A Data-Free Approach to Mitigate Catastrophic Forgetting in Federated Class Incremental Learning for Vision Tasks
Authors: Sara Babakniya
Zalan Fabian
Chaoyang He
Mahdi Soltanolkotabi
Salman Avestimehr
Venue: NeurIPS 2023 poster (2023)
Keywords: federated learning
class incremental learning
generative models
data-free
continual learning
TL;DR: This work presents a federated class incremental learning framework that utilizes generative models to synthesize data instead of using on device memory

Abstract: Deep learning models often suffer from forgetting previously learned information when trained on new data. This problem is exacerbated in federated learning (FL), where the data is distributed and can change independently for each user. Many solutions are proposed to resolve this catastrophic forgetting in a centralized setting. However, they do not apply directly to FL because of its unique complexities, such as privacy concerns and resource limitations. To overcome these challenges, this paper presents a framework for \textbf{federated class incremental learning} that utilizes a generative model to synthesize samples from past distributions. This data can be later exploited alongside the training data to mitigate catastrophic forgetting. To preserve privacy, the generative model is trained on the server using data-free methods at the end of each task without requesting data from clients. Moreover, our solution does not demand the users to store old data or models, which gives them the freedom to join/leave the training at any time. Additionally, we introduce SuperImageNet, a new regrouping of the ImageNet dataset specifically tailored for federated continual learning. We demonstrate significant improvements compared to existing baselines through extensive experiments on multiple datasets.

A Data-Free Approach to Mitigate Catastrophic Forgetting in Federated Class Incremental Learning for Vision Tasks
Sara Babakniya
Zalan Fabian
Computer Science
Electrical and Computer Engineering University of Southern California
University of Southern California
Los Angeles, CA babakniy@usc.cm edu
Los Angeles, CA zfabian@usc. edu
Chaoyang He
Mahdi Soltanolkotabi
Salman Avestimehr
FedML
Electrical and Computer Engineering
Electrical and Computer Engineering University of Southern California
Sunnyvale, CA ch@fedml.ar ai
University of Southern California
Los Angeles, CA soltamolQusc.edi
Los Angeles, CA avestimeQusc.
Abstract
Deep learning models often suffer from forgetting previously learned information when trained on new data. This problem exacerbated federated learning (FL), where the data is distributed and can change independently for each user. Many solutions are proposed to resolve this catastrophic forgetting a centralized setting. However, they do not apply directly to FL because of its unique complexities, such as privacy concerns and resource limitations. To overcome these challenges, this paper presents framework for federated class incremental learning that utilizes a generative model to synthesize samples from past distributions. This data can be later exploited alongside the training data to mitigate catastrophic forgetting. To preserve privacy, the generative model is trained on the server using data- free methods at the end of cach task without requesting data from clients. Morcover, our solution does not demand the users to store old data or models, which gives introduce
them the freedom join/leave the training at any time. Additionally, SuperlmageNet, a new regrouping of the ImageNet dataset specifically tailored for federated continual learning. We demonstrate significant improvements compared to existing baselines through extensive experiments on multiple datasets.
Introduction
Federated learning (FL)
40 29 is decentralized machine learning technique that enables privacy-
preserving collaborative learning. FL, multiple users (clients) train a common (global) model in coordination with a server without sharing personal data. In recent years, FL has attracted tremendous attention both research and industry and has been successfully employed various fields, such as autonomous driving [17] next-word prediction [21], health care [3] and many more.
Despite its popularity, deploying FL in practice requires addressing critical challenges, such as resource limitation and statistical and system heterogeneity (3]. While tackling these challenges an essential step towards practical and efficient FL, there are still common assumptions in most FL frameworks that are too restrictive in realistic scenarios.
37th Conference on Neural Information Processing Systems (NcurIPS 2023).

---

Task=1
Task=2
Task=3
Task=T
Client
Client N
Figure 1: In the real world, users constantly change their interests, observe new data, lose some of the old ones. As a result, the training dataset is divided into different tasks. For example, here, at Task 1, the clients' datasets dominantly include pictures of animals, and by the end of the training (T (Task- = 7), the trend shifts towards landscapes.
In particular, one of the most common assumptions that clients' local data distribution is fixed and does not change over time. However, in real-world applications [4)] clients' data constantly evolve due to changes in the environment, trends, or new interests. For example, [6] presents the real- world data of online shop, suggesting interest in items shifts through seasons. Another example arises in healthcare, where a model trained on old diseases should be able to generalize to new diseases (58). In such scenarios (Figure M. the model must rapidly adapt to the incoming data while preserving performance on past data distributions to avoid catastrophic forgetting [28] 39].
In the centralized setting, such problems have been explored in continual learning 448 34 (also called lifelong learning or incremental learning 2 based on the initial settings and assumptions). In recent years. various algorithms have been proposed in Continual Learning (CL) to tackle catastrophic forgetting from different angles and can achieve promising performance in different scenarios.
Despite all the significant progress, most CL methods are not directly applicable to the federated setting due inherent differences (Table [ between the two settings. For instance, experience replay 47 is a popular approach, where a portion of past data points is saved to maintain some previous distributions throughout the training. However, deploying experience replay in FL has resource and privacy limitations. It requires clients to store and keep their data, which may increase the memory usage of already resource-limited clients. Furthermore, users may not be able to store data for more than a specific time due to privacy concerns. Finally, depending solely on the clients to preserve the past not reliable, as clients leaving means losing their data.
representation
Challenge
Limitation
Low memory
Chents cannol store many examples
Clients drop out
Causes loss of information stored in memory
New clients join
New clients only have access to new classes
Privacy
Limits data saving and sharing of the clients
Table 1: Challenges that limit the direct use of continual learning methods in federated settings.
To address the aforementioned problems, we propose MFCL, Mimicking Federated Continual Learning: a
federated continual learning approach without episodic memory. In particular, MFCL is based on training generative model in the server and sharing it with clients to sample synthetic examples of past data instead of storing the actual data on the client side. The generative model training is data-free in the sense that no form of training data is required from the clients, and only the global model is used in this step. It is specifically crucial because this step does not require powerful clients and does not cause any extra data leakage. Finally, this algorithm has competitive performance; our numerical experiments demonstrate improvement by 10% 20% in average accuracy while reducing the training overhead of the clients.
Moreover, benchmarking federated continual learning in practical scenarios requires a large dataset to split among tasks and clients. However, existing datasets are not sufficiently large, causing most of the existing works federated continual learning evaluating on a few clients (5 to 20) [45] 24 (2). To enable more practical evaluations, we release a new regrouping of the ImageNet dataset, SuperlmageNet. SuperImageNet enables evaluation with many clients and ensures all clients are assigned sufficient training samples regardless of the total number of tasks and active clients.

---

We summarize our contributions below:
We propose a novel framework to tackle the federated class incremental learning problem more efficiently for many users. Our framework specifically targets applications where past data samples on clients are unavailable.
We point out potential issues with relying on client-side memory for FCL. Furthermore, we propose using a generative model trained by the server in a data-free manner to help overcome catastrophic forgetting while preserving privacy.
We modify the client-side training of traditional FL. techniques in order to mitigate catas- trophic forgetting using a generative model.
We propose a new regrouping of the ImageNet dataset, SuperlmageNet, tailored to federated continual learning settings that can be scaled large number of clients and tasks.
We demonstrate the efficacy of our method in more realistic scenarios with a larger number of clients and more challenging datasets such as CIFAR- 100 and TinyImageNet.
2 Related Work
Continual Learning. Catastrophic forgetting [39 is a fundamental problem in machine learning: when we train a model on new examples, its performance degrades when evaluated on past data. This problem is investigated in continual learning (CL. [59], and the goal is for the model to learn new information while preserving knowledge of old data. A large body of research has attempted to tackle this problem from different angles, such adding regularization terms [3 41),
experience replay by storing data in memory [2 10 335, training a generative model [56 53 32)
or architecture parameter isolation [6 38 19 51.
In CL settings, the training data is presented to the learner as a sequence of datasets commonly known as tasks. In each timestamp, only one dataset (task) is available, and the learner's 's goal is to perform well on all the current and previous tasks.
Recent work focuses on three main scenarios, namely task-, domain- and class-incremental learning (II.) (54] In Task-II., tasks are disjoint, and the output spaces are separated by task IDs provided during training and test time. For Domain-ll., the output space does not change for different tasks, but the task IDs are no longer provided. Finally, in Class-IL, new tasks introduce new classes the output space, and the number of classes increases incrementally. Here, we work on Class-IL, which the more challenging and realistic, especially in FL. In most of the FL applications, there no task ID available, and it is preferred to learn single model for all the observed data.
Class Incremental Learning. In standard centralized Class-IL, the model is trained on a sequence of oon-overlapping T tasks (1(1,, (2)) .... T(T) where the data distribution of task t, D is fixed but unknown in advance, while all the tasks share the same output space ())). For task t, D' consists of No pairs of samples and their labels ((f()()) where all the newly introduced classes (v²)
t-1
belong to y Cof E (D') and U = 0). Moreover, a shared output space among all j=1
tasks means that at the end of task f, the total number of available classes equals g = -i 1
Federated Continual Learning. In rife- scenarios, users' local data is not static and may evolve. For instance, users' interests may change over time due to seasonal variations, resulting in more examples for given class. On the other hand, reliability issues or privacy concerns may lead to users losing part of their old data as well. In Federated Continual Learning (FCL), the main focus is to adapt the global model to new data while maintaining the knowledge of the past.
Even though FCL is an important problem, has only gained attention very recently. and [58 is the first paper on this topic. It focuses on Task-IL, which requires a unique task ID per task during inference. Furthermore, adapts separate masks per task to improve personalized performance without preserving common global model. This setting is considerably different than ours as we target Class-IL with a single global model classify all the classes seen so far. [37 employs server and client-side knowledge distillation using surrogate dataset. [15] relaxes the problem as clients have access to large memory to save the old examples and share their data, which is different from the standard FL setting. Some works, such as (26 44 52 explore the FCL problem in domains other than image classification. 42] has proposed using variational embedding to send data to the server securely and then server-side training to rehearse the previous task for Domain-IL.
3

