Synergistic Neuromorphic Federated Learning with ANN-SNN Conversion For Privacy Protection
Authors: Yingni Chen
Shikuang Deng
Yuhang Li
Xin Dong
Shi Gu
Venue: Submitted to ICLR 2023 (2023)

Abstract: Federated Learning (FL) has been widely explored for the growing public data privacy issues, where only model parameters are communicated instead of private data. However, recent studies debunk the privacy protection of FL, showing that private data can be leaked from the communicated gradients or parameters updates. In this paper, we propose a framework called Synergistic Neuromorphic Federated Learning (SNFL) that enhances privacy during FL. Before uploading the updates of the client model, SNFL first converts clients' Artificial Neural Networks (ANNs) to Spiking Neural Networks (SNNs) via calibration algorithms. In a way that not only loses almost no accuracy but also encrypts the client model's parameters, SNFL manages to obtain a more performant model with high privacy. After aggregation of various SNNs parameters, server distributes the parameters back to clients to continue training under ANN architecture, providing smooth convergence.  The proposed framework is demonstrated to be private, introducing a lightweight overhead as well as yielding prominent performance boosts. Extensive experiments with different kinds of datasets have demonstrated the efficacy and practicability of our method. In most of our experimental IID and not extreme Non-IID scenarios, the SNFL technique has significantly enhanced the model performance.  For instance, SNFL improve the accuracy of FedAvg on Tiny-ImageNet by 13.79%. In the IID situation of tiny-ImageNet, for instance, the SNFL method is 13.79% more accurate than FedAvg.  Also, the original image cannot be reconstructed after 280 iterations of attacks with the SNFL method, whereas it can be reconstructed after just 70 iterations with FedAvg.


Under review as a conference paper at ICLR 2023
SYNERGISTIC NEUROMORPHIC FEDERATED LEARNING WITH ANN-SNN CONVERSION FOR PRIVACY PROTEC- TION
Anonymous authors Paper under double-blind review
ABSTRACT
Federated Learning (FL) has been widely researched for the growing public data privacy issues, where only model parameters, instead of private data, are communi- cated. However, recent studies debunk the privacy protection of FL, showing that private data can leaked from the communicated gradients or parameter updates. In this paper, propose framework called Synergistic Neuromorphic Federated Learning (SNFL) that enhances privacy during FL.. Before uploading the updates of the client model, SNFL first converts clients' Artificial Neural Networks (ANNs) to Spiking Neural Networks (SNNs) via calibration algorithms. In a way that not only loses almost no accuracy but also encrypts the client model's parameters, SNFL manages to obtain more performant model with high privacy. After the aggregation of various SNNs parameters, the server distributes the parameters back to the clients. This design offers smooth convergence to continue the model training under the ANN architecture. The proposed framework is demonstrated to be private, introducing a lightweight overhead as well as yielding prominent performance boosts. Extensive experiments with different kinds datasets have demonstrated the efficacy and the practicability of our method. In most of our experimental IID and not extreme Non- IID scenarios, the SNFL technique has significantly enhanced the model performance. For instance, SNFL improves the accuracy of FedAvg on Tiny-ImageNet by 13.79%. Besides, the original image cannot be reconstructed after 280 iterations of attacks with the SNFL method, whereas it can be reconstructed after just 70 iterations with FedAvg.
INTRODUCTION
Recent advancements in machine learning, particularly deep learning, rely heavily on large data sets to obtain decent inference performance. Due to the growing demand for data, is now necessary to feed models with information from multiple entities. However, this transfer, exchange, and trade of data among entities may violate the General Data Protection Regulation (GDPR) and get punished by the Act (Wachter, 2018), posing an unprecedented challenge the field of machine learning. Federated learning (McMahan et al., 2017) then emerges and flourishes as a approach by training shared model collaboratively while keeping data locally. Despite that the data are stored locally, clients that join the federated learning need to transmit their local gradients the server update the shared model. Recent studies Zhu & Han (2020); Zhao al. (2020); Huang et al. (2021) have revealed that sensitive local data could be leaked from these transmitted local gradients via model inversion attack Zhu & Han (2020). To defend against such kind of attack and prevent privacy leakage, defense strategies including differential privacy (Geyer et al., 201 7), secure taltipppryy computation (Byrd Polychroniadou, 2020), and MixUp (Zhang et al., 2017) have been developed. In exchange for privacy, the cost is then either severe computational overheads (Hardy et al., 2017) or unavoidable accuracy losses (Kim et al., 2021).
What's the intrinsic source of privacy in these defense strategies? If we consider this question from an information theory perspective, decryption steps for clients and servers when partial encryption information is kept locally only. From this standpoint, as long as an encryption method capable of inevitability between clients and servers while still allowing for effective aggregation, it would be feasible to improve the privacy
is indeed the asymmetry of entropy in the encryption and

