Enforcing fairness in private federated learning via the modified method of differential multipliers
Authors: Borja Rodríguez Gálvez
Filip Granqvist
Rogier van Dalen
Matt Seigel
Venue: ICLR 2022 Submitted (2022)
Keywords: Private federated learning
fairness

Abstract: Federated learning with differential privacy, or private federated learning, provides a strategy to train machine learning models while respecting users' privacy. However, differential privacy can disproportionately degrade the performance of the models on under-represented groups, as these parts of the distribution are difficult to learn in the presence of noise. Existing approaches for enforcing fairness in machine learning models have considered the centralized setting, in which the algorithm has access to the users' data. This paper introduces an algorithm to enforce group fairness in private federated learning, where users' data does not leave their devices. First, the paper extends the modified method of differential multipliers to empirical risk minimization with fairness constraints, thus providing an algorithm to enforce fairness in the central setting. Then, this algorithm is extended to the private federated learning setting. The proposed algorithm, FPFL, is tested on a federated version of the Adult dataset and an "unfair" version of the FEMNIST dataset. The experiments on these datasets show how private federated learning accentuates unfairness in the trained models, and how FPFL is able to mitigate such unfairness.

Under review as a conference paper at ICLR 2022
ENFORCING FAIRNESS IN PRIVATE FEDERATED LEARN- ING VIA THE MODIFIED METHOD OF DIFFERENTIAL MULTIPLIERS
Anonymous authors Paper under double-blind review
ABSTRACT
Federated learning with differential privacy, or private federated learning, pro- vides strategy to train machine learning models while respecting users' privacy. However, differential privacy can disproportionately degrade the performance of the models on repre-represented groups, as these parts of the distribution are dif- ficult to learn in the presence of noise. Existing approaches for enforcing faimess in machine learning models have considered algorithm has access to the users' data. This paper introduces an algorithm enforce group fairness in private federated learning, where users' data does not leave their devices. First, the paper extends the modified method of differential multipliers to empirical risk minimization with fairness constraints, thus provid- ing algorithm enforce fairness in the central setting. Then, this algorithm is extended to the private federated learning setting. The proposed algorithm, FPFL, is tested on a federated version of the Adult dataset and "unfair" version of the FEMNIST dataset. The experiments on these datasets show how private federated learning accentuates unfaimeess in the trained models, and how FPFL is able mitigate such unfairness.
centralized setting, in which the
INTRODUCTION
Machine learning requires data to build models. This data is often private and resides on users' devices. Federated learning (FI.) (McMahan et al., (017) is a strategy where multiple users (or other entities) collaborate in training model under the coordination of central server or service provider. FL, devices share only data statistics (e.g. gradients of the model computed from their data) with the server, and therefore the users' data never leaves their devices.
However, these statistics can still leak information about the users (see Shokri et al. (2017); 7); Fredrik- et al. (2015) for practical attacks recovering the users' identity and reconstructing the users' face images). To protect against this leakage, differential privacy (DP) can be provided. Differential privacy offers mathematical guarantee the maximal amount of information any attacker can obtain about user after observing the released model. In practice, often (Bhowmick et al.) 2018 McMahan et 2018a Truex et al., 2019 Granqvist et al. 2020) this guarantee is achieved by adding a certain amount of noise to the individuals' statistics. In this paper, federated learning with differential privacy will be referred as private federated learning (PFL).
The models trained with PFL are often neural networks, since they work well in many use cases, and turn be resistant the noise added for DP. These models have been successfully trained with PFL for tasks like next word prediction or speaker verification (McMahan et al. 2017 Granqvist al. 2020). However, they are prone to perpetuating societal biases existing in the data (Caliskan al. 2017) to discriminate against certain groups even when the data is balanced (Buolamwini & Gebru 2018). Moreover, when the training is differentially private, degradation in the performance of these models disproportionately impacts under-represented groups (Bagdasaryan al. 2019). More specifically, the accuracy of the model on minority groups deteriorated to a larger extent than the accuracy for the majority groups.
In the realm of FL. there has been some research studying how to achieve that the performance the model is similar among devices (Hu al. 2020 Huang et al. 2020 Li et al. 2019 2021). However,

---

Under review as a conference paper at ICLR 2022
this notion of fairness falls short in terms of protecting users from under-represented groups falling foul of disproportionate treatment. For example, [Castelnovo et al. (2021 Section 3.6) show that a model that performs well the majority of the users will have a good score on individual fairness metrics, even if all the users suffering from bad performance belong to the same group. Conversely, there is little work proposing solutions to enforce group faimess, i.e. that the performance is similar among users from different groups. Current work in this area is either limited to reducing demo- graphic parity in logistic regression (Du al. 2021 or minimizing the largest loss across the different groups with minimax optimization (Mohri et al. 2019). Concurrently to this paper. (Cu al.) (20T)) proposed an approach to enforce group fairness FL for general models and metrics. However, this approach does not consider DP. Moreover, most prior work does not consider the adverse effects that DP has on the models trained with private federated learning, or is restricted to logistic regression models (Abay et al. 2020).
On the other hand, work studying the trade-offs between privacy and group faimess proposes solu- tions that are either limited to simple models such as linear logistic regression (Ding et al. 2020) require an oracle (Cummings et al. 2019), scale poorly for large hypothesis classes (Jagielski et al, 2019), only offer privacy protection for the variable determining the group (Tran et al. 2021 Rodriguez-Gále Gálvez et al.] 2021). Furthermore, the aforementioned work only considers the central learning paradigm, and the techniques are not directly adaptable to FL..
For all the above reasons, in this paper, we propose an algorithm to train neural networks with PFL while enforcing group fairness. We pose the problem an optimization problem with fairness constraints and extend the modified method of differential multipliers (MMDM) (Platt & Barr 1987) solve such a problem with FL and DP. Hence, the resulting algorithm (i) is applicable to any model that can be learned using stochastic gradient descent (SGD) or any of its variants, (ii) can be tailored to enforce the majority of the group fairness metrics, (iii) can consider any number of attributes determining the groups, and (iv) can consider both classification and regression tasks.
The paper structured follows: in Section we review the background on differential privacy, private federated learning, the MMDM algorithm, and group fairness; in Section 3] we present our approach for fair private federated learning: in [Section 4] we describe our experimental results; and in Section 5] we conclude with summary and interpretation of our findings.
2
BACKGROUND
In this section, we review several aspects on the theory of private federated learning, the MMDM algorithm, and group fairness that are necessary to develop and understand the proposed algorithm.
2.1 FEDERATED LEARNING
The federated learning setting focuses on learning model that minimizes the expected value of loss function É using dataset d (#1, .2. kn) E D of samples distributed across K users. This paper will consider models parametrized by a fixed number of parameters w E IR and differentiable loss functions f, which includes neural networks.
Since the distribution of the data samples Z is unknown and each user l is the only owner of their private dataset d², the goal of FL is to find the parameters w* that minimize the loss function across the samples of the users. That is, defining L(d", w) == Ezed' f(z, w), to solve
1 Σ K WER T2
w = arg min
--- ((d"ww)
This way. the parameters w can be learned with an approximation of SGD. McMahan et al. (2017) suggest that the central server iteratively samples m users; they compute and send back to the server an approximation of the model's gradient (d. w): and finally the server up- E. dates the parameters as dictated by gradient descent w f- w - VV w). where 7j is the learning rate. If the users send back the exact gradient the algorithm is known as Federat edSGD. A generalisation of this, mini-batch SGD and sending up the difference. However, the method in this paper considers an optimization with fairness constraints, requiring the communication of extra information in each iteration, and therefore will extend FederatedSGD.
sewerrttddveeeaaiinn involves users rumning several local epochs of
2

