Inference-Time Personalized Federated Learning
Authors: Ohad Amosy
Gal Eyal
Gal Chechik
Venue: ICLR 2022 Submitted (2022)
Keywords: Federated learning
Personalized federated learning
hypernetworks

Abstract: In Federated learning (FL), multiple clients collaborate to learn a model through a central server but keep the data decentralized. Personalized federated learning (PFL) further extends FL to handle data heterogeneity between clients by learning personalized models. In both FL and PFL,  all clients participate in the training process and their labeled data is used for training. However, in reality, novel clients may wish to join a prediction service after it has been deployed, obtaining predictions for their own unlabeled data.
 
Here, we defined a new learning setup, Inference-Time PFL (IT-PFL), where a model trained on a set of clients, needs to be later evaluated on novel unlabeled clients at inference time.  We propose a novel approach to this problem IT-PFL-HN, based on a hypernetwork module and an encoder module. Specifically, we train an encoder network that learns a representation for a client given its unlabeled data. That client representation is fed to a hypernetwork that generates a personalized model for that client. Evaluated on four benchmark datasets, we find that IT-PFL-HN generalizes better than current FL and PFL methods, especially when the novel client has a large domain shift. We also analyzed the generalization error for the novel client, showing how it can be bounded using results from multi-task learning and domain adaptation. Finally, since novel clients do not contribute their data to training, they can potentially have better control over their data privacy; Indeed, we showed analytically and experimentally how novel clients can apply differential privacy to their data. 

Under review as a conference paper at ICLR 2022
INFERENCE-TIME LEARNING
PERSONALIZED
FEDERATED
Anonymous authors Paper under double-blind review
ABSTRACT
In Federated learning (FL), multiple clients collaborate to learn a model through central server but keep the data decentralized. Personalized federated learning (PFL) further extends FL to handle data heterogeneity between clients by learning personalized models. In both FL and PFI., all clients participate in the training process and their labeled data is used for training. However, in reality, novel clients may wish to join prediction service after has been deployed, obtaining predictions for their own unlabeled data.
Here, we defined new learning setup, Inference- PFL (IT-PFL), where a model trained on a set of clients, needs to be later evaluated on novel unlabeled clients inference time. We propose a novel approach to this problem IT-PFL- HN, based on a hypernetwork module and an encoder module. Specifically, we train encoder network that learns representation for a client given its unla- beled data. That client representation is fed to hypernetwork that generates a personalized model for that client. Evaluated on four benchmark datasets, we find that IT-PFL-HN generalizes better than current FL and PFL methods, especially when the novel client has a large domain shift. We also analyzed the general- ization error for the novel client, showing how it can be bounded using results from multi-task learning and domain adaptation. Finally, since novel clients do not contribute their data to training, they can potentially have better control over their data privacy; indeed, we showed analytically and experimentally how novel clients can apply differential privacy to their data.
INTRODUCTION
Personalized Federated learning (PFL) Zhao et al. (2018) extends federated learning (FL) McMahan (0177a) to the case where the data distribution varies across clients. This has numerous applica- tions like when a smartphone application wishes to improve their text prediction without uploading user-sensitive data, or in the case when consortium of hospitals wishes to train joint model while preserving the privacy of their patients. Current methods assume that all clients participate in the
training process and that their data is labeled (Shamsian al. 2021
Bui et al., 2019 Hsu al.
2020 Zhu et al.) 2020) Yang et al.) 2020 Hanzely & Richtárik 2020
SO once a model is trained,
there is no way to add novel clients.
In many cases, however, federated model has been trained and deployed, but then novel clients wish to join. Often, such novel clients have no labeled data, and the distribution of their samples may shift significantly. This is the case for example, when a ppeech-recognition federated model has been deployed and needs to be applied new users, or when virus diagnostic has been devel- oped for some regions or countries, and then needs to be applied to new populations while the virus spreads. This learning setup poses hard challenge to existing FI. approaches. techniques may not generalize well to novel clients with different data distribution. PFL techniques learn personal- ized models but are not designed to apply to a client that was not available during training.
Here, we define novel problem, performing federated learning in novel clients with unlabeled data that are only available at inference time. We call this setup IT-PFL for Inference- Personalized Federated Learning. We propose novel approach to this problem, called IT- IT-PFL-HN. During the training phase, our architecture learss a space of personalized models, one for each client, together with encoder that maps each client point in this space. All personalized models are learned

---

Under review as a conference paper at ICLR 2022
jointly through hypemeeworr,, allowing to personalized data effectively (Figure 1_ At infer- ence time, a novel client can locally compute its own descriptor using the encoder. Then is sends the descriptor to the server as imput to the hypemetwork to obtain its personalized model.
The key idea in IT-PFL-HN is to first train a client encoder, that maps a full client dataset into a dense descriptor. That descriptor is fed into hypernetwork, which learns to map client descriptors onto a space of networks. At inference time, any novel client simply computes it descriptor locally using the encoder. It then sends that descriptor the server, which sends back an "on-demand" personalized model for that client.
FL was motivated by privacy, but was shown vulnerable to differential attacks (Xie al., 2018
Augenstein et al. [2019] Melis et al. 2019; Zhu & Philip 2019; Hao et al. 2019; Truex et al. 2019
Mothukuri et al. 2021 Hitaj et al. 2017). In our setup of IT-PFL, novel clients do not contribute their data to training so they have better control over their data privacy. We show how differential privacy (DP) can be applied effectively to a novel client and experimentally measured how applying DP to the client affects the accuracy of the personalized model.
This paper makes the following contributions: (1) A new learning setup, IT-PFL. learning per- sonalized model to novel unlabeled clients at inference time. (2) A new approach, learning space of models and an encoder that maps a client to that space, and architecture ITT-PFL-HN, based on hypernetworks. (3) A bound on the generalization error, based on MTL and DA. (4) Analysis of dif- ferential privacy for the novel client. (5) Evaluation on 4 benchmark datasets, CIFARIO, CIFARIOO, iNaturalist, Landmarks, showing that ITT-PLL-HN performs better equally well as baselines.
2
RELATED WORK
Federated learning (FL) In FL, clients collaboratively solve a learning task. The key motivation for individual clients to participate in FL is to leverage the shared pool of knowledge from other clients in the federation. Individual clients often face data constraints such as data scarcity, low data quality, and unseen classes that limit their capacity to train well performing local models. FedAvg (McMahan et al.] 2017a), is an early but effective FL approach that updates models locally and averages them into a global model. Several optimization methods have been proposed for improving
convergence in FL. (Sahu et al., 2018:) [in et al.] 2018 Stich 2018 Wang & Joshi 2018). Other
approaches focus preserving client privacy (Agarwal et al. 2018 Duchi et al. [014]] | McMahan
ct 20176 et al.] 2020), improving robustness to statistical diversity (Haddadpour & Mahdavi
2019 Hanzely & Richtárik 2020 Hsu et al., 2019b] Karimireddy al. 2020 Zhao et al. 2018
Zhou & Congl 2017), and reducing communication cost (Reisizadeh et al. [2020] Dai et al.] 2019).
These methods aim learn a global model across clients, which limits their ability to deal with heterogeneous clients.
Personalized federated learning (PFL) aims to handle data heterogeneity across clients. Following Tan et al. (2021), here we divide PFL methods into data-based and pondel-based approaches.
Data-based approaches aim smooth the statistical heterogeneity of data among different clients.
This can be achieved by normalizing the data (Duan et al.) 2021). or by designing client selection mechanisms that enable sampling from more homogeneous data distribution. |Wang et al. (2020b)
selects a subset of participating clients for each training round, with the objective of maximizing accuracy while minimizing the number of communication rounds. Yang al. (2020) selects the subset of clients with minimal class imbalance.
Model-based approaches aim enable FL models to adapt to the diverse data distributions among clients. Jiang et al.) (2019) and Fallah et al. (2020) use meta-learning for finding global model that is efficiently optimized with few steps of gradient descent using the client local data. AAchtuve et al. (2021) propose learning single kernel function shared by all clients, but use personalized Gaussian processes classifier for each client, Bui et al. (2019) and Liang et al. (2020)) achieve personalization by using a global model, and local model on top of it. The local model does not share parameters with the server. HHang et al. 202T regularized stronger collaboration amongst clients with similar data distributions.
2