---

This work focuses on Class-IL for supervised image classification without memory replay, similar to 45 24. However. [24] allows overlapping classes between tasks and focuses on few-shot learning. which is different from the standard Class-II.. The most related work to ours is 45 where authors propose FedCII.. This work also benefits from generative replay to compensate for the absence of old data and overcome forgetting. In FedCIL, clients train the discriminator and generator locally. Then, the server takes a consolidation step after aggregating the updates. In this step, the server generates synthetic data using all the generative models trained by the clients to consolidate the global model and improve the performance. The main difference between this work and ours is that in our work, the generative model is trained by the server in a data-free free manner, which can reduce clients' training time and computation and does not require their private data (detailed comparison in Appendix HH).
Data-Free Knowledge Distillation. Knowledge distillation (KD) [25] is popular method to transfer knowledge from well-trained teacher model (usually) smaller student model. Common KD) methods are data-driven, and at least small portion of training data is required. However, in some cases, training data may not be available during knowledge distillation due to privacy concerns. To tackle this problem, a new line of work [12] 222 proposes data-free knowledge distillation. In such methods, generative model is used as a training data substitute. This generative model is trained to generate synthetic images such that the teacher model predicts them as their assigned label (Figure 2 This method has recently become popular in CL [57 [50] as
Synthetic Image
Input Noise
Generative model
Teacher model
Prediction
inndients
Gradients
(Training)
(Frozen)
well, mainly due to the fact that it can eliminate the need for memory in preserving knowledge. Data-free KD has been previously used in FL (60) to reduce the effect of data heterogeneity. However, to the best of our knowledge, this is the first work that adapted such technique in the context of federated continual learning.
Figure 2: Data-Free Knowledge Distillation. The generator receives random noise as input labels and synthesizes images that are labeled correctly by the trained teacher model.
3 Federated Class Incremental Learning with MFCL
In federated Class-IL, shared model trained on T different tasks. However, the distributed and private nature of FL makes it distinct from the centralized version. In FL, users may join, drop out, or change their data independently. Besides, required data or computation power for some centralized algorithms may not be available in FL due to privacy and resource constraints.
To address the aforementioned problems, we propose MFCL., which is less reliant on the client-side memory and computational power. This algorithm includes two essential parts: first, at the end of each task, the server trains generative model with data-free knowledge distillation methods to learn the representation of the seen classes. Second, clients can reduce catastrophic forgetting by generating synthetic images from the trained generative model obtained from the server side. This way, clients are not required to use their memory for storing old data. Moreover, this technique can address the problem of newly connected clients without past data. Furthermore, since the server trains the generative model training without additional information, this step does not introduce new privacy issues. Finally, MFCL can help mitigate the data heterogeneity problem, as clients can synthesize samples from classes they do not own [60] in memory. Next, we explain the two key parts of MFCL: server-side generative model (Figure Left) and client-side continual learning (Figure Right).
3.1 Server-Side: Generative Model
The motivation for deploying a generative model is to synthesize images that mimic the old tasks and to avoid storing past data. However, training these generative models on the client's side, where the training data exists, is computationally expensive, requires large amount of training data and can be potentially privacy concerning. On the other hand, the server has only access to the global model and aggregated weights and no data. We propose training a generative model on the server, but in data-free manner, i.e., utilizing model-inversion image synthesis [57 (5). In such approaches, the goal is to synthesize images optimized with respect to the discriminator (global model). Then, the

---

Every Round
of Every Tink
Client
-N0.1)
Aggrapite
Gidtal Nusid
Generador
Model drrust
x N(O
Model
Generalor
(Trout
Update Aguregation
Data free generative model training
Syuthetic Data
Figure 3: Overview of MFCL. Left. The server aggregates the updates every round and trains generator using data-free methods at the end of each task. Right. Clients train their models locally using their local data and synthetic images of past tasks from the generator.
generative model is shared with the clients to generate images during local training. To this aim, we utilize a generative model with ConvNet architecture, that takes noise NN,,, as input and produces a synthetic sample I, resembling the original training input with the same dimensions. In order train this model, we must balance the various training objectives detail next.
Cross Entropy Loss. First, the synthetic data should be labeled correctly by the current discriminator model (global model F). To this end, we employ cross entropy classification loss between its assigned label z and the prediction arbitrary and greater than the current discovered classes of task t; therefore, only consider the first q dimension here, where Σi=1
J on synthetic data Note that noise dimension can be
|J* (which is equal to the total number of classes seen in the previous tasks). Then, we can define the cross- entropy loss as
Lce CE(arggan(z() F(i)).
(1)
Diversity Loss. Synthetic images can suffer from lack of class diversity. To solve this problem, we utilize the information entropy (IE) loss [12] For a probability vector p P2,. Pa). information entropy is evaluated as (P) = - Σ, p; log(p;). Based on the definition, inputs with uniform data distributions have the maximum IE. Hence, to encourage G to produce diverse samples, we deploy the diversity loss defined as
Lavo - -Hinfol Σ F(i.)).
This loss measures the IE for samples of a batch (bs: batch size). Maximizing this term encourages the output distribution of the generator to more uniform and balanced for all the available classes.
57 50 in the centralized setting have recognized that the distribution of synthetic images generated by model inversion methods can drift from real data. Therefore, order to avoid such problems, we add batch statistics loss LBN to our generator training objective. Specifically, the server has access to the statistics (mean and standard deviation) of the global model's BatchNorm layers obtained from training on real data. We want to enforce the same statistics in all BatchNorm layers the generated synthetic images well. To this end, we minimize the layer-wise distances between the two statistics written as
Batch Statistics Loss. Prior works 22
L Σ O 0(), = log à LBN = L
2 ++ (n 10)
(3)
σ 2
82
Here, L denotes the total number of BatchNorm layers, μ4 and o; are the mean and standard deviation stored in BatchNorm layer of the global model, f4, ōj are measured statistics BatchNorm layer for the synthetic images. Finally, KL stands for the Kullback-Leibler (KL) divergence.
We want to note that this loss does not rely on the BatchNorm layer itself rather on their stored
statistics (ū;, ē; ). G aims to generate synthetic images similar to the real ones such that the global model would not be able to classify them purely based on these statistics. One way to achieve this to ensure that synthetic and real images have similar statistics in the intermediate layers, and this is
5

---

the role of LBN. In our experiments, we employed the most common baseline model in CL, which already contains BatchNorm layers and measures those statistics. However, these layers are not necessity and can be substituted by similar ones, such GroupNorm. In general, if no normalization layer is used the model, clients can still compute the running statisties of specific layers and share them with the server, and later, the server can use them in the training of the g.
Image Prior Loss. In natural images, adjacent pixels usually have values close each other. Adding prior loss is a common technique to encourage similar trend in the synthetic images [22]. In particular, we can create the smoothed (blurred) version of an image by applying Gaussian kernel and minimizing the distance of the original and (mooth(T) using the image prior loss
Spr j - Smooth
In summary, we can write the training objective of G as Equation where Wdinu WBN and upr control weight of each term.
min LCE + Cdiv + WBN + Upr
(5)
3.2 Client-side: Continual Learning
For client-side training, our solution is inspired by the algorithm proposed in [50]. In particular, the authors distill the stability-plastiiity dilemma into three critical requirements of continual learning and aim to address them one by one.
Current Task. To have plasticity, the model needs to learn the new features in way that is least biased towards the old tasks. Therefore, instead of including all the output space in the loss, the CE loss can be computed for the new classes only by splitting the linear heads and excluding the old ones, which we can write as
(C((F()).))
i O.W.
c = 0.
(6)
Previous Tasks. To overcome forgetting, after the first task, we train the model using synthetic and real data simultaneously. However, the distribution of the synthetic data might differ from the real one, and it becomes important to prevent the model from distinguishing old and new data only based on the distribution difference. To address this problem, we only use the extracted features of the data. To this aim, clients freeze the feature extraction part and only update the classification head (represented by Fi)) for both real (x:) and synthetic (i) images. This fine-tuning loss is formulated as
ST CE(F ((x,, B)).
(7)
Finally, to minimize feature drift and forgetting of the previous tasks, the common method is knowledge distillation over the prediction layer. However, (50) proposed importance-weigg feature distillation: instead of using the knowledge in the decision layer, they use the output of the feature extraction part of the model (penultimate layer). This way, only the more significant features of the old model are transferred, enabling the model to learn the new features from the new tasks. This loss can be written as
CDD II - E1)
(8)
where W is the frozen linear head of the model trained on the last task (W = F!. In summary, the final objective on the client side as
min fire + wrrL'rr + WKDLkD. Ft
where wer and DND paremepasameters determining the importance of each loss term.
3.3 Summary of MFCL Algorithm
In summary, during the first task, clients train the model using only the LcE part of 99) and send their updates to the server where the global model gets updated (FedAvg) for R rounds. At the end of

---

training task t = 1, the server trains the generative model by optimizing (5). using the latest global model. Finally, the server freezes and saves and the global model (Fr-1). This procedure repeats for all future tasks, with the only difference being that for >> 1, the server needs to send the current global model (Ft), precious task's final model (Ft-1) and 9 to clients. Since Ft-1 and & are fixed during training Ft. the server can send them to each client once per task to reduce the communication cost. To further decrease this overhead, we can employ communication-cffiiccn methods in federated learning, such [5], that can highly compress the model with minor performance degradation, which we leave for future work. Algorithm in the Appendix shows different steps of MFCL.
4 SuperlmageNet
In centralized Class-IL, the tasks are disjoint, and each task reveals a new set of classes; therefore. the total number of classes strongly limits the number of tasks. Moreover, we must ensure that each task has sufficient training data for learning. Thus, the number of examples per class is essential in creating CL. datasets. However, the dataset needs to be split along the task dimension and clients in a Federated Class-IL. setup. For instance, CIFAR-100, 100, popular dataset for benchmarking FL. algorithms, consists of 100 classes, each with 500 examples, which must be partitioned into T tasks, and each task's s data is split among N clients. In other words, for a single task, client has access to only TxN of that dataset; in common scenario where N = 100 and T = 10, we can assign only 50 samples to each client (about 5 example per class in i.idd data distribution), which is hardly enough.
combined mul- To resolve this problem, prior works have used small number of clients 45 24 52
tiple datasets (58), employed a surrogate dataset (37 or allowed data sharing among the clients (15). However, these solutions may be possible, applicable, or may violate the FL's assumptions. This demonstrates the importance of introducing new benchmark datasets for federated continual settings.
Wolf
Shark
Footwear
Bear
Timber wolf
Red wolf
Great White sharks
Tiger shark
Sandal
Loafer
Brown Hear
Polar Bear
Figure 4: Building SuperImageNet by regrouping ImageNet dataset. Labels in Blue are the original labels, and in Red are the labels in SuperlmageNet.
We introduce SuperlmageNet, a dataset created by superclassing the ImageNet [4 dataset, thus greatly increasing the number of available samples for each class. There are versions of the dataset, each offering a different trade-off between the num- ber of classes (for Class-IL) and the number of ex- amples per class (for FL) as shown in Table 4 For example, Superlmage
Dataset
# examples/class # classes
SuperlmageNer-S SuperImageNet-M
2500
100
5000
75
SuperlmageNet-L
7500
has 10x more samples per class compared to CIFAR-100, which allows for an order of magnitude increase in the number of fed- erated clients in while maintaining the same amount of training data per client. As shown in Figure we have merged classes of similar concepts to increase the sample size per class.
Table 2: Versions of SuperImageNet
5 Experiments
Setting. We demonstrate the efficacy of method three challenging datasets: CIFAR-100 30
TinylmageNet [43] and SuperImageNNt--II]] For all datasets, we use the baseline ResNer18 [3 as
the global model and ConvNet architecture for G, which we explain in detail in the Appendix C
'The image size of the CIFAR-I00, TinylmageNet, and SuperImageNet datasets is 32 32, 64 x 64 and 224 224, respectively
7

