack (Fredrikson et al. 2015 Wang et al. 2019) on both FedAvg and WAFFLe. Unlike MIAs, which must start from query data input, model inversion attacks seek to reconstruct the inputs used to train model from the trained model itself; successful inversion attacks pose a significant risk from a data security perspective. We perform model inversion attack on FedAvg and WAFFLe models trained on FMNIST, showing randomly selected results in Figure 3 recov- ered from an individual user. Importantly, reconstructions on FedAvg are significantly sharper, with the class identity far clearer than for WAFFLe, meaning FedAvg is more vulnerable to model inversion attacks.
T-shirt
Pants
WAFFLe FeetAvg
Figure 3: FMNIST model inversion attacks.
5 CONCLUSION
We have introduced WAFFLe, Bayesian nonparametric framework for federated learning, employing shared rank-1 weight factors. This approach allows for learning individual models for each client's s specific data distributions while still sharing the underlying learning problem in a parameter-efficien manner. Our experiments demonstrate that this model customizability makes WAFFLe successful at improving local test performance and, more importantly, significantly improves fairness in model performance when the data distribution among clients is multimodal. Furthermore, we are able to scale our results to CIFAR- 10 and convolutional networks, where we observe the biggest improvements. We also show that by keeping the active factors selected by each model private on each device along with the data, WAFFLe's 's communication rounds only send partial model information, making it significantly harder perform attacks on the private data.
8

---

Under review as a conference paper at ICLR 2021
REFERENCES
Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep Learning with Differential Privacy. ACM SIGSAC Conference on Computer and Communications Security, 2016.
Charles Blundell, Julien Cornebise, Koray Kavukcuoglu, and Daan Wierstra. Weight Uncertainty in Neural Networks. International Conference Machine Learning, 2015.
Luca Corinzia and Joachim M Buhmann. Variational Federated Multi-Task Learning. arXiv preprint
netp:/90660000 2019.
Jeffrey Dean, Greg Corrado, Rajat Monga, Kai Chen, Matthieu Devin, Mark Mao, Mare' aurelio Ranzato, Andrew Senior, Paul Tucker, Ke Yang, et al. Large Scale Distributed Deep Networks.
Neural Information Processing Systems, 2012.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Fei-Fei Li. ImageNet: A Large-scale scale Hierarchical Image Database. Computer Vision and Pattern Recognition, 2009.
Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating Noise to Sensitivity in Private Data Analysis. Theory of Cryptography Conference, pp. 265-284, 2006.
Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model Inversion Attacks that Exploit Con- fidence Information and Basic Countermcasures. ACM SIGSAC Conference on Computer and Commusiccations Security, 2015.
Zoubin Ghahramani and Thomas L. Griffiths. Infinite Latent Feature Models and the Indian Buffet Process. Neural Information Processing Systems, 2006.
Jack Goetz and Ambuj Tewari. Federated Learning via Synthetic Data. arXiv preprint
arXiv:2008.04480 2020.
Stephen Hardy, Wilko Henecka, Hamish Ivey-Law, Richard Nock, Giorgio Patrini, Guillaume Smith, and Brian Thome. Private Federated Learning on Vertically Partitioned Data via Entity Resolution and Additively Homomorphic Encryption. arXiv preprint arXiv: 1rXXvv1711.10677 2017. Sepp Hochreiter and Jürgen Schmidhuber. Long Short-Term Memory. Neural Computation, 1997. Yihan Jiang. Jakub Konečný, Keith Rush, and Sreeram Kannan. Improving Federated Learning Personalization via Model Agnostic Meta Learning, arXiv preprint arXiv: 1909.
(209./248 /2488, 2019, Mikhail Khodak, Maria-Florina Balcan, and Ameet Talwalkar. Adaptive Gradient-based Meta- learning Methods. Neural Information Processing Systems, 2019.
Alex Krizhevsky. Learning Multiple Layers of Features from Tiny Images. 2009.
Ponnambalam Kumaraswamy. A Generalized Probability Density Function for Random Processes. Journal of Hydrology, 1980.
Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based Learning Applied to Document Recognition. Proceedings of the IEEE, 86(1 11:22)8:2--224 1998.
Daliang Li and Junpu Wang. FedMD: Heterogenous Federated Learning via Model Distillation.
arXiv preprint arXiv:1910.0358/ 2019.
Tian Li, Anit Kumar Sahu, Manzil Zaheer, Maziar Sanjabi, Ameet Talwalkar, and Virginia Smith. Federated Optimization in Heterogeneous Networks. arXiv preprint urXiv:/812.066 2018 Tian Li, Anit Kumar Sahu, Ameet Talwalkar, and Virginia Smith. Federated Learning: Challenges, Methods, and Future Directions. arXiv preprint arXiv: 1908. 07873, 2019.
Tian Li. Maziar Sanjabi, and Virginia Smith. Fair Resource Allocation in Federated Learning. International Conference
Learning Representations, 2020.
Kevin J Liang, Geert Heilmann, Christopher Gregory, Souleymane O. Diallo, David Carlson, Gre- gory P. Spell, John B. Sigman, Kris Roe, and Lawrence Carin. Automatic Threat Recognition of Prohibited Items at Aviation Checkpoints with X-ray Imaging: A Deep Learning Approach. SPIE Anomaly Detection and Imaging with X-Rays (ADIX) III, 2018.
Chris J Maddison, Andriy Mnih, and Yee Whye Teh. The Concrete Distribution: A Continuous Relaxation of Discrete Random Variables. International Conference on Learning Representations, 2017.
H Brendan McMahan, Fider Moore, Daniel Ramage, Seth Hampson, et al. Communication-efficiennt Learning of Deep Networks from Decentralized Data. Artificial Intelligence and Statistics, 2017. Nikhil Mehta, Kevin Liang, and Lawrence Carin. Bayesian Nonparametric Weight Factorization for Continual Learning, arXiv preprint arXiv:2004.1000 2020.
Luca Melis, George Danezis, and Emiliano De Cristofaro. Efficient Private Statistics with Succinet
Sketches. arXiv preprint 1rXiv:1508.061
2015.
Mehryar Mohri, Gary Sivek, and Ananda Theertha Suresh. Agnostic Federated Learning. Interna-
fional Conference on Machine Learning, 2019.
9