---

Under review as a conference paper at ICLR 2022
model
my [x
Encoder By
Hypernetwork fe
weights
Local model
k==
hj
Figure 1: The architecture of IT-PFL. The encoder uses the data of the novel client to produce embedding. Then, the hypernetwork fo predicts a local model /t for the novel client.
Adapting a model new distribution inference time was also considered a variant of domain adaptation (DA) (Wang et al. 2020a Kim et al. 2021; Liang et al., 2020a). Our new client setup can be seen as an adaptation of this setup the federated setup.
Differential privacy (DP) The goal is to share information about dataset while withholding in- formation about individuals the dataset. Although one of the key motivations of PFL privacy, it has been shown that some private information is exposed in the process (Mothukuri et al., 2021 Melis et al. (2019) shows that an adversarial participant can infer the presence of exact data points in others training data. Hitaj et al. (2017) shows that an adversarial participant can generate other clients private data. Several works utilizes DP to protect the client privacy (Xie et al. 2018 Augen- stein al. 2019: Zhu & Philip 2019 Hao et al. 2019 Truex al. 2019). However, adding noise to the embedding of the clients may harm the model performance. Unlike these papers, we focus on the privacy of the novel client, we do not harm the training process, and each novel client can choose its privacy-accuracy balance in real-time.
THE LEARNING SETUP
We now formally define the learning setup of IT-PFL.
Following the notation in [axter (2000) define X to be an input space and Y output space. P is probability distribution over the data X x Y. Let / be a loss function 1 Y x Y - R. H set of hypotheses h X Y. The error of a hypothesis h over a distribution P is errp(h)
Jxxy 1(h(z), v)dP(z,)))
In IT-PFL, we are given federation of N clients .I...., CN for training, and other, novel, clients added inference time. For simplicity of notation, we consider a single novel client Crew- Let {P.) be the data distributions of training clients, and Pnew the data distribution for Crew- Each training client has access m, IID samples from its distribution P.. St {<r), 1²
The goal of IT-PFL is to use data from training clients { to learn a mechanism that can assign hypothesis know H when given data from novel client Snew. That hypothesis should minimize the error on the novel client eTT (hoeew)
4 OUR APPROACH
In IT-PFL, we are evaluated by the quality of inference on novel client, one that was never seen during training. and has its own data distribution. Fundamentally, this problem not about pro- ducing a single trained model, but about producing a "meta mechanism" that can provide model "on-demand".. given (a descriptor of) novel client.
A natural candidate for such meta-mechanism, are hypernetworks (HNs). HNs are neural networks that output the weights of another network, conditioned on some input, and can therefore produce "on-demand" models. Since the weights of the generated model are (diffcrentiable) function of
the HN parameters, training the HN is achieved simply by propagating gradients from the generated (client) model. HNs have already been shown be effective for PFL by Shamsiia al. (0221)
To generate a model for a novel client, the HN should be fed with a proper descriptor, We propose to learn an Encoder that takes input the data of the novel client and produces dense descriptor. The encoder learns an embedding space over clients. This allows to interpolate to novel clients, since the hypernetwork learns to produce proper model for client, based its embedding.
3

---

Under review as a conference paper at ICLR 2022
(a) Training with clients 1..N:
Server Hypernetwork fe (ek Encoder
fe(e,), Te
Client
Embeddings
Ag,
Figure 2: (a) The server trains a hypernetwork fo and encoder gy using the labeled clients. (b) A novel client uses unlabeled data to receive personal- ized model from the server.
(b) Inference for new client:
gy
Server Hypernetwork fo
New client
Cnew
By [[x+)R==
Mnow
flnew {Xg
(enen
Encoder
gy
Figure shows the model architecture, used during inference. We now describe more formally the two model components: (1) hypernetwork and (2) encoder, then describe the flow during training and inference.
Client encoding. The HN expects to receive input a descriptor of client. The Encoder module takes unlabeled data and produces dense descriptor. Consider a representation space & of clients, we aim to obtain a representation e E for client i. This is achieved by applying a deep-set architecture (Zaheer et al.] 2017) to data batches, producing descriptor for each batch. A single client descriptor is obtained by averaging all batch descriptors. One potential extension our method is that one could apply this technique to individual batches, obtaining personalized model per batch.
Hypernetworks. Assume first that there already exist representation space E of clients, where client i has representation E E. This representation used as an input to the HN, which then produces personalized model for the client. We explain below how the representation is learned.
A hypernetwork fo parametrized by embodies a mapping from client-embedding space to hy- potheses (model) space fo 3 H. Any client with an embedding vector e, is mapped by the hypernetwork to personalized model h; = fo(e).
Training The hypernetwork learns to produce personalized model from client descriptor by optimizing the following loss L e1.,,e......, ex) Σn (labeled) clients C1,...,
mD j=1 (()((e)(x))) v²)) using training
When training the encoder, found that in practice it worked better learn embedding for the training clients, which takes a client identity and produces a dense descriptor. Presumably, this is because reduces the batch-to-batch variability for batches from the from client i receive unique client descriptor. The embedding layer was trained in standard way end-to-end with the hypernetwork. Once every client has an embedding descriptor e,, trained the client encoder, as described above, taking a data batch and producing descriptor that is L2 close Cy. More details are given in appendix
client, since all samples
Flow Figure 2 iilustrates the steps of the federated training. During training, the hypernetwork fo optimizes LHN and the encoder 9- optimizes Leeeeder -'. T.2 (2( (0)g((22) )==1), Specifically, first, the server applies the hypernetwork to each client embedding e;- Then, the server sends each client its personalized model h, together with the encoder gr. The client trains the predicted net- work locally using its labeled data. Then, the client sends to the server its updates to the parameters of the network hG, and to the encoder 97:
At inference time, the server only sends the encoder to the novel client. The client uses the encoder to caleulate embedding &new and sends it to the server. The server uses the hypernetwork to predict the client personalized model hnww from the embedding and sends the result to the client. The client then applies its personalized model locally without revealing its data.