---

Under review as a conference paper at ICLR 2023
Server
Upreed
Server Model
Local Data
Client Model
VW,
Standard FL
+ Client
Bownlead
Oesearsion
SPFL
Client
sntrot BIGS
11
VW,
8 Loce ltsta
BBB Locil Datts Cliene N
Model
>Prdd L
(0.08,4-002,0.... 0.7
Leaal
Client
Figure 1: Right: Workflow of Synergistic Neuromorphic Federated Learning with ANN-SNN Conversion (SNFL). Left: Each client communicates parameters VWA generated by the model trained on private local data. The attacker updates randomized dummy input and label to minimize the gradient distance VW WWIl. When the optimization is complete, the attacker can obtain the training set from the client. However, in SNFL, the client's model has been converted and calibrated to SNN before communication.
for federated learning. Recent progression in neuromorphic computing, especially the conversion from traditional artificial neural networks (ANNs) to spiking neural networks (SNNs) (Deng & Gu, 2020), provides pair of source ANN and target SNN that both achieve high accuracy, with the source ANN not recoverable from the resulted SNN (Li et al., 2021b). This property fits naturally with the demand for privacy protection in federated learning. Indeed, if we train ANNs clients and only send the converted SNNs with partial parameters to the server for aggregation, we can then expect obtain a feasible privacy-protected FL algorithm with an effective parameter-sharing paradigm. In addition, such an ANN-SNN conversion is lightweight and performance preseevvnn (or even performance-improoingg by careful design. Fig. illustrates the pipeline of our proposed method.
Besides the natural feasibility SNNs (Esser et al., 2016; Kim al., 2019), this synergistic framework also brings two additional benefits that special for federated learning. First, in contrast to existing noise injection methods (e.g., differential privacy Geyer et al. (2017)), our ANN-SNN conversion process is optimized to improve performance by fine-tuning SNN's weights rather than trading off performance drop versus noise level. As a result, our method is able to achieve even better performance against standard federated learning. Second, the SNN emits discrete spikes and is not differentiable, thus the induced synergistic FL. could be more robust to small perturbations and adversarial attacks like white-box attacks (Liang et al., 2021). Our contributions summarized as follows:
Innovation/Privacy: We design a federated learning framework where the server and clients run two different models in servacc--preeervnnn manner our work is one of the first to train different types of neural network models on server and clients.
solution. To the best of our knowledge,
Accuracy: Compared the conventional approach, extensive experiments validate SNFL can deliver similar or superior accuracy relative to other common methods.
Effectiveness: Based on the SNFL framework, we analyze the backdoor attack and develop a method to simply detect it through abnormal SNN thresholds.
RELATED WORK
2.1 FEDERATED LEARNING (FL)
In federated learning, each client computes model update, i.e. gradient, on its local data. While sharing gradients was assumed to leak little information about the client's private data, recent papers (Zhu & Han, 2020: Zhao et al., 2020; Huang et al., 2021) devised "gradient inversion attack" in which an attacker listening to one client's communications with the server can begin to reconstruct the client's private data. To defend against this, methods such as gradient clipping (Sun et al., 2019),
2

---

Under review as a conference paper at ICLR 2023
perturbing gradients (Zhu & Han, 2020), and robust aggregation (Blanchard al., 2017; Goryczka & Xiong, 2015; Yin et al., 2018) are commonly used.
2.2 SPIKING NEURAL NETWORK (SNN)
Conventionally, there two distinct routes obtain deep SNN (Deng al., 2020):(1) direct training SNN from scratch, and (2) converting pretrained ANN to SNN. In this work, we mainly focus the conversion-band based method. ANN-SNN conversion directly reuses the features learned in ANN to obtain performant SNN. However, it requires trade-off between inference latency and task performance. Data-based normalization (Dichl et al., 2016) and threshold balancing (Sengupta et al., 2018) are the basic methods of ANN-to-SNN conversion. Then Rueckauer et al. (2016); Han et al. (2020) propose the soft mechanism to reduce information loss by membrane potential reset. Recently, Deng & Gu (2020) analyze the conversion error and propose shift method reduce it by half. Li et al. (2020) propose a light pipeline and an advanced pipeline, which apply layer-wise calibration algorithms to modify the network parameters to diminish the conversion error, significantly reducing the required simulation length. We adopt the layer-wise calibration algorithm for high-performance and low-latency SNN in the SNFL framework.
3 PRELIMINARIES
In this section, briefly introduce the concept and the baseline method for Federated Learning (FL). We also point out the privacy issue in FL, which can lead to the leakage of user data.
Federated Learning (FL). FL enables mobile devices to collaboratively learn shared prediction model while keeping all the training data on device, decoupling the ability to do machine learning from the need to store the data in the cloud. Formally, assuming have K clients, the optimization objective in FL is to solve the following empirical risk minimization problem:
min L( 0
(0)),, where (0) ((.. (w., yoi 0).
Here, 0 is the model parameters vector and (6) denotes the loss function of evaluated the i-th client's ' dataset D,, (z,, y4) is the input-label pair on D:. The goal of this objective is to achieve minimum average loss each client. We assume {D: 1KK are randomly sampled from Dirinn where both IID sampling and Non-IID sampling are considered in this work.
To ensure the minimization of average loss all clients while not sharing the local input data, the clients will upload their model parameters to the server periodically. A communication round is used for client upload, server aggregation, and server distribution. Here introduce the FedAvg (McMa- han et al., 2017) communication for client-server update.
In the r-th communication round, each client uploads it's local model parameters change A to the server. The ervser aggregates the local model updates from all participating clients, given by
g(r)= - g(r- + A0
1 K
after which the server distributes the aggregated parameters (0(r) to clients. Upon receiving the aggregated parameters from server, the clients start their own local learning using the private datasets, i.e., {D;} which creates new model parameters update for the next
round A0." (++)) given by
A8 (
17, Vocr ((n (x; yr. (()))
(3)
where 7); is the learning rate in local learning. The clients usually update multiple iterations with gradient descent (we only show one update in above equation).
3