---

Table 3 Summarizes the setting for each dataset. For each dataset, there are 10 overlapping tasks (T = 10), and we use Latent Dirichlet Al- location (LDA) 46 with a = 1 to distribute the data of each task among the clients. Clients train the local model using an SGD optimizer, and all the results were reported after averaging over 3 different random initializations (seeds). We
#Client per round
#classes
Dataset
#Client
per lask
CIFAR 100
50
10
ImnylmageNet
100
10
20
SuperlmageNet-L
300
30
5
Table 3: Training parameters of each dataset.
refer to Appendix F
for other hyperparameters.
Metric. We use three metrics -Aveaage Accuracy, Average Forgetting, and Wallclock time.
Average Accuracy (AA): Let us define Accuracy (A') the accuracy of the model the end of task t, over all the classes observed far. Then, A is average of all A for all the T available tasks.
Average Forgetting (f): Forgetting (f*) of task i is defined as the difference between the highest accuracy of the model on task and its performance at the end of the training. Therefore, we can evaluate the average forgetting by averaging all the f for task 1 to T 1 at the end of task T.
Wallclock time. This is the time the server or clients take to perform one FL round in seconds. The time is measured rounds on our local GPU NVIDIA-A 100 and averaged between different clients.
Baseline. We compare method with FedAvg [40]. FedProx B3], FedProx FedCIL [45), FedLwF-2T [52] and Oracle. FedAvg and FedProx are the two most common aggregation methods; specifically, FedProx is designed for non-i.i.d data distributions and tries to minimize the distance of the client's 'ss update from the global model. Inspired by FedProx, we also explore adding a loss term to minimize the change of the current global model from one from the previous task, which name FedProx* FedCIL is a GAN-based method where clients train the discriminator and generator locally to generate synthetic samples from the old tasks. F-2T is another method designed for federated continual learning. In this method, clients have two additional knowledge distillation loss terms: their local model trained on the previous task and the current global model. Finally, Oracle is an upper bound on the performance: during the training of the ie task, clients have access to all of their training data from i.
5.1 Results
Figure 5 shows the accuracy of the model on all the observed classes so far. In all three datasets, MFCL consistently outperforms the basclines by large margin (up to 25% absolute improvement in test accuracy). In the CIFAR- dataset, the only baseline that can also correctly classify some examples from past data FedCIL. Both MFCL and FedCIL benefit from a generative model (roughly the same size) to remember the past. Here, a similar generative model to the one in the [45] for the CIFAR-IO dataset is used. Since, in FedCIL, the clients train the generative and global models simultaneously, they require more training iteration. We repeat the same process and adapt similar architectures for the other two datasets. But, given that GANs are not straightforward fine-tune, this method does not perform well or converge. We explain more in the Appendix H
We have further compared the performance and overhead of the methods in Table
4 The first two metrics, Average Accuracy and Average Forgetting reveal how much the model Is learning new tasks while preserving its performance on the old task. As expected, FedAvg and FedProx have the highest forgetting values because they are not designed for such scenario. Also, high forgetting for FF indicates that including teachers in the absence of old data cannot be effective. Notably, FedProx has lower forgetting value, mainly due to the fact that it also has lower performance for each task. Finally, FedCIL and MFCL have experienced the least forgetting with knowledge transferred from the old task to the new ones. Particularly, MFCL. has the smallest forgetting, which means is the most successful in preserving the learned knowledge.
We also compare the methods based on their computational costs. It is notable that some methods change after learning the first task; therefore, we distinguish between the cost of the first task and the other ones. As depicted, for T > 1, MFCL slightly increases the training time caused by employing the generative model. But, as a trade-off, it can significantly improve performance and forgetting.
"This result might improve by allocating relatively more resources the clients.
8

---

Our (MFCL)
-4- PeOCE
-D- FedLaF-27
- Fechug
Fedioox
STAR-330
TeyimageNat
Superimagehve
60-
(.50
Test Accuracy [%6]
60-
Test Accuracy
40
40-
30
40
6 2) Task
6
10
b) Task
Task
Figure 5: Test Accuracy vs. # observed tasks for (a) CIFAR-100, (b) TinylmageNet, (C) SuperlmageNet-LL datasets. After each task, the model is evaluated all the seen tasks so far.
The server cost in MFCL is similar to FedAvg except at the end of each task, where it needs to train the generative model. This extra computation cost should not be bottleneck because it occurs once per task, and servers usually have access to better computing power compared to clients.
Table Performance of the different baselines in terms of Average Accuracy. Average Forgetting and Wallclock time for CIFAR- 100 dataset.
Average Accuracy
Average forgetting
Training time (s)
Training time (8)
Server Runtime (s)
(%)
f(%)
(T = 1)
(T's
FedAvg
22.27 0.22
78.77 +: 0.83
R 1.2
Ri 1.2
RV T.8
FedProx
22.00 0.31
78.17
0.33
1.98
1.98
1.8
FedCII
26.8 0.44
38.19
0.31
17.8
24.5
2.5 for T 1. 4.35 for T
F-
22.17 = 0.13
75.08
+: 0.72
Rs 1.2
R 3.4
Rs 1.8
MFCL (Ours)
0.12
0.78
1.2
(once per task), P2 1.8 O.W. 1.8
Oracle
67.12 0.4
ss 1.2
= 1.2 T
5.2
Ablation Studies
Here, we demonstrate the importance of each component in our proposed algorithm, both on the server and client side, by ablating their effects by one. (able/Sshowss our results, where each row removes a single loss component, and each column represents the corresponding test accuracy (A4'), average accuracy (A), average forgetting (f) and their difference from our proposed method. The first three are the losses for training the generative model. Our experiments show that Batch Statisties Loss (L and Diversity loss (Lrts) play an essential role in the final performance. The next three reflect the importance of client-side training. In particular, the fourth row (Ours-w/o Lgg) represents the case where clients use all the linear heads of the model for cross-entropy instead of show the
splitting the heads and using the part related the current task only. The following impact of removing Eer and C'DD from the client loss. In all threc cases, the loss considerably drops, demonstrating the importance of all components. Finally, FedAvg + Gen shows the performance of the case where the server trains the generative model, and clients use its synthetic data the same way as the real ones without further modifications. In the Appendix G we perform additional ablations on hyperparameters. such as weights of each loss term, generator model size, and noise dimension.
Table 5: Ablation study for MFCL on CIFAR-100
Method
.41
_42
.4
.4
A
A4
A
Ours-wio Lnn
70.00
47.09
43.93
38.08
35.98
34.14
32.00
30.17
27.03
24.36
38.51
-6.47
45.95
+17.05
Ours-wie
70.47
52.33
49.00 49.50
44.87
42.09
39.55
38.18
35.21
33.74
32.40
43.87
1.11
29.47
11.17
Oursswilo Lai
B9.87
53.48
47.60
30.000
35.43
32.95
30.81
27.15
24.14
22.34
38.44
-.54
44.90
416.5
33.40
26.70
17.96
13.69
+13.94
Ours-wlo Cky
70.37
46.17
42. 16
37.57
33.91
$2.29
30.94
28.25 25
27.00
21.64
37.33
-7.65
42.85
+14.55
Ours-wio Cyp
70.10
45.9%
38
31.01
26.45
24.07
21.32
18.02
16.85
16.29
30.96
-14.12
53.64
+25.34
FedlAvg a Gin
70.57
40.07
30.01
23.75
20.38
17.56
16.12
12.00
18.18
11.57
26.00
10.231
60:46
132.16
Ours
71.50
56.00
00.73
45.73
42.38
40.62
38.97
36.18
35.47
33.25
44.98
28.3

---

Discussion
Privacy of MFCL. Federated Learning, specifically FedAvg, is vulnerable to different attacks, such as data poisoning, model poisoning, backdoor attacks, and gradient inversion attacks (27 36 T8| 20 33 We believe, MFCL generally does not introduce any additional privacy issues and still it is prone to the same set of attacks as FedAvg. MFCL trains the generative model based on the weights of the global model, which is already available to all clients in the case of FedAvg. On the contrary, in some prior work in federated continual learning, the clients need to share a locally trained generative model or perturbed private data, potentially causing more privacy problems.
Furthermore, for FedAvg, various solutions and defenses, such as differential privacy secure aggregation 55 8], are proposed to mitigate the effect of such privacy attacks. One can employ these solutions in the case of MFCL as well. Notably, in MFCL, the server does not require access to the individual client's ' updates and uses the aggregated model for training. Therefore, training generative model still viable after incorporating these mechanisms.
In MFCI,, the server trains the generator using only client updates. Figure 6 presents random samples of real and synthetic images from the CIFAR-I00 dataset. Images of the same column correspond to real and synthetic samples from the same class. Synthetic samples do not resemble any specific training examples of the clients and thus preserve privacy. However, they consist of some common knowledge about the class and effectively represent the whole class. Therefore, they can significantly reduce catastrophic forgetting.
Class
Class 2
Class
Class
Class
Class
Class
Figure 6: Real vs synthetic data generated by the generative model for CIFAR-100 dataset.
Limitations. In our method, clients need the generative model, the final global model of the last task, and the current global model, which adds overheads such as communication between the server and clients and storage. However, there are fundamental differences between storing the generative model and actual data. First, the memory cost is independent of the task size: as the number of tasks increases, clients either have to delete some of the existing examples of the memory to be able to add new ones or need to increase the memory size. In contrast, the generative model size is constant. Finally, clients can delete the generative model while not participating in the FL process and retrieve later if they join. On the other hand, deleting data samples from memory results in a permanent loss of information. We have delved into this in Appendix D
7 Conclusion
This work presents a federated Class-IL framework while addressing resource limitations and privacy challenges. We exploit generative models trained by the server in data-free fashion, obviating the need for expensive on-device memory on clients. Our experiments demonstrate that method can effectively alleviate catastrophic forgetting and outperform the existing state-of-the-ar solutions.
8 Acknowledgment
This material is based upon work supported by ONR grant N00014-23-1-2191, ARO grant 19 22- 1-0065, Defense Advanced Research Projects Agency (DARPA) under Contract No. FASTNICS HR001 120C0088 and HR001 120C0160 60, and gifts from Intel and Qualcomm. The views, opinions, and/or findings expressed are those of the author(s) and should not interpreted as representing the official views or policies of the Department of Defense the U.S. Government.
10