---

Under review as a conference paper at ICLR 2022
5 GENERALIZATION BOUND
We now develop a bound for the generalization error of a novel client in the IT-PFL setup. We build on previous bounds developed for multi-task learning (MTL) and for domain adaptation (DA). Theorem 5.1. Let H. be hypotheses space, Preee be the data distribution of novel client, and Q be a distribution over client data distributions, namely Pt drawn from Q.
The generalization error of the novel client is bound by PTT (H) S efr + Sr inn duan (P, Pnew (P) Here, is the approximation error of a client in the federation from Theorem in Baxter (2000) and dHAH is the distance measure between probability distribu- tions defined in Ben-David et al. 2010). The error errq(H) and the empirical ervor efr: are defined in detail in appendix
Proof. See appendix A for the detailed proof. The main idea of the proof is first bound the error of all (labeled) training clients, using results from multi-task learning. Then, treat the novel client as target domain in domain adaptation problem, and bound its shift from training clients.
The error of the novel client for given hypothesis space H is inf eTT (h). Since Pnew is independent of Q, we can integrate over all P Q and obtain
= inf err ( (h) S inf errp.ew (P)) bEH
err (H)
hEH
Using Theorem from Ben-David et al. (2010) with Pnem treated as the target domain and as the source domain, gives that Vh, VP erT (h) S errp(h) + Idnau Pnew). Plugging into Eq. (1) gives
CTT (H) S |
1 inf errp(h) + + Iddan(P, dQ(P) Jin
(2)
1 / inf dNAn(P, (PQ)).
(r)
hEH
Since (H) is unknown, we use Theorem 2 from Baxter (0000) to bound the error of the novel client. That yields the bound in the theorem.
EXPERIMENTS
We evaluate the empirical performance of IT-PFL-HN using four benchmark datasets.
6.1 EXPERIMENT SETUP AND EVALUATION PROTOCOL.
We evaluate IT-PFL--HN on the proposed IT-PFI. setup where novel clients are presented to the server at inference time. Client split: To quantify performances novel clients first randomly partition clients to Ntrain train clients and Nnovel novel clients. We used Nnovel 0.1 N. Unless stated otherwise, We report the average accuracy novel clients: wÿ). Where Vi is the model chosen by the server evaluate novel client with m, samples. To conduct fair comparison, training limited to 500 steps for all evaluated methods. In each step, the server communicates with a 0.1 fraction of training clients according the protocol of each method. Specific model architectures are described for each ex- periment separately. Sample split and HP tuning: We split the samples of each training client into a training set and validation set. Validation samples were used for hyperparameter tuning for all methods and datasets. Specifically, we tuned training batch size, learning rate of each method, weight-decay values and the number of inner training epochs, and an early stopping point. Results reported using the best hyperparameters for each experiment. See appendix C for more details.
Naowel Σ, Noovst 1 ΣT" (xf))
Ta.
6.2 BASELINES
We evaluate and compare the following FL and PFL methods: (1) IT-PFL-HN, our proposed IT- PFL method using HN and client encoder. Each novel client evaluated using its personalized
5

---

Under review as a conference paper at ICLR 2022
Table 1: Accuracy on novel Clients, CIFAR Data: Values are averages and standard error across clients.
CIFAR-10
CIFAR- 100
xpli
puhoological
0.1
0
pathological
0.1
0.5
FodAvg
50.3 2.0
58.7
62.5
66.2 =
16.2 1.8
17.9
23.8
30.2
prellLN sampled
24.8 1.0
61.0 2 3.7
60.5::00 0.9
68.52 0.7
5,9
13.5 0.5
25.7 0.8
32.4000
peedHN ensemble
47.6
3.2
63.6 1.0
08.5
20.4 1.2
32.7 + 0.5
PFedLEN nearest
24.4
6.2
63.1
32.1
TE-PEL.HN
65.9 2.3
61.3
64.7 1.8
67.9
9.9
24.4
29.3
model; (2) FedAVG (McMahan et al. 2017a). perhaps the most widely used FL. algorithm. All novel clients are evaluated using single global model; (3) pFedHN (Shamsian et al. [021). Currently the state-of-the-art approach to PFL. PFL-HN is based on a HN. Sine PFL methods produce a set of models, one for each training client, we tested three different ways to use training models for inference with the novel client. (3a) FedHN-sampled: Draw a trained client model uniformly at random. We evaluate this baseline by computing the mean accuracy of all personalized models each novel client. (3b) FedHN-Ensemble: A stronger baseline is achieved by taking into account all personalized models when predicting for single novel client. This is achieved by averaging the logits of all models for each prediction. In practice, this method requires sending multiple models each novel client. Therefore, it is expensive both communication and computation costs. (3c) FedHN-neareed We measured the distance between a novel client and all trained clients, and use the model of the closest training client. Since FL the data must not leave the client, common methods to measure divergence between datasets Instead, we use A-distance (Ben-Davel et al. (200)), which measures how hard to separate data points from two different clients using a linear model. Since that linear model can get gradients from each client separately, it can be used in the FL setup.
6.3 RESULTS ON CIFAR DATA
We evaluate IT-PFL-HN using CIFARIO and CIFARIOO datasets (Krizhevsky et al., 2009). Since these datasets do not have natural partitioning into clients, we follow two commonly used protocols to split the data across clients.
As proposed by McMahan et al. (2017a), sort the training samples by their labels and partition them into K shards. Each client is then randomly assigned K the shards. This results in N clients with the same number of training samples and different distribution labels. In our experiments,we use = 100 clients, = 2 for CIFARIO and K = for CIFAR 100.
(1) Pathological split:
We follow the procedure by Hsu et al. (2019)) control the magnitude of distribution shift between clients. For each client samples are drawn independently with class labels following categorical distribution over classes with parameter qi Dir(a:.. Here, Dir is the symmetric Dirichlet distribution and is the concentration parameter. We conduct three experiments for each of the two datasets with 0.1, 0.5, 10. Smaller values of alpha imply larger distribution shifts between clients.
(2) Dirichlet allocation:
Implementation details: There are three different models in IT-PFL-HN: A target model, hy- pernetwork, and a client encoder. Target model: When evaluating using CIFAR10 10 and CIFAR100 we use a LeNet-based (LeCun al., 1998) network with two convolutions and two fully connected layers. To assure fair comparison, we use the same target model across all evaluated methods and baselines. Client encoder: Same architecture as the target model above but with an additional fully connected layer followed by Global-Max and Global-Mean operations over batch samples. These layers are added after each convolution layer and before the fully connected layers. The output di- mension is the size of the embedding dimension rather than the number of labels. Hypernetwork: The hypernetwork is a fully connected neural network, with three hidden layers and multiple linear heads per target weight tensor as in Shamsian et al. (202T)
Results: Table shows IT-PFL-HN performs better than or equivalent to the evaluated FL and PFL methods in all evaluated datasets and split, except for CIFAR-100 100 pathological split.