---

Under review as a conference paper at ICLR 2023
Gradient-Inversion Attack. Proposed in Zhu & Han (2020), the Deep Leakage from Gradients (DLG) attack can utilize the gradient information to reverse the private local data and the label information, that is, given the model parameters update A0; one can obtain the similar (æ,, 36) pairs. This is done by mimicking the real gradient (also the parameters update, see Eq. (3)). Formally, DLG first randomly initialize a dummy input and dummy label (ar v(), and optimize them by minimizing the discrepancy between real gradients and current gradients, given by
min mx 2.
Vol(ar v() Vol(m, yill + aR((x')
where Vol(2; Y:) is the real gradient uploaded to the server. R(x') is an image prior loss function with a as the coefficient. The current gradient Val(ar therefore, can made as close as possible to the real gradient and generate corresponding input data and label.
So far, some defensive methods have been proposed. For example, Gradient Pruning (Zhu Han, 2020), Gradient Noise (Zhu & Han, 2020), and Mixup (Zhang al., 2017) aim to provide less or distributed information in gradients. However, these methods sacrifice task performance for better privacy. In this paper, we seek method for preserving privacy during federated learning while not jeopardizing its accuracy.
4 METHODOLOGY
In this section, we introduce our method both Artificial Neural Networks (ANNs) and Spiking Neural Networks (SNNs) for privacy-preserving federated learning.
4.1 SPIKING NEURAL NETWORKS
Compared to artificial neurons ie., ReLU: max(0, z),, spiking neurons are biologically-inspree.
where each neuron maintains variable dubbed membrane potential v. Here, we describe the dynamics using the iterative expression of the Integrate-and-Fi (IF) neuron model (Liu & Wang, 2001), which is favorable for ANN-SNN conversion regime (Rueckauer et al., 2016; Han al., 2020). Formally, at time step t, the IF neuron receives the pre-synaptic input, and then charges the membrane potential, given by
(t)) = v(1)+ + I(1), s()) 10 Vir of Vin
v(t + 1) x(t) - s(1),
(5)
otherwise
where (() is the pre-synaptic input calculated by the weights W and the spike s from last layer. As long the membrane potential exceeds the firing threshold Vin, the neuron will clicit spike otherwise, will stay silent. For fired neurons, the membrane potential will be reset by subtraction, ie., the third term in Eq. (5). Noting that the threshold yt! further apply weight normalization (Diehl et al., 2016) to convert the output {0, v-(1 to a binary spike f0, 1}.
th differs between layers, the server can
4.2 SYNERGISTIC NEUROMORPHIC FEDERATED LEARNING
In the conversion from a source ANN to target SNN, the discrepancy of output activation between the two networks will accumulate layer-by bayer, resulting in significantly different output at the final output layer. To address this issue, layer-wise parameter calibration technique (Li et al., 2021b) is proposed to adjust the SNN parameters so that its activation frequency gets close to the activation in the source ANN. Mathematically, denote the average spike rate over time in SNN is 8, we can write the conversion error as e = a 8, where a is the activation in source ANN. For each channel c, the average activation is then calculated as (o(a) (a= = 1 Σn Σj To,i.j. where w, h are the width and height of the feature. The bias calibration (BC) algorithm computes the spatial mean of the error term, given by
wh
pe(e) = (a) (alp)-J-oh (s).
Afterwards, (e( can be added to the c-th channel of bias term b in SNNs. When calculating (e).). we need to estimate (a(aa) and (z based on a small calibration dataset (e.g. 128 images), which not accessible on the server set. Given that the small calibration dataset is subset of the client's
4

---

Under review as a conference paper at ICLR 2023
private dataset and differs between clients, the attacker will be unable to recover every client's pele). Our framework can take advantage of this algorithm to encrypt the gradient information, therefore improving privacy in FL. The overall pipeline (Algo. 1) in our SNFL is described follows:
Client Eneryption. Before uploading the parameter updates to the server, the clients convert the ANN models into SNN models. The conversion first replaces all the ReLU neurons into IF neurons. Due to there is no corresponding module in SNN for BN layer, Rueckauer et al. (2017) propose to absorb the BN parameters to the weight and bias, which can be represented as Ws + 3 by < 8 + (bΛ 1)) 2, where WA, ba are the weight and bias of ANN model, Ws, by are the weight and bias of SNN model, Js, a are the running mean and standard deviation and 7, B are the transformation parameters of the Batch Normalization (BN) layer. Then, all clients run bias calibration algorithm to update the bias parameters for SNN. Note that each local BC process will infer its own local model using its private dataset to record some activation, i.e., a, and for the i-th client's ANN and SNN. The bias parameters can then be calibrated as b < b'g + (uaa)) - [=s;). Because the curious server couldn't recover u(a.)) - u(8c), and that couldn't 't recover by from U'g. it couldn't possibly recover ba- The BC algorithm has two advantages: (1) the uploaded SNN has higher accuracy since its parameters are calibrated, and (2) the uploaded parameters are not the same as the original ANNs, which prevents leakage from gradients. In the sharing step, clients send parameters to the server, which include the weight (W5), bias (b3'). threshold (V*) of SNN models as well BN layer (7', oa, p²) ) of ANN models.
Server Aggregation. In the global communication round, the server will receive the encrypted parameters from clients. Then, on the server side, we apply FedAvg (MeMahan et al., 2017) (cf. Eq. (2)) to aggregate the massive clients updates. The server averages parameters uploaded by all clients to obtain the averaged SNN model (W3, 6g. V and BN layer parameters (7 o g μ v where the subscript S/A indicates that the parameters are from the SNN or ANN model and the superscript S indicates that the model is owned by the server. Thus, the aggregated model is also SNN. Since SNN has discrete spikes, it might be less sensitive to a small amount of random noise, which leads to the robustness of SNN (Venkatesha et al., 2021). In practice, we find that the aggregation of SNNs loses less task performance than that of ANNS in most cases. Note that clients do not require the aggregated SNN's parameters. So the server has to take an additional step while processing the WA from each client to obtain the parameters that clients require. The server gets WA + W from the i-th client and then applies (cf. Eq. (2)) to aggregate all WA from clients to obtain W which is the parameter required by clients. In the sharing step, the server sends WSS 7 o ,. u to each client.
Server Distribution. Following the FedAvg setting, clients use these parameters updated by the server recreate the ANN model and continue to train the ANN using the local dataset. Note that clients will not receive the updates of bias parameters from the server; rather, they continue to use their original ANN bias (before calibration) for the next round of training. On the client-side, they lose less information compared to FedAvg since the bias parameters are kept intact, which helps them learn a better local model. On the server-side, it always uses SNN model for evaluation.
EXPERIMENTS
In FI., it is frequently vital to consider the presence of semi-honest buturiouu adversaries for the sake of privacy protection. The adversary is honest in the sense that he/she faithfully follows the collaborative learning protocol, but he/she may be curious about the training data of other participants. On the one hand, given the presence of semi-honest partners, private data must be kept as secure as possible, while certain amount of information must be transferred across parties for the sake of learning utility. In this section, we conduct experiments to demonstrate the benefits of SNFL in protecting privacy and, in most cases, improving accuracy.
5.1 PRIVACY
The parameters that the server can get are (r)(r) - 1), (W Wa()) W (r--1) 1), (br(r) = 1/ (r(r) b'(r- 1y, where is the global round and i is the i-th client.
5