---

Under review as a conference paper at ICLR 2022
2.2 PRIVATE FEDERATED LEARNING
Private federated learning combines federated learning with differential privacy. Differential privacy (Dwork et al. 2006 2014) provides a mathematical guarantee by restricting the amount of informa- tion that randomized function m. of dataset d leaks about any individual. More precisely, it ensures that the probability that the output of the function m. on the dataset d belongs to any set of outcomes Ö is close to the probability that the output of the function dataset d' (i.e. equal to d but where all samples from any individual are removed or replaced) be- longs said set of outcomes. Formally, randomized function is ( -iffferentill private if
applied to neighbouring
PP (d) E c6] < (e((mm(') E 66] + E6)
(2)
where and ò are parameters that determine the strength of the guarantee. Two useful properties of DP are that that it composes (i.e. the combination of DP functions is DP) and that post-procesn processins does not undo its privacy guarantees (Dwork et al., 2014). These properties ensure that the modifi- cations that we will make to FederatedSGD will keep the algorithm differentially private.
Typically, the functions of interest not differentially private. For this reason, they are privatized with "privacy mechanisms", which apply random transformation to the output of the function on the dataset. A standard mechanism is the Gaussian mechanism, which adds Gaussian noise to the function's 's output, calibrating the noise variance with the privacy parameters (c, 6) and the maximum individual's s contribution to the function's 's output measured by the & norm.
In the context of F FederatedSGD, the functions to privatize are the gradient estimates sent to the server. The individual's s contribution is the gradient computed on their data. This gradient is "norm- clipped" (Abadi et al. 2016), i.e. it is scaled down so its Eg norm is at most predetermined value C. Then, Gaussian noise is added the sum of contributions, which is sent the server.
Applying the privacy mechanism to a sum of contributions is a form of central DP. An alternative local DP (Dwork al.] 2014), where the privacy mechanism applied to the statistics before leaving the device. However, models trained with local DP often suffer from low utility (Granqvist) jet al. 2020), and are thus not considered this paper. Central DP can involve trust in the server that updates the model, or a trusted third party separated from the model, which is how DP was originally formulated. This paper instead assumes the noisy sum computed through secure multi- party computation (Goryezka & Xiong 2015). such secure aggregation (Bonawitz et al.) (017). This is a cryptographic method that ensures the server only sees the sum of contributions. A crucial limitation of secure aggregation is that it can only compute sums, the novel method introduced in Section 3 is restricted to working only on sums of individuals' statistics.
2.3 THE MODIFIED METHOD OF DIFFERENTIAL MULTIPLIERS
Ultimately, our objective is to find parametric model that minimizes a differentiable loss function and respects some fairness constraints. Thus, this subsection reviews a constrained differential opti- mization algorithm, the modified method of differential multipliers (MMDM) (Platt & Barr 1987).
This algorithm tries to find solution to the following constrained optimization problem:
= arg min ((w) w) s.t. g(w) = 0,
(P1)
wER
where Φ Rº + IR is the function to minimize, g(w) (gi (w), 92(w)...... 9, (w)) is the concate- nation of r constraint functions, and (w E IR. g(w) = 0} is the solution subspace.
The algorithm consists of solving the following set of differential equations resulting from the La- grangian of (PT) with an additional quadratic penalty cg(w)² using gradient descent/ascent. This results in an algorithm that applies these updates iteratively:
+ A (g(
w - w 17 (vw + X" X'V Vug(w) + V
where À E R' is a Lagrange (or dual) multiplier, e E R, is a damping parameter, 7) is the learning rate of the model parameters, and y is the learning rate of the Lagrange multiplier.
3

---

Under review as a conference paper at ICLR 2022
Intuitively, these updates gradually fulfill (PI.. Updating the parameters V Vww(w) and V (wg(w) respectively enforce function minimization and constraint's satisfaction. Then, the multiplier À and the multiplicative factor cg(w) control how strongly the constraints' violations are penalized.
A desirable property of MMDM is that for small enough learning rates 7, Y and large enough damp- ing parameter c, there is region comprising the vicinity of each constrained minimum such that if the parameters' initialization is in that region and the parameters remain bounded, then the algorithm converges a constrained minimum (Platt & Barr 1987). Intuitively, the term cg cg(w) V (ww(w) enforces a quadratic shape on the optimization search space to the neighbourhood of the solution subspace, and this local behavior is stronger the larger the damping parameter c. Thus, the algorithm converges to a minimum if the parameters' initialization is in this locally quadratic region.
2.4
GROUP FAIRNESS
In this subsection, we mathematically formalize what group fairness means. To ease the exposition, describe this notion in the central setting, i.e. where the data is not distributed across users.
Consider a dataset d = (#1, ......, =n) of n samples. The dataset is partitioned into groups from A such that each sample belongs to group aq Group fairness considers how differently model treats the samples belonging to each group. Many fairness metrics can be written in terms of the similarity of the expected value of function of interest of the model evaluated on the general population d with that on the population of each group du = {zz E d: 0; a} (Agarwal et al. 2018 Fioretto al. 2 That is, if we consider supervised learning problem, where z; = (2r,, 3r, 0g) and where the output of the model is an approximation ÿt of yı. we say a model is fair if
E|S(X, Y, Y) A a] EIS(X Y, Y) for all a E A.
(4)
Most of the group fairness literature focuses on the case of binary classifiers, i.c. d E {0, 1}. and on the binary group case, i.c. AA {0, 13. However, many of the faireess metrics can be extended to general output spaces y and categorical groups A. It is common that the function f is the indicator function 1 of some logical relationship between the random variables, thus turning (4) to an equality between probabilities. As an example, we describe two common faimess metrics that will be used later in the paper. For a comprehensive survey of different fairness metrics and their inter-relationships, please refer to Verma & Rubin (2018): Castelnovo el al. (202T)
False negative rate (FNR) parity (or equal opportunity) (Hardt et al., 2016) This fairness
metric is designed for binary classification and binary groups It was originally defined as equal true positive rate between the groups, which is equivalent to an equal FNR between each group and the
overall population. That is, if we let f Y, Y) = E[ = 0) Y = 1] then (4) reduces to
(5) This is usually good metric when the target variable Y is something positive such as being granted a loan or hired for job, since we want to minimize the group disparity of misclassification among the individuals deserving such a loan or such a job (Hardt et al. 2016 Castelnovo et al. 202I).
P| 0 = A a] = PI = Y = 1] for all a e A.
Accuracy parity (or overall misclassification rate) (Zafar et al. 2017) This faimess metric is also designed for binary classification and binary groups. Nonetheless, applies well to general tasks and categorical groups. In this case, if we let f(X, Ý) = 1( Y) then (4) reduces to
PI Y A= a) P| Y] for all a A.
(6)
This is usually a good metric when there is not a clear positive or negative semantic meaning to the target variable, and also when this variable is not binary.
AN ALGORITHM FOR FAIR AND PRIVATE FEDERATED LEARNING (FPFL)
In this section, we describe the proposed algorithm to enforce faimess in PFL of parametric models learned with SGD. First, we describe an adaptation of the MMDM algorithm to enforce faimnsss in standard central learning. Then, we extend that algorithm PFI.
4

---

Under review as a conference paper at ICLR 2022
3.1 ADAPTING THE MMDM ALGORITHM TO ENFORCE FAIRNESS
of n samples. The dataset is partitioned into groups from A such that each sample z; belongs group dg. Then, let consider also supervised learning setting where = (2,, Mt. 0z), the model's output Dr approximates yt. and the model is parametrized by the parameters w E IRP. Finally, assume we have no information about the variables' (X,Y, distribution apart from the available samples.
Consider dataset = (2), ,2,,,,,,........ 22, Zn)
We concern ourselves with the task of finding the model's parameters w² that minimize loss function & across the data samples and enforce measure of faimesss on the model. That is, we substitute the expected values of the fairness constraints with empirical averages:
[td, (d)
F(d', u) F(d w) S a. for all E A.
2* arg min WERr
s.t.
(P2)
72
n'
n2a
where [dd, w) :-)== Ezed ((z, w), F(d', [d) :- E=ed f(z, w) is a subset of that varies among different fairness metrics, is the number of samples d', d² is the set of samples in d' such that a, a. n/ is the number of samples in d'z. is the function employed for the fairesss metric definition, and a is a tolerance threshold. The subset d' chosen based on the function f used for the fairness metric: if the fairness function does not involve any conditional expectation (e.g. accuracy parity), then d' = d; if, on the other hand, the subset involves a conditional expectation, then the d' is the subset of d where that condition holds, e.g. when the faimess metric is FNR parity d' (ax y, E d y = 13. We exclude the case where the conditioning in the expectation is Y, thus excluding predictive parity as a target fairness metric.
Note that the constraints are not strict, meaning that there is a tolerance a for how much the function if can vary between certain groups and the overall population. The reason for this choice is twofold. First, it facilitates the training since the solution subspace larger. Second, it is known that some fairness metrics, such as FNR parity, are incompatible with DP and non-trivial accuracy. However, the fairness metric relaxed, fairness, accuracy, and privacy can coexist (Jagielski et al. 2019 Cummings al. 2019).
This way, we may re-write [22 in the form of (PI) to solve the problem with MMDM. so we let ((ur) = [dd, w))n and g (n)) (go(w), (v)) (w)...... .. Al-1 (w)), where
ga (w) { ha (w)) (Th((w) 20 and ha(w) = F(d', w)
Fdd w)
0
otherwise
n'
n'/
a.
(7)
Therefore, the parameters updated according to
A x A + 7g (w))
(8)
w - w V ((d, w) + X" X (w) + +eg(w)> VV
where we note that Vig(w) (w) (V w: (w)) Vugi(w), Vwo9)A)-((w)) and
Vwla(w) =
{{ sign F(d',w) w))
F(d.. w)
V Fw. VwF((c.
if ha (w)) 20 otherwise
(9)
Now, the climess--nforcingg problem P2 can be solved with gradient descent/ascent or mini- batch stochastic gradient descent/ascent, where instead of the full dataset d, d', and d'g one considers batches b, b', and b/, (or subsets) of that dataset. Moreover, it can be learned with DP adapting the DP-SGD algorithm from (Abadi al. 2016), where clipping bound and Gaussian noise is included in both the network parameters' and multipliers' individual updates. Nonetheless, there are a series of caveats of doing so. First, the batch size [b'] should be large enough to, on average, have enough
samples of each group a E A so that the difference F(B
((,,,w) 1%
is well estimated. Second,
|
in many situations of interest such when we want to enforce FNR parity accuracy parity, the function f employed for the fairness metric is not differentiable and thus F(d", w) does not exist. To solve this issue, resort estimate the gradient V F(d', w) using differentiable estimation of the function aggregate F(d', w); see Aeeppddixx A. for the details on these estimates in the above situations of interest.
5