---

Under review as a conference paper at ICLR 2022
Figure Accuracy of novel clients vs. distribution shift be- tween the novel client and train- ing clients. Shown results for CIFAR-I00 across multiple splits to Ntrain = 90 train clients and Nooeel = 10 novel clients us- ing symmetric Dirichlet distribu- tions with varying parameter a (see 6.5). For each test client, we calcu- late its KL-divergence to the near- est train client. Accuracies of novel clients are reported against the KL- divergence from the nearest train client for each method.
0.45
IT-PFL-HN pFedHN-sampled FedAvg
Novel Client Accuracy
0.40
0.35
0.30
0.25
0.20
0.15
0
2
4
10
KL Divergence
6.4 REAL-WORLD DATA
We next extend our experiments to more realistic datasets with data splits across clients that simulate real-world distributions. We two different datasets studied in Hsu al. (2020). (1) iNaturalist: A dataset for Natural Species Classification based on the iNaturalist 2017 Challenge (Horn et al. 2018). The dataset has 1,203 classes. (2) Landmarks:
dataset for landmark recogmition based on the 2019 Landmark Recogmition Challenge (Weyand et al. (020)). The dataset has 2,028 classes. We split the datasets into clients following the splits suggested by Hsu al. (2020). We evaluate IT-PFL--N using two of the suggested geographical splits of iNaturalist: iNaturalist- Deeiiistt-----il 1k and iNaturalist-Go--2 with 368 and I 1,208 users respectively, and using the proposed split by author- ship of Landmarks, Landmarks-User- 160k, with 1,262 users.
Implementation details: We first use a MobileNetV2 model (Sandler et al. 2018) pre-trained on ImageNet (Deng al. 2009) to extract features for each image. The extracted feature vectors, of length 1280, are the input for both the target model and the client encoder. Target model: When evaluating Naturaliss and Landmarks datasets the target model is simple fully connected network with two Dense layers and a Dropout layer. We use the same target model across all evaluated methods and baselines. Client encoder: the client encoder architecture has three fully connected layers with Global-Max and Global-Mean operations over batch samples after the first layer. The output dimension is the size of the embedding dimension. Hypernetwork: The HN is fully connected neural network, with three hidden layers and multiple linear heads per target weight tensor as in the previous experiments.
Results: Table shoow IT- PFL-HN outperforms cur- rent FL. and PFL meth- ods in both evaluated splits of the iNaturalist dataset. IT-PFL-HN ties with the pFedHN ensemble base- line on the Landmarks dataset. However, pFedHN ensemble suffers from rel- atively large communica- tion and computation costs compared to the proposed IT-PFL-HN.
Table 2: Accuracy novel Clients, Real- World Data: Values averages and standard error across clients.
iNaturalist
Landmarks
split
Geo-300
Gco- 1k
1
FedAvg
36.14 +: 1.60
36.89 1 1.12
34.85 1: 1.28
DFedHN sampled
25.58 = 1.39
27.23 + 0.86
37.39 + 1.31
pFedHNN ensemble
31.54 + 1.65
36.55 1 1.16
39.08 + 1.38
PFedIIN nearest
24.16 11 3.65
26.92 1 4.55
33.06 1 3.56
IT-PFL-HN (ours)
37.47 + 1.65
41.57 1.17
39.4 + 1.43
6.5 EFFECT OF DISTRIBUTION SHIFT
To measure the effect of distribution shift on the results synthesize additional splits of the CIFAR- 100 dataset using the same Dirichlet allocation procedure described in section 6.3 We evaluate three methods: FedAvg, @FedHN-sample and IT-PFL--HN, while varying (..1,0.25, 25, 0.5. 1, 10). To
7

---

Under review as a conference paper at ICLR 2022
Table 3: Test mean accuracy (+SEM) for corrupted CIFAR-10 novel clients.
Blur
Rotation
Brightness
Contrast
Saturation
FedAvg
02.57=:0.02
22.28+0.03
21.9420.03
21.10=0.03
47.48-0.03
pFedHN sampled
22.99 +0001
13.23+00.02
13.37+00.02
12.80+0.02
24.73+0.001
pFedHN ensemble
38.00 =0.04
21.76:1.006
21.75=0.006
21.43
43.70=10.04
pFedHN nearest
8.37 40.05
11.70:10.10
11.99:10.09
11.16=0.04
20.70=0.11
IT-PFL- HN (ours)
46.17110001
23.34
22.57 10.04
22.0810.04
53.45:1002
estimate the "distance" between novel client and the training clients measure the KL-divergence between the novel client and the nearest trained client. The KL-divergence is computed over the empirical distributions of labels.
Figure presents the accuracy of the novel client as a function of its Kl-divergence to the nearest novel clients decreases the KL-divergence between
train chient. As Expected, the accuracy that novel client and the training clients grows. This holds for all three evaluated methods. IT-PFL.- HN method demonstrates the most moderate decrease in performance KL--divergence grows, and achieves the highest accuracy for novel clients with large distribution shifts.
6.6 IT-PFL--HN ON NOISY DATA
In real life, many times the domain shift of the novel client is caused by using different sensors and/or different enviromments. We evaluated IT-PFL-HN robustness five common sensor and environment corruptions: blur, rotation, brightness. contrast, and saturation.
We evaluate this domain shift using CIFAR-10. The data from training clients were kept noncor- rupted. The data of the novel client was corrupted in five different ways: Blur, Rotation, Brightness, Contrast, Saturation For blur, we used a x 7 Gaussian filter, with sigma that is chosen uniformly at random in the range of (0.1, 2.0). For brightness, contrast, and saturation, we use factor that is chosen uniformly at random in the range (0.5, 1.5). The rotation transformation used an angle that was chosen uniformly at random to lie in the range of (0, 15).
Table 3 summarizes the results. IT-PFL--H outperforms the evaluated FI. and PFL baselines when evaluated on corrupted novel clients.
7 DIFFERENTIAL PRIVACY
A key aspect of federated learning is data privacy, restricting clients from sharing their data directly with the hub. Unfortunately, since data is used to train the federated model, and the federated model produces models for other clients, some private information may be exposed (See a recent survey by Mothukuri al. ) ). In this section, we analyze the privacy of novel client and characterize how it can protect its privacy by applying differential privacy (DP). We further show the trade-off between the privacy of novel client and the accuracy of the personalized model.
We first define key concepts and our notation. Following Abadi et al. (2066), we say that two datasets D. D' are adjacent if they differ in a single instance. A randomization mechanism M D - R satisfies (e, diffferrnti privacy if for any two adjacent inputs d, d' E D and for any subset of outputs S C holds that Pr(M (d) E 5) S e Pr(M(d')) E S] + 8. Here, quantifies privacy loss smaller values mean better privacy protection and 0 bounds the probability of privacy breach. Finally, given two datasets 1) and D' that differ in only one element, the sensitivity function f is defined by A maXp, Ilf (DD
Dwork et al. (006) showed that given a model f. data privacy can be preserved by perturbing the output of the model, and calibrating the standard deviation of the noise according to the sensitivity of the function f. and the desired level of privacy e. Intuitively, if the protected model not very sensitive changes in single training element, one can achieve DP with smaller perturbations.
8