---

References
[1] Rahaf Aljundi. Francesca Babiloni, Mohamed Elhoseiny, Mareus Rohrbach, and Tinne Tuytelaars. Memory aware synapses: Learning what (not) forget. In Proceedings of the European Conference on Computer Vision (ECCV), pages 139-154, 2018.
[2] Rahaf Aljundi, Eugene Belilovsky, Tinne Tuytelaars, Laurent Charlin, Massimo Caccia, Min Lin, and Lucas Page-Caccia. Online continual learning with maximal interfered retrieval. H. Wallach, H. Larochelle, A. Beygelzimer, F. d' L'Allcé-Buuc, F. Fox, and R. Garnett, editors, Advances in Neural Information Processing Systems 32, pages 11849-18 11860 Curran Associates, Inc., 2019.
[3] Rahaf Aljundi, Punarjay Chakravarty, and Tinne Tuytelaars. Expert gate: Lifelong learning with a network of experts. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 3366 3375, 2017.
[4] Rahaf Aljundi, Min Lin, Baptiste Goujaud, and Yoshua Bengio. Gradient based sample selection for online continual learning. Advances in neural information processing systems, 32, 2019.
[5] Sara Babakniya, Souvik Kundu, Sauray Prakash, Yue Niu, and Salman Avestimehr. Federated sparse training: Lottery aware model compression for resource constrained edge. arXiv preprini 220.922288.1009 2022.
[6] Jihwan Bang. Heesu Kim, YoungJoon Yoo, Jung-Wop Woo Ha, and Jonghyun Choi. Rainbow memory: Continual learning with memory diverse samples. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8218 0218-8227, 2021.
[7] Eden Belouadah, Adrian Popescu, and loannis Kanellos. A comprehensive study of class incremental learning algorithms for visual tasks. Neural Networks, 135:38-54 54, 2021.
[8] Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth. Practical secure aggregation for federated learning on user-held data. arXiv preprint 16 1,04422, 2016.
[9] Francisco M Castro, Manuel J Marin-Jiménez, Nicolás Guil, Cordelia Schmid, and Karteek Alahari. End-to-end incremental learning. In Proceedings of the European conference on computer vision (ECCV), pages
2018.
[10] Arslan Chaudhry, Marcus Rohrbach, Mohamed Elhoseiny, Thalaiyasingam Ajanthan, Puneet Dokania, Philip HS Torr, and Mare' Aurelio Ranzato. On tiny episodic memories in continual learning. arXiv preprint
10486, 2019.
[11] Chien-Lun Chen, Sara Babakniya, Marco Paolieri, and Leana Golubchik. Defending against poisoning backdoor attacks on federated meta-learning. ACM Transactions on Intelligent Systems and Technology (TIST), 13(5):1-25 1-55: 2022.
[12] Hanting Chen, Yunhe Wang, Chang Xu, Zhaohui Yang. Chuanjian Liu, Boxin Shi, Chunjing Xu, Chao Xu, and Qi Tian. Data-free learning of student networks. In Proceedings of the IEEF/CVF International Conference on Computer Vision, pages 3514-3522, 2019.
[13] Yiqiang Chen, Xin Qin, Jindong Wang, Chaohui Yu, and Wen Gao. Fodhealth: federated transfer learning framework for wearable healthcare. IEEE Intelligent Systems, 35(4):83-93, 2020.
[14] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: large-scale hicrarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248-255. leee, 2009.
[15] Jiahua Dong, Lixu Wang, Zhen Fang, Gan Sun, Shichao Xu, Xiao Wang, and Qi Zhu, Federated class- incremental learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10164-10173, 2022.
[16] Sayna Ebrahimi, Franziska Meier, Roberto Calandra, Trevor Darrell, and Marcus Rohrbach. Adversarial continual learning. In European Conference on Computer Vision, pages 386 402. Springer, 2020.
[17] Ahmet M Elbir, Burak Soner, and Sinem Coleri. Federated learning in vehicular networks. arXiv preprint arXiv:2006.0144 2020.
[18] Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Gong. Local model poisoning attacks to (Byzantine- Robust) federated learning. In 29th USENIX security symposiun (USENIX Security 20), pages 1605- 1622, 2020.

---

[19] Chrisantha Fernando. Dylan Banarse, Charles Blundell, Yori Zwols. David Ha, Andrei A Rusu, Alexander Pritzel, and Daan Wierstra. Pathnet: Evolution channels gradient descent in super neural networks. arXiv preprint XXXv::7011.8734. 2017.
[20] Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller. Inverting gradients how easy is to break privacy in federated learning? Advances in Neural Information Processing Systems, 33: 33:16937-16947, 2020.
[21] Andrew Hard, Kanishka Rao, Rajiv Mathews, Swaroop Ramaswamy, Françoise Beaufays, Sean Augenstein, Hubert Eichner, Chloé Kiddon, and Daniel Ramage. Federated learning for mobile keyboard prediction. arXiv preprint 1.Xiv:8811.03604 2018.
[22] Matan Haroush, Itay Hubara, Flad Hoffer, and Daniel Soudry. The knowledge within: Methods for data-free model compression. In Proceedings of the IEEF/CVE Conference Computer Vision and Pattern Recognition, pages 8494-8502, 2020.
[23] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pottern recognition, pages 770-778, 2016.
[24] Scan M Hendryx, Dharma Raj KC, Bradley Walls, and Clayton Morrison. Federated reconnaissance:
Efficient, distributed, class-incremental learning. arXiv preprint 10Xi:2200900150, 2021.
[25] Geoffrey Hinton, Oriol Vinyals. Jeff Dean, et al. Distilling the knowledge in a neural network. arXiv preprint arXiv: 1akKv::5000 503.02531, 2(7), 2015.
[26] Ziyue Jiang, Yi Ren, Ming Lei. and Zhou Zhao. Fedspeech: Federated text-to-speech with continual learning. arXiv preprint 1rXiv:2110.072.6. 2021.
[27] Peter Kairouz, H Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, al. Advances and open problems federated learning. Foundations and Trends( in Machine Learning, (411-)):1210, 2021.
[28] James Kirkpatrick, Razvan Pascanu, Neil Rabinowitz, Joel Veness, Guillaume Desjardins, Andrei Rusu, Kieran Milan, John Quan, Tiago Ramalho, Agnieszka Trabska-Barwinssee et al. Overcoming catastrophic forgetting in neural networks. Proceedings of the national academy of sciences, 114(13):352) -3526, 2017.
[29] Jakub Konečný, H Brendan McMahan, Felix X Yu, Peter Richtárik, Ananda Theertha Suresh, and Dave Bacon. Federated learning: Strategies for improving communication efficiency. arXiv preprint 12Xiv:1610.005492,,22 2016.
[30] Alex Krizhevsky, Geoffrey Hinton, al. Learning multiple layers of features from tiny images. 2009.
[31] Sang- Woo Lee. Jin-Hwa Kim, Jaehyun Jun, Jung-Woo trophic forgetting by incremental moment matching. Advances neural information processing systems, 30, 2017.
Woo Ha, and Byoung- Tak Zhang. Overcoming catas-
[32] Timothée Lesort, Hugo Caselles-Dupré, Michael Garcia-Ortiz, Andrei Stoian, and David Filliat, Generative models from the perspective of continual learning. In 2019 International Joint Conference on Neural Networks (IJCN), pages 1-8. IEEE, 2019.
[33] Tian Li, Anit Kumar Sahu, Ameet Talwalkar, and Virginia Smith. Federated learning: Challenges. methods. and future dircctions. IEEE Signal Processing Magazine, 37(3):50 60, 2020.
[34] Zhizhong Li and Derek Hoiem. Learning without forgetting. IEEE transactions pattern analysis and machine intelligence, 40( 40( 12:29335229947, 2017.
[35] David Lopez-Paz and Mare' Aurelio Ranzato. Gradient episodic memory for continual learning. Advances in neural information processing systems, 30, 2017.
[36] Lingjuan Lyu. Han Yu, and Qiang Yang. Threats to federated learning: A survey. arXiv preprint arXiv:2003.022 2020.
[37] Yuhang Ma. Zhongle Xie, Jue Wang, Ke Chen, and Lidan Shou. Continual federated learning based on knowledge distillation.
[38] Arun Mallya and Svetlana Lazebnik. Packnet: Adding multiple tasks to a single network by iterative pruning. In Proceedings of the IEEE conference on Computer Vision and Pattern Recognition, pages 7763-7773, 2018
12