---

Under review as a conference paper at ICLR 2021
Vinod Nair and Geoffrey E Hinton. Rectified Linear Units Improve Restricted Boltzmann Machines.
International Conference on Machine Learning. 2010.
Milad Nasr, Reza Shokri, and Amir Houmansadr. Comprehensive Privacy Analysis of Deep Learning:
Passive and Active White-box Inference Attacks Against Centralized and Federated Learning.
IEEE Symposium Security and Privacy, 2019.
Daniel Peterson, Pallika Kanani, and Virendra Marathe, Private Federated Learning with Domain
Adaptation. arXiv preprint 19I.vv:922.066
2019.
Dezsö Ribli, Anna Horváth, Zsuzsa Unger, Péter Pollner, and István Csabai. Detecting and Classifying
Lesions in Mammograms with Deep Learning. Nature Scientific Reports, 8, 2018.
Neta Shoham, Tomer Avidor, Aviv Keren, Nadav Israel, Daniel Benditkis, Liron Mor-Yosef, and
Itai Zeitak. Overcoming Forgetting in Federated Learning on Non-IID Data. arXiv preprint
arXiv: 191000790, 2019.
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership Inference Attacks
Against Machine Learning Models. IEEE Symposium Security and Privacy (SP), 2017. Virginia Smith, Chao-Kai Chiang, Maziar Sanjabi, and Ameet $ Talwalkar. Federated Multi-task
Learning. Neural Information Processing Systems, 2017.
Chen Sun, Abhinav Shrivastava, Saurabh Singh, and Abhinav Gupta. Revisiting Unreasonable Effectiveness of Data in Deep Learning Era. International Conference on Computer Vision, 2017.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing Properties of Neural Networks. International Conference on Learning Representations, 2014.
Romain Thibaux and Michael Jordan, Hierarchical Beta Processes and the Indian Buffet Process. Artificial Intelligence and Statistics, 2007.
Aleksei Triastcyn and Boi Faltings. Federated Generative Privacy. IEEE Intelligent Systems, 2020. Hongyi Wang, Mikhail Yurochkin, Yuekai Sun, Dimitris Papailiopoulos, and Yasaman Khazaeni. Federated Learning with Matched Averaging. arXiv preprint arXiv:2002.06444 2020.
Zhibo Wang, Mengkai Song. Zhifei Zhang, Yang Song. Qian Wang, and Hairong Qi. Beyond Inferring
Class Representatives: User-level Privacy Leakage from Federated Learning. International
Conference on Computer Communications, 2019.
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-MNIST: A Novel Image Dataset for Bench- marking Machine Learning Algorithms. arXiv preprint arXiv: 07744, 2017.
Mikhail Yurochkin, Mayank Agarwal, Soumya Ghosh, Kristjan Greenewald, Trong Nghia Hoang, and Yasaman Khazaeni. Bayesian Nonparametric Federated Learning of Neural Networks. arXiv preprint /905. Yue Zhao, Meng Li, Liangzhen Lai, Naveen Suda, Damon Civin, and Vikas Chandra. Federated Learning with Non-IID Data. arXiv preprint arXiv: / 1806.00000088 2018 Ligeng Zhu, Zhijian Liu, and Song Han. Deep Leakage from Gradients. Neural Information Processing Systems, 2019.
2019.
10