---

Under review as a conference paper at ICLR 2022
0.7
epiioo-0.3
epsion-011
Accuracy
0.6
epsioo-0003
No perturbation
0.5
0.4
Figure Test accuracy (#SEM) for CIFAR-10 novel client while applying DP. As the dataset size increases, we add less noise to obtain the same privacy level.
30
100
300
1000
3000 10000
Dataset size
Our focus here apply DP to ITT-PLL novel client. Fortunately, the only information that novel client shares the embedding. It is computed locally by the client, so applying DP procedure to the encoder can protect the data privacy of the novel client. As side benefit, the novel client applies the encoder at the inference time, not affecting the training convergence time and accuracy.
Several mechanisms were proposed for noise adding to achieve DP. Here focus the mechanism described by Abbai et al.) (2016), but the same method can be used with other mechanisms. Abbadi al. (2016) describes a Gaussian mechanism that adds noise drawn from Gaussian distribution with 2A/
0²
Let novel client apply (e, 6)-DP the encoder using the Gaussian mechanism. The server sends to the encoder to the client. Then the client send to the server g {x) y= + & as its embedding, (00((125/6) where & is IID vector from Gaussian distribution with o² 24g 2Ag"tog(1 log(1 25/6] To do that, the client has to know what is the encoder sensitivity. The following lemma shows that when using a deep-set encoder, we bound the sensitivity of the encoder, hence bound the noise magnitude necessary to achieve privacy. See proof appendix D
Lemma 7.1. Let g be deep-set encoder, written as: g(D) = function with Lipschitz conslant Lag, and i is bounded by Big, then the sensitivity of the encoder is bounded by Ag S { Lgg..
1/( b) EEED o(x)). If ib is a linear
2
The lemma shows that the sensitivity of the encoder decreases linearly with the size D] of the novel client dataset. For given (c, 8), lower sensitivity means lower Gaussian noise, which leads to better performance.
We now evaluate empirically the effect of adding noise the embedding of novel client. To meet the conditions in lemma 7.1 we normalized the output of á to be on unit sphere, so B 1. In addition,
simple average the output of Φ, so Lg different values of and dataset size.
We used 8 0.01 and compare
Figure 4 shows that with sufficient data (n 2 3000 for e 0.3), novel client can protect its privacy without compromising the performance of the personalized model.
CONCLUSION
This paper describes IT-PFL, new real-world federated setup, focusing on transferring model trained in feerated learning manner, to novel clients that were not available during training, and dont even have labeled data.
We propose IT-PFL-HN, novel approach for IT-PFL,, based on learning encoder that learns space of clients, and a hypernetwork that can map a client to its corresponding model in an "on- demand" way. We evaluated IT-PFL-HN on four benchmark datasets, showing that it usually gen- eralizes better than current FL and PFL methods. Finally, we analyze and bound the generalization for the novel client and show that approach guarantee differential privacy. We hope this paper will encourage the research community to consider generalization to novel clients when designing FL methods.

---

Under review as a conference paper at ICLR 2022
REFERENCES
Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, llya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pp. 308-318, 2016.
Idan Achituve, Aviv Shamsian, Aviv Navon, Gal Chechik, and Ethan Fetaya. Personalized federated learning with gaussian processes. 2021.
Naman Agarwal, Ananda Theertha Suresh, Felix Yu, Sanjiv Kumar, and H Brendan Mcma- han. cpsgd: coamunication-efffceee and differentially-priie privvate distributed sgd. arXiv preprint arXiv:1805.10553 2018.
Sean Augenstein, H Brendan McMahan, Daniel Ramage, Swaroop Ramaswamy, Peter Kairouz, Mingqing Chen, Rajiv Mathews, et al. Generative models for effective ml on private, decentral- ized datasets. arXiv preprint arXiv:1911.066 2019.
Jonathan Baxter. A model of inductive bias learning. Journal of artificial intelligence research, 12: 149-198, 2000.
Shai Ben- Den-David, John Blitzer, Koby Crammer, Fernando Pereira, et al. Analysis of representations for domain adaptation. Advances in neural information processing systems, 19:137, 2007.
Shai Ben-David, John Blitzer, Koby Crammer, Alex Kulesza, Fernando Pereira, and Jennifer Wort- man Vaughan. A theory of learning from different domains. Machine learning, 1911-1): 2010.
Anselm Blumer, Andrzej Ehrenfeucht, David Haussler, and Manfred K Warmuth. Learnability and the capnik-chervoneekii dimension. Journal of the ACM (JACM), 36(4):929 965,,9965,5 1989.
Duc Bui, Kshitiz Malik, Jack Goetz, Honglei Liu, Seungwhan Moon, Anuj Kumar, and Kang G Shin. Federated representation learning. arXiv preprint arXiv: /909. /2535, 2019.
Xinyan Dai, Xiao Yan, Kaiwen Zhou, Han Yang, Kelvin KW Ng, James Cheng, and Yu Fan. Hyper-sphere quantization: Communication-efficiee sgd for federated learning, arXiv preprint arXiv: I. 1.06655, 2019.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scalle scale hi- erarchical image database. In 2009 IEEE conference computer vision and pattern recognition, pp. 248-255. Icee, 2009.
Moming Duan, Duo Liu, Xianzhang Chen, Renping Liu, Yujuan Tan, and Liang Liang, Self- balancing federated learning with global imbalanced data in mobile systems. IEEE Transactions on Parallel and Distributed Systems, 32(1):59-71, 2021.
John C Duchi, Michael I Jordan, and Martin Wainwright. Privacy aware learning. Journal of the ACM (JACM), 61(6):1-57. 2014.
Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of cryptography conference, pp. 265-284. Springer, 2006.
Alireza Fallah, Aryan Mokhtari, and Asuman Ozdaglar. Personalized federated learning with the-
oretical guarantees: A model-agnostic meta-learning approach. Advances in Neural Information Processing Systems, 33, 2020.
Farzin Haddadpour and Mehrdad Mahdavi. On the convergence of local descent methods in feder- ated learning. arXiv preprint 1rXiv:1910.14422 14425, 2019.
Filip Hanzely and Peter Richtárik. Federated learning of a mixture of global and local models. arXiv preprint arxiv:2002.0533 16, 2020.
Meng Hao, Hongwei Li, Guowen Xu. Sen Liu, and Haomiao Yang. Towards efficient and privacy- preserving federated deep learning. In ICC 2019-2019 IEEE International Conference on Com- munications (ICC), pp. 1-6. IEEF, 2019.
10

---

Under review as a conference paper at ICLR 2022
Briland Hitaj, Giuseppe Ateniese, and Fernando Perez-Cruz. Deep models under the gan: infor- mation leakage from collaborative deep learning. In Proceedings of the 2017 ACM SIGSAC Conference Computer and Communications Security, pp. 603-618, 2017.
Grant Van Horn, Oisin Mac Aodha, Yang Song, Yin Cui, Chen Sun, Alexander Shepard, Hartwig Adam, Pietro Perona, and Serge J. Belongie. The inaturalist species classification and detection dataset. 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 8769- 8778, 2018.
Tzu-Ming Harry Hsu, Hang Qi, and Matthew Brown, Measuring the effects of non-identical data distribution for federated visual classification. arXiv preprint (e0i:::999.0060 2019a.
Tzu-Ming Harry Hsu, Hang Qi, and Matthew Brown. Measuring the effects of non-identical data distribution for federated visual classification. arXiv preprint
2019b.
Tzu-Ming Harry Hsu, Hang Qi, and Matthew Brown. Federated visual classification with real-world data distribution. In Computer Vision-ECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part X 16, pp. 76-92. Springer, 2020.
Yutao Huang, Lingyang Chu, Zirui Zhou, Lanjun Wang, Jiangchuan Liu, Jian Pei, and Yong Zhang. Personalized cross-silo federated learning on non-iid data. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pp. 7865-7873, 2021.
Yihan Jiang, Jakub Konečný, Keith Rush, and Sreeram Kannan, Improving federated learning per- sonalization via model agnostic meta learning, arXiv preprint arXi::1909. 2019.
Sai Praneeth Karimireddy, Satyen Kale, Mehryar Mohri, Sashank Reddi, Sebastian Stich, and Ananda Theertha Suresh. Scaffold: Stochastic controlled averaging for federated learning. In International Conference Machine Learning, pp. 5132-5143. PMLR, 2020.
Youngeun Kim, Donghyeon Cho, Kyeongtak Han, Priyadarshini Panda, and Sungeun Hong, Do- main adaptation without source data. IEEE Transactions on Artificial Intelligence, 2021.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient- learning applied to document recognition. Proceedings of the IEEE, 86(1 (1111))2278222221 1998.
Jian Liang, Dapeng Hu, and Jiashi Feng. Do really need access the source data? source hypothesis transfer for unsupervised domain adaptation. In International Conference on Machine Learning. pp. 6028-6039, PMLR. 2020a.
Paul Pu Liang, Terrance Liu, Liu Ziyin, Nicholas Allen, Randy Auerbach, David Brent, Ruslan Salakhutdinov. and Louis Philipp Moreney. Think locally, act globally: Federated learning with local and global representations. arXiv preprint arXiv:2001.01522, 2020b.
Tao Lin, Sebastian U Stich, Kumar Kshitij Patel, and Martin Jaggi. Don't use large mini-batches, use local sgd. arXiv preprint arXiv:1808.0722 2018.
Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communicatonn-eficiennnt learning of deep networks from decentralized data. In Artificial Intelli- gence and Statistics, pp. 1273-1282. PMLR, 2017a.
Brendan McMahan, Daniel Ramage, Kunal Talwar, and Li Zhang. Learning differentially private recurrent language models. arXiv preprint arXiv:1710.06963 2017b.
Luca Melis, Congzheng Song, Emiliano De Cristofaro, and Vitaly Shmatikov. Exploiting unintended feature leakage in collaborative learning. In 2019 IEFE Symposium on Security and Privacy (SP), pp. 691-706. IEEE, 2019.
Viraaji Mothukuri, Reza M Parizi, Seyedamin Pouriyeh, Yan Huang, Ali Dehghantanha, and Gautam Srivastava. A survey on security and privacy of federated learning. Future Generation Computer Systems, 115:619 9400 2021.
11