---

Under review as a conference paper at ICLR 2022
We conclude this section noting the similarities and differences of this work and (Tran al. 2021 Even though their algorithm is derived from first principles on Lagrangian duality, it is ultimately equivalent to application of the basic method of differential multipliers (BMDM) to solve a prob- lem equivalent to (P2) when a = O. Nonetheless, the two algorithms differ in three main aspects:
1. BMDM vs MMDM: BMDM is equivalent to MMDM when e c= 0, that is, when the effect of making the neighbourhood of the solution subspace quadratic is not present. Moreover, the guarantee of achieving a local minimum that respects the constraints does not hold for unless the problem simple (e.g- quadratic programming).
c ==
2. How they deal with impossibilities in the goal of achieving perfect fairness together with privacy and accuracy. (Tran et al. ( include limit Amax to the Lagrange multiplier to avoid floating point emrors and reaching trivial solutions, which in our case is taken care by the tolerance a, which, in contrast to Amax, is an interpretable parameter.
3. This paper uses the exact expression in for the gradient V
F(d'ww)
Pid, w))
while
w
n'
V Fdd' w) V F(d mp)
Tran et al. (2021) ignore the sign of the difference and use
In the next subsection, we extend the algorithm to PFL, which introduces two new differences with (Tra al., 2021). Firstly, the privacy guarantees will be provided for the individuals, and not only to the group to which they belong; and secondly, the algorithm will be tailored to FL.
3.2 EXTENDING THE ALGORITHM TO PRIVATE FEDERATED LEARNING
In the federated learning setting now consider that the dataset d is distributed across K users such that each user maintains a local dataset d with n² samples. This setting applies to both cross- device and cross-silo FL., since each sample contains the group information a, Nonetheless, the central setting, the task is to find the model's parameters w² that minimize the loss function across the data samples of the users while enforcing measure of fairness to the model. That is, to solve
in
To achieve this goal, we might first combine the ideas from FederatedSGD (McMahan et al. 2017) and the previous section to extend the developed adaptation of MMDM to FL. Our adaptation of MMDM cannot be combined with weteeratddveeagiii
for more details See/Appendix A.2 In order to perform the model updates from (8), the central server requires the following statistics:
VwL(d, w); F(d', w); [F(d', w)]aes V F w);
F w)] ae n'; [n's] aEA' (10)
However, some of these statistics can be obtained from the others: F(d', w) = EuSA F(d'.. [d".. w), V.d w) EaEs V', wr), and n' = ExeA nn Moreover, as mentioned the previous section, one might use a sufficiently large batch b of the data instead of the full dataset for each update. Therefore, we consider an iterative algorithm where, at each iteration, the central server samples cohort of users 5 that report vector with the sufficient statistics for the update, that is at = (Voo w), [F((d"),. w))GAA [V
F ((d")) w)) ((n")alae)
(1I)
This way, if we define the batch the sum of the m users' local datasets = Exes dl and the batch D' analogously, then the aggregation of each user's vectors results in
v = Ebes x = Lb, w), [F(,,, w)
F(,, w)) dEAA (Vallaed)
(12)
which contains all the sufficient statistics for the parameters' update.
Finally, the resulting algorithm. termed Fair PFL or FPFL and described in Algorithm I inspired by the ideas from (McMahan et al.) 2018b Truex et al., 2019: Granqvist et al. 2020, Bonawitz et al.) 2017) guarantees the users' privacy by (i making sure the aggregation of the users' sent vectors is done securely with secure aggregation (Bonawitz et al.) 2017). and (ii) clipping each users' vectors with a clipping bound C and employing the Gaussian mechanism to the sum of the clipped vectors (lines 13 and 15). The variance of the Gaussian noise is calculated according to the refined moments accountant privacy analysis from (Wang et al., 2019), taking into account the number of iterations T. the cohort size m, the total number of users (or population size) K, and the privacy parameters and 8. Note that the post-proct procesrncsssig property of DP keeps the algorithm private even if the received noisy vector is processed extract the relevant information for the model's update.

---

Under review as a conference paper at ICLR 2022
Batch size. This algorithm can also be employed using only fraction of the user's data in each update, i.c using a batch 6t their local dataset dº. Nonetheless, it is desirable (i) to delegate as much computation to the user possible and (ii) to as much users' data possible to have good approximation of the performance metrics F F(d w0), which are needed to enforce faimesss.
4 EXPERIMENTAL RESULTS
We study the performance of the algorithm in two clas- sification tasks. The first task is a binary classifica- tion based on some demographic data from the publicly
1
0
2
/
3
available Adult dataset (Dua & Graffi 2017). The fair- ness metric considered for this task is FNR parity. The second task is multi-class classification where there are three different attributes. This task considers accuracy parity as the fairness metric and uses a modification the publicly available FEMNIST dataset (Caldas al. 2018), where only digits are considered and the classes are digits written with black pen on a white sheet, dig- its written with a blue pen on a white sheet, and digits written with white chalk on blackboard (see seeeFigure I).
7 0
9
8
0
Figure 1: Samples from the Unfair FEM- NIST dataset. Digits written on a white sheet with black pen (top), sheet with blue pen (middle), and on a blackboard with white chalk (bottom).
white
For the first task, we first compare the performance of the MMDM algorithm with BMDM, Tran et al.] (2021), and vanilla SGD centrally and without privacy. After that, for both tasks, we confirm how rederatedSee deteriorates the performance of the model for the under-represented classes when clipping and noise (DP) are introduced. Finally, we demonstrate how FPFL can, under the appropriate circumstances, level the performance of the model across the groups without largely decreasing the overall performance of the model.
In all our experiments, the fairness metrics are defined as the maximum difference of the value of a performance measure between the general testing data and each of the groups described by that sensitive attribute. Moreover, the privacy parameters are (c, (2,1/K) where K is the population size. All experimental details and additional experiments are in Appendix B
4.1 RESULTS ON THE ADULT DATASET
We start our experiments comparing the performance and fairness in the central, non-federated, non- private setting. We trained shallow network (consisting of one hidden layer with 10 hidden units and a ReLU activation function) with these algorithms, where we tried to enforce FNR parity with tolerance 0.02. For MMDM, the damping parameter is 2. For Tran et al. (2021). the multiplier threshold Amax 0.05. The results after 1,000 iterations are displayed in Table I which also shows the gap in other common measures of faimess such the equalized odds, the demographic parity, or the predictive parity, see e.g. Castelnovo et al. (002T)
Compared to Federated SGD, the MMDM algorithm reduces the FNR gap from 7% to 0.5%, while hardly reducing the accuracy of the model. Similarly, the gap in the equalized odds (EO), which is a stronger fairness notion than the FNR parity, also decreases from around 7% to 3%. Moreover, the demographic parity (DemP) gap, which considers the probability of predicting one or the other target class, also improves. In terms of predictive parity (PP), which uses the precision as the performance function, the MMDM algorithm did not improve the parity among groups The BMDM algorithm, which lacks a quadratic term of the fairness function, performs even slightly better in the central scenario. However, the algorithm from Tran et al. (202T). approximation to BMDM as discussed in inceecion 3.1 gives only a small improvement, Therefore, we continue our analysis to the federated and private settings only with the BMDM and MMDM algorithms.
The second experiment is to study how federated learning, clipping, and DP decrease the perfor- mance for the under-represented groups, thus increasing the fairness gap the different fairness metrics. For that, we trained the same network with FederatedSe rithm where only clipping was performed and where both clipping and DP where included. They were trained with a cohort size of m 200 for T = 1, 0.00 iterations and the model with best training cohort accuracy was selected. The privacy parameters are 8) (2, 5 10-5). The results
and versions of this algo-
7