---

[39] Michael McCloskey and Neal J Cohen. Catastrophic interference in connectionist networks: The sequential learning problem. In Psychology of learning and motivation, volume 24, pages 109-165. Elsevirr, 1989.
[40] Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication -ettiiiicaaiioeffeiinnttttt efficient learning of deep networks from decentralized data. In Artificial intelligence and statistics, pages 228.-1282. PMLR, R, 2017.
[41] Pingbo Pan, Siddharth Swaroop, Alexander Immer, Runa Eschenhagen, Richard Turner, and Mohammad Emtiyaz E Khan. Continual deep learning by functional regularisation of memorable past. Advances in Neural Information Processing Systems, 33:4453-4464, 2020.
[42] Tae Jin Park. Kenichi Kumatani, and Dimitrios Dimitriadis. Tackling dynamics in federated incremental learning with variational embedding rehearsal. arXiv preprint arXiv:2 10.00699, 2021.
[43] Hadi Pouransari and Saman Ghili. Tiny imagenet visual recognition challenge. CS231N course, Stanford Univ., Stanford, CA, USA, 5, 2014.
[44] Aman Priyanshu. Mudit Sinha. and Shreyans Mehta. Continual distributed learning for crisis management. arXiv preprint arXiv:2104. 12876, 2021.
[45] Daiqing Qi. Handong Zhao, and Sheng Li. Better generative replay for continual federated learning. arXiv preprint arXiv:2302. 13001, 2023.
[46] Sashank Reddi, Zachary Charles, Manzil Zaheer, Zachary Garrett, Keith Rush, Jakub Konečný, Sanjiv Kumar, and H Brendan McMahan. Adaptive federated optimization. arXiv preprint arXiv:2003.00295, 2020.
[47] David Rolnick, Arun Ahuja, Jonathan Schwarz, Timothy Lillicrap, and Gregory Wayne. Experience replay for continual learning, Advances in Neural Information Processing Systems, 32, 2019.
[48] Hanul Shin, Jung Kwon Lee, Jachong Kim, and Jiwon Kim. Continual learning with deep generative replay. Advances in neural information processing systems, 30, 2017.
[49] Neta Shoham, Tomer Avidor, Aviv Keren, Nadav Israel, Daniel Benditkis, Liron Mor- Yosef, and Itai Zeitak. Overcoming forgetting in federated learning on non-iid iid data. arXiv preprint 19X.v:1900007766. 2019.
[50] James Smith, Yen-Chang Hsu, Jonathan Balloch, Yilin Shen, Hongxia Jin, and Zsolt Kira. Always be dreaming: A new approach for fata-free class-incremental learning. In Proceedings of the IEEE/CVF International Conference on Computer Vision. pages 9374-9384, 2021.
[51] James Smith, Cameron Taylor. Seth Baer, and Constantine Dovrolis. Unsupervised progressive learning and the stam architecture. arXiv preprint arXiv: 19001120211111.... 2019.
[52] Anastasiia Usmanova, François Portet, Philippe Lalanda, and German Vega. A distillation-basel ap- proach integrating continual learning and federated learning for pervasive services. arXiv preprint arXiv:2109.0m 04197, 2021.
[53] Gido M Van de Ven and Andreas S Tolias Generative replay with feedhack connections a general strategy for continual learning. arXiv preprint arXiv:1809.10335 2018
[54] Gido M Van de Ven and Andreas S Tolias. Three scenarios for continual learning. arXiv preprint arXiv: N.44:0994.0773.. 2019.
[55] Kang Wei, Jun Li, Ming Ding, Chuan Ma, Howard H. Yang. Farhad Farokhi, Shi Jin, Tony Q S. Quek, and H. Vincent Poor. Federated learning with differential privacy: Algorithms and performance analysis. IEEF Transactions on Information Forensics and Security. 15:3454-3469 2020.
[56] Yue Wu, Yinpeng Chen, Lijuan Wang, Yuancheng Ye, Zicheng Liu, Yandong Guo, Zhengyou Zhang, and Yun Fu. Incremental classifier learning with generative adversarial networks. arXiv preprint arXiv:1802.0ww
2018
[57] Hongxu Yin, Pavlo Molchanov, Jose M Alvarez, Zhizhong Li, Arun Mallya, Derek Hoiem, Niraj K Jha, and Jan Kautz. Dreaming to distill: Data-free knowledge transfer via deepinversion. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, pages 8715-8724, 2020.
[58] Jaehong Yoon, Wonyong Jeong, Giwoong Lee, Eunho Yang, and Sung Ju Hwang. Federated continual learning with weighted inter-client transfer. In International Conference on Machine Learning, pages 12073- 22073-12086. PMLR, 2021.
13

---

[59] Friedemann Zenke, Ben Poole, and Surya Ganguli. Continual learning through synaptic intelligence. In International Conference Machine Learning, pages 3987-3995. PMLR, 2017.
[60] Zhuangdi Zhu, Junyuan Hong, and Jiayu Zhou. Data-free knowledge distillation for heterogeneous
federated learning. In International Conference Machine Learning, pages 12878 118889 PMLR, 2021.
14

---

A MFCL Algorithm
Algorithm summarizes our method. Here, for every task, clients train the local model using the shared generative model. At the end of each task, the server updates the generative model using data-free methods.
Algorithm MFCL
1: N: #Clients, [C Client Set, K: #Clients per Round, u,t client i Update, E: Local Epoch
2: R: FL Rounds per Task, T: #Tasks, current task , | Task t Size, q: #Discovered Classes
3: Fr: Global Model for task t, Gy: Generative Model, Eg: Generator Training Epoch
4: q <-0
5: G.Fi t initialize()
6: for = 1 to To
7:
q + 1
8:
Fr + updateeArchitecture(/..) # Add new observed classes the classification layer.
9:
for 1 to R do
10:
Ck f RandomSelect (Cx]:
11:
for Cx in parallel do
12:
Ue < locallppdateeF 9, F, E) For 1 = we do not need Fo and g. end for
13:
14:
Fi + globalAggrregation [ue]) end for
16:
F. +- freezeModel(F.) # Fix Global model.
G trainDFFGenrrtorr(F5 Eg, g) # Train the generative model.
18:
g < freezeModel()) # Fix generator weights.
end for
B Code for Reproduction
The codehase for this work and regrouping the ImageNet dataset is available hhttps///githbb. BeBaabbak///CC--WeurPP333
C Details of the Generative Model
Architectures. In Table O we show the generative model architectures used for CIFAR-100, TinyImageNet, and SuperImageNet datasets. In all experiments, the global model has ResNet1 8 architecture. For the CIFAR-100 and LinylmageNet datasets, layers are reported as COKVK x K (Ci... Cout). where K, C.., and Cont are the size the kemel, input channel and output channel of the layer, respectively.
change the first CONV layer kernel size 3 3 from 7 x 7. In this table, CONV
Weight Initialization. The generative model is randomly initialized for the first task and trained from scratch. For all the future tasks (t> 1), the server uses the previous generative model (t 1) as the initialization.
Synthetic Samples Generation. To generate the synthetic data, clients sample i.i.d noise, which later would determine the classes via the argmax function applied to the first q elements (considering is the total number of seen classes). Given the noise sampled i.i.d, the probability of generating samples from class equals 4. Although this might not lead to same number of synthetic samples from each class in every batch, the generated class distribution uniform over all classes. Thus, in expectation, have class balance in generated samples.
Catastrophic Forgetting in the Generative Model. The effectiveness of the G is closely linked the performance of the global model. If the global model forgets old classes after completing task, the quality of corresponding synthetic data will decline. Hence, it is crucial to select a reliable generative model and a robust global model. A good generative model can assist the global model in preventing forgetting when learning new teacher for the next round of the G model.
tasks. This model then
Global Aggregation Method. In this work, have employed FedAvg to aggregate the client updates. Since the generator always trained after the aggregation, its training is not impacted by changing the aggregation method. However, the generative model uses the aggregated model as its discriminator, and it is directly affected by the quality of the final global model. Therefore, any aggregation mechanism that improves the global model's performance would also help the generative model and vice versa.
15

---

Table 6: Generative model Architecture
CIFAR-100
TinyImageNet
SuperImageNet
FC(200, 128 x 8 x 8)
FC(400, 128 x 8 x 8)
FC(200, 64 7 x 7)
reshape 128, 8.8)
reahape 128, 8,8)
reahape 64, 7, 7)
BatchNorrm(122 (128)
BatchNorm! 128)
BatchNorm(66)
Interpollate())
Interpolate(2)
Interpolate(2)
CONV3 3(128, 128)
CONV3 x 3(128, 128)
CONV3 x 3(64, 64)
BatchNorrm
BatchNorm 128)
BatchNoorm(64)
LeakyReLU
LeakyReLU
LeakyReLU
Interpolate(2)
Interpolate(2)
Interpolate(2) (2)
CONV3 x 3(128, 64)
CDNV3 x 3(188, 128)
CONV3 x 3(64, 64)
BatchNorm(64)
BatchNorm 128)
BatchNorm (64)
LeakyReLU
LeakyReLU
LeakyReLU
CONV3 x 3(4,33)
Interpolate(2)
Interpolate 2)
Tanh
CDNV3 x 3(128, 64)
CONV3 x 3(64, 64)
BatchNorm 3)
Batchhorrm(3)
BatchNorrm (64)
LeakyReLU
LeakyReLU
CDRV3 x 3(61,3)
Interpolate (2)
Tanh
COMV3 x 3(64, 61)
Batchhlorm(33
BatchNorm (64)
LeakyBeLU
Interpolate(2
CDNV3 x 3(64, 64)
BatcchNrrm(64]
LeakyReLU
CDNV3 x 3(64, 3)
Tanh
BatchNorm (3)
D Overheads of generative model
Client-side. Using G on the client side would increase the computational costs compared to vanilla FedAvg. However, existing methods in CL often need to impose additional costs such as memory, computing, or both to mitigate catastrophic forgetting. Nevertheless, there ways to reduce costs for MFCL. For example, clients can perform inference once, generate and store synthetic images only for training, and then delete them all. They can further reduce costs by requesting that the server generate synthetic images and send them the data instead of G. Here, we raise two crucial points about the synthesized data. Firstly, there is an intrinsic distinction between storing synthetic (or G) and actual data; the former is solely required during training, and clients can delete them right after the training. Conversely, the data in episodic memory should always be saved the client's 's side because once deleted, it becomes unavailable. Secondly, synthetic data shared knowledge that can assist anyone with unbalanced data or no memory in enhancing their model's performance. contrast, episodic memory can only he used by one client.
The server needs to train the G once per task. It is commonly assumed that the server has access to more powerful computing power and can compute more information in faster time compared to clients. This training step does not have overhead the client side and might slow down the whole process. However, tasks do not change rapidly in real life, giving the server ample time train the generative model before any trends or client data shifts occur.
Server-side.
Communication Cost. Transmitting the generative model can be a potential overhead for MFCL, as it is cost that clients must bear once per task to prevent or reduce catastrophic forgetting. However, several possible methods, such as compression, significantly reduce this cost while maintaining excellent performance. This could be an interesting dircction for future research.
E
More on the Privacy of MFCL
MFCL with Differential Privacy. We want to highlight that the generator can only be good the diseriminator in data-free generative model training. the global model learn the decision boundaries individual classes with DP guarantee, the generator can learn this knowledge and present through the synthetic example. Otherwise, if the global model fails to learn the current tasks, there is not much knowledge to preserve for the future. With the DP guarantee. the main challenge is training reasonable global model; improving this performance also help the generative model.
16