---

Under review as a conference paper at ICLR 2022
Amirhossein Reisizadeh, Aryan Mokhtari, Hamed Hassani, Ali Jadbabaie, and Ramtin Pedarsani. Fedpaq: A coammunccation-fffciiii federated learning method with periodic averaging and quan- tization. In International Conference Artificial Intelligence and Statistics, pp. 2021-2031. PM 2020.
Anit Kumar Sahu, Tian Li, Maziar Sanjabi, Manzil Zaheer, Ameet Talwalkar, and Virginia Smith. On the convergence of federated optimization in heterogeneous networks. arXiv preprint arXiv:1812.06127. 3, 2018.
Mark Sandler, Andrew Howard, Menglong Zhu, Andrey Zhmoginov, and Liang-Chiee Chieh Chen. Mo- bilenetv2: Inverted residuals and linear bottlenecks. Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 4510-4520, 2018.
Aviv Shamsian, Aviv Navon, Ethan Fetaya, and Gal Chechik. Personalized federated learning using hypemetworks. arXiv preprint 1tt:::20330042288 2021.
Sebastian U Stich. Local sgd arXiv:/805.09767 2018.
converges fast and communicates little.
arXiv
preprint
Alysa Ziying Tan, Han Yu, Lizhen Cui, and Qiang Yang. Towards personalized federated learning- arXiv preprint arXiv:2103.00710, 2021.
Stacey Truex, Nathalie Baracaldo, Ali Anwar, Thomas Steinke, Heiko Ludwig, Rui Zhang, and
Yi Zhou. A hybrid approach to privacy-preserving federated learning. In Proceedings of the 12th
ACM Workshop Artificial Infelligence and Security, pp. 1-11,
Dequan Wang, Evan Shelhamer, Shaoteng Liu, Bruno Olshausen, and Trevor Darrell. Tent: Fully test-time adaptation by entropy minimization. arXiv preprint arXiv:2006. 2012660000.10266 2020a.
Hao Wang, Zakhary Kaplan, Di Niu, and Baochun Li. Optimizing federated learning non-iid data with reinforcement learning. In IEEE INFOCOM 2020-IEEE Conference on Computer Commu- nications, pp. 1698-122 1707. IEEE, 2020b.
Jianyu Wang and Gauri Joshi. Cooperative sgd: A unified framework for the design and analysis of communication--fficcnnl sgd algorithms. arXiv preprint arXiv: 07576, 2018.
Tobias Weyand, André Araujo, Bingyi Cao, and Jack Sim. Google landmarks dataset v2 a large- scale benchmark for instance-level recognition and retrieval. In CVPR, 2020. URL https:
//axxiv.rrgaabs///// 2004.0000000 1.4...1100 B
Liyang Xie, Kaixiang Lin, Shu Wang, Fei Wang, and Jiayu Zhou. Differentially private generative adversarial network. arXiv preprint arXiv: 1002:018000067333 2018.
Miao Yang, Akitanoshou Wong, Hongbin Zhu, Haifeng Wang, and Hua Qian. Federated learning with class imbalance reduction. arXiv preprint urXiv:2011..1226. 2020.
Manzil Zaheer, Satwik Kottur, Siamak Ravanbakhsh, Barnabas Poczos, Ruslan Salakhutdinov, and Alexander Smola. Deep sets. arXiv preprint arXhv: 2017.
2017.
Yue Zhao, Meng Li, Liangzhen Lai, Naveen Suda, Damon Civin, and Vikas Chandra. Federated learning with non-iid data. arXiv preprint arXiv:1806.0053 00582, 2018
Fan Zhou and Guojing Cong. On the convergence properties of k-step averaging stochastic gradi- ent descent algorithm for nonconvex optimization. arXiv preprint /708.00700../113 2017.
Tianqing Zhu and S Yu Philip. Applying differential privacy mechanism in artificial intelligence. In 2019 IEEE 39th International Conference on Distributed Computing Systems (ICDCS), pp- 1601-1609. IEEE, 2019.
Wennan Zhu, Peter Kairouz, Brendan McMahan, Haicheng Sun, and Wei Li. Federated heavy hitters discovery with differential privacy. In International Conference Artificial Intelligence and Statistics, pp. 3837-3847. PMLR, 2020.
12