---

Under review as a conference paper at ICLR 2022
Table 1: Performance in the central (i.e. non-federated) setting the Adult dataset.
The fairness
metric optimized is FNR parity, The tolerance for BMDM and MMDM is = 0.02.
Algorithm
Accuracy
FNR gap
FO gap
DemP gap
PP gap
SGD
0.857
0.071
0.071
0.113
0.016
Tran et al. 2021
without privacy
0.856
0.048
0.048
0.108
0.036
BMDM
0.857
0.001
0.030
0.094
0.046
MMDM (this paper)
0.856
0.005
0,028
0,091
0.063
Table 2: Performance of a neural network on the Adult dataset when trained with FL. The fairness
metric considered for BMDM-FL and FPFL is FNR parity and the tolerance is = 0.02.
Algorithm
Accuracy
FNR gap
EO gap
DemP gap
PP gap
FL BMDM-FL
0,851
0.121
0.121
0.122
0.037
0.854
0.043
0.043
0.101
0.016
Fair FL
0,855
0.036
0.039
0.108
0.033
FL Clip
0.844
0.169
0.169
0.129
0.051
BMDM-FL Clip
0.851
0.052
0.052
0.105
0.008
Fair FL Clip
0.853
0.018
0.029
0.090
0.016
Private FL
0.847
0.148
0.148
0.126
0.041
BMDM-PFL
0,850
0.023
0,035
0,097
0,009
Fair Private FL
0.851
0.001
0.027
0.087
0.042
are displayed in Table 2 The network becomes less fair under all the metrics considered, compared with the central setting. Moreover, the introduction of clipping largely increases the unfairness of the models reaching more than a 16% gap in FNR. The addition of DP requires an increase in cohort
size from 200 to 1, 000, but does not have a larger effect on the unfairness of the models (see Table in Appendix B. for the details). These observations are in line with (Bagdasaryan et al. (019), where they note that the under-represented groups usually have the higher loss gradients and thus clipping affects them more than the majority groups.
After that, we repeated the above experiment with FPFL and BMDM with DP. FPFL and BMDM with DP converged to solution faster than FederatedSGD, and thus the models were trained for only T = 250 iterations. Here the model with the best training cohort accuracy while respecting the fairness condition the training cohort data selected. Note that the faimess condition is evaluated with noisy statistics, so model may be deemed as fair while slightly violating the desired constraints. The results are also included in Table 2 aid the comparison. We note how, similarly to the central case, the model trained with FPLL manages to enforce the faireess constraints while keeping similar accuracy. contrast, BMDM seems to be able to find network weights that respect the fairness conditions, as expected by the less favorable ("less convex") loss surface around these solutions. Moreover, clipping does not seem affect largely the performance of FPFL since it compensates the gradient loss clipping with the faimess enforcement.
4.2 RESULTS THE UNFAIR FEMNIST DATASET
We start our experiments confirming again the hypothesis and findings from Bagdasaryan et al. (219) that clipping and DP disproportionately affect under-represented groups. For that, we trained a convolutional network (consisting of convolution layers with kernel of size
5, stride of 2, ReLU activation function, and 32 and 64 filters respectively) with Federate edStD and versions of this algorithm where only clipping was performed and where both clipping and DP were included. For the FEMNIST experiments, the privacy parameters are (e, (2, 2.5 10 4) and the damping parameter is c = 20. They were trained with a cohort size of m 100 for = 2, 2.000 iterations and the model with best training cohort accuracy Similarly to before, clipping increases the accuracy gap from 13% to almost 17%. In this case, since the number of users K is small, the DP noise is large compared the users' statistics. Therefore, the
selected. The results are displayed in Table 3)
8

---

Under review as a conference paper at ICLR 2022
accuracy drops from more than 94% with clipping to 80.7% when DP is also used, and the accuracy gap increases to more than 40%.
Table 3: Performance of a convolutional net- work on the Unfair FEMNIST when trained with different algorithms: like Table 2, starting with FederatedSGD and ending with FPFL. The faimess metric considered for FPFL is accuracy
The second experiment tests whether FPFL remedy the unfairness without decreasing ac- euracy too much. We trained the same con- volutional network, again for T = 2, 000 it- erations, and selected the model with the best training cohort accuracy that respected the fair- ness condition on the training cohort. When DP noise is not included, FPFL reduces the accu- racy gap with FederatedSch by around 9% while keeping the accuracy within 1. We note how, as before, clipping largely does not affect the ability of FPFL to enforce fairness. How- ever, note that since the data more non-i.i.d. than before (i.e. there are more differences be- tween the distribution of each user) the models that are deemed fair in the training cohort may not be as fair in the general population, and now we see a larger gap between the desired tolerance a = 0.04 and the obtained accuracy gap from FPFL without noise (0.047 and 0.053 without and with clipping).
parity and the tolerance is a 0.04.
Algo.
Population Accuracy Acc. gap
100
FL FFL
K
0.960
0.134
K
0.950
0.047
FL Clip FFL + Clip
K
0.946
0.166
K
0.954
0.053
PFL FPFL
K
0,807
0,409
K
0.093
0.015
m
2, 000
PFL
100K
0.951
0.157
FPFL
100K
0.903
0.074
PFL FPFL
1, 1,000
0.951
0.153
1,000K
0.927
0.073
When DP is used, the noise is too large for FPFL to function properly and often the sign of the constraints' gradient, see (9). flips. Note that in the estimation of the performance function, i.e. F(da, /n.. both the numerator and denomi- nator are obtained from noisy vector, thus making the estimators more sensitive to noise than the estimators for plain F FederatedSSa larger the aggregation of the gradients for each weight, and thus more noise needs to be added; and (ii) the smaller the amount of users, the larger the noise that needs to be added.
This is due to two main factors: (i) the larger the model, the
For this reason, we considered the hypothetical scenario where the population, used for calculat- ing the DP noise, is 100 and 1,000 times larger, which is a conservative assumption for federated learning deployments (Apple (017). Then, repeated the experiment with DP FederatedSGD and FPFL and increased the cohort size to m = 2, 000. In this scenario, DP FederatedSGD maintained accuracy gap of more than 15% while FPFL reduced this gap to less than half in both cases, Nonetheless, the accuracy still decreases slightly, with reduction of around 5% and 2% respectively compared with DP Federate
CONCLUSION
In this paper, we studied and proposed solution to the problem of group fairness in private federated learning. For this purpose, we adapt the modified method of multipliers (MMDM) (Platt & Barr 1987) to empirical loss minimization with fairness constraints, producing an algorithm for enforcing fairness in central learning. Then, extend this algorithm private federated learning.
Through experiments in the Adult (Dua Graff, 2017) and a modified version of the FEM- NIST (Caldas et al. 2018) datasets, first confirm previous knowledge that DP disproportionattel affects performance on under-represented groups (Bagdasaryan et al.) 2019). with the further ob- servation that this is true for many different fairness metries, and not just for accuracy parity. The proposed FPFL algorithm is able to remedy this unfairness even in the presence DP.
Limitations and future work. The FPFL algorithm is more sensitive to DP noise than other al- gorithms for PFL. This requires increasing the cohort size ensuring that enough users take part in training. Still, for the experiments, the number of users required still lower (more than an order of magnitude) than the usual amount of users available in deployments of federated learning set- tings (Apple) (017). In the future, we intend to scale the algorithm to larger models and empirically integrate with faster training methods like Federated Averaging McMMahan al. 2017).

---

Under review as a conference paper at ICLR 2022
REFERENCES
Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, llya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security (CCS), pp. 308-318 2016.
Annie Abay, Yi Zhou, Nathalie Baracaldo, Shashank Rajamoni, Ebube Chuba, and Heiko Ludwig. Mitigating bias in federated learning. arXiv preprint arXiv:2012.02447, 2020.
Alckh Agarwal. Alina Beygelzimer, Miroslav Dudik, John Langford, and Hanna Wallach. A ductions approach to fair classification. In International Conference on Machine Learning, pp- 60-69. PMLR, 2018.
Diffcrential Privacy Team Apple. Learning with privacy at scale. Technical report, Apple, 2017.
Eugene Bagdasaryan, Omid Poursaeed, and Vitaly Shmatikov. Differential privacy has disparate impact on model accuracy. Advances Neural Information Processing Systems (NeurIPS), 32: 15479-15488, 2019.
Abhishek Bhowmick, John Duchi, Julien Freudiger, Gaurav Kapoor, and Ryan Rogers. Protec- tion against reconstruction and its applications in private federated learning. arXiv preprint arXiv:1812.00094, 2018.
Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth. Practical secure aggregation for privacy- preserving machine learning. In proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pp. 1175-1191, 2017.
Joy Buolamwini and Timnit Gebru. Gender shades: Intersectional accuracy disparities in commer- cial gender classification. In Conference on fairness, accountability and transparency, pp. 77-91. PMLR, 2018.
Sebastian Caldas, Peter Wu, Tian Li, Jakub Konečný. H Brendan McMahan, Virginia Smith, and Ameet Talwalkar, Leaf: benchmark for federated settings. arXiv preprint arXiv:1812.01099 2018.
:// arxiv. org/ abs 011//1111211111
Aylin Caliskan, Joanna Bryson, and Arvind Narayanan. Semantics derived automatically from language corpora contain human-like biases. Science, 356(6334) 2017.
Alessandro Castelnovo, Riccardo Crupi, Greta Greco, and Daniele Regoli. The zoo of fairness metrics in machine learning. arXiv preprint arXiv:2106.00467, 2021.
Gregory Cohen, Saeed Afshar, Jonathan Tapson, and Andre Van Schaik. Emnist: Extending mnist to handwritten letters. In 20/7 International Joins Conference on Neural Networks (IJCNN, pp- 2921-2926 IEEF, 2017.
Sen Cui, Weishen Pan, Jian Liang, Changshui Zhang, and Fei Wang. Addressing algorithmic dis- parity and performance inconsistency in federated learning, 2021.
Rachel Cummings, Varun Gupta, Dhamma Kimpara, and Jamie Morgenstern. On the compatibil- ity of privacy and fairness. In Adjunct Publication of the 27th Conference on User Modeling, Adaptation and Personalization, pp. 309-315, -15, 2019.
Jiahao Ding, Xinyue Zhang, Xiaohuan Li, Junyi Wang, Rong Yu, and Miao Pan. Differentially private and fair classification via calibrated functional mechanism. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 34, pp. 622-629, 2020.
Wei Du, Depeng Xu, Xintao Wu, and Hanghang Tong. Fairness-aware agnostic federated learning. In Proceedings of the 2021 SIAM International Conference on Data Mining (SDM), 181-189 SIAM, 2021.
Dheeru Dua and Casey Graff. UCI machine learning repository, 2017. URL ics. uct edu/mdumm mm]
10