---

MFCL with Secure Aggregation. If the clients do not trust the server with their updates, potential solution is Secure Aggregation. In nutshell, secure aggregation defense mechanism that ensures update privacy, espe- cially when the server potentially malicious. More importantly since MFCL does not require individual updates, is compatible with secure aggregation and can be employed to align with Secure Aggregation.
Privacy Concerns Associated with Data Storage. Currently, some different regulations and rules limit the storage time of users' data. Usually, the service providers do not own the data forever and are obligated to crase it after specific duration. Sometimes, the data is available only in the form of stream, and it never gets stored. But most of the time, data available for short period of enough perform few rounds of training. In this way, multiple service providers participate federated learning, their data would dynamically change as they delete old data and acquire new ones.
MFCL and Batch Statistics, MFCL benefits from Batch Statistics Loss (CBN) in training the generative model. However. some defense mechanisms suggest not sharing local Batch Statisties with the server. While training the generative model without the Lax still possible, it reduce the accuracy. Addressing this is interesting future direction.
F Hyperparameters
Table presents some of more important parameters and seltings each experiment.
Table Parameter Settings in different datasets
Dataset
CIFAR-100
TinylmageNet
SuperImageNet-L
Data Size
32
64
64
224 224
# Tasks
10
10
10
# Classes per task
10
20
5
# Samples per class
500
500
7500
LR
All task start with 0.I and exponentially decay to 0.01
Batch Size
32
32
32
Synthetic Batch Size
32
FL round per task
100
100
100
Local epoch
10
10
G Hyperparameter tuning for MFCL
Hyperparameters can play essential role in the final performance of algorithms. In our experiments, we have adapted the commonly used parameters, and here, show how sensitive the final performance is regarding each hyperparameter. This particularly important because hyperparameter tuning very expensive federated learning and can unfeasible continual learning. To aim, we change one parameter time while fixing report the final A of each hyperparameter CIFAR- 100 datasets with 10 tasks.
the rest. In Table g
wait Weight of diversity loss (Case).
weN: Weight of Batch Statisties loss (CaN).
p Weight of Image Prior loss (CFt).
Z dim: Input noise dimension for training the model.
gen gen_epoch: Number of iteration train the G model.
This is the setting that used Waie WBN 75, Wpr 0.001, 2 Z_dim 200, pen__pooch 5000 and the average accuracy equals 45.1%. (There may be minor difference hetween this value and the result in the main manuscript. This discrepancy arises hecause we only ran the ablation for a single seed, whereas results reported in the primary manuscript are the average of three different sceds.)
Table 8: Effect of different hyperparameters on the final Á (in %) for CIFAR- 100 dataset.
Wdiv
A
WBN
Wpr
Z_ dim
A
gen_ ren_epoch
Á
44.35
0.1
40.12
0.0101
43.10
110
42.39
100
40.77
0.5
44.37
43.90
0.001
45.1
200
45.1
5000
45.1
1
45.1
10
44.77
0.01
43.56
1000
45.01
10000
43.35
2
44.08
75
45.1
0.1
44.73
5
44.57
100
45.02
1
44.37
17

---

This table shows how robust the final performance is with respect to each parameter, which is preferred both in lederated and continual learning problems.
H
Comparison between MFCL and FedCIL
Here, would like to highlight some distinctions hetween our algorithm and FedCII., both of which aim to alleviate catastrophic forgetting using generative models.
FedCII,, clients train the local generative model every round, which adds great computational overhead. On the other hand, in our approach, the generative model is trained on the server and only once task.
Training models GANs usually require large amount of data that not commonly available, especially on edge devices. Our data free generative models address this issue.
Training the generative model directly from the training dataset may pose risk of exposing sensitive training data, which contradicts goal of FL. the other hand, MFCL uses only the information from the global model.
FedCIL is limited simpler datasets and FL settings, such as MNIST and CIFARIO, with fewer clients and less complex architectures. In contrast, our approach can handle more complex datasets, such as CIFARIO0 Tiny ImageNet, and Superlmagenet, with a much larger number of clients.
Training GAN models usually require more careful hyperparameter tuning. To train FedCII for Titee and SuperImageNet, we tried SGD and Adam optimizers with learning rates E 10 0.05, 0.01} } and local epoch E {1, 23. Furthermore, we adopt generative model architecture with similar input dimension and a total number of parameters in MFCL. However, the model did not converge to good performance. While more extensive hyperparameter search might improve the results, mentioning that order train the CIFAR- 10 dataset, we used local epoch 8 larger than the other baselines; otherwise, the performance on this dataset would also degrade.
indicate the difficulty of the hyperparameter tuning of this algorithm. It is worth
In conclusion, FedCIL can be good fit for a cross-silo federated learning setting with only few clients, each possessing large amount of data and computing resources. Meanwhile, while still applicable in the above setting, method also suitable for edge devices with limited data and power.
18