---

Under review as a conference paper at ICLR 2023
Algorithm 1 Synergistic Neuromorphic Federated Learning (SNFL)
Intut:Set of K clients with local datasets; the local minibatch size, Et is the number of local epochs, Eg is the number of Global communication round, and 1 is the learning rate. fsg is the global SNN model of server, fsz is the local SNN model of client, fAL the local ANN model of client
Parameter:
Output: Well-trained model JsG
Algorithm: MAIN
1: Initialize global SNN model fsG and local ANN model fAL with random weights
2: for round m + 0 to EG do
3: Broadcast the weight parameters of current global ANN model w/ fsa all clients
4: for Client 4 0 to K do
5: Transplants w' local ANN model fAL
6: for epoch < 0 to Eg do
7: Train f'A. with local private dataset
8: end for
9: Perform ANN-TO-SNNO and obtain fsL
10: end for
11: Randomly select P participating clients
12: Aggregate the parameters of fsL using FedAvg and obtain fsc
13: Send fsq parameters to the clients
14: end for
ProcedureeANN-ro-SWW ()
1: for all = .. p-th layers in the ANN do
2: Collect input data (:(1) ,output data (+++) in one batch
3: Get MMSE threshold v-(() using grid search
4: Get SNN output g(++1)
5: Compute Error term e(++ = x (1+ g(i+1)
6: Calibrate bias term b(i) < b(i) p(ett1)
7: end for
8: output Converted SNN model
Attack on SNN model: We employ gradient inversion attack (Zhu & Han, 2020) (ef) Eq. (4) on LeNet (LeCun et al., 2015) with batch size and optimize for 280 iterations. We use CIFARIO (Krizhevsky et al., 2010) to evaluate the attack and defense performance. The leaking process is visualized in Fig. (a). This attack can recover every image from ANN model gradients. However, when the model is converted into SNN, the attack is rendered ineffective. This is because, as mentioned in 4.2, SNN replaces the differentiable ReLU neurons into non-differenniable IF neurons. For SNN, there is no gradient.
Attack ANN model converted from SNN model: We also consider
where attacker ignores the bias calibration and forcibly converts the SNN model to an ANN model. We employ a more sophisticated gradient inversion attack (Huang et al., 2021) ResNer20 (Sengupta al., 2018) with a more realistic setting in which the attacker is unaware of the exact batch size. ANN1 SNN + ANN2. The difference between AN N2 and ANN1 is the value of bias. As shown in Fig. 2 (b), the images reconstructed by ANN2 are more blurry than the images reconstructed by ANNI.
5.2 ACCURACY
Implementation Details: We perform experiments on widely adopted benchmarks CIFAR10 (Krizhevsky et al., 2010), CIFAR 100 (Krizhevsky et al., 2010), and ImageNet (Russakovsky et al., 2015). To simulate federated learning scenario, we randomly split the training set of each dataset into N parties, and assign one training party each client. Namely, each client owns its local training set. We are interested in different partitions: IID and Non-IID, where the overall label distribution across clients is the same in the IID setting, whereas class proportions and the number data points of each client are unbalanced in the Non- RoD-IID setting. Especially, for the Non-IIID setting, impose data shift follows (Li et al., 2022): The size of the local dataset D
constructed from

---

Under review as a conference paper at ICLR 2023
reconstructed
reconstructed
Original
(ANN)
(ANN from SNN)
ANN
20
00
Ecr
SNN
(a)
(b)
Figure 2: Results of gradient inversion attack. The left half shows the attack on ANN model and SNN model, respectively. The right half shows the attack ANN model and ANN model reconverted from SNN model.
Table I: Accuracy(%) on I0, CIFAR100, and TinyImageNet test dataset with IID. "P" means the number of participating clients. "Client Accuracy" shows the mean and variance of all clients' ANN models. "Server Accuracy" is the accuracy of the server model."S- means applying SNFL.
Dataset
P
FedAvg
S-FedAvg
FedProx
S-Fedprox
MOON
S-MOON
SOLO
Client Accuracy
5
94.4+0.06
94.7+0.06
94.6#0.06
95.4+0.05
94.8+0.08
95.3+0.04
89.640.18 18
10
92.0=0.11
93.1+0.07
91.4=0.88
95.1=0.09
92.9=0.07
94.7=0.09
84.2=0.89
CIFAR10
15
88.6#0.18
91.1+0008
84.8+0.10
95.0=0.12
89.5=0.09
94.4=0.08
79.7=1.07
5
70.1
71.4+0.22
70.3+0.12
72.8+0.39
71.5=0024
72.2=0.56
52.4
10
67.0=0.13
68.9+0.11 17
67.5=0.19
72.8+0.18
69.2+0.10
72.1=0.45
40.2=0046
CIFARIO0
15
60.2+0.26
66.8+0.19 19
59.7=0.11
71.7=0.22
67.2-0.21
71.7=0.30
31, 31.4+2.50
5
39.0+0.02
43.7+0.01
38.2+0.01
41.7+%0.00
25.2+0.12
34.6#3.08
19.5=1.45
10
31.0=0.01
41.3+0.03
29.9 0.0
39.2+0.02
21.5=0.38
34.9=1.22
9.38=0.66
+0.02 15
35.9+0.04
06.520.02
37.7+0.31
18.2+0.22 24
32.8=0.84
5.31
Server Accuracy
5
94.5
95.2
94.6
95.2
94.9
94.4
10
92.2
95.3
91.6
95.1
92.8
94.6
CIFARIO
15
88.8
94.8
85.0
95.0
89.5
94.3
5
70.2
73.1
70.4
73.5
72.2
73.6
10
62.1
72.3
67.8
73.5
69.6
73.0
CIFARIO0
15
60.9
72.4
60.1
72.0
68.0
72.2
38.9
43.4
38.2
41.5
30.5
35.2
10
31.1
41.3
30.0
38.7
25.9
35.5
Timy-ImageNe
15
22.9
35.9
26.6
35.9
20.9
33.4
varies across clients. We sample q Dir (3) and allocate di proportion of the total data samples to client i. We should note that if [3 is set to smaller value, then the partition is more unbalanced. we use q Dir (B) to denote such a partitioning strategy.
For all the experiments, we use ResNet20 (Sengupta et al., 2018) architecture and SGD optimizer with weight decay of le-5 and momentum of 0.9. The adopted learning is 0.1, which is multiplied by 0.1 at communication rounds 61 and 96. We set the total global communication rounds Eg at 100 and train each client for E, 5 epochs in every global communication round. The simulation length T of SNN model is 256.
Baselines: (1) FedAvg (MeMahan et al., 2017): it involves multiple local random gradient updates
on the client nodes, followed by server model averaging updates. (2) FedProx(Li et al., 2020): it improves the local objective based on FedAvg and introduces an additional L2 regularization term in the local objective function to limit the distance between the local model and the global model. A yu is introduced to control the weight of the L2 regularization.
(3) MOON (Li et al., 2021a): it corrects the local updates by maximizing the agreement of representation learned by the current local model and the representation learned by the global model. (4) SOLO: each client uses local private data train its own model without communicating with others.
7