---

Under review as a conference paper at ICLR 2022
Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of cryptography conference, pp. 284. Springer, 2006.
Cynthia Dwork Aaron Roth, et al. The algorithmic foundations of differential privacy. Found. Trends Theor, Comput. Sei., 9(3-4):211 1-77, 2014.
Ferdinando Fioretto, Pascal Van Hentenryck, Terrence WK Mak, Cuong Tran, Federico Baldo, and Michele Lombardi. Lagrangian duality for constrained deep learning. arXiv preprint arXiv:2001.09394, 2020.
Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confi- dence information and basic countermeasures. In Proceedings of the 22nd ACM SIGSAC confer- ence on computer and communications security, pp. 1322-1333, 2015.
Slawomir Goryezka and Li Xiong. A comprehensive comparison of multiparty secure additions with differential privacy. IEEE Transactions on Dependable and Secure Computing, 2015. doi:
10.1109/DDC.220522444420
Filip Granqvist, Matt Seigel, Rogier van Dalen, Áine Cahill, Stephen Shum, and Matthias Paulik. Improving on-device speaker verification using federated learning with privacy. Interspeech, pp- 4328 4332, 2020.
Moritz Hardt, Eric Price, and Nati Srebro. Equality of opportunity in supervised learning, Advances in neural information processing systems, 29:3315-3323, 2016.
Zeou Hu, Kiarash Shaloudegi, Guojun Zhang, and Yaoliang Yu. FedMGDA+: Federated learning meets multi-objective optimization. arXiv preprint arXiv:2006. 11489, 2020.
Wei Huang, Tianrui Li, Dexian Wang, Shengdong Du, and Junbo Zhang. Fairness and accuracy in federated learning. arXiv preprint arXiv:20/2.10069) 2020.
Matthew Jagielski, Michael Kearns, Jieming Mao, Alina Oprea, Aaron Roth, Saeed Sharifi- Malvajerdi, and Jonathan Ullman. Differentially private fair learning. In International Conference on Machine Learning (ICML), pp. 3000-3008. PMLR, 2019.
Tian Li, Maziar Sanjabi, Ahmad Beirami, and Virginia Smith. Fair resource allocation in federated learning. arXiv preprint arXiv: 10497 2019.
Tian Li, Shengyuan Hu, Ahmad Beirami, and Virginia Smith. Ditto: Fair and robust federated learning through personalization. In Proceedings of the 38th International Conference on Ma- chine Learning (ICML), pp. 6357-6368. PMLR, 2021.
Jingeheng Liu and Kunal Talwar. Private selection from private candidates. In Proceedings of the ACM SIGACT Symposium on Theory of Computing, 2019.
Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Agüera y Arcas. Communication-efficeeet learning of deep networks from decentralized data. In Proceedings of the 20th International Conference Artificial Intelligence and Statistics (AISTATS), pp. 1273- 1282. PMLR, 2017.
H Brendan McMahan, Galen Andrew, Ulfar Erlingsson. Steve Chien, Ilya Mironov, Nicolas Paper- not, and Peter Kairouz. A general approach to adding differential privacy to iterative training procedures. arXiv preprint arXiv: / 8/2.06220. 2018a.
H. Brendan McMahan, Daniel Ramage, Kunal Talwar, and Li Zhang. Learning differentially private recurrent language models. In International Conference on Learning Representations (ICLR), 2018b.
Mehryar Mohri, Gary Sivek, and Ananda Theertha Suresh. Agnostic federated learning. In Interna- tional Conference on Machine Learning, pp. 4615-4625, PMLR, 2019.
John Platt and Alan H Barr. Constrained differential optimization. In Proceedings of the 1987 International Conference Neural Information Processing Systems, pp. 612-621, 1987.

---

Under review as a conference paper at ICLR 2022
Borja Sedriguez-Gälvezz Ragnar Thobaben, and Mikael Skoglund. A variational approach pri- vacy and fairness. In 2nd Privacy Preserving Artificial Intelligence Workshop (PPAI) of the AAAI Conference Artificial Intelligence, 2021. URL https:t/aaxii...ttttt org.iiiv.rggaaa hwwpgg/abb//00e
06332
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference at- tacks against machine learning models. In 2017 IEEE Symposium on Security and Privacy (SP), pp. 3-18. IEEE, 2017.
Cuong Tran, Ferdinando Fioretto, and Pascal Van Hentenryck. Differentially private and fair deep learning: A Lagrangian dual approach. Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pp.
2021.
Stacey Truex, Nathalie Baracaldo, Ali Anwar, Thomas Steinke, Heiko Ludwig, Rui Zhang, and Yi Zhou. A hybrid approach to privacy-preserinng federated learning. In Proceedings of the 12th ACM Workshop on Artificial Intelligence and Security, pp. 2019.
Sahil Verma and Julia Rubin. Fairness definitions explained. 2018 IEEE/ACM International Workshop on Software Fairness (FairWare), pp. 1-7. IEEE, 2018.
Pauli Virtanen, Ralf Gommers, Travis E. Oliphant, Matt Haberland, Tyler Reddy, David Courna- peau, Evgeni Burovski, Pearu Peterson, Warren Weckesser, Jonathan Bright, Stéfan J. van der Walt, Matthew Brett, Joshua Wilson, K. Jarrod Millman, Nikolay Mayorov, Andrew R. Nel- son, Erie Jones, Robert Kern, Eric Larson, Carey, Ilhan Polat, Yu Feng, Eric W. Moore, Jake VanderPlas, Denis Laxalde, Josef Perktold, Robert Cimrman, Ian Henriksen, E. A. Quintero, Charles R. Harris, Anne M. Archibald, Antônio H. Ribeiro, Fabian Pedregosa, Paul van Mul- bregt, and SciPy 1.0 Contributors. SciPy 1.0: Fundamental Algorithms for Scientific Computing in Python. Nature Methods, 17:261-272. 2020. doi: 10. 1038/44/ 199--119-06----
Yu-Xiang Wang, Borja Balle, and Shiva Prasad Kasiviswanathan. Subsampled Rényi differential privacy and analytical moments accountant. In Proceedings of the 22nd International Conference on Artificial Intelligence and Statistics (AISTATS), pp. 1226-1235. PMLR, 2019.
Muhammad Bilal Zafar, Isabel Valera, Manuel Gomez Rodriguez, and Krishna P Gummadi. Fair- ness beyond disparate treatment & disparate impact: Learning classification without disparate mistreatment. In Proceedings of the 26th international conference on world wide web, pp. 1171- 1180, 2017.
12