Reviews:
[{"review_id": "ymfnNs91qF", "reviewer": "Reviewer_4Enn", "summary": "This work introduces MFCL, a method to primarily alleviate the catastrophic forgetting problem that arises in (more realistic) FL settings framed under the continual learning paradigm. In MFCL, the model is split into a generator (only trained on the server side) and a discriminator (only trained by clients). The former is data-free generative model that is trained to output synthetic samples suitable for the task(s) the discriminator is trained (in federation) to perform. This generator is also used by the clients to inject some synthetic training examples into their own local training stages. This component helps counteracting the forgetting problem. The empirical evaluation suggest that MFCL is far superior to other methods.", "questions": "In addition to the questions I ask in the _Weaknesses_ section, I have a few more:\n\n* Maybe include in the Appendix some additional information about the experimental setup: it seems you used PyTorch, as for FL framework I see there are some utility functions from Flower but for the rest I looks you implemented a custom for loop.\n* Why not going a step further with `SuperImageNet` and also fix the number of clients it can be divided into? In FL papers are often hard to compare because people use datasets (synthetic ones specially) in vastly different ways. In my opinion if you were to fix how many partitions it contains, it would help easing the reproducibility problem of FL and ensure subsequent papers that use `SyperImageNet` do so under a common setup. What do you think?\n* The role of injecting synthetic images during training (on the client side) could be seen as some form of \"alignment\" mechanism. This has been presented before in FL [1]. Maybe the Authors could comment whether calling this \"alignment\" is correct and put it in context with other works? (I only suggested the one that comes to mind immediately, but there are more)\n* (very minor style comment) wouldn't It be better to have only full page wide figures/tables (like Fig3) instead of half-page ones (like Tab2,3 and Fig 4) ?\n\n[1] https://arxiv.org/abs/2202.05963", "limitations": "There are a few limitations that come to mind after reading this paper:\n\n* How does this method extend to other domains beyond image classification? or image-based problems in general? (I'm inclined to suggest the title of this paper to include the \"image\" or \"vision\" keyword)\n* In the Discussion, the Authors briefly talk about the privacy implications. I agree that synthetic images do not \"resemble any specific training example\" but this doesn't have to hold to have some privacy leak. As stated in line 61, the generative model \"does not cause any extra data leakage from them [the clients]\". But there is a data leak on the discriminator part (just like any other FL method that doesn't apply Differentiable Privacy or similar). Could the Authors comment what would be the implications of adding DP to the discriminator on the client side?", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "The main strength of this paper is that it studies a far more realistic setting in which FL is used in practice for cross-device settings: clients come and go; data in the clients changes over time (more is added, some might be deleted); and, there is no centralised dataset available on the server. To this problem, MFCL proposes a solution that, although borrowing components and ideas from existing works, have been adapted to the FL setting and they work well.\n\nOther strengths that I have identified:\n\n* The generative model is of a reasonable size (<1M params if my understanding is correct when looking into Table 1 in the Appendix)\n* The Authors proposed SuperImageNet dataset. ", "weaknesses": "The main weaknesses I see in this work are related to lack of clarity in some important point:\n\n* In my view, folks in the FL community might not be familiar with the concept of \"task\" (common in the CL literature). This means that Sec 3.2 and other parts before might not be so clear. Later in Sec 4 (in line 261 onwards) a clear example of what a _task_ is is presented. Maybe it's worth giving an informal definition earlier?\n* The main results (i.e. Figure 5) are not super clear how to interpret. What does it mean \"shows the accuracy of the model on the observed classes so far\" (line 315)? Is the plot generated at `t=10`  (i.e. after all tasks are completed)? \n* Following the comment above: wouldn't it be more informative to have \"task\" on the x-axis and show how test accuracy (or forgetting) changes as time passes? Presenting the results in such way are more common in some recent CL works I've been reading [1] (see for instance Figures 3,4,5 -- no, I'm not an author :) )\n* Figure 3: I think it could be improved adding more details and nomenclature introduced in the text otherwise, what toes the right hand side of Fig3.a tell us that we don't know about all generative training schemes out there? Also, is the \"aggregate\" green box in Fig3.a outputting the discriminator (yellow rhomboid on the right)? (I think so, so how about connecting them?)\n\n\n[1] https://arxiv.org/abs/2303.11165", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for reading the details of our paper and appreciate their comments highlighting the strengths of our method and finding the setting more realistic and practical. We are grateful for their insightful questions/suggestions and try to address their concerns in detail;\n\n---\n> Implications of adding DP to the discriminator.\n\nThis is a very interesting question, and we thank the reviewer for raising this point. We want to highlight that in data-free generative model training, the generator can only be as good as the discriminator. If the global model can learn the decision boundaries and individual classes despite having DP, the generator can learn this knowledge and present it through the synthetic example. Otherwise, if the global model fails to learn the current tasks, there is not much knowledge to preserve for the future. \n\nWith the DP guarantee, the main challenge is training a reasonable global model. Prior work explores the impact of DP in training the generative model in centralized settings. As an example, [1] shows promising results by training a discriminator with a DP guarantee and training an effective generative model on top of that.\n\n[1] Liu, Bochao, et al. \"Privacy-Preserving Student Learning with Differentially Private Data-Free Distillation.\" 2022 IEEE 24th International Workshop on Multimedia Signal Processing.\n\n> Relation between MFCL and alignment mechanism. \n \nWe believe these two lines of work, despite sharing similarities, are mostly orthogonal to each other. Alignment refers to the process of finding a proper permutation of the updates to improve the performance of the aggregated model, whereas in our case, we use a generative model to mitigate forgetting previous tasks. At a high level, both techniques can benefit from shared synthetic data on the client side. However, finding the proper alignment to aggregate does not address the forgetting problem. Our method helps clients to generate data from old tasks (that they may not have access to the data anymore) and inject those samples into their training loop.\n\nWe may not have understood the question correctly, and appreciate it if the reviewer could correct us if there is a misunderstanding. \n\n> Clarifying Figures.\n\n**Figure 5.** In Figure 5, we iteratively introduce new tasks. Each task consists of 10, 20, and 5 new classes for CIFAR100, TinyImageNet, and SuperImageNet-L, respectively. To be more specific, the x ticks in all three figures are equivalent to task = {2, 4, 6, 8, 10}. Each point in the plot measures the accuracy of all the classes from the beginning up to that point. For example, the second point from the left shows the accuracy on the first 2 tasks (i.e., 20 classes for CIFAR100). We will clarify this in the paper and will change the x-axis of the figure to show tasks.\n\n**Figure 3.** The right-hand side of figure3(a) emphasizes the difference in frequencies of aggregation and training of the generative model. This is important because the latter is potentially more expensive than aggregation, but the server performs it once per task. \n\nThe output of the aggregation is the global model, which we later use as the discriminator in training the generative model. We will replace the figure in the paper with Fig1 in the attached PDF to clarify this.\n\n> Extention to beyond image classification; add \"image\" or \"vision\" in the title.\n\nOur method relies on training generative models in a data-free manner. Most prior work in this domain focus on vision tasks since images are more resilient to noise. The generated data may not resemble any meaningful entity but still can help to distinguish different classes. Unfortunately, this may not hold for NLP tasks. As a result, the extension of our method to text data is not straightforward. We will definitely incorporate the reviewer’s suggestion, add ‘image’ or ‘vision’ to the title, and discuss this in the paper.\n\n> Task definition.\n\nWe will add the following definition in section 2.\n\nTask: in class incremental learning, the training data is presented to the learner as a sequence of datasets - commonly known as tasks. In each timestamp, only one dataset (task) is available, and the learner’s goal is to perform well on all the current and previous tasks.\n \n> Additional information about the setup.\n\nOur implementation is based on Pytorch 1.13.1 and does not contain any FL framework in the main body. We use FLOWER only for distributing data among clients using LDA.\n\n> SuperImageNet with a fixed number of clients. \n\nWe appreciate the reviewer’s suggestion and will release the dataset with the mentioned property.\n\n---\nWe sincerely thank the reviewer for their time, valuable feedback, and questions. We hope to have addressed their concerns and look forward to engaging in further discussion. If the reviewer finds our response satisfactory, we kindly ask them to revisit their evaluation.\n\n"}, {"review_id": "Mdwqdtg74d", "reviewer": "Reviewer_p34V", "summary": "The work proposes using a server-learned generator for synthetic data replay for federated Class-IL. The method saves client-level compute while preserving data-privacy. The authors show their method outperforms existing methods on 2 existing benchmarks, plus a proposed larger-scale ImageNet benchmark protocol.", "questions": "a) What specifically would you state are your method contributions compared to a federated variant of [45] and similar approaches?\nb) How do you think your method would perform in more realistic federated CL settings where classes are not \nOverall, I am worried about the contributed novelty and impact for a venue such as NeurIPS. However, I do think the paper is sound, and in-line with similar works accepted to recent high-tier conferences (e.g., [A]). I am very borderline, but would rather lean towards the accept side.\n\nA. Qi, Daiqing, Handong Zhao, and Sheng Li. \"Better generative replay for continual federated learning.\" arXiv preprint arXiv:2302.13001 (2023).\n\nOther\n-> I am not sure that data-free image generation actually protects data-privacy concerns, since you are creating synthetic training data, but, since this line of work is already established, I do not feel the authors need to further justify it.\n-> Line 48, might be missing a space between \"replay\" and \"[42]\"", "limitations": "The discussion on limitations is concise and complete.", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1) I am already familiar with this setting, but I feel that the authors did a good job at selling the problem-setting to me. While potentially space inefficient, table 1 is very concise and convincing.\n2) Moving from multiple client generators -> server generator is very justified, as it will save client compute time. Also, the generator does not need to be communicated from the client to the server, only from the server to the client.\n3) The proposed approach does have significantly better performance, especially on the first two datasets.\n4) Thank you for the transparency on training costs and server overhead. I do not think the large server overhead is a big deal - since the client costs are minimally affected in T = 1 compared to FedLwF.", "weaknesses": "1) The novelty seems to be in more of a high-level idea combination of [45] and federated learning. I am not sure the method is truly impactful from a novelty perspective.\n2) SuperImageNet is a protocol benchmark, not a \"new benchmark dataset\". However, I do appreciate the protocol and agree it is better than CIFAR-100 and TinyImageNet.\n3) Overall, the performance is very weak of all methods. I wonder if the impact might be increased with a more realistic setting where past class examples may re-appear in future tasks. Could also consider a small replay buffer and/or a pre-trained model. \n4) Often, federated learning papers include some type of theoretical analysis on, for example, convergence.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for reading the details of our paper and appreciate their comments highlighting our design choices, superior performance, clarity, and writing as the strengths of the paper. We are grateful for their insightful questions and try to address their concern in detail:\n\n---\n\n> Novelty of our method\n\nIn this paper, we identified the main challenges toward federated continual learning and designed a method to address these challenges. Our framework is **unique** in that it achieves higher accuracy and lower forgetting without requiring any episodic memory and without introducing additional privacy issues compared to the existing alternatives. Our experiment setup is arguably more complex (larger number of clients and larger datasets) than those explored in prior work, such as FedCIL, indicating the effectiveness of our approach.\n\nEven though we borrowed ideas from continual learning (including standard data-free knowledge distillation training and the loss function that has been proven to be effective), we are the first to employ these ideas in the context of federated continual learning. We hope the reviewer agrees that our framework is not a straightforward combination of federated learning and continual learning. We could not outperform other state-of-the-art baselines without our novel design choices, such as deciding to train the generative model on the server (which was pointed out by the reviewer as one of the strengths). \n\n\n> Performance in realistic scenarios.\n\nPlease refer to Figure 2 in the attached pdf for the new experiment results. \n\nWe define memory as the number of samples from previous tasks. In the paper, we showed the results for $\\alpha=1$ and memory size = 0 (meaning that no sample reappears). In the new experiments, we evaluated three different scenarios for the CIFAR100 dataset with 50 clients and evaluated each scenario for two different memory sizes (20 and 50) – each client has 100 samples for each task, so memory size = 50 means 33% of training data is from previous tasks. To pick the reappearing samples, we choose the same number of samples from each previous task and pick the specific sample uniformly at random.\n\n**Scenarios**\n\nA) non-IID data distribution with $\\alpha=1$ \n\nB) Highly non-IID data distribution with $\\alpha=0.1$   \n \nC) Highly non-IID data distribution with $\\alpha=0.1$ and dynamic client participation. In this scenario, at the end of each task, 5 clients would leave the training, and 5 new clients would join. \n\n**Results.** In all the experiments increasing memory size would improve the final performance. We still see that combining the power of generative models with memory examples has superior performance compared to other baselines. \n\nDue to time constraints, we ran the experiments only on one seed.\n\n\n> Theoretical analysis on convergence.\n\nIn this work, we focus on presenting a more realistic experimental setting with various datasets. However, we believe the convergence analysis of our algorithm is mainly determined by the aggregation mechanism. \n\nIn our paper, we use FedAvg as the aggregation mechanism in the server, and the convergence of this method is already proved. In FedAvg, the most common local objective function is Cross Entropy (CE). In our algorithm, after task 1, clients add a new term to their objective: $L_{FT}$ and $L_{KD}$. $L_{FT}$ is also a CE loss for synthetic data, and $L_{KD}$ is an MSE loss. Since MSE is L-smooth and $\\mu-convex$, we believe adding these two losses does not change the convex property of the original CE loss. \n\nIt is also commonly assumed that variance and expected squared norm of stochastic gradients of all the clients are bounded. \n\nGiven that adding MSE loss should not change these properties, we believe we can follow the same proof as [1,2] (or similar analysis) for convergence. However, we leave detailed and formal proof for future work. \n \n[1] Li, Xiang, et al. \"On the Convergence of FedAvg on Non-IID Data.