---

Under review as a conference paper at ICLR 2021
A GENERALIZING WEIGHT FACTORIZATION TO CONVOLUTIONAL KERNELS
While introducing WAFFLe's formulation in Section 2.1 we assumed a multilayer perceptron (MLP) model, illustrating our proposed shared dictionary with the 2D weight matrices composing fully connected layers is made especially clearer. While MLPs are sufficient for simple datasets such MNIST, more challenging datasets require more complex architectures achieve the most competitive results. For computer vision, for example, this often means convolutional layers, whose kernels are 4D. While 4D tensors can be similarly decomposed into rank-1 factors with tensor rank decomposition, such an approach would result in large increase in the number of parameters in the weight factor dictionary due to the low spatial dimensions of the convolutional kernels (e.g.. 3 x 3) in most commonly used architectures. Instead, reshape the 4D convolutional kernels into 2D matrices by combining the three input dimensions (number of input channels, kernel width, and kernel height) into single input dimension. We then proceed with the formulation in (2). Similar approaches can be taken to generalize our formulation to other types of layers.
B DATA PARTITIONING
by
Softiito
Sutpopulation
Minority
Majority
Split 900 shards
3
Singla Population
Sharcs
Multiimoda non-i.i.
Unimodal non-i.idd
H
locane
Figure 4: Example data allocation process N clients for MNIST and 2 in the unimodal i.i.d. (left) and multimodal i.i.d. (right) settings. Notice that the primary difference is the grouping of the data into two subpopulations (here referred to as "Majority" and "Minority") before sharding and allocating Z shards to each client.
Because statistical heterogeneity is an inherent property of federated learning paradigms, we focus evaluation in this setting, testing WAFFLe in two different types of non-i..d. partitions of the data. diagram showing the differences of the data allocation process for the two considered settings shown for MNIST (LeCCun al. 1998) in Figure