---

Under review as a conference paper at ICLR 2022
A ADDITIONAL DETAILS ABOUT FPFL
A.1 DIFFERENTIABLE ESTIMATES OF THE FUNCTION AGGREGATES
As mentioned in Section 3.1 there are many situations of interest when the function f employed to describe the faimess metric is not differentiable. In these cases, the gradient Fw' w) does not exist and we resort estimate the gradient V ('' w) using differentiable estimation of the function aggregate F(d', w) As an example, when trying to enforce FNR parity or accuracy parity (as is the case our experiments from from [Section 4Jand Appendiix B) the employed estimates are:
Enforcing FNR parity neural network vhe (with a Sigmoid output activation function) in a binary classification task. We note that given an input æ,, the raw output of the network (x;) is estimate of the probability that Dr = 1. Hence, the function aggregate can be estimated as
+ F(dd w)
1 Ea-vi(a R Pl = OJY 1]. W
~
(13)
B.Ed'
Enforcing accuracy parity on a neural network the (with softmax output activation func- tion) in a multi-class classification task. We note that given an input æ;, the raw in output the network (a,,; is an estimate of the probability that i/s = j. Hence, y, the one-hot encoding vector of ys. the function aggregate can be estimated as
1 F(d', w) x T
Σ ( yi =
(14)
E.ed
A.2 WHY IS FEDERATEDAVERAGIIG INCOMPATIBLE WITH FPFL?
The proposed algorithm extends the MMDM algorithm from [Section 3.1 to FL adapting FederatedSGD, where each user uses all their data, computes the necessary statistics for a model update, and sends them the third-party.
A natural question could be why is not FederatedAveraging adapted instead. That is, to perform several stochastic gradient descent/ascent updates of the model's parameters w and the Lagrange multipliers X, and send the difference of the updated and the original version, i.e. to send the vector d : Iw* w. A A]. This way, the size of the communicated vector would be reduced from (IA) + 1)p A| to just p + |A and larger part of the computation would be done locally, increasing the convergence speed. Moreover, the clipping bound could be reduced, thus decreasing the noise necessary for the DP guarantees.
Unfortunately, for the proposed MMDM algorithm, this option could lead to catastrophic effects. Imagine for instance a situation where each user only has data points belonging to one group, say a = 0 or a = 1. Then in their local dataset the general population is equivalent to the population of their group and thus F(d'', w) F(d'', w). implying that locally g(w) = O. Therefore, the Lagrange multipliers will never be locally updated and the weights updates will be equivalent to those updates without considering the fairesss constraints. That is, using this approach one would (i recover the same algorithm than standard PFL and (ii) communicate a vector of size p + [AA] instead of size p.
A.3 THE ALGORITHM
The employed algorithm is detailed in algorithm It is separated into three main parts:
1. Server:
The server initializes the network wg and Lagrange multiplier A parameters, and also calculates the noise scale a Wain et al. (2019)'s 's privacy analysis before training. Then, for each iteration it samples m users S₁ and asks for the noisy aggregation of their statistics vg. Then it updates the Lagrange multiplier X, and the network weights w, following (8)
2. Virtual secure third-party (obtained via secure multi-party computation): The third party asks for each users' statistics b and clips them with the clipping bound C. After
13

---

Under review as a conference paper at ICLR 2022
that, it aggregates the clipped statistics and privatizes the aggregation with the Gaussian mechanism using the previously calculated by the server noise scale d.
3. Users: Each user calculates the relevant statistics, see [I and sends them to the secure virtual third-party
Algorithm 1: FPFL. The users are indexed by k, m the cohort size, is the number of iterations, C is the clipping bound, and (s, d) are the DP parameters.
Server Executes:
Wo. Ao + ImiitallizeParammters// a 5 -CalculateNoiiiSSeal((/... m, E, 6)
for each iteration t T. do
S. < (random set of users)
< BegreeAggreg (utregattion(::1111555 St, o)
A; + UpdateMultiplier(t:. Ve; w.;-)
UpdateParameters Ar)
end
SecureAggregation (,, C,
// Performed by the virtual secure third-party for each user k in S do v + UserStatistics((; w) ek vk min {1, C/
end
EkEs t + +0 C² 02)
return
UserStatisties (k, w): // Performed by the user
V.. ) [F(w, d'tt) IEEA Vw (()) ne [nc (oea
return V
B EXPERIMENTAL DETAILS AND ADDITIONAL EXPERIMENTS
B. DETAILS THE EXPERIMENTS AND ADDITIONAL EXPERIMENTS ON ADULT
B.1.1 DETAILS OF THE EXPERIMENTS
Adult dataset, from the UCI Machine Learning Repository (Dua & Graff 2017). This dataset consists of 32,561 training and 16,281 testing samples of demographic data from the US census. Each datapoint contains various demographic attributes. Though the particular task, predicting indi- viduals' salary ranges, is not itself of interest, this dataset serves proxy for tasks with inequalities in the data. reason this dataset is often used in the literature on MI. fairness that the fraction of individuals in the higher salary range is 30% for the men and only 10% for the women. The experiments in this paper will aim to stop this imbalance from entering into the model by balancing the false negative rate (Castelnovo al. 2021
Federated Adult dataset. To generate version of the Adult dataset suitable for federated learn- ing, it must be partitioned into individual contributions. In the experiments, differential privacy will be guaranteed contribution. In this paper, the number of datapoints per contribution is Poisson- distributed with mean of 2. Therefore, the number of users is K n/2 16, 280.5.
Privacy and fairness parameters. For all our experiments, we considered the privacy parameters = 2 and 8 = 5 10 < 1/K and the faimess tolerance a 0.02.
Data pre-processing The categorical variables were one-hot encoded and the 6 numerical vari- ables where normalized with the training mean and variance. There underlying assumption
14

---

Under review as a conference paper at ICLR 2022
that these means and variances can be learned at low privacy cost. Hence, be precise, the private models are (cu 2,, 10 10-8)- DDDP, where 6g is a small constant representing the privacy budget for learning said parameters for the normalization.
Models considered. We experimented with two different fully connected networks. The first net- work, from now on the shallow network, has one hidden layer with 10 hidden units and a ReLU activation function. The second network, henceforth the deep network, has three hidden layers with 16, and hidden units respectively and all with ReLU activation functions. Both networks ended with fully connected layer to final output unit with Sigmoid activation function.
Hyperparameters. For all the experiments, the learning rate was 0.1 for the network param- eters and y 0.01 for the Lagrange multipliers. The damping parameter was size for the experiments learned centrally was Reatch = 400 and the cohort sized studied for the federated experiments were m 200 and m 1, 000. Finally, the clipping bounds for the shallow and the deep networks were, respectively and depending if the training algorithm was PFL or FPFL, C 1.3 or = 2 and = or C 2.4. These hyper-parameters where not selected with a pri- vate hyper-parameter search and were just set as exemplary configuration. For TTan et al. [202I). we chose the multiplier threshold Amax = 0.05 by sweeping over multiple orders of magnitude and finding the optimal accuracy and FNR gap. If one desires to find the best hyper-parametees, one can do so at an additional privacy budget cost following e.g. Abadi et al. (2016) Appendix D). Liu &
The batch
Ta war (2019).
B.1.2 ADDITIONAL EXPERIMENTS
We replicated all the experiments with the shallow network from Section 4.1 with the deep net- work instead. The results for these experiments on the central and federated setting are displayed in Table and Table 5| respectively.
The results obtained with the deep network are almost identical to those of the shallow network in the central setting without DP noise.
The first difference with the results for the shallow network is that the performance and fairness of the deep network does not change much when going from the central to the federated setting without DP noise nor clipping. The shallow network, however, becomes less fair under all the metrics considered.
The results for federated learning with clipping do not differ much between the shallow and deep net- works. In both cases we see how gederatedAveraginng of the model with all the measures considered. Moreover, they also suggest how FPFL can mitigate this problem, maintaining similar levels of accuracy (in this case, even higher) while keeping the fairness below the fairness tolerance.
with clipping deteriorates the fairness
Another contrast with the shallow network appears in the comparison of algorithms with and without differential privacy. With DP, training does not reliably converge. This is partly due to the fact that the noise is large enough so that sign of the constraints' gradient, see ( is sometimes mistaken.
For this reason, we repeat the experiments with PFI. and FPFL with larger cohort size, m 1, 000, to see if a smaller relative noise would aid the training with PFL or with FPFL. The results with PFI. were almost identical, with similar levels of accuracy and unfairness. On the other hand, the larger signal-to-DP noise ratio helped the models trained with FPFL to keep models with the desired levels of FNR gap and lower unfairness measured with any other metric. Moreover, the accuracy of the models, that now work better for the under- redres-epreeented group, is in fact slightly higher than for the models trained with PFL.
B.2 DETAILS OF THE EXPERIMENTS ON THE UNFAIR FEMNIST
FEMNIST dataset (Caldas et al. 2018 This dataset is adaptation of the Extended MNIST dataset (Cohen et al. 2017). which collects more than 800,000 samples of digits and letters dis- tributed across 3,550 users. The task considered is to predict which of the 10 digits or 26 letters (upper or lower case) is depicted in the image, so it is a multi-class classification with 62 possible classes.
15