---

Under review as a conference paper at ICLR 2023
Table 2: Accuracy(%) CIFARIO and CIFAR100 with different degrees of Non-IID. There 10 participating clients.
Dataset
Partition
FedAvg
S-FedAvg
FedProx
S-FedProx
MOON
S-MOON
(2.0)
92.15
94.74
92.54
94.87
92.59
94.74
9 D (1.0)
90.83
94.6
91.8
94.45
91.83
94.6
CIFARIO
9 ~ D (0.5)
88.67
86.88
89.97
93.88
90.95
93.38
Dirn (2.0)
68.81
72.54
68.52
72.4
69.07
73,95
Dirx (1.0)
66.3
72.47
67.58
71.78
70.27
73.02
CIFARI00
9 D (0.5)
68.17
71.47
67.81
71.63
70.23
72.29
Table 3: The impact of bias. "VIx" denotes whether to do bias calibration (BC), whether the server shares its bias with clients (Bias Back). "T=" means the simulation length T of SNN model. The dataset is CIFARIO.
BC
Bias back
T=64
T=128
T=256
X
94.46
95.08
95. 14
X
/
94.4
94.82
95.00
V
94.75
95.05
95.14
V
/
94.51
94.91
95.08
Validation in the TID Case: Since real-world federated system involves many devices, a federated learning model must be scalable with the number of devices. In this experiment, verify the cases of 5, 10, and 15 clients, respectively, As shown Table. 5.1, we present the test accuracy on all datasets before and after applying SNFL.. From horizontal perspective, it can be observed that applying SNN-conversion increases accuracy for all baseline methods, even with an accuracy gain of up to 13.7%. This is particularly inspiring because SNPL requires modification the original federated training process. One can easily get considerable accuracy profits by simply post-processing the trained global model. Comparing the accuracy gains of different methods after applying SNFL and whole data calibration, we find that FedProx and MOON have the greatest improvement. From the vertical, the accuracy of baseline methods using SNFL drops more slowly the number of clients increases. For example, on CIFAR 100, when 5 clients participate, the accuracy of S-MOON is 0.71% % higher than MOON, while the difference between S-MOON and MOON increases to 4.46% when 15 clients participate. This reflects the SNFL benefits that are better suited to the federated learning situation with large number of clients.
A key challenge in FL is the Non-IID data among the parties. As shown in Table. 5.2, although accuracy decreases to varying degrees as / decreases, SNFL can still increase the performance of model, with MOON and Fed seeing the most benefit. For instance, CIFARIO, when = 0.5, S-FedProx is 3.91% % higher than FedProx and S-MOON is 2.43% higher than MOON.
Validation in the Non-IID Case:
5.3 BIAS ANALYSIS
Compared to FedAvg, SNFL has two different operations on bias. (1) In the conversion between ANN and SNN. one client uses its local private data to calibrate the SNN model's bias. (2) When sending back server's 's model to clients, standard FL returns all parameters of server's 's model including bias, but the server SNFL. keeps bias as a private key and does not share it with clients. Since both clients and server use bias as their private key, SNFL secures the privacy of all parties to some extent. To investigate the effect of the above two operations on bias, we design four ablation studies (Table. 5.2). It can be seen that the extra BC operations have significant effect the final server accuracy when clients use their own saved bias instead of the server's 's bias. There a slight increase in accuracy if the server does not share its bias with clients. In other words, maintaining the performance the model, rather than trading precision for privacy as in previous studies.
protecting privacy while
8

---

Under review as a conference paper at ICLR 2023
NartiD NarttD-g-..9
24
12 Zyy Grokii
18L0
Uii 11.0
Prlconclir Nortol cater
Poscce cota
10
kod daolaed
Laga
Figure 3: Bias and threshold analysis. (A) The 1.2 distance between the true bias and the inferred bias. (B) Scatter image for the thresholds of the last two layers. 2/10 clients are attack clients. (C) The thresholds comparison between the normal clients and the poisoned clients. The dataset is CIFARIO.
Then, we simulate an honest but curious server, which attempts to infer one client ANN's full parameters. In this experiment, we used 10 clients with IID and Non-IID (q ~ Dir (0.5)) Since the malicious server cannot directly access the bias of ANN in SNFL, it can only calculate new bias using the bias of SNN and ANN's BN parameters. Fig. (A) shows the L.2 distance between the true bias and the inferred bias. In the IID case, the disparity between them is much greater than in Non-IID case, showing BC needs more huge bias shift (more huge difference between ANN and SNN) when layer-by-layer calibration in the IID case.
5.4 BACKDOOR ATTACK AND DETECTION
In federated learning, backdoor attack (Bagdasaryan et al., 2020) attempts to cause the model to make wrong judgments about data with certain characteristic (trigger), but the model does not affect on the main task. In other words, the attacked model still exhibits high accuracy the test dataset, but its output will be different from the output of the clean model when input activates the backdoor trigger. Since the server cannot access the client's 's training data in federated learning, it is difficult to determine whether the global model has been poisoned through data detection.
In recent paper (Bhagoji al., 2019), the server identifies the abnormal client based on clustering or mean detection on the model weight and bias. However, these detection methods are cumbersome since the number of parameters in ANN is enormous, e.g., the number of parameters in ResNet20 has reached over million. For SNFL, the server adopts the SNN model, which has a special type of parameter called "threshold". As shown in Fig. 3 and C, find that the thresholds (only 20 thresholds in ResNet20, including the converted pooling layer) of poisoned clients and normal clients significantly different. The distance between the normal clients' threshold and the cluster center is less than 17.62, whereas the distance between the poisoned client and the cluster center is more than 103.53, making the distinction very clear.
6 CONCLUSION
In this paper, we propose that SNFL, a simple FL framework, protects privacy while improving model accuracy in most cases. To the best of our knowledge, this the first paper that allows clients and server to use different types of neural network models. SNFL can be thought of as lightweight encryption component add-on for any global federated objective. We investigate the root cause of its privacy from both theoretical and experimental perspectives and conduct experiments to demonstrate that the framework does not jeopardize the model's 's performance. Empirical results demonstrate that SNFL result in both more privacy and more accurate models compared with the strong baseline. Our work suggests several interesting directions for future studies, such as exploring the applicability of SNFL to other attacks and its ability migrate other algorithms.