---

Under review as a conference paper at ICLR 2022
A GENERALIZATION BOUND
In the context of MTL and DA, the "vanilla" supervised learning setup, can be viewed as if we have only one task and one domain. The most common solution is find h E H. that minimizes the loss function on a training set sampled from probability distribution P. In general, H is a hyperparameter, defined by the network architecture. This Blumer al. (989)) shows that in this simple case, the generalization error is bounded. The bound depends upon the "richness" of H. Choosing a "rich" H (with large VC-dimension). let the generalization error be larger.
In IT-PFL, each client may use a different hypothesis. Instead of bounding the eπтоr of one chosen hypothesis, we bound the error of the chosen hypothesis space that each client chooses from. This way, we can bound the error of novel client, without assuming anything about the way it chose from the hypothesis space.
First, we find H that contains hypotheses that can fit all data of the clients. Second, for each client, we select the best hypothesis E H according to the client data. We define Q as a distribution over P. so, each client sample from Q the distribution P. We further define HH as hypothesis space family, where each H HI is set of functions h X Y.
The first goal is to find hypothesis space H E IH that minimizes the weighted error of all clients, assuming each client uses the best hypothesis H. We define this error using the following loss:
erro(H) = [/ inf errp(t))Q(P) kEH
while (h) fxxx l(h(x), y)dP(z,)) 3). In practice Q in unknown, so we can only estimate (H) using the sampled clients and their data.
For each client = 1..m, we sample the client training data from XxY ~ P.. We denote the sampled training set with 2; == (I11, 9/ ) (Imm ym). and = En... The empirical error of a specific hypothesis is defined by (h) == t/2 - [(h(x.), vk). Now the empirical loss to minimize is
1
ér (H)
iff ér 2, (h) helf
(4)
n
Baxter (2000) shows that if the number of clients satisfies n 2 mar 2
256
log(
8C 2C(22..1))
HH
64),
80 12 Hi"
and the number of samples per client m satisfies m 2 max net log( probability 1 - 5 all H E H satisfies
64
j. then with c
errQ(H) S (T) +e
were C2 H!)) and _ H!)) are the covering numbers defined in Baxter 2000), and can be referred as way measure the complexity of H. Note that very "rich" makes er, (H) small, but it increases the covering number, so for the same amount of data, increases.
For the PFL setup, this is enough, since we can ensure that for client that sampled from Q and was a part in the federation, the chosen hypothesis h E Hhas an error close to the empirical one (H) For novel client, this may not be the case. The novel client may sample from a different distribution over P. In the general case, the novel client may even have different distribution over X Y. In the most general case, the error on the novel client can not be bound. In DA, a common distribution shift is a covariate shift, where P(x) may change, but P(ryy) remains constant. This assumption lets us bound the error of the novel client.
Ben- Donn-avid et al. (210)) proofed that for given H H. Sf and T are two datasets with m samples, then with probability I 8, for every hypothesis h E H:
2d (2m) + log
erry (h) < (hr)(h) + (d ( +4/
+ +
(6)
where errp(h) = F((e))) D [l((x)) - y|] is the error of the hypothesis on probability distribution of the domain D. duan(S (S,T) is distance measure between the domains S and T, and X
13

---

Under review as a conference paper at ICLR 2022
arg e (rr + (h). Note that for over wer-paramettried models like deep neural networks should be very small. To keep the analysis shorter we assume this is the case. We further assumed
2d tog(2m)++og(?) Those assumptions are not mandatory, and the mn
is big enough neglect 4v
following analysis can be done without it.
B MORE DETAILS ABOUT TRAINING
In IT-PFL-HN two main components trained using federation of labeled clients: A hyperntt- work and a client encoder. The hypernetwork optimizes the LHN loss defined in by updating both its own weights 8 and the clients representations {ek 1.N {Ckik=1-
L8x .l..,,,,................ CN) = Σ ((o(e))))))))
The client encoder trains predict the representations learned by the hypernetwork from the client raw data by minimizing Lencoder defined in g At inference time, a novel client feeds its data the client encoder and gets embedding vector. Then, feeding the embedding vector to the hypernetwork produces a custom model for the client.
Lencoder
Le(e
(8)
In detail, in each communication step, the server selects a random client. Using its current embed- ding, the hypernetwork generates customized network and communicates then locally trains that network on its data for predefined number of local epochs. As in (Shamsian al.) (202I), the client communicates the delta between the weights before and after the training back to the server. Using the chain rule, the server can train the hypernetwork and the embeddings to optimize LHN (see Figure 2..
the client. The client
In addition to the custom target model, the server sends the client the current encoder, and the current embedding of the client. Similar the previous step, the client trains the encoder locally to predict the embedding from the client data by optimizing Lenester. then, the updates of the encoder are sent back the server for aggregation.
Up to this point, the client encoder trains in parallel to the hypernetwork, and has no influence on the hypernetwork weights or the embeddings of the labeled clients. We found that freezing the encoder and fine-tuning the hypernetwork using the trained encoder predictions improve the results of our method. This done by optimizing the hypernetwork parameters using LFine-ture tune-
mi
L Liine- tune (0) = Σ ΣΣeR (L
(9)
However, this fine-tune step reduces the performance of the labeled clients. Since our goal to generalize well to novel clients, we ignored this effect. Note that in a real-world application, the server may save a version of the hypernetwork before fine-tuning it, and used it when generating models for the original federation.
C EXPERIMENTAL DETAILS
For all experiments presented in the main text, we use fully-connected hypernetwork with 3 hidden layers of 100 hidden units each. The size of the embedding dim is Natients Experiments are limited to 500 communication steps. In each step, communication done with 0.1 Ntroón
Hyperparmeter Tuning We divide the training samples of each train client into 85% 15% train / validation sets. The validation sets are used for hyperparameter tuning and early stopping of all haselines and datasets. The searched hyperparameters and corresponding values by method:
14

---

Under review as a conference paper at ICLR 2022
FedAVG: The local momentum Miocal is 0.5. We search local learning-rate nocal {le - 1,3e 2, le 2, 5e - 3, le 3/. number of local epochs K E {1, 2, 5, 10] and batch size {16, 32, 64]. pFEdHN: We set Ptocal 0.9. We search over learning-ratee -ratess of the hypernetwork, emhedding layer and local training: '/hn, -embeddingg Mocat E (1e - 1, 5e 2, le- 2, 5e 55e-3, 3, 1e- 3), weight decays wdhn; WWdembedding: uddtocal {le 3, le 4, le 5), number of local epochs K E (1, 2, 5, 10} and batch size {32, 64). IT-PFL-HN: We perform the optimization using the same parameters and values as pFEdHN. In addition, we search over the learning-rate of the client encoder Mencoder E {le 56 2, le - 2,5c 5e 3, le 33..
CIFAR 6.3) We use a LeNet-based target network with two convolution layers with 16 and 32 filters of size 5 respectively. Following these layers are two fully connected layers of sizes 120 and 84 that output logits vector. The client encoder follows the same architecture with an additional fully connected layer of size 200 followed by Mean-global- globaa-poooling for the first 100 units and Max--global-pooling for the other 100 units. Global-pooling is done over the samples of a batch.
Real-Word World Data(Section 6.4) We use simple fully-connecter network with two Dense layers of size 500 each, followed by a Dropout layer with dropout probability of 0.2. The client encoder fully-connected network with three Dense layers of size 500. The first layer followed by Mean-globas -pooling for the first 250 units and Max-global -oobling for the other 250 units.
D DIFFERENTIAL PRIVACY
Proof.
Ag = max (lg(D) g(D')l| D.D'
max | D.D
1 D ZDD
Σ
((x))
x D
Σ <(x))|
(10)
ZED'
Denote E D and d' E D' as the only nonidentical instance between D and D', so D/d = D'Id'. Then
Ag
max 1 D.D
Σ
<(x) d(())) +(an))
- |D'
Σ
x(x) + o(d')) +
(11)
D
#ED/a
#r DED' ja'
mazddd
11 (o(d) ((d'))
(12)
Assume that ø is bounded with BB. (dd) x(d')] < 2B Then from the linearity of g/:
2
Ag - D
Tup (dd) - x(d')) -
Lag B
(13)
D
15