---

Under review as a conference paper at ICLR 2021
B.1 UNIMODAL NON-LLD.
We first consider the non-i.i.d. setting introduced by McMahan et al. (017)) This is a widely used evaluation setting, commonly referred to as "non-ii.d." or "heterogeneous" works, to distinguish it from completely i.i.d. data splits. We refer to this as unimodal non-i.i.d. to distinguish it from our second setting, which also non-i.i.d. The primary purpose of such partition is to investigate the behavior of federated average algorithms when each client has data from only subset (Z) of classes.
other federated learning
This type of partition begins by sorting all data by class. Given N client devices, the samples from each class are evenly divided into shards of data, each consisting of single class, resulting in NZ shards across all classes. These shards are then randomly distributed to the N clients such that each receives Z shards. The data in the Z shards for each client is then shuffled together and split into a local training and test set. This ensures that the local test set for each client is representative of its own private data distribution.
B.2 MULTIMODAL NON-L.LD.
While the above partition does explore the non-i.i.d. nature of class distribution among clients, it does adequately characterize the tendency for subpopulations exist, with some being more prevalent than others. We propose a new non-i.i.d. setting to capture this, which we call multimodal non-i.id. as each subpopulation group can be thought of mode of the overall distribution.
This partition begins similarly to unimodal non-i.i.d., with the data being sorted by class. Before sharding. however, classes are assigned to modes. The number of modes arbitrary, but we choose two for simplicity, creating "majority" and "minority" subpopulations. In our experiments. the two modes are odd digits (N1 100) versus even digits (N₂ = 20) for MNIST (LeCun et al., 1998), footwear and shirts (N₂2 = 20) versus everything else (N1 = 90) for FMNIST (Xiao et al., 2017). and animals (N, = 90) versus vehicles (N₂2 = 20) for CIFAR-IO (Krizhevsky) 2009), where N1 and N2 are the number of clients in the majority and minority subpopulations, respectively. Once the classes have been separated by group, the process proceeds similarly to the unimodal i.idd. partition process, with the data being divided into shards and then randomly allocated to clients within each subpopulation. We make the shards equal in size both within and across modes, so in instances where there more data shards available than there are clients, we discard the unallocated data. Just for unimodal non-i.i.d., local training and test sets are created for each client from its allocated data.
C ADDITIONAL EXPERIMENTAL SET-UP DETAILS
MNIST For MNIST (LeCun et al. 1998) digit recognition, we multilayer perceptron with 1 -hidden layer with 200 units using ReLU activations (Nair Hinton 2010). Based on this model, constructed WAFFLe with F 120 factors. The traditional 60K training examples are partitioned into local training and test sets as described in Section 4.1 Stochastic gradient descent (SGD) with learning rate 17 0.04 is employed for all methods.
FMNIST For FMNIST (Xiao et al. 2017) fashion recognition, we use a convolutional network consisting of two 5 5 convolution layers with 16 and 32 output channels respectively. Each convolution layer is followed by 2 x 2 maxpooling operation with ReLU activations. A fully connected layer with softmax is added for the output. Based on this model, we construct WAFFLe by only factorizing the convolution layers, with F = 25 factors. As with MNIST, the traditional 60K training examples are used to form the two local sets. SGD with learning rate 17 = 0.02 used as the optimizer for all methods.
CIFAR-10 For CIFAR-10 (Krizhevsky 2009), we use we use a convolutional network consisting of two 3 x 3 convolution layers with 16 and 16 output channels respectively. Each convolution layer followed by a x 2 maxpooling operation with ReLU activations. These two convolutions are followed by two fully-connected layers with hidden size 80 and 60, with softmax applied for the final output probabilities. To construct WAFFLe, we set the number of factors = 10 for the two convolution layers, F 80 for the first fully connected layer, and F 40 for the second fully connected layer. The 50K training examples are used for constructing the local train and test sets. SGD with learning rate y 0.02 is utilized for all methods.
12

---

Under review as a conference paper at ICLR 2021
Accurscy tho
Epoch
Figure 5: Local test performance for unimodal non-i.id degree Z (a) MNIST; (b) FMNIST: (c) CIFAR-10.
3 5 5
Epoch
Global Epoch
Global Epech
(a)
(b)
(C)
Figure 6: Local test performance for majority and minority subpopulations for multimodal non- i..d degree = 2. (a) MNIST; (b) FMNIST; (c) CIFAR-10.
D TRAINING CURVES
We plot local test accuracy against the global epoch for FedAvg, FedProx and WAFFLe on MNIST, FMNIST, and CIFAR-10 averaged over all clients for unimodal non-i.i.d data in Figure 5 similar comparison is made between FedAvg and WAFFLe for multimodal non-i,id data in Figure O with majority and minority learning curves separately shown. For both cases, the clear gap between curves shows that WAFFLe achieves better performance throughout training. Notably, WAFFLe converges a similar rate as FedAvg with respect to the global epoch number; this important as the number of communication rounds is often considered one of the primary bottlenecks in federated learning.
In the multimodal non-i.i.d. case, the difference is especially stark for the minority subpopulation, which lags significantly behind the majority when modeled with FedAvg's one-size mne-size-fits- fits-all all approach. Interesting, in addition having lower value, the FedAvg minority's 's training curve is not smooth, with large dips and spikes, especially when compared with the majority subpopulation's curve. We hypothesize that this may be due the smaller subpopulation being more vulnerable to being unrepresented during client sampling, which may lead to catastrophic forgetting (Shoham et al. 2019). We find this to be an interesting future direction of research. In comparison, the WAFFLe minority, with its separate set of customized weight factors, has a much smoother training trajectory.
E ABLATION STUDIES
Statistical Heterogeneity (Z) WAFFLe specifically designed for statistical heterogeneity, as each client can select different weight factors, effectively learning personalized models. WAFFLe was shown to excel when samples from two classes. In Figure 7 show how WAFFLe performs in unimodal settings with less statistical heterogeneity, for % {3, 4). Although it takes longer to converge in these cases, WAFFLe still outperforms FedAvg by 7. 7.20% and 2. 2.74%, respectively.
2, as this is a strongly non-i.i.d. setting: as each client only has
Local epochs (E) Training client devices for more local epochs allows each server to collect a bigger update from each device, increasing local computation in exchange for fewer total communication rounds. This often a desirable trade-off, as communication costs are commonly viewed as the primary bottleneck for federated learning. However, many local epochs lead to divergence
13