---

Under review as a conference paper at ICLR 2022
Table 4: Performance of deep and shallow network the Adult dataset when trained with SGD and the MMDM algorithm. The fairness metric considered for MMDM is FNR parity and the
tolerance is a 0.02. Tran et al. (202I) without privacy, and with Amax 0.05.
Model
Algorithm
Accuracy
FNR gap
EO gap
DemP gap
PP gap
Shallow
SGI)
0.857
0.071
0.071
0.113
0.016
Shallow
Tran et al. 2021
0.856
0.048
0.048
0.108
0.036
Shallow
BMDM
0.857
0.001
0.030
0.094
0.046
Shallow
MMDM
0.856
0.005
0.028
0.091
0.063
Deep
SGD
0.858
0.070
0.070
0.117
0.006
Deep
Tran et al. (2021
0.853
0.054
0.054
0.111
0.035
Deep
BMDM
0.853
0.000
0.027
0.088
0.050
Deep
MMDM
0.855
0.003
0.027
0.090
0.066
Table 5: Performance of deep and shallow network the Adult dataset when trained with different algorithms: FederatedSGD without privacy, with norm clipping, and with DP, denoted as FL. FL Clip, and PFL respectively, and FPFL without privacy nor norm clipping, with norm clipping only, and with DP, denoted as FFL., FFI. Clip, and FPFL respectilly...... The fairness metric
considered for FPFL FNR parity and the tolerance
0.02.
Model Algorithm
Accuracy
FNR gap
EO gap
DemP gap
PP gap
m
200
Shallow FL
0.851
0.121
0.121
0.122
0.037
Shallow BMDM-FL
0.854
0.043
0.043
0.101
0.016
Shallow
FFL
0.855
0.036
0.039
0.108
0.033
Deep
FL
0.853
0.078
0.078
0.125
0.015
Deep
BMDM-FL
0.850
0.051
0.051
0.116
0.012
Deep
FFL
0.854
0.009
0.030
0.093
0.049
Shallow
FL Clip
0.844
0.169
0.169
0.129
0.051
Shallow
BMDM-FL Clip
0,851
0.052
0.052
0.105
0.008
Shallow
FFL + Clip
0.853
0.018
0.029
0.090
0.016
Deep
FL. Clip
0.848
0.160
0.160
0.131
0.056
Deep
BMDM-FL. Clip
0.844
0.130
0.130
0.112
0.041
Deep
FFL Clip
0.852
0.008
0.023
0.081
0.031
Shallow
PFL
0.828
0.171
0.171
0.093
0.038
Shallow
BMDM-PFL
0.803
0.002
0.005
0.044
0.209
Shallow
FPFL
0.793
0.060
0.060
0.051
0.167
Deep
PFL
0.804
0.174
0.174
0.073
0.031
Deep
BMDM-PFL
0.792
0.303
0.303
0.164
0.067
Deep
FPFL
0.281
0,036
0.036
0.014
0.127
1, 000
Shallow
PFL
0.847
0.148
0.148
0.126
0.041
Shallow BMDM-PFL
0.850
0.023
0.035
0.097
0.009
Shallow FPFL
0.851
0.001
0.027
0.087
0.042
Deep
PFL
0,847
0.167
0.167
0.132
0.043
Deep
BMDM-PFL
0.837
0.167
0.167
0.115
0.085
Deep
FPFL
0.848
0.027
0.027
0.080
0.026
Unfair FEMNIST dataset. We considered the FEMNIST dataset with only the digit samples.
This restriction consists 3,383 users spanning 343,099 training and 39,606 testing samples. The task now is to predict which of the 10 digits is depicted in the image, it is multi-class classifica- tion with 10 possible classes. Since the dataset does not contain clear sensitive groups, we artificially create three classes (see Figure
16

---

Under review as a conference paper at ICLR 2022
Users that write with black pen in white sheet. These represent the first (lexico- graphical) 45% of the users, i.c. [0.45.3. 3, 383] = 522 users. These users contain 146,554 (42.7%) training and 16,689 (42. %) testing samples.
The images belonging this group are unchanged.
Users that write with blue pen in white sheet. These represent the second (lexico- graphical) 45% of the users, i.e. 1,522 users as well. These users contain 159,902 (46.6%) training and 18,672 (47.1%) testing samples.
The images belonging to this group are modified making sure that the digit strokes are blue instead of black.
Users that write with white chalk in blackboard. These users represent the last remaining 10% of the users, i.c. 339 users. These users contain 36,643 (10.7%) training and 4,245 (10.7%) testing samples.
The images belonging to this group modified making sure that the digit strokes white and the background black. Moreover, to make the task more unfair, we simulated the blurry effect that chalk leaves in blackboard. With this purpose, blurred noise to the image, and then we blended them with further Gaussian blur. To be precise, if is the image normalized to [0, 1], the blackboard effect is the following.
added Gaussian
I ワ (xr + N2) $ K1,
(15)
where & ~ (0, () is Gaussian noise of the size of the image, K1 and K2 are Gaussian kernel with standard deviation and 2, respectively, and represents the convolution operation. Moreover, the images are rotated 90 degrees, simulating how the pictures were taken with the device in horizontal mode due to the usual shape of the blackboards.
Privacy and fairness parameters. For all our experiments, considered the privacy parameters e = 2 and = 2.5 10 4 < 1/K. However, for the last experiment, we consider the hypothetical scenario where we had a larger number of users K +- 100K and K +- 1, 0,000, thus decreasing the privacy parameter to + 5/100 and 5 + 5/1, 000 and reducing the added noise in the analysis from (Wang et al. 2019).
Model considered. We experimented with a network with 2 convolution layers with kernel of size 5, stride 2, ReLU activation function, and 32 and 64 filters respectively. These layers are followed by a fully connected layer with 100 hidden units and ReLU activation function, and fully connected output layer with 10 hidden units and a Sofumax activation function. From now on, this model will be referred as the convolutional network.
Hyperparameters. For all the experiments the learning rate was 1j = 0.1 for the network param- eters and 7 0.05 for the Lagrange multipliers. The damping parameter we set a larger damping parameter to increase the strength to which we want to enforce the con- straints, given that the task harder than before. The cohort sizes considered were
20. Note that
100 and m 2, 000. Finally, the clipping bound for the convolutional network was C = 250 if the training algorithm was PFL and C 350 it was FPFL. As previously, these hyper-parametens where not selected with a private hyper-parameter search and were just set as an exemplary configuration. If one desires find the best prper-parameters, one can do so an additional privacy budget cost following e.g. (Abadi et al., 2016 Appendix D).
We used the Gaussian filter implementation from SciPy VVittannn
2020
17