Reviews:
[{"review_id": "qPkxRFScxeX", "reviewer": "Reviewer_GyWf", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "This paper is clearly written. The authors adopt an additional novel client to enhance the accuracy of personalized FL. However, the reviewer still has several concerns: \n1. The proposed generalization bound is established for the novel client. How does this generalization-bound reflect the efficacy of the proposed personalized federated learning framework? \n2. The compared baselines are not sufficient to demonstrate the efficacy of the proposed algorithm. In fact, there exist several PFL algorithms, such as Ditto, Sub-FedAvg, etc.\n3.  The authors should do an additional ablation study to evaluate the influence of the size of the unlabeled dataset.  It seems that is the novel client merely has limited data. The proposed algorithm in this work reduces a smile variant of pFedHN. \n", "summary_of_the_paper": "The authors propose a new personalized federated learning paradigm composed of a hypernetwork module and an encoder module in server and an extra novel client with unlabeled data.  The encoder module is enhanced thanks to the unlabeled data.   Preliminary experiments demonstrate the efficacy of the proposed algorithm. ", "summary_of_the_review": "see the comment above. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "ovyBOpXRGP", "reviewer": "Reviewer_pXWe", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "While the authors claimed that IT-PFL is a novel problem, the solution that the authors gave is similar to [1], which utilizes hypernetwork in personalized federated learning task. At least to me, the difference between [1] and this paper is marginal, which makes me question the novelty of the paper. I think the authors need to make clear what is the novel contribution given the existence of [1]. This paper does give some results on generalization bound and differential privacy, but I believe they are just results of simple application of existing theorems. The theoretical contributions from these two sections are not strong enough, or at least the authors did not make clear what are theoretical challenges.\n\nBesides the novelty concern, I have two additional suggestions.\n\nFirst, I think it will be interesting to compare hypernetworks and meta-learning. These two approaches are solving essentially the same problem in the end, and they are both applied to personalized federated learning. A deep understanding of the connections and differences between the two approaches will be beneficial to the community.\n\nSecond, I think in related work, the authors should summarize the literature about Hypernetworks (HNs), and especially its recent application in personalized federated learning ([1]), because there is obviously an intimate connection between that line of works and this paper.\n\n[1] Aviv Shamsian, Aviv Navon, Ethan Fetaya, and Gal Chechik. Personalized federated learning using hypernetworks. arXiv preprint arXiv:2103.04628, 2021.", "summary_of_the_paper": "The paper proposes a new task named as Inference-Time Personalized Federated Learning (IT-PFL). Specifically, given a new client with unlabeled data joining in the federated learning system after the training process has finished, IT-PFL aims to deploy personalized FL model to it. The strategy is based on recent works on hypernetwork. The training strategy is in an end-to-end framework.", "summary_of_the_review": "Given the major novelty concern, I do not think the paper is appropriate for acceptance in its current shape. The authors should try to make clear what is the novel part of the paper, how challenging it is to get those results, and add more literature review in related work.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "1: The contributions are neither significant nor novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "j5EBRBSiO1G", "reviewer": "Reviewer_o4oc", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strength: The proposed idea contributes to the hypernetwork research and ourperforms current state-of-the-art results.\n\nWeaknesses: it's clear how the proposed paper is different from [1] but I would dedicate more space for the comparison, specifically Section 5.3 of [1] suggests using the nearest client (as you describe in Table 1). It's clear that CIFAR-100 or iNaturalist have more diverse data where your method excels, but I wonder if in real scenario with millions of users participating (e.g. language model for Reddit/Stackoverflow dataset) the same conclusion would persist. \n\nIt would be useful to see the distribution and not the average accuracy values for new user performance. It might be that the proposed method benefits (or harms) the users with diverse data, which is an essential question for FL fairness.\n\nIt leads to the following point: evaluating the method on the text data is important for FL as language modeling is one of the few industry-deployed use cases and widely used in FL literature. And also the personalization of LM models is an important problem. \n\nFor DP please clarify what d \\in D is? Is it a single input of the user? \n\nLastly, other personalization works that use local adaptation [2], such as finetuning global model on the local data, should be considered as baselines and I wonder what is their performance w.r.t. the proposed method.\n\n[1] Shamsian, A., Navon, A., Fetaya, E., & Chechik, G. \"Personalized Federated Learning using Hypernetworks.\" In ICML'21\n[2] Li, Tian, Shengyuan Hu, Ahmad Beirami, and Virginia Smith. \"Ditto: Fair and robust federated learning through personalization.\" In ICML'21.", "summary_of_the_paper": "This paper proposes to use hypernetwork to personalize the federated model by encoding new user data and using this embedding as a parametrization argument. The results demonstrate significant average improvement over the new clients. Furthermore, the authors evaluate the possible use of DP to encode the user embedding vectors. ", "summary_of_the_review": "The paper is well-written and presents a new algorithm that uses encoder to adapt for new clients. The paper lacks few baselines and explanations but can be beneficial for FL community.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "XVjDVZ_4GEa", "reviewer": "Reviewer_MpJV", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Pros:\n1. The paper overall in clearly written and easy to follow. The overall flow of the paper and descriptions of the proposed approach is clear.\n2. The problem being study is well-motivated and can be useful. \n3. It also provide differential privacy analysis to provide insights into the privacy protection perspective of the proposed approach. \n\nCons:\n1.  Some of the experiment results are not explained. For example, in Table one, the CIFAR-100 pathological split, the proposed approach is not outperforming the baseline approaches. However, it lacks any explanation or analysis about why it is the case. \n2. Question: in the real-world dataset, for the models both target model, client encoder, and hyper network. These are all simple fully connected learns with global operations. Are these models realistic for real-world use-case\u0010s? If these base model change, will the framework performance differ? It would be good to demonstrate the effectiveness of the proposed approach with different types of neural networks. \n3. In the experiment, Section 6.4, it methods the pFedHN-ensemble suffers from large communication and computation cost. However, there are not numbers supporting the claim. It would be good to provide numbers to see if these are real-concerns. \n4. I was wondering how much difference it will make in comparison with the new client participate in training. It would be good to add experiments to compare with that. \n\nMinors:\n1. In section 4, Meta mechanism, the quote is not right. same for many other quotes", "summary_of_the_paper": "This paper studies the problem of in personalized federated learning, the current paradigm does not allow for new clients to join during the inference time. Federated learning does not generalize well to new data distribution that is very different from training. Personalized FL are not designed to apply to a client that is not being trained. This paper defines a new task inference-time personalized federated learning (ITPFL) to close the gap. The proposed approach IT-PFL-HN first trains a client encoder, then maps a full client dataset to descriptor. A hyper network maps the descriptors on to a space. During inference time, the client description can be computed locally and request the personalized model on-demand. The paper demonstrate the effectiveness of the proposed approach on both CIFAR and real-world datasets. \n", "summary_of_the_review": "Overall, the problem being studied in this paper is interesting and well-motivated. The paper is clearly written. The novelty perspective of this paper can be highlighted better. It seems like a lot of the aspect like hyper network are proposed by other approaches.  Some other major concerns are in terms of the experiments, there are results are not explained or claims without number supported. Please see main review for details. \t\t \n", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper proposes a personalized federated learning method using a hyper-network to encode unlabeled data from new clients. At inference time, new clients can use unlabeled data as input to this hyper-network in order to obtain a personalized version of the model. The key strength of the paper is that the idea is interesting and timely. Personalization has been studied for clients that participate from the beginning of training, but personalization of models for new clients that join later on has not been considered in most previous works. The experimental results also show a reasonable improvement over the baselines. However, the following concerns remain:
1) Novelty in comparison with reference [1]. Please add a detailed comparison when you revise the paper.
2) Explanation of the experimental results and comparison with baselines was deemed insufficient by some of the reviewers.
3) The generalization bound and the DP results seem standard extensions of existing works and do not add much novelty to the paper.

There wasn't much post-rebuttal discussion and the reviewers decided to stick to their original scores. Therefore, I recommend rejection of the paper. I hope that the authors will take the reviewers' constructive comments into account when revising the paper for a future resubmission.
Decision: Reject