\" ICLR. 2019.\n\n[2] Charles, Zachary, and Jakub Konečný. \"Convergence and accuracy trade-offs in federated learning and meta-learning.\" International Conference on Artificial Intelligence and Statistics. PMLR, 2021.\n\n> SuperImageNet is a protocol benchmark.\n\nWe agree with the reviewer and will clarify this in the main manuscript. \n\n---\nWe sincerely thank the reviewer for their time, valuable feedback, and questions. We hope to have addressed their concerns and look forward to engaging in further discussion. If the reviewer finds our response satisfactory, we kindly ask them to revisit their evaluation.\n"}, {"review_id": "wUqwwz6co8", "reviewer": "Reviewer_NkkA", "summary": "This paper introduces a framework for federated class incremental learning, which employs a generative model trained at the server. This model is then utilized by the client to generate samples from previous distributions to mitigate catastrophic forgetting.", "questions": "1) Is it practical for all clients to share same task transitions at a specific point in time?\n2) If storing data locally becomes an issue, the local model update should be performed in a single iteration, and the samples should be discarded afterward. Allowing multiple iterations implies that data has already been stored locally, thus raising privacy concerns associated with data storage. If limited memory resources are the problem, it is understandable. However, there is a concern about whether the generative model will maintain affordable computational complexity as the scale increases.\n3) If the server maliciously trains the data-free generative model using a specific local model instead of the aggregated model, wouldn't this lead to privacy issues?\n4) Is the L_KD in Eq. (8) and Eq. (9) same with the L_KL in Table 5?\n5) At each task boundary, how did you validate the trained generative model?\n", "limitations": "I have some concerns about the communication cost and local computational cost that may arise when using a generative model at scale. It remains uncertain whether these costs will be negligible still.", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "This paper addresses the challenging problem of CIL (Class Incremental Learning) within the FL (Federated Learning) framework. It introduces a novel approach of data-free generative model training in the FL framework. Furthermore, the paper proposes a new benchmark dataset for FCIL called SuperImageNet. The effectiveness of the proposed method is demonstrated through extensive experiments.", "weaknesses": "This paper uses small-scale model and generative model. It is uncertain how the communication cost and local computational cost will be affected when scaling up and using a generative model.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for reading the details of our paper and appreciate their comments highlighting the novelty of our method and our extensive empirical results as the strengths of the paper. We are grateful for their insightful questions and try to address their concern in detail:\n\n---\n> Practicality of sharing the same task transitions.\n\nWe want to highlight that in the majority of existing FL studies, client data remains static throughout the entire process. We believe our paper and, in general, federated continual learning is a step towards making FL more realistic where we can observe the impact of change in local data. Undoubtedly, the next step is to relax the setting and let the users’ data change anytime.\n\nIn addition, tasks in centralized continual learning are usually isolated and do not overlap to ensure we only observe the challenges of forgetting. Following the same standard practice, we also assume that clients change their training data at specific times.\n\nIn practice, clients and the server can establish an agreement on task transitions to improve the global model’s performance. The server can handle task transitions in this setup, and clients can change their local tasks according to the agreement. For example, consider multiple hospitals training a shared model using patient data. The server can analyze the historical data to identify trends, determine specific timestamps, and ask the clients to train the model on the most common illnesses in the seasons.\n\n> Effect of generative model scale on communication and computation costs. \n\nIn general, mitigating forgetting requires additional mechanisms on top of traditional FL and introduces new costs in terms of communication, computation, or memory. \n\n**Comparison with the cost of prior work**\n\n*MFCL scales better with the number of tasks*. In memory-based techniques, clients need to assign a fixed memory to all the tasks (which requires deleting old data as the number of tasks increases and, therefore, degrades performance) or a fixed memory per task (the total memory increases linearly by tasks). In contrast, the generative model size is independent of the number of tasks. \n\n*MFCL clients can delete the model*. The generative model is solely required during training, and clients can delete them afterward. Conversely, memory-based techniques require clients to save the data at all times because once deleted, that data become unavailable. \n\n**Potential ways to reduce the costs of generative models**\n\nThere are different design choices in MFCL that one can exploit to trade off these costs. To name a few; \n\n*Computation cost.* MFCL, in its current form, requires clients to generate synthetic data in every batch. Clients can reduce this cost by generating and storing synthetic images once (only for training) and deleting them afterward. To further reduce the cost, clients can request the server to generate and send them synthetic images instead of the generative model.\n\n*Communication cost.* The discussed methods can also reduce communication costs. Another alternative is to send the generative model once per task and store it on the client side. Existing techniques, such as pruning, can further reduce the model size while preserving performance.\n\n*Resource-limited clients*. In terms of scaling the generative model, if there are resource-limited clients among the participants, the server can train different generative models with different qualities. Clients can then select the proper generative model based on their restrictions.\n\n> Privacy concerns associated with data storage.\n\nThere are different regulations and rules that limit the storage time of users’ data. Service providers are obligated to erase the data eventually after a specific period. Sometimes, the data is available only in the form of a stream and never gets stored; then, we can only use it once for training. However, most of the time, the regulations allow the service provider to store the data for longer, which is enough to perform a few training rounds. After this period, the local data will change, but our method helps the model preserve its knowledge of the unavailable data from old tasks. \n\n> Malicious server\n\nThis is a great question, and we thank the reviewer for pointing this out.\n\nFedAvg and other common aggregation methods where the server has access to clients’ updates are susceptible to such attacks. The crucial point is that MFCL trains the generative model based on the aggregated model, which is already available to all clients and servers in the case of FedAvg. So, MFCL is vulnerable to the same set of attacks as FedAvg (including the server accessing clients’ updates) but does not introduce additional problems. In contrast, prior work requires clients to share a locally trained generative model or perturbed private data, potentially causing more privacy issues.\n\n **Secure aggregation.** A potential solution when clients do not trust the server with their updates is “Secure Aggregation”. In summary, secure aggregation is a defense mechanism that protects update privacy from malicious servers. Since MFCL does not require individual updates, it is compatible with secure aggregation and can be employed to align with this dense.\n\n> How to validate the generative model.\n\nWe validate the generative model in different ways:\n\n1- Monitoring the trends in each loss term to verify if they are decreasing.\n\n2- Examining the quality of the synthetic data.\n\n3- Evaluating the final performance of the global model.\n\n> Are L_KD in Eq. 8, 9 and L_KL in Table 5 equal?\n\nThis is a typo, and we will fix it in the paper.\n\n---\nWe sincerely thank the reviewer for their time, valuable feedback, and questions. We hope to have addressed their concerns and look forward to engaging in further discussion. If the reviewer finds our response satisfactory, we kindly ask them to revisit their evaluation."}, {"review_id": "8JsifZNTOH", "reviewer": "Reviewer_zVmx", "summary": "In this paper, authors propose a new approach to perform class-incremental learning in federated setting. Their approach uses a generative model trained at the server side which generates synthetic images to be used as a replacement for data corresponding to old classes. The authors claim through empirical results that their approach outperform all the earlier approaches for this problem.", "questions": "Please see above. ", "limitations": "NA", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "This paper clearly articulates the class incremental training in a federated learning setting and the related challenges. The paper also clearly explains different loss functions used for training the generative model and the client training paradigms used in the proposed approach. Ablation study is also performed to break down the gains into different constituents of the approach. ", "weaknesses": "\n\nOn page 3, authors mention that the main difference between FedCIL and their approach is that generative model in the proposed approach is trained in a data free manner which can reduce client's training time and computation. It's not clear how does this difference leads to such better performance in the experimental results. It will be nice to have some discussion and experiments to explain. \n\nAs mentioned on page 4, line 177, the generative model produces samples resembling the original training inputs and given that this model is transmitted to all the clients, why this is not a privacy issue? It will be good to analyze any potential privacy leakage through the shared generative model. \n\nIt's not clear the SuperImageNet dataset claimed by the authors, is it just a regrouping of the ImageNet Dataset or something more substantial. \n\nIn Fig. 5, it's quite surprising to see the such a poor performance of FedCIL compared to FedAvg and FedProx which are not even designed for this problem. There is not much discussion in the paper on this. Specifically, are these results over one run or multiple runs? What hyper parameter thing has been performed for these approaches. \n\nIn Fig. 5, performance of MFCL is falling the most as we go from CIFAR-100 to tinyImageNet to SuperImageNet although the number of samples per task is increasing. It will be good to understand why is this observed?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for reading the details of our paper and appreciate their comments. We are grateful for their insightful questions and try to address their concern in detail:\n\n---\n> FedCIL compared to MFCL and other methods\n \nWe have briefly discussed the differences between FedCIL and MFCL and our hyperparameters in section 7 of the appendix.\n\nFedCIL is a GAN-based method where all the participating clients train the discriminative model to align with their local generative model.  In the original paper, the authors show successful results for smaller datasets (MNIST and CIFAR10) and a small number of clients (=5). We believe by increasing the dataset’s difficulty and reducing the number of examples per client; this method would face the following challenges;\n1. GAN models require training on a large amount of data for a long time. However, in scenarios like CIFAR100 with 50 clients, each client has a few examples of each class.\n\n2. GAN are commonly known to be very sensitive to hyperparameters, especially in a decentralized setup. \n\n**Hyperparameters.** To train FedCIL for TinyImageNet and SuperImageNet, we tried SGD and Adam optimizers with learning rates $\\in${0.1, 0.05, 0.01} and local epoch $\\in$ {1, 2}. For a fair comparison, we adopt a generative model architecture with the same input dimension and a total number of parameters as MFCL. Unfortunately, the model did not converge to good performance with the mentioned hyperparameters. \n\nWe want to highlight that training FedCIL is substantially more expensive compared to other methods, as individual clients have their local generative model. Although other hyperparameters may improve the results, our evaluation indicates the difficulty of the hyperparameter tuning for FedCIL. It is worth mentioning that in order to train the CIFAR-100 dataset, we used a local epoch $8 \\times$ larger than the other baselines; otherwise, the performance on this dataset would also degrade. \n\nHaving this said, we believe that FedCIL is designed for cross-silo settings where each client has a lot of computational power and training data. On the contrary, MFCL works well across both cross-silo and cross-device settings.\n\n> Privacy implications of sharing the generative model\n\nIn our method, the server relies only on the aggregated global model to train the generative model. Since this global model is already shared with the clients in any standard FL framework (such as FedAvg), clients can anyway train such generative models locally and synthesize data. As a result, we believe our method generally does not introduce any *additional privacy* issues. \n\nIt is still possible to conduct other attacks, such as model/data poisoning, that are common in FedAvg. Our claim about privacy is compared to other federated continual learning methods where the clients need to share a locally trained generative model or perturbed private data, causing more privacy problems.\n\nIt is noteworthy that common defense mechanisms for FedAvg, such as secure aggregation, are also applicable to our algorithm. In MFCL, the server does not require access to the individual client's updates and uses the aggregated model for training. Therefore, training a generative model is still viable after incorporating these defense mechanisms. \n\n> Performance of MFCL from CIFAR-100 to tinyImageNet to SuperImageNet.\n\nWe thank the reviewer for their observation. We believe the main reason behind this performance degradation is the difficulty of the datasets. SuperImagenet resolution is 3 * 224 * 244, while this value is 3 * 32 * 32 for CIFAR100. This difference in quality causes two types of problems;\n\n 1- Training a model on SuperImageNet is more difficult. Even in the centralized setting with all the data present (no FL or CL), the performance of ResNet18 is better on CIFAR100.\n\n2- As the data resolution increases, generating high-quality synthetic data becomes more challenging. \n\nTo address the first problem, clients need to train a larger discriminative model and to resolve the second issue, we should increase the generative model size. In our experiments, we employed the common backbone architecture for the global model, which is more suitable for cross-device FL. \n\n> SuperImageNet dataset\n\nSuperImageNet is a subgroup and regrouping of the ImageNet dataset. We will clear this in the main manuscript to avoid confusion. \n\n---\nWe sincerely thank the reviewer for their time, valuable feedback, and questions. We hope to have addressed their concerns and look forward to engaging in further discussion. If the reviewer finds our response satisfactory, we kindly ask them to revisit their evaluation."}]

Author rebuttal:
We thank all the reviewers for their insights and comments on the paper. Here we have attached a PDF that includes the following;

* A more clarified version of Figure 3.(a) of the paper for reviewer 4Enn.

* More experiment results with increased memory sizes for reviewer p34V.

Meta-review: This paper explores an interesting (and realistic, as noted by a reviewer) setting for federated continual learning. The overall approach is an adaptation of existing techniques in CL (i.e., leverage generated data for classes/tasks seen in the past) to the case of federated CL. This is not a trivial task, and the paper does a good job of explaining, justifying, and evaluating the proposed approach. The proposal of a new protocol benchmark is another big plus for the paper. On the downside, reviewer NkkA points to a potential issue with the generator (model selection issues).

In summary, during the discussion phase, the several positive aspects of the paper were noted by the reviewers and the AC. There is also a strong support from several reviewers to accept the paper. On balance, the AC recommends the paper for acceptance.
Decision: Accept (poster)