---

Under review as a conference paper at ICLR 2021
60
Accurary (%)
Accurary (%s
Glcball Epoch
Global Epoch
(b)
Figure 7: CIFAR-10 local test performance for statistical heterogeneity: (a) - 3; (b) 2 =
Table 4: Unimodal Local Test Accuracy
Table 5: Multimodal Local Test Accuracy vs
Local Epochs
Local Epochs
Dataset
Method
F=10
E=20
R=30
Dataset
Method
E=10
F=20
F=30
FedAvg
92.95
93.36
93.55
FedAvg
88.70
89.27
89.03
MNIST
MNIST
WAFFLe
95.10
96.32
96.43
WAFFLe
95.37
94.87
95.07
FedAvg
85.32
85.13
85.14
FedAve WAFFLe
86,21
86.58
86,47
FMNIST
FMNIST
WAFFLe
87.52
87.07
89.25
87.03
89.15
91.33
FedAvg
47.40
47.60
55.39
FedAvg WAFFLe
42.09
42.00
CIFAR-10
CIFAR-10
WAFFLe
64.18
71.92
74.50
58.79
$7.00
62.61
Table 6: Unimodal Local Test Accuracy vs a
Table 7: Multimodal Local Test Accuracy vs
and F
and F
F=80
F=100
F=150
F=80
F=100
F=150
a/F= 0.4
93.20
94.07
94.42
a/ F 0.4
91.83
92.70
93.23
a/F 0.6
95.08
94.48
95.56
a/ F 0.6
94.23
94.48
95.26
a/ a/F= 0.8
95.56
95.15
96.08
0/ F 0.8 0: F = 1.0
94.76
95.15
95.70
a F/F=1 96.33
95.63
96.45
94.70
94.93
95.93
during the aggregation step. We study the influence of local epochs E for unimodal non-i.i.d. in Table 4 and for multimodal non-i.i.d in Table using the same settings as in Section 4.1 except for reducing the global training epochs T 50 and the learning rate 77 to 0.02 for all methods in multimodal non-i.i.d scenario. We observe that WAFFLe can handle increased number of local epochs, improving performance for three datasets.
Indian Buffet Process Sparsity (o) and Number of Factors (F) At the cost of more parameters, an increasing number factors F' and higher IBP parameter a gives client more expressivity for modeling its local distribution. We study the influence of and F for an MLP architecture MNIST partitioned in both non-i.idd settings in lables/aand As expected, the higher a and are, the better performance observe, though in practice we prefer lower and F for efficiency. On the other hand, the overall difference in local test accuracy does not vary drastically, meaning that WAFFLe is fairly robust to both hyperparameters.
14