---

Under review as a conference paper at ICLR 2023
REFERENCES
Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. How to backdoor federated learning. In International Conference on Artificial Intelligence and Statistics, pp. 2938-2948, PMLR, 2020.
Arjun Nitin Bhagoji, Supriyo Chakraborty, Prateek Mittal, and Seraphin Calo. Analyzing federated learning through an adversarial lens. International Conference on Machine Learning, pp. 634-643. PMLR, 2019.
Peva Blanchard, Mahdi EI Mhamdi, Rachid Guerraoui, and Julien Stainer. Machine learning with adversaries: Byzantine tolerant gradient descent. In Proceedings of the 31st International Conference on Neural Information Processing Systems, pp. 118-128, 2017.
David Byrd and Antigoni Polychroniadou. Differentially private secure multi-party computation for federated learning financial applications. In Proceedings of the First ACM International Conference Al in Finance, pp. 1-9, 2020.
Lei Deng, Yujie Wu, Xing Hu, Ling Liang, Yufei Ding, Guoqi Li, Guangshe Zhao, Peng Li, and Yuan Xie. Rethinking the performance comparison between snns and anns. Neural Networks, 121:294 307, 2020.
Shikuang Deng and Shi Gu. Optimal conversion of conventional artificial neural networks to spiking neural networks. In International Conference Learning Representations, 2020.
Peter Diehl, Guido Zarrella, Andrew Cassidy, Bruno U Pedroni, and Emre Neftci. Conversion of artificial recurrent neural networks to spiking neural networks for low-power neuromorphic hardware. In 2016 IEEE International Conference on Rebooting Computing (ICRC), pp. 1-8. IEEE, 2016.
Steven Esser, Paul Merolla, John V Arthur, Andrew S Cassidy, Rathinakumar Appuswamy, Alexander Andreopoulos, David Berg, Jeffrey L. McKinstry, Timothy Melano, Davis R Barch, et al. Convolutional networks for fast, energy infryy-efficient neuromorphic computing. Proceedings of the national academy of sciences, 1 1444)):11411-11440 2016.
Robin C Geyer, Tassilo Klein, and Moin Nabi. Differentially private federated learning: A client level perspective. arXiv preprint 17Xiv:1712.07557, 2017.
Slawomir Goryczka and Li Xiong. A comprehensive comparison of multiparty secure additions with differential privacy. IEEE transactions on dependable and secure computing. 14(5):463-477,
2015.
Bing Han, Gopalakrishnan Srinivasan, and Kaushik Roy. Rmp-snn: Residual membrane potential neuron for enabling deeper high-accuracy and low-latency spiking neural network. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 13558-13567, 2020.
Stephen Hardy, Wilko Henecka, Hamish Ivey-Law, Richard Nock. Giorgio Patrini, Guillaume Smith, and Brian Thore. Private federated learning on vertically partitioned data via entity resolution and additively homomorphic encryption. arXiv preprint 17X1v:1711.1106 2017.
Yangsibo Huang, Samyak Gupta, Zhao Song, Kai Li, and Sanjeev Arora. Evaluating gradient inversion attacks and defenses in federated learning. Advances in Neural Information Processing Systems, 34, 2021.
M. Kim, O Günlü, and R. F. Schaefer. Federated learning with local differential privacy: Trade-offs between privacy, utility, and communication. 2021.
Seijoon Kim, Scongsik Park, Byunggook Na. and Sungroh Yoon. Spiking-yolo: Spiking neural network for energy-efficient object detection. arXiv preprint arXiv:1903.065300 2019.
Alex Krizhevsky, Vinod Nair, and Geoffrey Hinton. Cifar- 10 (canadian institute for advanced research). URL http://ww.. toronto. edu/kriz/cifar himl, 5(4):1, 2010.
10