Reviews:
[{"review_id": "wyvNV-rgdP", "reviewer": "Reviewer_18Rw", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "**Strengths**\n\n- `The paper investigates a relevant problem.` Prior work on fair federated learning has mostly considered achieving uniform performance. In contrast, this work proposes a method for group fairness (in private federated learning), which is a relevant problem (as also empirically evidenced in the paper).\n- `The method is novel, technically sound, and achieves its goal.` In contrast to prior work, the proposed approach enforces group fairness constraints via the modified method of differential multipliers. Concretely, it augments the parameter update with a term that encourages the neighborhood of the solution subspace to be quadratic, which guarantees the reachability of a local minimum. The experimental evaluation shows that the proposed method reduces various group fairness gaps while maintaining high accuracy.\n\n**Weaknesses**\n\n- `The method is not compatible with federated averaging.` As explained in section A.2, the proposed method is incompatible with federated averaging, which is quite a big limitation in federated learning. However, this crucially limits the practical applicability of the proposed approach, since federated settings are typically characterized by a communication bottleneck. In contrast to federated SGD, federated averaging avoids this bottleneck by exploiting the availability of local computational resources to learn a global model with significantly fewer communication rounds. I am thus uncertain whether the proposed algorithm would be practically relevant for real-world federated learning applications.\n- `The paper does not compare to prior work on group fairness.` While the paper shows that the proposed method can reduce various group fairness metrics in the federated setting, it would be interesting to see how it compares to other methods for group fairness in the centralized setting (e.g., Zafar et al., (2017)). If the method does not outperform prior work in the centralized setting, then it might not be the most promising candidate to consider for the federated setting. An in-depth experimental evaluation of this aspect is definitely needed to motivate the proposed approach. Of course, it may be possible (but unlikely) that prior group fairness methods cannot be extended to the federated setting, but even in that case, the paper should include a detailed discussion to point out the specific limitations.\n- `Various aspects of the experimental section are unclear.` See the questions below for some ambiguities. Moreover, section B.1.1 states that delta is approximately 5 * 10^-5, while section B.2 states that delta is approximately 2.5 * 10^-5.\n- `The proposed method may be susceptible to a potential privacy violation.` The statistics that need to be shared at every round include the number of individuals per protected attribute for every client. Thus, if the server would set the cohort size to 1 and always select the same user, it would be able to reconstruct the number of individuals per protected attribute for that client (even after the addition of noise when using multiple rounds). This presents a potential privacy leak and could be exploited to learn an unfair model with respect to certain sensitive attributes.\n- `Incorrect characterization of prior work.` The paper refers to prior fair federated learning approaches (e.g., Li et al. (2019)) as individual fairness methods. However, these methods enforce uniform performance across all devices, which is neither individual nor group fairness, but a novel notion tailored to the federated learning setting. To view prior work in the individual fairness context, which requires that similar individuals be treated similarly, one would have to consider all clients similar, which beats the purpose of having a similarity notion in the first place. However, I do agree that prior work has not yet studied group fairness in the federated setting (apart from Du et al. (2021), which the paper mentions).\n\n**Questions**\n\n- It is well-known that there is a tradeoff between accuracy and fairness when imposing fairness constraints in machine learning. I believe there is also such a tradeoff in the proposed approach. However, table 2 seems to indicate that fairness can be attained “for free” without losing accuracy (or even increasing accuracy). How can this happen? I suggest conducting more experiments to examine the impact of the various hyperparameters (e.g., the Lagrange multipliers) to better understand this tradeoff.\n- Is the accuracy of 9.3% for FPFL with m = 100 in table 3 a typo or does the method break down completely in this case?\n- How can you increase K in table 3 to 100K if K denotes the population size?", "summary_of_the_paper": "This paper considers the problem that differential privacy disproportionally degrades the performance of minority groups in the federated learning context. To mitigate this problem, the paper introduces a novel method for enforcing group fairness constraints via the modified method of differential multipliers. The paper then shows how to generalize this method to the differentially private federated learning setting. Finally, the paper empirically evaluates the method on two real-world datasets, demonstrating that it achieves high accuracy while significantly reducing various group fairness metrics.", "summary_of_the_review": "While the proposed approach is novel and interesting, various motivational aspects (e.g., comparison with prior work) are unclear or lacking. Moreover, the method is crucially limited by its incompatibility with federated averaging. Thus, the paper does not meet the bar for acceptance in its current form. However, I am willing to increase my score if my concerns are addressed.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works.", "empirical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works."}, "extra_text": {}}, {"review_id": "gBIvsCJ8T6", "reviewer": "Reviewer_FrAm", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Pros:\n\nI think the solution is very elegant as the empirical version of the group fairness (as considered e.g. by Agarwal et al., 2018; Fioretto et al., 2020) can be just added to the DP-SGD training. \n\nThe empirical results are convincing: there only a small drop in test accuracy for considerable increase in fairness (as measured by the 'FNR Gap').\n\nThe paper is very well written (except for few parts detailed below) :\n\nCons:\n\nSome weaknesses regarding the presentation (these are fixable I believe) :\n-I cannot find there EO Gap, DemP Gap and PP Gap of Tables 1 and 2 explained anywhere. What are those?\n-I cannot find any parameters for the DP training in the main text (what was the epsilons / noise level etc.?)\n\nThe role of hyperparameter tuning does not seem to be addressed really (at least in the main text). I would be slightly concerned about the fact that the constrained optimisation adds (as far as I see) two hyperparameters (for both SGD and DP-SGD). Especially in DP case this might cause problems (cf. DP hyperparameter tuning, e.g. Liu and Talwar (2019)).\n\nQuestions:\n\n-How does the size of the model affect the results? In DP, things get more difficult as the dimension increases, does it affect here?\n\n-There now two additional parameters compared to DP-SGD (for which rigorous hyperparameter tuning already\nseems quite difficult). How would you tune the parameters in practice? How sensitive are they?\n\n\nOther:\nThis sounds a bit funny:\n“where each sample $z_i$ belongs to a group $a_i \\in A$. “\nperhaps simply “belongs to a group $A$”. ?\n\n-I think that Table 3 would be much more readable if you would write out those abbreviations the way you do in Tables 1 and 2.\n\n- I did not check all the details from the supplementary material, but I think it would be good to add more description of the models (e.g. number of parameters, number of layers etc.) to the main text. \n", "summary_of_the_paper": "The fact that DP (and in particular DP-SGD) makes models unfair (e.g. disparate impact on accuracy for minor groups) is well known (Bagdasaryan et al., 2019), however it is possible to have a satisfying trade-off between these ethical measures (Jagielski et al., 2019; Cummings et al., 2019).\nI think this seems like an elegant solutions for forcing fairness in DP gradient optimisation trained models.The solution uses classical constrained optimisation (the modified method of differential multipliers) and directly uses an empirical estimate of the group fairness to form the differentiable constraint function.\n", "summary_of_the_review": "All in all very nice and elegant looking contribution. However quite a few questions remain, I would be happy to see this paper accepted in case the authors can make those small modifications (that I have listed) and also address my questions.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "dZkVIk1HkQ", "reviewer": "Reviewer_cNjj", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The paper considers a timely and important problem that considers both fairness and privacy; however, the paper has a lot of room for improvement and also the experimental section and results obtained have some flaws and a lot of room for improvement.\n\nStrengths:\n1. Paper is considering a timely and important problem.\n2. Paper is easy to follow and clear.\n\nWeaknesses:\n1. Some important literature review is missing and more importantly these could have been considered as a baseline for comparing their method against methods that are trying to enforce group fairness in FL such as: Cui et al. 2021 Fair and Consistent Federated Learning.\n2. Not enough baselines for Fair FL is considered to compare against. It is true that they might not satisfy privacy considerations, but they could still be included for the reader to have intuition of how your method compares against such methods especially that the results are not promising in the paper. Some baselines to consider is Cui et al or Tran et al. Authors claim that they do not compare with Tran et al since Tran et al does not consider privacy, but still I believe these types of results should be included as I am not sure now how effective your approach is in enforcing fairness compared to such baselines.\n3. How do authors justify some of the incompatibility results shown in previous work between fairness and privacy?\n4. Algorithm 1 can be improved. e.g., What do clients do? What is UpdateMultiplier? What is UpdateParameters? What is Calculate noiseScale?\n5. Results are not promising for predictive parity among groups! Discuss why? There is also reduction in accuracy. Perhaps having the baselines that I suggested could improve and give us a sense of what other methods achieve in terms of loss in accuracy etc.\n6. In Table 2 put the results for the central setting as well.", "summary_of_the_paper": "In this paper, authors propose a federated learning algorithm that is able to satisfy group fairness while maintaining privacy.", "summary_of_the_review": "I think the paper is missing discussion on important previous and related work as well as not including them in the results as baselines. Baselines should be added along with discussion around some of the results which does not seem to be promising. More details can be found under weaknesses discussed above.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "VeNdB4mhBdY", "reviewer": "Reviewer_jvmJ", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "- The discussion in the last paragraph of page 2 is confusing. What additional term is considered in this paper? \n\n- The extension to private federated learning seems straightforward. I think the main contribution of the paper is adapting the MMDM algorithm to satisfy fairness constraints. Aggregating $v^k$'s in (11) with clipping and adding Gaussian noise is standard. Similar techniques have been proposed in the federated learning literature.      \n\n- The differentiable estimation of $F(d';w) $ is provided for very special cases without any theoretical guarantees on the estimation error in Section 3.1. \n\n- The construction of subsets $d'$ and $d'_a$ is confusing. It seems that these subsets may depend on $w$ in general for example for accuracy parity, which makes the optimization problem in (P2) more difficult.\n\n- Problem (P2) introduces additional hyperparameters such as $c$ and $\\gamma$. It is not clear how those parameters are set. In practice, tuning additional hyperparameters is challenging. It is important to understand how sensitive the accuracy and gaps reported in Section 4 are to the choice of additional hyperparameters.  \n\n-  The authors introduces cohort size in Section 3.2 without providing much explanation. It will be nice if the authors provide further clarifications. \n\n\nMinor comments: \nEquation (11): what is $k'$? should it be $k$ instead?\n\n", "summary_of_the_paper": "This paper studies the problem of training neural networks with differential privacy and fairness guarantees. The authors proposed an algorithm using a modified method of differential multipliers. In terms of group fairness, the authors focus on false negative rate parity and accuracy parity notions. They compare their proposed algorithm with federatedSGD and its variants with clipping and adding noise.", "summary_of_the_review": "Several aspects of the proposed method should be clarified, and I think that the extension of the MMDM with fairness constraints to the federate learning is marginally significant. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper continues the investigation on fairness and privacy in the context of federated learning. We appreciate the detailed response from the authors. During the rebuttal period, the authors have largely updated the set of experiments, since there was an identified bug in the previous implementation. Another drawback that the AC identified is that there is a lack of formulation and formal guarantees in the paper. In particular, is the proposed algorithm trying to satisfy example-level or client-level data privacy? The resulting noise scale can be quite different. Unlike prior work (e.g. Jagielski et al), the proposed algorithm does not seem to provide any fairness guarantee. Thus, it is not clear why the proposed approach is justified (even under some assumptions). In a similar vein, perhaps the authors could consider a more in-depth discussion that compares their approach with prior work and articulate what advantages does their new method offers. Overall, the paper is not ready for publication at ICLR.
Decision: Reject