Reviews:
[{"review_id": "vF5GkyKu9F8", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper proposes WAFFLe for anonymized federated learning.  The idea seems interesting, but I have a few concerns.  In summary, the motivation/privacy claims are not clear, and the performance evaluation doesn't seem fair as the authors only considered single-model FL algorithms.  \n \n- Motivation (Why can't we just use SecAgg?): Secure aggregation guarantees that each local model parameter is protected.  See \"Practical Secure Aggregation for Privacy-Preserving Machine Learning\" by Bonawitz et al.  Thus, I am not sure about this problem's motivation.  Is there any reason one should employ this instead of secure aggregation?  (Note that the original secure aggregation protocol is computationally expensive, but the recent variations are not: For instance, see SecAgg+ [Bell et al., \"Secure Single-Server Aggregation with (Poly)Logarithmic Overhead\"] and TurboAGG [So et al., \"Turbo-Aggregate: Breaking the Quadratic Aggregation Barrier in Secure Federated Learning\"].)\n\n- Missing privacy guarantees: While secure aggregation comes with a solid privacy guarantee, there is no theoretical guarantee that WAFFLe indeed can protect clients' data.  Especially with the IBP prior that induces sparsity, each client will update only a small subset of the weight factor dictionary.  This pattern may even reveal more information about the set of weight factors used by each client.  (Maybe the updated r also reveals this support information?)  \n\n- Non-adaptive attack: While the authors have presented some experimental results to claim improved privacy in Section 4.4, they only used the off-the-shelf attack algorithms.  The authors should have designed an adaptive attack algorithm, which could have performed much better.  The need for \"adaptive evaluations\" has been well described in [Tramer et al., \"On Adaptive Attacks to Adversarial Example Defenses\"], though in an adversarial example context.  \n\n- Multi-task/multi-center/personalization FL: The performance improvements in Table 1 and Table 2 seem mostly due to personalization, i.e., each model has its own model.  However, all the baseline algorithms assume a single model.  The authors should have compared the performance of WAFFLe with other algorithms that also maintain individual local models or multiple global models.  For instance, the authors may want to add MOCHA in [Smith et al., \"Federated Multi-Task Learning\"] (cited in the current work), and multi-center FL algorithms in [Sattler et al., \"Clustered Federated Learning: Model-Agnostic Distributed Multi-Task Optimization under Privacy Constraints\"] and its follow-up works.  The authors claimed that meta-learning-based approaches require sharing a small subset of data, but not all do.  For instance, see [Fallah et al., \"Personalized Federated Learning: A Meta-Learning Approach\"].  \n ", "extra_scores": {}, "extra_text": {}}, {"review_id": "r-u06YVsri", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "-Summary-\nThe paper proposes a novel approach to federated learning which decomposes model parameters into two sub-modules with task-specific weight factors. The authors adopt the IBP process for sparse selections of the factors per client, which mitigates interferences across local clients. They validate the model with several baselines on two different non-iid settings.\n\n-Pros-\n- The proposed method largely outperforms baselines like FedAvg, FedProx, and p-FFL.\n- The paper is easy to follow and intuition/direction is reasonable enough.\n- Reasonable analysis of attacks and ablation studies (Appendix) is described.\n\n-Cons-\n- Lack of intuition about the architectural design of WAFFLe. There will be several similar designs like W_i^l \\leftarrow \\lambda_i^l * W_i^l (without decomposition) where \\lambda_i^l is an attention vector, or r^l can leave as local without communication. Even weight factors can be regularized to l_0 norm.  I agree that the method looks reasonable but there need more insights into the necessity of model components. \n- Only tiny networks are used. I recommend utilizing further modern complex CNN architectures. Applicability of modified network designs of WAFFLe on diverse modern CNNs is not guaranteed.\n- Comparison with recent personalized FL/ Bayesian FL approaches is required. Since the method uses task-specific local parameters to mitigate inference from the naive aggregation of local parameters, the authors should compare with recent personalized FL/ Bayesian FL methods rather than old FL baselines.", "extra_scores": {}, "extra_text": {}}, {"review_id": "c-t_fLBGheC", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "**Pros:**\n+ Providing clients with additional flexibility to weight different portions of the globally learned weights allows for greater customization in federated learning\n+ The client-specific hidden information leads to better test performance on non-iid data, along with better fairness and privacy properties for the trained models\n+ Experiments are carried out across a range of datasets, with appropriate modifications made to simulate non-iid distribution among agents\n\n**Cons:**\n- The description of the IBP used to learn the local active factors in Section 2.2 is almost incomprehensible. The terms $v$ and $\\pi$ are never defined, and it is unclear what the distribution $q$ corresponds to. While there may not be sufficient space in the main body to provide a detailed description, it should be included in the supplementary material without assuming detailed prior knowledge of Bayesian nonparametrics.\n- Data privacy and security are often using interchangeably in the paper, when they correspond to very different concepts. This terminology needs to be clarified, as all the benefits of the proposed method are with regard to data privacy, and not security. \n\n_Questions:_\n1. Why is the number of learnable parameters smaller for CIFAR-10 than MNIST in Table 1? ", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper proposes an anonymization method for federated learning based on the Indian buffet process. The reviewers found the idea interesting, but raised the following main concerns (please see the reviews for more details):
* Motivation and terminology needs clarification
* Better comparison with secure aggregation methods
* Missing privacy guarantees
Overall the reviewers of this paper are borderline. I hope the authors will take the reviewers' feedback into account when revising the paper.

Decision: Reject