---

Under review as a conference paper at ICLR 2023
Yann LeCun al. Lenet-5, convolutional neural networks. URL: http://yann. lecun. com/exdb/lenet, 20(5):14, 2015.
Qinbin Li, Bingsheng He, and Dawn Song. Model-contrasivve federated learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 10713-10722, 2021a.
Qinbin Li, Yiqun Diao, Quan Chen, and Bingsheng He. Federated learning non-iid data silos: An experimental study. In 2022 IEEE 38th International Conference on Data Engineering (ICDE), pp. 965-978. IEEE, 2022.
Tian Li, Anit Kumar Sahu, Manzil Zaheer, Maziar Sanjabi, Ameet Talwalkar, and Virginia Smith. Federated optimization in heterogeneous networks. Proceedings of Machine Learning and Systems, 2:429-450, 2020.
Yuhang Li, Shikuang Deng, Xin Dong, Ruihao Gong, and Shi Gu. A free lunch from ann: Towards efficient, accurate spiking neural networks calibration. arXiv preprint arXiv:2106.0698 0669444 2021
Ling Liang, Xing Hu, Lei Deng, Yujie Wu, Guoqi Li, Yufei Ding, Peng Li, and Yuan Xie. Exploring adversarial attack in spiking neural networks with spike-compatible gradient. IEEE transactions on neural networks and learning systems, 2021.
Ying-Hui Liu and Xiao-Jing Wang. fire model neuron. Journal of computational neuroscience, 10(1):25-45, 2001.
adaptation of generalized leaky integrate-and-
Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera Arcas. learning of deep networks from decentralized data. In Artificial intelli- gence and statistics, pp. 2273-1282. PMLR, 2017.
Communication
Bodo Rueckauer, lulia-Alexandi Lungu, Yuhuang Hu, and Michael Pfeiffer. Theory and tools for the conversion of analog to spiking convolutional neural networks. arXiv: Statistics/Machine Learning, (061 2016.
Bodo Rueckauer, Iulia-Alexanrra Lungu, Yuhuang Hu, Michael Pfeiffer, and Shih-Chii Liu. Conver- sion of continuous- deep networks to efficient event-driven networks for image classification. Frontiers in neuroscience, 11:682, 2017.
Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Imagenet large scale visual recognition challenge. International journal of computer vision, 115(3):211-22, 2015.
Abhronil Sengupta, Yuting Ye, Robert Wang, Chiao Liu, and Kaushik Roy. Going deeper in spiking neural networks: Vgg and residual architectures. Frontiers in Neuroence, 13, 2018.
Ziteng Sun, Peter Kairouz, Ananda Theertha Suresh, and H Brendan McMahan. Can you really backdoor federated learning? arXiv preprint 1rXiv:1911.07960 2019.
Yeshwanth Venkatesha, Youngeun Kim, Leandros Tassiulas, and Priyadarshini Panda. Federated learning with spiking neural networks. IEEE Transactions on Signal Processing, 69:6183-6194 2021.
Sandra Wachter. Normative challenges of identification in the internet of things: Privacy, profiling, discrimination, and the gdpr. Computer law & security review, 34(3):433-445 4499, 2018.
Dong Yin, Yudong Chen, Ramchandran Kannan, and Peter Bartlett. Dyzzaninn-robust distributed learning: Towards optimal statistical rates. In International Conference on Machine Learning, pp. 5650-5659. PMLR, 2018
Hongyi Zhang, Moustapha Cisse, Yann N Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization. arXiv preprint arXiv: 17l0:001000922 2017.
Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. idlg: Improved deep leakage from gradients. arXiv preprint arXiv:2001.0266 2020.
Ligeng Zhu and Song Han. Deep leakage from gradients. In Federated learning, pp. 17-31. Springer, 2020.
11

---

Under review as a conference paper at ICLR 2023
A APPENDIX
A.1 IMPACT OF NUMBER OF CLIENTS
The total number of clients is aspect of scalability that influences the performance of a federated learning system. To study the impact of client count, we use the case with CIFARIO in IID setting. We observe, in Table, A.I, that there is sharp drop as the number of clients increases in standard FL. However, in SNFL, the server model accuracy lowers just little as show in Fig, A.I.
Table Impact of Number of Cheent-CIFARROO
Dataset
Party
FedAvg
S-FedAvg
FedProx
S-Fedprox
MOON
S-MOON
94.3840.06
94.7140.06
94.5940.06
95.4010.05
94.8010.08
95.2620.04
10
92.0240.11
93.0940.07
91.3940.08
95.1140.09
92.9040.07
94.73+0.09
Clients
15
88. 88.6240.18
91.1040.08
84.7620.10
95.01=0.12
89.5040.10
94.3620.08
57.0140.18
90.1440.02
73.4640.05
90.8840.02
59.6840.22
90.5740.038
94.45
95.22
94.64
95.18
94.85
94,44
10
92.19
95.25
91.6
95.07
92.81
94.62
Server
15
88.80
94.76
84.97
94.98
89.5
94.27
57.62
90.31
73.94
91.00
60.48
90.66
74, 22
87
55
MSOO MM0
Acurc
Acomnoy
Figure 1: Impact Number of Clients-CIFARIA
A.2 SENSITIVITY STRAGGLERS
Because real-world networks are inherently unstable, assuming updates communication would be effective from all selected devices is impracticable. Hence, the model needs to be robust enough handle devices that fail to communicate updates. These devices are referred to as stragglers. In this section, we analyze the impact of stragglers on the performance of final SNN model. We case with total of N = 60 clients. In each round, we randomly select PN clients upload parameters server. We consider different levels of probabilities and summarize Table. A.2. We found that when the number of stragglers decreased, the accuracy of FedAvg increased first and subsequently declined to 57.62%, whereas the accuracy S-FedAvg increased amazingly consistently to 90.31 %.
Table 2: The accuracy with various client drop probabilities.
Probability 0.1
0.2
0.5
0.7
FedAvg 65.07
66.05
68. 16
65.76
57.62
S-FedAvg
73.29
83.53
89.87
90.13
90.31
A.3 SENSITIVITY TO THE LENGTH OF SIMULATION T
The forwarding pass in SNN is repeated for steps to get the final result, where the final result is the expectation of the ultimate layer's output across 7 steps. This allows the flexibility of adjusting T to
12

---

Under review as a conference paper at ICLR 2023
balance between the latency and accuracy of SNNs for different application scenarios. We conduct experiments on CIFARIO with different simulation length T. as shown Table. A.3. We discovered that increasing T improved SNN accuracy to certain extent. However, T increases to a certain point, its influence on accuracy decreases.
Table 3: The accuracy with different SNN simulation steps.
Simulation steps
64
128
192
256
320
S-FedAvg
89.26
90.23
90.31
90.26
S-FedProx
90.52
90.96
90.94
91
90.99
S-MOON
89.95
90.51
90.66
90.66
90.74
13


Reviews:
[{"review_id": "iYULdKwq-vl", "reviewer": "Reviewer_Wfez", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "A framework for private federated learning is proposed. The conversion from ANN to SNN includes the encryption property for privacy protection. The results show competitive performance for IID and non-IID cases.", "summary_of_the_review": "The idea of the paper is interesting but several concerns should be clarified.", "strength_and_weaknesses": "Strengths:\n1. The tackled problem is relevant to the ICLR community.\n2. The results look promising and competitive.\n\nWeaknesses:\n1. There are several typos throughout the text. Please revise and correct.\n2. The proposed method combines multiple techniques together. Besides such a combination, each individual technique seems strongly influenced by previous works. It is recommended to discuss in more detail the key differences between the related works and the proposed method.\n3. The table numbering in the text does not match the numbers in the table captions.\n4. Please specify which dataset has been used for generating the results reported in Table 3 and Figure 3.\n5. It would be useful to provide the source code for reviewers' inspection during the rebuttal.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "68VFmo2YBw6", "reviewer": "Reviewer_ddxi", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "Federated learning based on client-side uploading of spiking neural networks (SNNs) is considered. Each client's SNN model parameters are obtained by converting locally updated regular NNs (called ANNs here). The server obtains and downloads the aggregated global ANN parameters from the SNN parameters uploaded from the clients. Experiments show performance improvements and enhanced robustness against attacks, compared to baselines.", "summary_of_the_review": "The paper deals with a timely topic (enhancing robustness of FL under privacy attacks) and appears to provides an interesting solution. However, I am confused with the very basic premise here. Each client uploads the updated SNN weights (converted from the updated ANN) along with the BN parameters. The server then converts them to the corresponding local ANN weights before aggregation and downloading. So if the eavesdropper can access the uploaded parameters of a client, then she can reproduce the ANN model weights of that client in a given iteration (as the serve does it easily). So, where's the protection against privacy threats that the ANN-SNN conversion process is supposed to bring to the table? My evaluation score would be a tentative one and I will reevaluate after/once my confusion gets cleared.  ", "strength_and_weaknesses": "Strengths: timely topic (enhancing robustness of FL under privacy attacks) and interesting solution.\n\nWeaknesses: I am confused with the very basic premise here. Each client uploads the updated SNN weights and the BN parameters. The server then converts them to the corresponding local ANN weights before aggregation. So if the eavesdropper can access to the uploaded parameters of a client, then she can reproduce the ANN model weights of that client (as the serve does it easily). So, where's the protection against privacy threats that the ANN-SNN conversion process is supposed to bring to the table?  ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "5aW3pLSGzT", "reviewer": "Reviewer_55hw", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes a privacy-preserving framework (SNFL) in federated learning by incorporating the conversion from artificial neural networks to spiking neural networks. SNFL is validated to robust to gradient inversion attack and backdoor attack and it guarantees privacy while improving accuracy.", "summary_of_the_review": "Overall, this paper doesn’t meet the criteria of publication in ICLR. The major concern is that the authors did not support their claims well and some extremely relevant related works are not well discussed and compared, which weakens the novelty and solidity of this paper. I recommend to reject it and hope the authors can do better in the future version.\n\n", "strength_and_weaknesses": "Strength: \nThis paper is somewhat novel, as it provides a solution to break the privacy-utility tradeoff. \n\nWeakness: \n- 1 One major weakness is that the most relevant related works are not well discussed and compared, which weakens the novelty and solidity of this paper. Before this submission, there are existing works about spiking neural networks in federated learning and privacy-preserving spiking neural networks, such as\n①\tVenkatesha Y, Kim Y, Tassiulas L, et al. Federated learning with spiking neural networks[J]. IEEE Transactions on Signal Processing, 2021, 69: 6183-6194.\n②\tYang H, Lam K Y, Xiao L, et al. Lead federated neuromorphic learning for wireless edge artificial intelligence[J]. Nature communications, 2022, 13(1): 1-12.\n③\tKim Y, Venkatesha Y, Panda P. PrivateSNN: Privacy-Preserving Spiking Neural Networks[C]//Proceedings of the AAAI Conference on Artificial Intelligence. 2022, 36(1): 1192-1200.\n\nThe authors did not compare the algorithms about directly incorporating SNN in FL and discuss the accuracy gains and privacy protection in this case. It is likely that the accuracy gains of SNFL are caused by the SNN itself, not the ANN-SNN conversion. Additionally, the author claims that the privacy guarantee of SNFL lies in “the server of SNFL keeps bias as a private key and does not share it with clients”. But in the vanilla FL with SNN, one can keep the bias of SNN as private keys in the server and clients, and it also can realize better privacy protection, so what is the difference and novelty of SNFL when compared with this case? \n\nBesides, the author did not compare the privacy-preserving SNN directly adopting in FL, and they did not discuss the existing works about privacy issues in SNN. As in “Kim Y, Venkatesha Y, Panda P. PrivateSNN: Privacy-Preserving Spiking Neural Networks[C]//Proceedings of the AAAI Conference on Artificial Intelligence. 2022, 36(1): 1192-1200.”, they mentioned the privacy leakages in ANN-SNN conversion. Since the SNFL is just a simple adaptation of ANN-SNN conversion in FL, will these leakages happen in SNFL?\n\n- 2 Another major concern of this paper is that the authors did not well support their claims in certain aspects. Specifically, the authors mentioned “SNFL introduces a lightweight overhead” in the abstract, but the computation overhead of the conversion is not discussed in the main paper. And I reckon the overhead is of particular importance, because the conversion process is conducted at the clients’ sides. While the clients’ devices are always resource-constrained, such a computation of conversion may cause extra burden to the clients. The authors should fully discuss the overhead and compare it with other privacy-preserving methods to show its superiority. By the way, I am not sure whether SNN is lighter than ANN in parameter space, and if SNN introduces more parameters, it will also cause extra communication overhead, which should to be claimed or discussed.\n\nThe main point of this paper is that SNFL can provide better privacy protection. However, I find the experimental part about privacy is weak and short. It seems that the author focused more on the accuracy rather than privacy in the experiments.\n\n- 3 The authors need give more insights on their method. Such as, why SNFL works better when the number of clients is larger. And for the privacy parts, I reckon it is not direct for the readers to get why your framework can better protect privacy. More empirical findings, like visualization and case study, or more theoretical findings are needed.\n\n- 4 Apart from the technical parts, the paper is somewhat poor in presentation. As I can see, there are many typos, including wrong spelling of words, incomplete formula symbols, wrong method names, mistakes in citations of tables, and so on. Also, some sentences are also confusing, and I am always lost in what the authors are trying to convey. For example, in the first paragraph of Section 4.2, it says “Considering that μc(e) is dependent on the data distribution rather than distribution free, we cannot use random dataset on the server side for the recovery. Our framework can take advantage of this algorithm to encrypt the gradient information, therefore improving the privacy in FL.”. I don’t see the logic behind the two sentences, and it is confusing why the authors mentioned the calibration dataset on the server. Did they use the calibration dataset on server or not? The authors should correct all these typos in the revision and present better in writing.\n\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject