On Privacy and Personalization in Cross-Silo Federated Learning
Authors: Ken Liu
Shengyuan Hu
Steven Wu
Virginia Smith
Venue: NeurIPS 2022 Accept (2022)
Keywords: Differential Privacy
Federated Learning
Model Personalization

Abstract: While the application of differential privacy (DP) has been well-studied in cross-device federated learning (FL), there is a lack of work considering DP and its implications for cross-silo FL, a setting characterized by a limited number of clients each containing many data subjects. In cross-silo FL, usual notions of client-level DP are less suitable as real-world privacy regulations typically concern the in-silo data subjects rather than the silos themselves. In this work, we instead consider an alternative notion of silo-specific sample-level DP, where silos set their own privacy targets for their local examples. Under this setting, we reconsider the roles of personalization in federated learning. In particular, we show that mean-regularized multi-task learning (MR-MTL), a simple personalization framework, is a strong baseline for cross-silo FL: under stronger privacy requirements, silos are incentivized to federate more with each other to mitigate DP noise, resulting in consistent improvements relative to standard baseline methods. We provide an empirical study of competing methods as well as a theoretical characterization of MR-MTL for mean estimation, highlighting the interplay between privacy and cross-silo data heterogeneity. Our work serves to establish baselines for private cross-silo FL as well as identify key directions of future work in this area.

On Privacy and Personalization in Cross-Silo Federated Learning
Ziyu Liu Shengyuan Hu
Zhiwei Steven Wu Virginia Smith
Carnegie Mellon University (kzliu, shengyuanhu, zstevenwu, smithv) @cmu edu
Abstract
While the application of differential privacy (DP) has been well-studied in cross- device federated learning (FL), there is lack of work considering DP and its implications for cross-silo FL, a setting characterized by limited number of clients each containing many data subjects. In cross-silo FL, usual notions of client-level DP are less suitable as real-world privacy regulations typically concern the in-silo data subjects rather than the silos themselves. In this work, we instead consider an alternative notion of silo-specific sample-level DP, where silos set their own privacy targets for their local examples. Under this setting, we reconsider the roles of personalization in federated learning. In particular, we show that mean- regularized multi-task learning (MR-MTL), simple personalization framework, is strong baseline for cross-silo FL: under stronger privacy requirements, silos are incentivized to federate more with each other to mitigate DP noise, resulting in consistent improvements relative to standard baseline methods. We provide empirical study of competing methods as well as a theoretical characterization of MR-MTL for mean estimation, highlighting the interplay between privacy and cross-silo data heterogeneity. Our work serves to establish baselines for private cross-silo FL as well as identify key directions of future work in this area.
Introduction
Recent advances in machine learning often rely on large, centralized datasets [84, 23, 65], but curating such data may not always be viable, particularly when the data contains private information and must remain siloed across clients (e-g. mobile devices or hospitals). Recently, federated learning (FL) [71, 50] has emerged as paradigm for learning from such distributed data, but it has been shown that its data minimization principle alone may not provide adequate privacy protection for participants [101, 102]. To obtain formal privacy guarantees, there has thus been extensive work applying differential privacy (DP) [27, 28] to various parts of the FL pipeline (e.g. [32, 73, 41, 48, 63, 44, 83, 34]).
Existing approaches for differentially private FL are typically designed for cliens-level DP in that they protect the federated clients, such as mobile devices ("user-level"",, tasks in multi-task learning ("task-level"), or data silos like institutions ("silo-Level"), and DP is achieved by clipping and noising the client model updates. While client-level DP is considered strong privacy notion as all data of single client is protected, it may not be suitable for cross-silo FL, where there are fewer clients but each hold many data subjects that require protection. For example, when hospitals/banks/schon wish to federate patien//custommerstuudenn records, it is the people owning those records rather than the participating silos that should be protected. In fact, laws and regulations may mandate such participation in FL be disclosed publicly [96], compromising the privacy of the federating clients.
In this work, instead consider with variants appearing in [41, 66, 109, 51]): the k-th silo may set its own (Ex. 6g) sample-leve DP target for any learning algorithm with respect to its local dataset. With this formulation in mind, then reconsider the impact of privacy, heterogeneity, and personalization in cross-silo FL. In particular,
natural model of silo-specific sample-leved privacy (Fig. 1,
36th Conference on Neural Information Processing Systems (NcurIPS 2022).

---

we explore existing baselines for FL (mostly developed in cross-device settings) across private cross-silo benchmarks, and we find that the simple baseline of mean-regularized MTL (MR-MTL) has many advantages for this setting rela- tive to other more common (and possibly more complex) methods. We then further analyze the performance of MR-MTL un-
Hospital
Hospital
Hospital
Hospital
der varying levels of heterogencity and pri- vacy, both in theory and practice. In addi- tion to establishing baselines for cross-silo FL, we also identify interesting future di- rections in this area (57 and Appendix G). We summarize our contributions below:'
model
updattess
updrtte
server
(e, 6)
[ protected
Cllent-level DP:: Participaing slos protected
Silo-spedffic sample-levd Inciridaal records
(with notione boca//ernaal/daarbttddd DP)
withir stios protected specific targets
Figure I: Client-level DP vs Silo-specific sample-level DP.
We consider the notion of silo-specific sample-level differential privacy (DP) as a more realistic privacy model for cross-silo federated learning (FL.). We analyze its implications on existing FL. algorithms and, in particular, how it interfaces with data heterogeneity across silos.
We empirically show that mean- reea--reguarrzeed multi-task learning (MR-MTL), simple form of model personalization, is a remarkably strong baseline under silo-specific sample-level DP, Core to its effectiveness is its ability to (roughly) interpolate on the model personalization spectrum between local training and FedAvg with minimal privacy overhead.
We provide a theoretical analysis of MR-MTL under mean estimation and characterize how MR-MTL navigates the tension between privacy and cross-silo data heterogeneity.
Finally, we examine the complications of deploying an optimal MR-MTL instance that stem from the privacy cost of hyperparameter tuning. Our reasoning also applies other personalization methods whose advantage over local training and/or FedAvg hinges on selecting the best hyperpa- rameter(s). This raises important questions around the practicality of leveraging personalization to balance the emerging tradeoffs under silo-specific sample-level DP.
2 Preliminaries
Federated Learning (FL) [71, 58, 50] is a distributed learning paradigm with an emphasis on data protection: in every training round, each client (participant) downloads the current global model from central server, trains it with the local dataset, and uploads the model changes (instead of the data) back to the server, which then aggregates the changes into a new global model. A basic instantiation of FL is FedAvg [71], where clients are stateless and the server performs simple (weighted) average. Cross-device FL refers to settings with many clients each with limited data, bandwidth, availability, etc. (e.g. mobile devices). In contrast, cross-silo FL typically involves less clients (e.g. banks, schools, hospitals) but each with more resources. Two distinguishing characteristics of cross-silo FL relevant to our work are that (1) silos may have sufficient data fit reasonable local model without FL., and (2) each data point in a silo tends to map to a data subject (a person) requiring privacy protection.
Differential Privacy (DP). Despite its ability to mitigate systemic privacy risks, FL by itself does not provide formal privacy guarantees for participants' data [50, 102, 101], and differential privacy is often used in conjunction with FL to ensure that algorithm does not leak the privacy of its inputs.
Definition 2.1 (Differential Privacy [27, 28]. A randomized algorithm M X + Y, where X is the set of datasets with n samples and ) is the set of outputs, is (c, 5)-P for any subset S C y and any neighboring x, x' differing in only one sample (by replacement), we have
Pr[M(z) E S] S exp(e) Pr|M E S]+
(1)
To apply DP a dataset query, one commonly used method is the Gaussian mechanism [28], which involves bounding the contribution (e--oorm of each sample in the dataset followed by adding Gaussian noise proportional to that bound onto the aggregate. To apply DP in FL, one needs to define the "dataset" to protect; typically, as in client-level DP, this is the set of FL participants and thus the model updates from each participant in every round should be bounded and noised. In learning settings, we need repeatedly query dataset and the privacy guarantee composes. We use DP-SGD [92. 11, 1] for ensuring sample-level DP for model training, and we use Rényi DP [77] and zCDP [15] for tight privacy composition. In certain FL algorithms, clients also perform additional
'Code is available at https::////
silo-f...
2

---

95
95
Avg. Sibo Test Ace (%)
Silo Test Ace (%)
100
Aug Silo Ace
600
90
85-
85-
Switch Feskug
80-
Local Local (s
to local traring
1)
80-
Feding
80-
Fineuoe
-00
100)
200
100
200
100
200
Rounds
Rounds
Rounds
Figure 2: Two notable phenomena under silo-specific sample-terel DP: (1) FedAvg can serve to cancel out per-silo DP noise and thus outperform local training even when the latter works better without privacy (left); (2) Local finetuning [104, 19] (FedAvg followed by local training) may not improve utility as expected, as the effect of noise reduction is removed when finetuning begins (mid & right). Results report mean test + std the Vehicle dataset over seeds. For simplicity, all silos budgets for the same labeled with 10 Transparent curves refer to local/FedAvg runs with the same 5 labeled for finetuning (compare left & mid).
work such as cluster selection [69, 33] that incurs privacy overhead with respect to its local dataset that must accounted for independently from DP-SGD. See Appendix A for additional background.
Personalized FL. Model personalization is key technique for improving utility under data hetero- geneity across silos.? 2 Past work has examined the roles of local adaptation [99, 104, 19]. multi-task learning [91, 89], clustering [33, 22, 69, 89], public data [108, 69], meta learning [46, 56, 31], or other forms of model mixtures [61, 57, 69, 38, 24, 3]. Notably, many methods leverage extra computation to some extent (e.g. extra iterations [61, 57, 19] or cluster selection [33, 69]), which will result in privacy overhead under silo-specific sample-level DP as discussed in the following section. Of particular interest is the family of mean- regularegee multi-task learning (MR-MTL) methods [30, 94, 38, 37] (see Algorithm A for a typical instantiation). We find that MR-MTL, while extremely simple, is strong baseline for private cross-silo FL.
3 Revisiting the Privacy Model for Cross-Silo Federated Learning
To date, the prevalent privacy model for federated learning has been to protect the participating clients, ie. client-level DP. For cross-silo FL, however, several factors render client-level DP less appropriate. First, cross-silo FL often involves a small number of clients and it can be utility-wise more costly to attain the same privacy targets. For example, privacy amplification via sampling [1, 78] may not apply on the client level since all silos typically participate in every round. Second, many existing methods focus enforcing client-level DP in non-local model and thus defines shared privacy target for all participants, but in world cross-silo settings, participants under different jurisdictions (e.g. states) may have varying privacy requirements and thus opt for different privacy-utiliny tradeoffs. Third, while silo-level protection implies sample-level protection, it may be too stringent in practice as silos often have large local datasets. These unique properties for private cross-silo learning motivate to consider silo-specific sample-level DP as an alternative privacy model (Fig. I):
Definition 3.1 (Silo-specific sample-level DP). A cross-silo FL algorithm with K clients (silos) sample- level DP if the local (personalized) model Mj of every silo A E [K] satisfies (Ex, DDP w.r.t. the silo's 's local dataset of training examples.
satisfy {EEx 5x)) "lseeecssslloosseeeeeee
Characteristics of silo-specific sample-level privacy. Importantly, silo-specific sample-level DP is defined over the disjoint datasets of the individual silos, rather than the combined dataset of all silos. To instantiate this setup in FL, each silo can simply run SGD [92, 11, 1] with noise scale calibrated to gradually spend its privacy budget over T training rounds, and return the noisy model update at each round. This privacy notion has several important implications the dynamics of FL::
Silos incur privacy costs with queries their data, but not with participation in FL. This follows from DP's robustness to post-prooe post-processing:: the silos' model updates in each round already satisfy their own sample-level DP targets, and participation by itself does not involve extra dataset
NNote that "personalization" refers to customizing models for each client in FL rather than specific person. record in such a combined dataset at most (max; Es, max, 6D)-PP [76. 103, 63]. Moreover, multiple records (either within a silo or across silos) map to the same person, then it is more intricate to protect the person rather than their records. Here we focus on the case where each entity has at most one record across the combined dataset (e.g. students attending exactly one school). See Appendix B for discussions.
3

---

queries (e.g. DP-SGD steps). In contrast, local training without communication can be kept noise-free under client-level DP, but participation in FL requires privatization. Two immediate consequences of the above are that (1) local training and FedAvg now have identical privacy costs, and (2) local finetuning for model personalization may no longer work as expected (Fig. 2).
2. Less reliance on a trusted server. As a corollary of the above, all model updates of silo satisfy (at least) (Eg, 5x) D against external adversaries, including all other silos and the orchestrating server [28, 109]. In contrast, client-level DP under a non-local model necessitates some trust on the server, even for distributed DP methods (e.g. [29, 21, 48, 4, 20, 18)).
Tradeoff emerges between costs from privacy and heterogeneity. As privacy- peererrinn noises are added independently on each silo, they are reflected in silos' model updates and can thus be mitigated when the model updates are aggregated (e.g. via FedAvg). leading to a smaller utility drop due to DP for the shared model. On the other hand, federation also means that the shared model may suffer from client heterogeneity (non-iid data across silos). This intuition is observed in Fig. 2: while local training may outperform FedAvg without privacy (as a result of heterogeneity), the opposite can be true when privacy is added (as a result of noise variance reduction).
The first and last in the above are of particular interest because they suggest that model personalization can play key and distinct role in our privacy setting. Specifically, local training (no FL participation) and FedAvg (full FL participation) can be viewed as two ends of a personalization spectrum with identical privacy costs; if local training minimizes the effect of data heterogeneity but enjoys no DP noise reduction, and contrarily for FedAvg, is then natural to ask whether there exist personalization methods that lie in between and achieve better utility, and, if so, what methods would work best.
Related privacy settings. Past work on differentially private FL. has concentrated on client-level DP and cross-device FL. (e.g. [32, 74, 44, 34, 49, 48, 6)), and the application of DP in cross-silo FI., particularly where each silo defines its own DP targets for records of its own dataset, is relatively underexplored. Privacy notions closest ours first appeared in [95, 56, 41, 109, 66. 51, 63]. In [95], each client adds its own one-shot noise onto its outgoing update, but in learning scenarios this provides client-level protection. The works of [56, 66, 109, 41, 63] study analogous privacy notions, though they respectively focus on boosting utility [56], analyzing statistical rates [66], adapting FL to f-DP [109, 25]. applying security primitives [41], and learning a better global model; the aspects of heterogeneity, DP noise reduction, the personalization spectrum, and their interplay (e.g. Figs. 2 and 5) were unexplored. The work of [51] also considers a similar privacy notion, but the authors study a disparate trust assumption where DP noise is not added to local training/finetuning such that the final personalized models lack privacy guarantees. We note that the trust model most suitable for private cross-silo FL may be application-speccfi;;; in this work, we focus the setting where the outputs of the FL procedure (the personalized models) must remain differentially private.
4 Baselines for Private Cross-Silo Federated Learning
With the characteristics from $3 in mind, we now explore various methods cross-silo benchmarks. We defer additional details as well as results on more settings and datasets to the appendix.
Datasets. We consider four cross-silo datasets that span regression/dlasiifcation and convex/non- convex tasks: Vehicle [26], School [35], Google Glass (GLEAM) [82], and CIFAR-10 [53]. The first three datasets have real-world cross-silo characteristics: Vehicle contains measurements of road segments for classifying the type of passing vehicles, School contains student attributes for predicting exam scores, and GLEAM contains motion tracking data to classify wearers' activities. CIFAR-10 has heterogeneous client splits following [94, 90]. See Appendix C. for more details and datasets.
Benchmark methods. We consider several representative methods in the personalized FL literature beyond local training and FedAvg [71]: local finetuning [99, 104, 19] (a simple but strong base- line for model personalization). Ditto [57] (state-of-the-art personalization method), Mocha [91] (personalization with task relationship learning), IFCA/HypCluster [33, 69] (state-of-the-a) hard clustering method for client models), and the mean-regularizedd multi-task learning (MR-MTL) meth- ods [30, 94, 38, 37] (which we analyze in $5). For fair comparison under silo-specific sample-level DP, we align all benchmark methods on the total privacy budget by first restricting the total number of iterations over the local datasets and then account for any privacy overheads (in the form of necessary extra steps [57] or cluster selection for IFCA/HypCluster [33, 69]). Importantly, many other personalization methods can either be reduced to one of the above under convex settings (e.g. [46, 61]) or are unsuitable due to large privacy overheads (e.g. large factor of extra steps for []....

---

Vahicle
Google Glass (GLEAM)
Hetorogenoous CIFAR-10
log Sil Test Aoc (Ng)
10.0-
(a)
Ang Sit Text MSE
0.000
Aug Silo Text Aue (N)
97.6
$5.0
(c)
0.003
FiAh (un))
85.0
Madka
92.5-
Local
16
60
Lozal
0.000
50.0
Frense
55-
80-5
IFCA (1EN)
87.5
PCC (285)
Unte (X3)
Loaal
0.080
(10%)
(6)
11220
0,20
0.70
1.00
10
10
20
Privecy with d
16-7
Privacy with 10-3
Privacy with 10-1
Privacy with d 10-
Figure 3: Privacy-utility tradcoffs (privacy budgets& & vs. test metrics, mean + std w/ seeds) for various personalization methods Vehicle, School, GLEAM, and Heterogeneous CIFAR-10 datasets respectively. For simplicity, every silo targets for the same (e, d) under silo-specific sample-leve level DP. ' denotes tuned regularization strength where applicable. "Local" denotes local training (clients train and keep their own models). "IFCA (10%)" denotes forming clusters for only first 10% of training rounds due to privacy overhead (Fig. 4).
Training setup. For all methods, we use minibatch DP-SGD in each silo to satisfy silo-specific sample-level privacy, while certain methods may have more efficient solvers (e.g. dual frrm for [91]), we
Avg Sile Test Acc (%)
90
80-
want compatibility with DP-SGD as well as privacy amplification via sampling on the example level for tight accounting. For all
FeelAug
MR-MTL (X')
70-
Ditto (A1)
experiments, silos train for local epoch in every round (except
for [57] which runs 2 2 epochs). Hyperparameter tuning is done via grid search for all methods. Importantly, when comparing the benchmark methods, we do not account for the privacy cost of hyperparameter tuning in order to focus on their inherent privacy- use
60
0.5
1.0
Privacy e with 10 7
utility tradeoff; revisit this issue in $7. For simplicity, the same privacy budget for all silos, i.c. (E,, 6,) = (Ej. 65) for all i E [K]; note that this is not restrictive assumption since the effect of having varying DP noise scales from different budgets can be attained by varying local dataset sizes.
Figure 4: The privacy overhead of cluster selection (IFCA) and extra iterations (Ditto) compared to lo- cal, FedAvg, and MR-MTL under silo-specific sample-level DP.
Results. Fig. shows the privacy-utility tradeoff's across four datasets. We observe that MR-MTL consistently outperforms suite of baseline methods, and that it performs at least as good as local training and FedAvg (endpoints of the personalization spectrum), except at nigh-privacy regimes (possibly different for each dataset). In particular, there exists range of E values where MR-MTL can give significantly better utility over local training and FedAvg under the same privacy budgets (e s 0.5, 6, 1.5 for Fig. 3 (a. b, c) respectively); this is our key regime of interest.
Effects of silo-specific sample-level privacy. In Fig. 2 we saw that local finetuning may not improve utility as expected, motivating us to reconsider the roles of federation and personalization ($5 below). In Fig. 4, we consider the implication of silo-specific sample-level DP from the effects of privacy overhead due to additional dataset queries: (1) If IFCA [33, 69] performs cluster selection at every round (default behavior), then the extra privacy cost can be prohibitive; (2) Despite its similarity to MR-MTL, Ditto [57]'s privacy overhead makes it less competitive (see also Fig. 5).
5 On the Effectiveness of Mean-Regularized MTL for Private Cross-Silo FL
Following the observations in $4, we now examine the desirable properties of good algorithm under silo-specific sample-level privacy and understand why MR-MTL may be an attractive candidate.
Federation noise reduction. A key message from $3 and Fig. 2 is that the utility cost from DP can be significantly smaller for FedAvg compared to local training even when the latter spends an identical privacy budget. This implies that FedAvg may have inherent benefits for DP noise reduction, despite the noise are added in the gradient space rather than the parameter space (as
in client-level DP). Consider simple setting of DP gradient descent: the update rule w (I+1)
ΣT- Ty (2(0) + + ( for silo k recursively expands to w w a me
(E)
(1)
(T) (0)
1 (0))
wk
Σi= ETh I over T steps, where I is the clipped gradient of the i-th local example at step (with norm bound e) out of total of na examples, and 2(() ~ (00 I) the Gaussian noise added to the gradient sum at step t that targets for overall privacy budget of (Ek, 6k) over T steps
5

---

with o² =0 - (cTTTmm(//6)/// [1].
The cumulative noise term
1 T2 In (1/5s)) [
2
A " Σ 0, O Tk
(2)
indeed implies that each silo's model update has an independent Gaussian random walk compo- nent [88, 7. 100] whose variance can be reduced by averaging with other silos' updates, as FedAvg." A similar reasoning applies to SGD cases since the additive DP noises are i.i.d. across the minibatches.
cost tradeoff. A major downside of FedAvg is that it may underperform simple local training due to data heterogeneity (e.g. [104] and Fig. 2). particularly given that clients in cross- silo FL often have sufficient data fit reasonable local models. This suggests an emerging role for model personalization on top of its benefits in terms of utility [99], robustness [104], or fairness [57] under heterogeneity; our privacy model allows local training and FedAvg to be viewed as two endpoints of personalization spectrum that respectively mitigate the utility costs of heterogeneity and privacy noise with identical privacy budgets (recall $3); this means that personalization methods could be viewed as interpolating between these endpoints and that various personalization methods essentially do so in different ways. However, our empirical observations motivate the following key properties of good personalization algorithm:
Model personalization for
1. Noise reduction: The effect of noise reduction is present throughout training so that the utility costs from DP can be consistently mitigated. Local finetuning is a counter-exampee (Fig. 2).
2. Minimal privacy overhead: There are little to no additional local dataset queries to prevent extra noise for DP-SGD under a fixed privacy budget. In effect, such privacy overhead can shift the utility tradeoff curve downwards, and Ditto [57] may be viewed as counter-example (Fig. 4).
3. Smooth interpolation along the personalization spectrum: The interpolation between local training and FedAvg should be fin-ggrined (if not continuous) such that an optimal tradeoff should be attainable. Clustering [33, 69] may be viewed as a counter-example when there are no clear heterogeneity strucutre across clients.
These properties are rather restrictive and they render many promising algorithms less attractive. For example, model mixture [61, 13, 24] and local adaptation [104, 19] methods can incur linear overhead in dataset iterations, and so can multi-tast learning [57, 91, 89] methods that benefit from additional training. Clustering methods [33, 22, 69, 89] can also incur overhead with cluster selection [33, 69], distillation [22], training restarts [89], and they discretize the personalization spectrum in way that depends on external parameters (e.g.. the number of clients, clusters, or top-down partitions).
The case for meca-regularization. These considerations point to mean-regularized multi-task learning (MR-MTL) as one of the simplest yet particularly suitable forms of personalization. MR- MTL has manifested in various forms in the literature [30, 105, 94, 38, 19, 44] with the key idea that a personalized model Wk for each silo & should be close to the mean of all personalized models i via regularization penalty 1/2||w> 211 (see Algorithm Al for typical instantiation). The hyperparameter À serves as a smooth knob between local training and FedAvg, with À = 0 recovering local training and larger À forces the personalized models Wy to be closer to each other ("federate more"). However, it is an imperfect knob as X > 0O may not recover FedAvg under typical optimization setup the regularization term may dominate the gradient step wi (f-1) wk
(4) 1 (t: + > (wkk -m(0) where ge is the noisy clipped gradient, and MR-MTL may thus
underperform FedAvg in high-privacy regimes that necessitate a large À to mitigate DP noise (Fig. 3).
MR-MTL has the attractive properties that: (1) noise reduction is achieved throughout training via soft constraint that personalized models are close to an averaged model; (2) for fixed À it has zero additional privacy cost compared to local training/FedAvv as it does not involve extra dataset queries; and (3) provides a smooth interpolation along the personalization spectrum. Moreover, compared to other regularization--e bassed MTL methods, it adds only one hyperparameter À (cf. [45, 110, 36]); this has important practical implications as will be discussed in $7. It also has fast convergence [106] and easily extends to deep learning with good empirical performance in the primal [94, 44] (cf. [10, 91, 64)). It is also sufficently extensible to handle structured heterogeneity (discussed below).
4 The work [49] examines the benefits of adding negatively correlated (instead of independent) noises 2; across time steps. While this is potential orthogonal extension to our use of local DP-SGD within each silo, it may not be directly applicable to our main focus of reducing noise variance across silos, since for each silo & to satisfy its own (Ex, 6z) requirement, it must add noise independent other silos.

---

Rotated MNIST (4 clusters)
Rotated, 15% Masked
Rotated, 30% Masked (c)
Rotated, 50% Masked
Siee Text (%)
50
(a)
Aur Sll Text Acc (%)
Avg Site Test Ace (%)
Aug Sto Text Acc (9g
(d)
80
Crnoonve of
600
50-
acct/Clueeee Methods
50-
70
Local LIIAA 150
60-
VIBATT STCA Ph1
50-
(00
Privary with 10-
Privacy with 10-7
Privacy with A
10
Privacy 5 with 10
Figure 6: Test acc i std on Rotated Masked MNIST. (IFCA 5%) denotes warm-starting the method by rumning IFCA [33, 69] for first 5% of rounds followed by running the method within the cluster structures.
We argue through the following empirical analyses that these properties make MR-MTL a strong baseline under silo-specifie sample-level DP.
Navigating the emerging privacy-heterogeneity cost tradcoff. In Fig. 5 we study the effect of the regularization strength À on the model utility di- rectly. There are several notable observations: (1)
94-
Aug Sito Test Acc (%)
(0
X' (non private)
Local (c- 0.5)
Local
Feolug
Festig (c - 0.5)
In both private and non- privarev settings, À serves to roughly interpolate between local training and FedAvg. (2) The utility at the best A may out- perform both endpoints. This is significant for the private setting since MR-MTL achieves an identical privacy guarantee as the endpoints. (3) Moreover, the advantage of MR-MTL over the best of the endpoints are also larger under privacy. (4) The value of X also increases under privacy, indicating that the personalized silo models are closer to each other (i.e. silos are encouraged to "federate more") for noise reduction. We will characterize these be- haviors in $6. We also consider Ditto [57] in Fig. 5, a state-of-the-art personalization method that resembles MR-MTL and exhibits similar behaviors, to illustrate the effect of privacy overhead from its extra local training iterations.
Déto (r 0.5)
Deto
MR MTL (c 0.5)
X' (pricate)
10-3
10-1
162
Regularization strength
Figure 5: Test acc + std of MR-MTL with varying À (corresponding to 0.5 in Fig. 3 (a)). Optimal points (A") exist where it outperforms both ends of the spectrum under the same privacy. Ditto [57] gives a similar interpolation but has strictly worse privacy- utility tradeoffss due to its privacy overhead. See Appendix H.2 for extensions of this figure to other privacy settings and datasets.
MR-MTL under structured heterogeneity. We further study (1) the extensibility of MR-MTL as strong baseline method to handle clustering structures of silo data distributions and (2) its flexibility to handle varying heterogeneity levels. by manually introducing two layers of heterogeneity the MNIST dataset [54]. The first layer is 4-way rotations: train/test images are evenly split into 4 groups of 10 silos, with each group applying {0', 990,, 180 270") of rotation to their images. The second layer is silo-specific masking: each silo generates and applies its unique random mask of 2 x 2 white patches to its images, with varying masking probability. Together, the 1st layer creates 4 well-defined silo clusters, and the 2nd layer (gradually) adds intra-cluster heterogeneity. Importantly, our goal is not to contrive a utility advantage of MR-MTL (in fact, the added heterogeneity is disadvantageous to mean regullaizzationn but to examine its extensibility and flexibility as strong baseline method to match the best methods by construction. Under the 1st layer of heterogeneity, clustered FL methods [33, 69] should be optimal if the correct clusters are formed since there is no intra-cluster heterogeneity; with increasing silo-specific heterogeneity in the 2nd layer, local training should be increasingly more attractive. See Appendix C. for more details on the setup and examples of images.
We propose simple heuristic to precondition or "warm-stare MR-MTL with a small number of training rounds by running private clustering (with IFCA [33, 691) followed by mean-regularized training within each each formed cluster (see Appendix for details). We find that this simple heuristic, with convergence properties carried forward from its components [33, 30, 106], enables MR-MTL to excel at all levels of heterogeneity: in Fig. 6 (a), the preconditioning allows MR-MTL to match IFCA (optimal by construction) while local training (full personalization) does not benefit from the same preconditioning: in Fig. 6 (b, c. d), MR-MTL remains optimal across different levels of silo-specific heterogeneity (the 2nd layer) while the gains from warm-start gradually drop. We argue that extensibility and flexibility are good properties that make MR-MTL a strong baseline, as heterogeneity in practical settings is likely less adversarial than what presented.
7

---

6 Analysis
In this section provide theoretical analysis of MR-MTL under mean estimation as simplified proxy for (single-round) FL using a Bayesian framework extending on [57]. We provide expressions for the Bayes optimal estimator MR-MTL (X*) and describe how MR-MTL behaves with varying À in relation to the personalization spectrum to characterize our observations from Fig. 5. Proofs and extensions are deferred to Appendix E.
Setup. We start with total of K silos where the k-th silo holds n training samples X { R kejn) each normally distributed around a hidden center wy with variance o²: i.e. T/. = we + Z with žg,i ~ -0 To quantify heterogeneity, the silo centers (w&Jke[Kt are also normally distributed around some unknown fixed meta-center 0 with variance 72; i.e. We 0 ~ (0, 72). A large r means that the silo centers are distant from each other and thus their local objectives are heterogeneous, and contrarily for small Our goal is for each silo k to compute sample-level private estimate of wy that minimizes the generalization error (i.c. on unseen points from the same local distribution). Each silo targets (e, 6) sample-level DP and runs the Gaussian mechanism with noise scale pp cv2 ln(1.25/6)) and clipping bound c.¹ Under this setting, the MR-MTL objective for the k-th silo is
with
A (w(w) = (w)
- 3
(3)
2
Here, (w)) - [w - (Sx + >i= TRii min(1, c/ ((,,))))) is the local objective to privately estimate the mean of the local data points with privacy noise &a (O, oB.). Since the data are (sub-JGaussian, we assume one can choose c such that no clipping error is introduced w.h.p., so vig _ argmin F& (wr) 1 (Ex + Σ; TR.i) is the best local estimator. wi = * Ee úy the average estimator across silos, which is the same the FedAvg estimator under mean estimation. We also consider the external average local estimators for silo k, defined as wi A K-I Ejye újj. The following lemma gives the best MR-MTL estimator (A) as function of A.
Lemma 6.1. Let X 2 0 and a
(1+A)K E (1/K, 1}. The minimizer of ha (w) is given by
K+A
wn (A)
wn + (1 a)) Wy
(4)
Note that the best is always for training error (i.e. estimating the empirical mean the local data {= our hope is that with some A > 0, wy (A) yields a better generalization error.
We now present the main takeaways. At high level, the basis of our analysis relies on expressing the true center wi in terms of ūy and ih conditioned on the local datasets {Xx {X*]ke[k]- Let
0² oi
oloc
(5)
n2
denote the "local variance" of th around w/ due both data sampling and privacy noise.
Behavior of MR-MTL at optimal X² We first derive the following lemma using Lemma 11 of [68].
Lemma 6.2. Given wk, Likk. and [X*]kE(K]] we can express wi = H4k + ÇR. where Çr. ~ NN(0,
1 T
K-1
and 19 A o
1 Tf.
K-1
r
Kr²
of
lac
Lemma 6.2 expresses the unobserved true silo centers Wa in terms of the (private) empirical estimators iy and u. This expression requires conditioning on the datasets X₁ as they form the Markoy blankets of ng.. Combining Lemma 6.1 and Lemma 6.2 gives the optimal X.
Theorem 6.3 (Optimal MR-MTL estimate). The best for the generalization error is given by oi
X = argmin E
(ww - (A))² wxx wi [X
0²
(7)
1
Theorem 6.3 suggests that there indeed exists an optimal point vi*)) on the personalization spectrum. Moreover, X grows smoothly with stronger privacy (ofr + oo) to encourage silos to "federate more" with others. This was empirically observed Fig. 5. We now characterize the utility of d(\)).
5 For simplicity, we start with the same n, a,, oDp for all silos and extend to silo-specific values in Appendix E.

---

Corollary 6.4 (Optimal error with ()(A)). ). The MSE of the optimal estimator =(\*) ) is given by
Tie (o Inc KT²)
A E [wv - in (x*))² úx ( [X*]ke]K]] =
(8)
K K(o + +2)
Note also that (A*) the MMSE estimator of wg. Using Corollary 6.4, we can compare dy (A*) against the endpoints of the personalization spectrum (local training and FedAvg) with the following propositions.
Proposition 6.5 (Optimal enror gap to local training). Let ELoc & E [(wx - xx)² Xx] the error of the local estimate. Then, compared to the optimal estimator ri(²) (Corollary 6.4), the local estimator incurs an additional error of
Roo be
(0-=(1-k)
11=1-11
o loc
Aloc A Eloe --" ---=
(9)
loc + 72
Proposition 6.6 (Optimal enror gap to FedAvg). Let Efed
- T.
[wwx= -m)² 2 (Xx [e(K]] be the wx()) (Corollary 6.4), the FedAvg
error under FedAvg. Then, compared to the optimal estimator estimator incurs an additional error of
Ased 2 Exed -E K
(10)
2 Toc
+ +
Together, Propositions 6.5 and 6.6 suggest that the effects of stronger privacy (op.. oec + 20) on how MR-MTL compares against the personalization endpoints are mixed, with the benefit of MR-MTL increasing against local training and diminishing against FedAvg. They also suggest that MR-MTL has an optimal utility advantage over both the endpoints when of R 7 and local training performs on par with FedAvg, and the utility "bump" under privacy observed in Fig. 5 can be viewed as result of this balance. is worth noting that since the data variance o² and heterogeneity 7² are often fixed in practice, the freedom for silos to vary their privacy targets (& and oBp) makes the utility advantage of MR-MTL more flexible compared non-private settings.
Behavior of MR-MTL as a function of X. The above captures how MR-MTL behaves at its optimum, but in Fig. 5 we also observed that MR-MTL has the desirable property that the utility cost from DP shrinks smoothly with larger À (65). Lemma 6.7 and Theorem 6.8 below provides a characterization.
Lemma 6.7 (Error of ūx Let E(A) 2 E [ uR (A))2 Lkk W.ss {Xx] be the error of MR-MTL as a function of X. Then, E(A) = (1 - K
L (A+1)" + K
+X²=²
Using Lemma 6.7 we now characterize how À affects the utility cost from DP (recall from Figs. and 5 that federation helps with noise reduction). As a side note, Lemma 6.7 also suggests that MR-MTL's utility function of À would have quasi-concave shape, as empirically observed in Fig. 5. This could potentially help make heuristic or automated search over À easier.
Theorem 6.8 (Private utility gap). Let (x)(A) and wPP (A) be the non-private and private estimate
of W2 with ofoc +- oa2 /n and of to2 /n + /B/n²,, respectively. Let E()) and (D)(X) be the error of (A) and &b (A) respectively as Lemma 6.7. Let ADP(A) e DD (A) E()) be the
utility cost due privacy as function of X. Then, ADP (A) (1 k) (x+1y= "
Lop + oàp. x..
Theorem 6.8 suggests that with larger X, the utility cost from privacy can be smoothly mitigated by up to factor of K, matching the empirical observation in Fig. 5.
7 Discussions
In previous sections, we empirically and theoretically studied the benefits of the best personalization hyperparameter X for MR-MTL, but it remains open as to how such A may be obtained. In this section, we take an honest look at the complications of deploying MR-MTL through the lens of the privacy cost of finding > There are in general several approaches: (1) non-adaptive search (e.g. grid/random search (1))): (2) an adaptive search (e.g. grad student descent); or (3) an online estimation during training (e.g. [97, 8, 80)). Here, we focus on approach (1) since it is generic to all personalization methods and a setting for which we have the best privacy accounting tools [62, 79] to our knowledge. We defer technical details and further discussions to Appendix F. Note that while we focus on MR-MTL, our reasoning in principle extends to all personalization methods whose ad advantage depends on having the best hyperparameter(s)

---

(6)
[c)
Stundio
General izziinn Enror
Generalization Error
Gener alizztioonn Error
Non-priote
(- 10-))
10-9
Pricat: TMR (4=00) 00007)
Preate. 1NB (1--115,) (0000)
Prizee, TNB (0-00.. 00000)
Maderate Heterggreetyy
2.0m..xm00 0.100)
Hattngerelty 0.2
Pricoe, TNR (a=3.1 0.37)
10
Pricets, TNR (a-5,y- 5..5-00351)
Pricats Palsson (pr
10
107
10 100
Figure 7: Privacy costs of tuning À on mean estimation (setup follows $6). Labels "Private" and "Non- Private" denote the errors of varying À with and without silo speeiiiii sample-level DP (the privacy cost of tuning A is not included). "Private, TNB/Poisson" [79] denotes the same errors but accounts for the privacy cost of trying on average Eih] = 10 values of A, with ht sampled from the truncated negative binomial distribution with parameters 7, 7 the Poisson distribution with parameter je to arrive at the same E[hl. To interpret, observe that the lowest points of "Private, TNB/Poisson" may be still higher than one of the endpoints of "Private".
Recall that for a typical tuning procedure, a baseline algorithm M is executed times with different hyperparameters and the best result is recorded. The work of [62, 79] shows that, with a constant h, there exists M that satisfies (z, 5 = OD- where the output of tuning is not (é, O)- for any ē he, with analogous negative results for Rényi DP (thus also for ó > 0). This implies that naive tuning (as done in practice) can incur prohibitive privacy overhead and obliterates the utility advantage of MR-MTL (X*) over local training/FedAAv Instead, by making h random, we can make & constant w.r.t. h or at most ē & (log E[a]) [62. 79J. However, using the simplified setting of mean estimation ($6), we find that even with this improved randomized protocol, there exist scenarios (Fig. 7) where the realistic cost of trying a moderate E[h] = 10 values of À may significantly diminish, or even outweigh, the utility advantage of X over local training and FedAvg- that is, we might be better off by not privately tuning À at all.
The above has several important implications. On the negative side, it suggests that the true efficacy of MR-MTL can be smaller practice. Moreover, raises the broader open question whether the emerging hhttroy cost tradeoff is best balanced by model personalization, as many existing methods including MR-MTL inherently require at least one hyperparameter to specify "how much to personalize" for general utility improvements over local training and FedAvg. Alternatively, the hyperparameter(s) may be estimated during training (approach (3) in the first paragraph), though such procedures may not be general and/or scalable and may need to be tailored to the specific personalization method. On the positive side, it is unclear whether the choice of can meaningfully leak privacy in practice. MR-MTL may also be viewed favorably needs one hyperparameter to attain its benefits, while other existing methods that require more tuning will incur even larger privacy costs from hyperparameter tuning.
strong baseline since it only
8 Concluding Remarks
In this work, we revisit the application of differential privacy in cross-silo FL. We examine silo- specific sample-level DP as more appropriate privacy notion for cross-silo FL, and we point out several meaningful ways in which it differs from client-level DP commonly studied under the cross-device setting, particularly when analyzing tensions between privacy, utility, and heterogeneity, We explore and establish baselines under this privacy setting and identify desirable properties for a personalization method for balancing an emerging tradeoff between utility costs from privacy and heterogeneity. We then analyze simple, promising method (MR-MTL) and discuss key open questions for the area at large. Some future directions include (1) extending the privacy model to cases where data subjects have multiple records across silos, (2) extending our theoretical characterization to deep learning cases or performing a large-scale empirical study, and (3) developing auto-tuning algorithms for personalization hyperparameters with minimal privacy overhead.
Acknowledgements. We thank Scbastian Caldas, Tian Li, Yash Savani, Amrith Setlur, and Peter Kairouz for helpful discussions and feedback and Thomas Steinke for guidance on implementing privacy accounting for hyperparameter tuning [79]. This work was supported in part by the NSF Grants IIS IIS1838017 7 and IIS2145670, a Meta Faculty Award, an Apple Faculty Award, the Intel Private AI Center, and the CONIX Research Center. ZSW was supported part by the NSF Award CNS2120667. Any opinions, findings, and conclusions or recommendations expressed herein are those of the author(s) and do not necessarily reflect the NSF or any other funding agency.
10

---

References
[1] Martin Abadi, Andy Chu, lan Goodfellow, H Brendan McMahan, llya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications securify, pages 308-318, 2016.
[2] The Alzheimer's s Disease Neuroimaging Initiative (ADNI). The alzheimer's discase neuroimaging initiative (adni). Jow..ooc.i.uditt 05 2022. attps://adin sonooonuue .usc.udu/..
[3] Alckh Agarwal, John Langford, and Chen-Y Yu Wei. Federated residual learning. arXiv preprint arXiv:2003. 12880, 2020.
[4] Naman Agarwal, Peter Kairouz, and Ziyu Liu. The skellam mechanism for differentially private federated learning. Advances in Neural Information Processing Systems, 34, 2021.
[5] Mohammad Alaggan, Sébastien Gambs, and Anne-Marie Kermarrec. Heterogeneous differential privacy. Journal of Privacy and Confidentiality. 7(2), 2016.
[6] Nasser Aldaghri, Hessam Mahdavifar, and Ahmad Beirami. Feo2: Federated learning with opt-out differential privacy. In NeurlPS 2021 Workshop on New Frontiers in Federated Learning: Privacy, Fairness, Robustness, Personalizaatin and Data Ownership. 2021.
[7]
Guozhong An. The effects of adding noise during backpropagation training on a generalization perfor- mance. Neural computation, 8(3))643-674 1996.
[8] Galen Andrew, Om Thakkar, Brendan McMahan, and Swaroop Ramaswamy. Diffcrentially private learning with adaptive clipping. Advances in Neurul Information Processing Systems, 34, 2021.
[9] Andreas Argyriou, Theodoros Evgeniou, and Massimiliano Pontil. Convex multi-task feature learning. Machine learning, 73(3):243-272, 2008.
[10] Aviad Barzilai and Koby Crammer. Convex multi talti-taskkk learning by clustering. Artificial Intelligence and Statistics, pages 65-73. PMLR, 2015.
[11] Raef Bassily, Adam Smith, and Abhradeep Thakurta. Private empirical risk minimization: Efficient algorithms and tight error bounds. In IEEE Symposium on Foundations of Computer Science, 2014.
[12) James Bergstra and Yoshua Bengio. Random search for hyper- parameter optimizatoo.. Journal of machine learning research, 13(2), 2012.
[13] Alberto Bietti, Chen- Yu Wei, Miroslav Dudik, John Langford, and Zhiwei Steven Wu. Personalization improves privacy-accuracy tradeoff's in federated optimization. In International Conference on Machine Learning. PMLR, 2022.
[14] James Bradbury, Roy Frostig, Peter Hawkins, Matthew James Johnson, Chris Leary, Dougal Maclaurin, George Necula, Adam Paszke, Jake VanderPlas, Skye Wanderman-Milng and Qiao Zhang. JAX: composable transformations of Python+NumPy programs, 2018
[15] Mark Bun and Thomas Steinke. Concentrated differential privacy: Simplifications, extensions, and lower bounds. In Theory of Cryptography Conference, pages 635 658. Springer, 2016.
[16] Schastian Caldas, Sai Meher Karthik Duddu, Peter Wu, Tian Li, Jakub Konečný, H Brendan McMahan, Virginia Smith, and Ameet Talwalkar. Leaf: A benchmark for federated settings. In NeurlPS 2019 Workshop on Federated Learning for Data Privacy and Confidentiuultyy 2019.
[17] Clément Canonne, Gautam Kamath, and Thomas Steinke. The discrete gaussian for differential privacy. Advances in Neural Information Processing Systems, 33:15676-15688, 2020.
[18] Wei-Ning Chen, Ayfer Ozgur, and Peter Kairouz. The paisson binomial mechanism for unbiased federated learning with secure aggregation. In International Conference on Machine Learning, pages 3490-3506. PMLR, 2022.
[19] Gary Cheng, Karan Chadha, and John Duchi. Fine-tuning fine in federated learning. arXiv preprint arXiv:2108.07311 2021.
[20] Albert Cheu. Differential privacy in the shuffle model: A survey of separations. arXiv preprint arXiv:2 10.100.111883 2021.
[21] Albert Cheu, Adam Smith, Jonathan Ullman. David Zeber, and Maxim Zhilyaev. Distributed differ- ential privacy via shuffling. In Annual International Conference the Theory and Applications of Cryptographic Techniques, pages 375-403. Springer, 2019.
[22] Yae Jee Cho, Jianyu Wang, Tarun Chiruvolu, and Gauri Joshi. Personalized federated learning for heterogencous clients with clustered knowledge transfer. arXiv preprint arXiv:2 0811008/19 2021.
[23] Aakanksha Chowdhery, Sharan Narang, Jacob Devlin, Maarten Bosma, Gaurav Mishra, Adam Roberts, Paul Barham, Hyung Won Chung, Charles Sutton, Sebastian Gehrmann, et al. Palm: Scaling language modeling with pathways. arXiv preprint 2rXiv:2204.023111 2022.

---

[24] Yuyang Deng, Mohammad Mahdi Kamani, and Mehrdad Mahdavi. Adaptive personalized federated learning, arXiv preprint arXiv:2003. 13461, 2020.
[25] Jinshuo Dong, Aaron Roth, and Weijie J. Su. Gaussian differential privacy. Journal of the Royal Statistical Society: Series B (Statistical Methodology), 84(1):3 3000333-72270 2022.
[26] Marco F Duarte and Yu Hen Hu. Vehicle classification in distributed sensor networks. Journal of Parallel and Distributed Computing, 64(7):826-838, 2004.
[27] Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of cryptography conference, pages 265-284. Springer, 2006.
128] Cynthia Dwork, Aaron Roth, et al. The algorithmic foundations of differential privacy. Found. Trends Theor. Comput. Sci., 9(3-4)221 2014.
[29] Úlfar Erlingsson. Vitaly Feldman, Ilya Mironov, Ananth Raghunathan, Kunal Talwar, and Abhradeep Thakurta. Amplification by shuffling: From local to central differential privacy via anonymity. In Proceedings of the Thirtieth Annual ACM-SIAM Symposium on Discrete Algorithms, pages 2468 2479.
SIAM, 2019.
[30] Theodoros Evgeniou and Massimiliano Pontil, Regularized multi-task learning. In Proceedings of the tenth ACM SIGKDD international conference on Knowledge discovery and data mining, pages 109-117 2004.
[31] Alireza Fallah, Aryan Mokhtari, and Asuman Ozdaglar. Personalized federated learning with thcoretical guarantees: A model-agnostic meta-leariing approach. Advances in Neural Information Processing Systems, 33:3557-3566 2020.
[32] Robin C Geyer, Tassilo Klein, and Moin Nabi. Differentially private federated learning: A client level perspective. In NIPS 2017 Workshop: Machine Learning the Phone and other Consumer Devices, 2017.
[33] Avishek Ghosh, Jichan Chung, Dong Yin, and Kannan Ramchandran. An efficient framework for clustered federated Icarning. Advances in Neural Information Processing Systems, 33:19586- 2020.
[34] Antonious Girgis, Deepesh Data, Suhas Diggavi, Peter Kairouz, and Ananda Theertha Suresh. Shuffled model of differential privacy in federated learning. In International Conference on Artificial Intelligence and Statistics, pages 2521-2529. PMLR, 2021.
[35] Harvey Goldstein. Multilevel modelling of survey data. Journal of the Royal Statistical Society. Series D (The Statisticiam), 40(2):235-244, 1991.
[36] Pinghua Gong, Jieping Yc, and Changshui Zhang. Robust multi-task feature learning. In Proceedings of the 18th ACM SIGKDD international conference on Knowledge discovery and data mining, pages 895-903, 2012.
[37] Filip Hanzely, Slavomír Hanzely, Samuel Horváth, and Peter Richtárik. Lower bounds and optimal algorithms for personalized federated learning. Advances in Neural Information Processing Systems, 33:2304-2315, 2020.
[38] Filip Hanzely and Peter Richtárik. Federated learning of a mixture of global and local models. arXiv preprint arXiv:2002.05510 2020.
[39] Charles R. Harris, K. Jarrod Millman, Stéfan J. van der Walt, Ralf Gommers, Pauli Virtanen, David Coumaaeau,, Eric Wieser, Julian Taylor, Schastian Berg, Nathamiel J. Smith, Robert Kern, Matti Picus, Stephan Hoyer, Marten H. van Kerkwijk, Matthew Brett, Allan Haldane, Jaime Fernández del Río, Mark Wiebe, Pcaru Peterson, Pierre Gérard-Marchant, Kevin Sheppard, Tyler Reddy, Warren Weckesser, Hameer Abbasi, Christoph Gohlke, and Travis E. Oliphant. Array programming with NumPy. Nature, 585(7825)357-362,, September 2020.
[40] Kaiming He, Xinlei Chen, Saining Xie, Yanghao Li, Piotr Dollár, and Ross Girshick. Masked autoencoders scalable vision learners. In Proceedings of the IEEE conference on computer vision and pattern recognition, 2022.
[41] Mikko A Heikkilä, Antti Koskela, Kana Shimizu, Samuel Kaski, and Antti Honkela. Differentially private cross-silo federated learning. In Privacy Preserving Machine Learning (PPML) and Privacy in Machine learning (PriML) Joint Workshop at NeurlPS 2020, 2020.
[42] Tom Hennigan, Trevor Cai, Tamara Norman, and Igor Babuschkin. Haiku: Sonnet for JAX, 2020.
[43] Tzu-Ming Harry Hsu, Hang Qi, and Matthw Brown. Measuring the effects of non-identical data distribution for federated visual classification. In Workshop on Federated Learning for Data Privacy and Confidentiality, NeurIPS 2019, 2019.
[44] Shengyuan Hu, Zhiwei Steven Wu, and Virginia Smith, Private multi task learning: Formulation and applications to federated learning. arXiv preprint 12X14:2108.12978, 2021.
12

---

[45] Ali Jalali, Sujay Sanghavi. Chao Ruan, and Pradeep Ravikumar. A dirty model for multi-task learning. Advances in neural information processing systems, 23, 2010.
[46] Yihan Jiang, Jakub Konečný, Keith Rush, and Sreeram Kannan. Improving federated learning personal-
ization via model agnostic meta learning. arXiv preprint arXiv: 00099///488 /2488, 2019.
[47] Zach Jorgensen. Ting Yu, and Graham Cormode. Conservative or liberal? personalized differential privacy. In 2015 IEEE 31St international conference on data engineering, pages 1023-1034. IEFF, 2015.
[48] Peter Kairouz, Ziyu Liu, and Thomas Steinke. The distributed discrete gaussian mechanism federated learning with secure aggregation. In International Conference on Machine Learning, pages 5201-5212. PMLR, 2021.
[49] Peter Kairouz, Brendan McMahan, Shuang Song, Om Thakkar, Abhradeep Thakurta, and Zheng Xu. Practical and private (deep) learning without sampling or shuffling. In International Conference on Machine Learning, pages 5213-5225, PMLR, 2021.
[50] Peter Kairouz, H Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, et al. Advances and open problems in federated learning, Foundations and Trends in Muchine Learning. 14(1-2):1-210, 2021.
[51] Pallika Kanani, Virendra Marathe, Daniel Peterson, Rave Harpaz, and Steve Bright. Private cross-silo federated learning for extracting vaccime adverse event mentions. In Joint European Conference on Machine Learning and Knowledge Discovery in Dutabases, pages 490-505. Springer, 2021.
[52] Sai Praneeth Karimireddy, Satyen Kale, Mehryar Mohri, Sashank Reddi, Sebastian Stich, and Ananda Theertha Suresh. Scaffold: Stochastic controlled averaging for federated learning. In In- ternational Conference Machine Learning, pages 5132-5143. PMLR, 2020.
[53] A Krizhevsky. Learning multiple layers of features from tiny images. Master's thesis, University of Toronto, 2009.
[54] Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient- learning applied to document recognition. Proceedings of the IEEE, 86(1 86(11):2278-2324, 1998.
[55] Daniel Levy, Ziteng Sun, Kareem Amin, Satyen Kale, Alex Kulesza, Mehryar Mohri, and Ananda Theertha Suresh. Learning with user-level privacy. Advances Neural Information Processing Systems, 34, 2021.
[56] Jeffrey Li, Mikhail Khodak, Sebastian Caldas, and Amect Talwalkar. Differentially private meta-lcarning In International Conference on Learning Representations, 2020.
[57] Tian Li, Shengyuan Hu, Ahmad Beirami, and Virginia Smith. Ditto: Fair and robust federated learning through personalization. In International Conference on Machine Learning, pages (357-6368. PMLR, 2021.
[58] Tian Li, Anit Kumar Sahu, Ameet Talwalkar, and Virginia Smith. Federated learning: Challenges. methods, and future directions. IEEE Signal Processing Magazine. 37(3):00-60. 60, 2020.
[59] Tian Li, Anit Kumar Sahu, Manzil Zaheer, Maziar Sanjabi, Ameet Talwalkar, and Virginia Smith. Federated optimization in heterogeneous networks. Proceedingy of Machine Learning and Systems, 2:429-450, 2020.
[60] Xiang Li, Kaixuan Huang, Wenhao Yang, Shusen Wang, and Zhihua Zhang. On the convergence of fedavg on non-iid data. In International Conference on Learning Representations, 2020.
[61] Paul Pu Liang, Terrance Liu, Liu Ziyin, Nicholas B Allen, Randy P Auerbach, David Brent, Ruslan Salakhutdinov, and I Louis-Philippe Morency. Think locally, act globally: Federated learning with local and global representations. In NeurlPS 2019 Workshop Federated Learning, 2020.
[62] Jingeheng Liu and Kunal Talwar. Private selection from private candidates. In Proceedings of the 51st Anmual ACM SIGACT Symposiun on Theory of Computing, pages 298 -00,, 2019.
[63] Junxu Liu, Jian Lou, Li Xiong, Jinfei Liu, and Xiaofeng Meng. Projected federated averaging with heterogeneous differential privacy. In International Conference on Very Large Databases. VLDB Endowment, 2022.
[64] Sulin Liu, Sinno Jialin Pan, and Qirong Ho. Distributed multi-task relationship learning. In Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pages 937-946, 2017.
[65] Zhuang Liu, Hanzi Mao, Chao- Yuan Wu, Christoph Feichtenhofer, Trevor Darrell, and Saining Xie. A convnet for the 2020s. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattrnn Recognition, pages 11976-11986, 2022.
[66] Andrew Lowy and Meisam Razaviyayn. Private federated learning without a trusted server: Optimal algorithms for convex losses. arXiv preprint arXiv:2106.0911 0977799 2021.
13

---

[67] Linpeng Lu and Ning Ding. Multi-party private set intersection in vertical federated learning. In 2020 IEEE 19th International Conference Trust, Security and Privacy in Computing and Communications (TrusiCem)), pages 707-714. IEEE, 2020.
[68] Hessam Mahdavifar, Ahmad Beirami, Behrouz. Touri, and Jeff S Shamma. Global games with noisy information sharing. IEEE Transactions Signal and Information Processing over Networks, 4(3):497- 509, 2017.
[69] Yishay Mansour, Mehryar Mohri, Jac Ro, and Ananda Theertha Suresh. Three approaches for personal- ization with applications to federated learning. arXiv preprint arXiv:2002. 10619, 2020.
[70] Ryan McKenna and Daniel R Sheldon. Permute-and-fiip
new mechanism for differentially private selection, Advances in Neural Information Processing Systems, 33:193-203, 2020.
[71] Brendan McMahan, Eider Moore, Daniel Ramage, Scth Hampson, and Blaise Aguera y Arcas. Communication-cffiiine learning of deep networks from decentralized data. In Artificial intelligence and stattistics, pages 1273-1282. PMLR, 2017.
[72] H Brendan McMahan, Galen Andrew, Ulfar Erlingsson, Steve Chien, Ilya Mironov, Nicolas Papernot, and Peter Kairouz. A general approach to adding differential privacy to iterative training procedures. In NewrlPS 2018 Privacy Preserving Machine Learning Workshop. 2018.
[73] Brendan McMahan, Daniel Ramage, Kunal Talwar, and Li Zhang. Learning differentially private recurrent language models. In International Conference on Learning Representations, 2018.
[74] H. Brendan McMahan, Daniel Ramage, Kunal Talwar, and Li Zhang. Learning differentially private recurrent language models. In International Conference on Learning Representations, 2018.
[75] Frank McSherry and Kunal Talwar. Mechanism design via differential privacy. In 48th Annual IEEE Symposium on Foundations of Computer Science (FOCS 07), pages 94-103, IEEE, 2007.
[76] Frank D MeSherry. Privacy integrated queries: an extensible platform privacy- preserving data analysis. In Proceedings of the 2009 ACM SIGMOD International Conference on Management of data, pages 19-30, 2009.
[77] Ilya Mironov. Rényi differential privacy. In 2017 IEEE 30th computer security foundations symposium (CSF), pages 263-275. JEEE, 2017.
[78] Ilya Mironov, Kunal Talwar, and Li Zhang. Rényi differential privacy of the sampled gaussian mechanism. arXiv preprint arXiv: 10530, 2019.
[79] Nicolas Papernot and Thomas Steinke. Hyperparameter tuning with renyi differential privacy. In International Conference on Learning Representations. 2022.
[80] Venkatadheeraj Pichapati, Ananda Theertha Suresh, Felix X Yu, Sashank J Reddi, and Sanjiv Kumar. Adaclip: Adaptive clipping for private sgd. arXiv preprint 1rXXvv:908.07644 2019.
[81] Liangqiong Qu, Niranjan Balachandar, and Daniel Rubin. An experimental study of data heterogeneity in federated learning methods for medical imaging. arXiv preprini 100.i::2077.0771111 2021.
[82] Shah Atiqur Rahman, Christopher Merek, Yuxiao Huang, and Samantha Kleinberg. Unintrusive cat- ing recognition using google glass. In 2015 9th International Conference on Pervasive Computing Technologies for Healthcare (Pervasivellealthi), pages 108-111. IEEF, 2015.
[83] Swaroop Ramaswamy, Om Thakkar, Rajiv Mathews, Galen Andrew, H Brendan McMahan, and Françoise Beaufays. Training production language models without memorizing user data, arXiv preprint arXiv:2009. 10031, 2020.
[84] Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text-conditional image generation with clip latents. Technical report, OpenAI, 2022.
[85] Sashank Reddi, Zachary Charles, Manzil Zaheer, Zachary Garrett, Keith Rush, Jakub Konečný, Sanjiv Kumar, and Hugh Brendan McMahan. Adaptive federated optimization. In International Conference on Learning Representations, 2021.
[86] F Reith, ME Koran, G Davidzon, and G Zaharchuk. Application of deep learning predict standardized uptake value ratio and amyloid status on 18f-florbetapir pet using adni data. American Journal of Neuroradiology, 41(6))980-988 986, 2020.
[87] Ryan Rogers and Thomas Steinke. A better privacy analysis of the exponential mech- anism. DifferentialPrivacy.oog proonential-mecheene
07 2021. httpss//affferentialppisss
bounded-range/
[88] Thorsteinn Rögnvaldsson. On langevin updating in multilayer perceptrons. Neural computation, 6(5):916- 926, 1994.
[89] Felix Sattler, Robus- Müller, and Wojciech Samek. Clustered federated learning: Model-agnostic distributed multitask optimization under privacy constraints. IEEE transactions on neural networks and learning systems, 32(8):3710-377 2020.
14

---

[90] Aviv Shamsian, Aviv Navon. Ethan Fetaya, and Gal Chechik. Personalized federated learning using hypemetworks. In International Conference on Machine Learning, pages 9489-9502. PMLR, 2021. [91] Virginia Smith, Chao-Kai Chiang, Maziar Sanjabi, and Ameet S Talwalkar. Federated multi-task learning. Advances in neural information processing systems, 30, 2017.
[92] Shuang Song, Kamalika Chaudhuri, and Anand D Sarwate. Stochastic gradient descent with differentially private updates. In JEEE Global Conference on Signal and Information Processing, 2013.
[93] Pranav Subramani, Nicholas Vadivelu, and Gautam Kamath, Enabling fast differentially private sgd via just-in-time compilation and vectorization. Advances in Neural Information Processing Systems, 34, 2021.
[94] Canh T Dinh, Nguyen Tran, and Josh Nguyen. Personalized federated learning with moreau envelopes. Advances in Neural Information Processing Systems, 13:211994-21405, 2020.
[95] Stacey Truex, Nathalie Baracaldo, Ali Anwar, Thomas Steinke, Heiko Ludwig, Rui Zhang, and Yi Zhou. A hybrid approach to privacy-preseriing federated learning. In Proceedings of the 12th ACM workshop on artificial intelligence and security, pages 1-11, 2019.
[96] Akhil Vaid, Suraj K Jaladanki, Jie Xu, Shelly Teng, Arvind Kumar, Samuel Lee, Sulaiman Somani, Ishan Paranjpe, Jessica K De Freitas, Tingyi Wanyan, Kipp W Johnson, Mesude Bicak, Eyal Klang, Young Joon Kwon, Anthony Costa, Shan Zhao, Riccardo Miotto, Alexander W Charney, Erwin Böttinger, Zahi A Fayad, Girish Nadkarni, Fei Wang, and Benjamin S Glicksberg. Federated learning of electronic health records improves mortality prediction in patients hospitalized with covid-19. medRxiv, 2020.
[97] Koen Lennart van der Veen, Ruben Seggers, Peter Bloem, and Giorgio Patrini. Three tools for practical differential privacy. In Privacy Preserving Machine Learning (PPML) Workshop at NeurlPS 2018, 2018.
[98] Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez. Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in neural information processing systems, 30, 2017.
[99] Kangkang Wang, Rajiv Mathews, Chloé Kiddon, Hubert Fichner, Françoise Beaufays, and Daniel Ramage. Federated evaluation of on-device personalization. arXiv preprint arXiv: /9/0. 10252, 2019.
[100] Max Welling and Yee Teh. Bayesian learning via stochastic gradient langevin dynamics. Proceedings of the 28th international conference on machine learning (ICML-I1), pages 68 1-688. Citeseer, 2011.
[101] Yuxin Wen, Jonas Geiping, Liam Fowl, Micah Goldhlum, and Tom Goldstein. Fishing for user data in large-batch federated learning via gradient magnification. arXiv preprint arXiv:2202.00 005800 2022.
[102] Hongxu Yin. Arun Mallya. Arash Vahdat, Jose M Alvarez. Jan Kautz, and Pavlo Molchanov. See through gradients: Image batch recovery via gradinversion. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, pages 16337-16346,, 2021.
[103] Lei Yu, Ling Liu, Calton Pu, Mehmet Emre Gursoy, and Stacey Truex. Differentially private model publishing for deep learning. In 2019 IEEE Symposium on Security and Privacy (SP), pages 332 349.. IEEE, 2019.
[104] Tao Yu, Eugene Bagdasaryan, and Vitaly Shmatikov. Salvaging federated learning by local adaptation. arXiv preprint arXiv:2002.04758 2020.
[105) Sixin Zhang, Anna E Choromanska, and Yann LeCun. Deep learning with elastic averaging sgd. Advances in neural information processing systems, 28, 2015.
[106] Yu Zhang and Qiang Yang. survey on multi-task learning. IEFF Transactions on Knowledge and Data Engineering, 2021.
[107] Han Zhao, Otilia Streteu, Alexander J Smola, and Geoffrey J Gordon. Efficient multitask feature and relationship learning. In Uncertainty in Artificial Intelligence, pages 777-787. PMLR, 2020.
[108] Yue Zhao, Meng Li, Liangzhen Lai, Naveen Suda, Damon Civin, and Vikas Chandra. Federated learning with non-iid data. arXiv preprint arXiv:1806.00
2018
[109] Qinqing Zheng, Shuxiao Chen, Qi Long, and Weijie Su. Federated f-differential privacy. In International Conference on Artificial Intelligence and Statistics, pages 2251-2259. PMLR, 2021.
[110] Jiayu Zhou, Jianhui Chen, and Jieping Ye. Clustered multi-task learning via alternating structure optimization. Advances in neural information processing systems, 24, 2011.
[111] Jiayu Zhou, Jianhui Chen, and Jieping Ye. Malsar: Multi-task learning via structural regularization. Arizona State University, 21:1- 50, 2011.
15

---

Checklist
1. For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope? [Yes]
(b) Did you describe the limitations of your work? [Yes] See Section 7 as well as the
appendix.
(c) Did you discuss any potential negative societal impacts of your work? [Yes] Discussions are provided in the appendix.
(d) Have you read the ethics review guidelines and ensured that your paper conforms to them? [Yes]
2. If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results? [Yes] See Section We also included additional details in the appendix.
(b) Did you include complete proofs of all theoretical results? [Yes] Complete proofs are included the appendix.
3. If you ran experiments...
(a) Did you include the code, data, and instructions needed to reproduce the main experi- mental results (either the supplemental material or as a URL)? [Yes] Code has been open sourced; see details in the appendix.
(b) Did you specify all the training details (e.g.. data splits, hyperparameters, how they were chosen)? [Yes] Details are provided in the appendix.
(c) Did you report error bars (e.g.. with respect to the random seed after running experi- ments multiple times)? [Yes] Most experiments are repeated at least times and Fig. repeated at least 3 times where computing resources permit.
(d) Did you include the total amount of compute and the type of resources used (e.g.. type of GPUs, internal cluster, or cloud provider)? [Yes] Details are provided in the appendix.
4. If you using existing assets (e.g., code, data, models) curating/releasing assets...
(a) If your work uses existing assets, did you cite the creators? [Yes]
(b) Did you mention the license of the assets? [Yes] Details are provided in the appendix.
(c) Did you include any assets either the supplemental material URL? [Yes]
Code has been open sourced; see details in the appendix.
(d) Did you discuss whether and how consent was obtained from people whose data you're using/curating? [N/A]
(c) Did you discuss whether the data you are using/curating contains personally identifiable information or offensive content? [N/A]
5. If you used crowdsourcing conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, applicable? [N/A]
(b) Did you describe any potential participant risks, with links Institutional Review Board (IRB) approvals, if applicable? [N/A]
(c) Did you include the estimated hourly wage paid to participants and the total amount spent on participant compensation? [N/A]
16


Reviews:
[{"review_id": "r0B9lsjVU_k", "reviewer": "Reviewer_7hbo", "summary": "The paper discusses personalization under differential privacy (DP) in federated learning (FL). The key observation in the paper is that with DP, there is a potential trade-off between the amount of federation, that can mitigate DP noise effect, and personalization, which can mitigate problems due to data heterogeneity. The authors then discuss the desiderata for a good personalization approach under DP, and explore the performance of mean-regularized multi-task learning, both theoretically and experimentally.", "questions": "1) Reading the current paper, especially lines 24-28, 35-37, 50-51, 109-110, one could be lead to think that this is the first paper to consider sample or item-level DP in cross-silo FL. Please add cites to relevant papers when introducing the problem to remedy this.\n\n2) Related to the previous point, some existing work is presented in a manner which seems a bit misleading, especially w.r.t. the sample-level vs client-level privacy: both Truex et al. 2019 and Heikkilä et al. 2020 define neighbourhood on a single-sample level, not on client-level (see Def.1, and first paragragh in Sec.3, respectively) as claimed. The secure primitives in these papers help to reduce the effect of DP noise, they do not change the basic DP neighbourhood definition used. I think this points to a misunderstanding in the client-level DP definition (see next questions as well).\n\n3) Line 105: \"Client-level DP canonically defines a shared privacy guarantee for all participants.\" Client-level vs sample-level privacy typically relates to the granularity of the DP guarantee, i.e., to the neighbourhood definition used, not having a joint vs individual DP budgets for each client (and incidentally, by tuning the granularity one can then also easily define the individual level privacy, where a single individual may have one or several samples in one silo, that sits between silo-level and sample-level). There is no problem in enforcing client-level DP with varying privacy budgets for different clients in FL (e.g., just use different amounts of noise for different clients with parameter perturbation).\n\n4) Related to the previous comment, on lines 117-120 you claim that client-level DP requires some trust to the central server. This is simply not true, there is no problem in each client enforcing client-level DP individually (although the model utility could be awful), this is local DP (LDP) on the client-level, and by post-processing immunity and parallel composition the global model will have DP guarantees as well, including against the central server.\n\n5) Again a related point, lines 122-123 \"local training is 'free' under client-level DP.\" I would claim that this depends on the DP mechanism, not on the neighbourhood definition: e.g. using DP-SGD and client-level LDP is a counter-example where local training is not free with client-level DP.\n\n6) Lines 33-34: \"...participation in FL [is] disclosed publicly, nullifying any client-level DP guarantees.\" Also lines 121-123. I do not understand why knowledge of participation in FL training would nullify DP guarantees.\n\n7) Lines 166-169: how do you choose the total number of iterations for the fair comparisons?\n\n8) Lines 175-176: if you do not even try to tune the hyperparameters properly for all methods, why should I believe that the results are not simply due to chance?\n\n### Minor comments:\n\n9) Figure 6: due to the scale, it is next to impossible to see from the figure what happens around eps=1-2 that is usually the most important region. Please fix this (change scale, add additional plot maybe to appendix or something else).\n\n\n10) Lines 86,171: DP-SGD was developed and analysed by Song et al. 2013 and Bassily et al. 2014, while the main contribution of Abadi et al. 2016 was the privacy accounting based on cumulants (moments accountant).\n\n11) DP def. 2.1: the definition of neighbourhood seems a bit strange, since x,x' in mathcal X^n explicitly declares the same dataset size for both, but then you mention addition and removal as well. Which one do you actually use?\n\nReferences:\nAbadi et al 2016: Deep learning with DP.\nBassily et al. 2014: Private empirical risk minimization.\nHeikkilä et al. 2020: DP cross-silo FL.\nSong et al. 2013: Stochastic gradient descent with DP updates.\nTruex et al. 2019: A hybrid approach to privacy-preserving FL.", "limitations": "The paper has a good discussion on some important limitations of the proposed method. There is some separate discussion on the potential negative societal impact in the appendix.\n", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "### Update after the discussions\n\nI raise my score to recommend acceptance. In case the paper is still not accepted, I would give it a higher score in the future if the following are addressed: 1) make further improvements in the main content (e.g. how to choose lambda under DP, run still more experiments to check how robust the current results are, especially are there cases which go against the current understanding), 2) improve writing clarity (see the discussions, give less weight to sample-level DP discussion and more to the utility trade-off results)\n\n### Strenghts\n\n+ The observation about a possible trade-off between mitigating utility loss due to DP noise by federation and mitigating utility loss due to data heterogeneity by personalization is a nice one and, to my knowledge, a novel perspective on the problem.\n+ The theoretical analysis, although under simplifying assumptions, seems to support the argument nicely.\n+ The discussion about the price of addional hyperparameters under DP points to an important problem.\n+ The paper is mostly clearly written and easy to read.\n\n\n### Weaknesses\n\n- There seems to be some possible misunderstandings about (client-level) DP in FL, which leads to a number of strange claims in various parts of the paper (see questions for authors for details).", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "mPKqadLVyHC", "reviewer": "Reviewer_JfCt", "summary": "The paper studies differential privacy (DP) in cross-silo (where participants share different attributes of the same data subjects) federated learning (FL). The authors propose a silo-specific item-level privacy (although it is unclear to me what it means and how it is connected to the methods used to achieve this privacy, see Question section) which is more suitable in cross-silo FL mainly because it can allow different silos (organizations/participants) apply their individual privacy policy (i,e. DP budgets). The paper uses FL personalization methods to achieve this privacy, and empirically finds that MR-MTL (encouraging the mean of each local model's weights to be close to the mean of all local models') lead to the best privacy-utility tradeoff. Then the paper justifies this observation with some theoretical analysis on MR-MTL.", "questions": "My major concern that needs clarifications is about the definition of proposed silo-specific item-level privacy. First, what is meant by \"item\"? From definition 2.1, it seems to mean sample. If so, I strongly recommend the authors to call it \"sample\" instead because the meaning of \"item\" is quite unclear. Furthermore, it would be helpful if the authors can provide a formal DP definition of the silo-specific item-level privacy like the definition 2.1.\n\nMore importantly, if I understand it correctly, the proposed privacy aims to protect data subjects. If that is the goal, shouldn't the privacy guarantee be data-subject-level rather than sample(or so-called item)-level? I find it hard to understand the proposed privacy definition given the motivation of protecting data subjects because what the paper actually protects is samples in each silo rather than the data subjects. Please let me know if I misunderstand anything.\n\nIn addition, if the goal is to protect data subjects, I do not understand why letting each silo adds its own noise, instead of protecting the combined datasets (from all silos), can mitigate the privacy risk since each data subject's full information can only be found in the combined datasets. I would imagine if you want to protect data-subject-level privacy, you would need to operate on the combined dataset. Therefore, it seems to me the proposed solution and privacy definition are disconnected from the motivation of \"concern in-silo data subjects\". Please let me know if I have a high-level misunderstanding.\n\nMinor concerns\n- Define \"local training\"\n- Fig.2, the right figure, explain what is meant by the semi-transparent plot line", "limitations": "In additions to the limitations shown in Section 7, I would suggest the authors to include a discussion on the proposed privacy definition. What might go wrong if practitioners go with this less stringent definition? What are the trade-offs between this definition and other DP definitions in cross-silo FL? Under which real-world scenarios, practitioners would be most likely to benefit from the proposed definition? ", "rating": 4, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strength\n- Topic and problem are important. Privacy concerns in cross-silo FL are indeed different from cross-device FL. The motivation that different silos might want to enforce different privacy policies/budgets is, in my opinion, reasonable, and it is a practical problem in the real-world cross-silo FL deployments\n\nWeaknesses\n- The proposed silo-specific item-level privacy is not clearly defined (see Questions section)\n- There is no novelty in the methodology, the paper only uses existing methods\n- The experiments only include two datasets, and performance difference is not very significant. It is unclear how solid the conclusion that MR-MTL is the best can be hold in general", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "G_dq5I2DaEX", "reviewer": "Reviewer_TNbE", "summary": "This paper considers the roles of privacy and personalization in cross-silo federated learning (FL) setting, which has less explored than in cross-device setting. This paper firstly shows why existing privacy solutions (employing differential privacy) are less appropriate to cross-silo FL with three key properties of silo-specific privacy. Then, it empirically shows that two notable phenomena under silo-specific item-level DP with two extreme baselines, local fine-tuning and federated average, which provides fundamental trade-off among privacy, utility and heterogeneity. It further shows mean-regularized multi-task learning (MR-MTL) is good interpolation between of the two extreme baselines while providing better trade-off between privacy and cross-silo data heteroneneity. Theoretical analysis of the MR-MTL is also included.\n", "questions": "Please explain more detailed reason that MR-MTL outperforms Ditto with a certain level of privacy budget ($epsilon=0.5 in Figure 5)", "limitations": "This paper has no negative societal impact as it studies the privacy protection in collaborative ML training.", "rating": 7, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Overall, even though this paper does not provide new algorithm for cross-silo privacy protection, it raises the new notion of privacy suitable for cross-silo FL, and proposes interesting trade-off among privacy and data heterogeneity by exploring state-of-the-art personalized FL techniques. This paper is organized and written well, and hence it is easy to understand the difference between the notion of privacy in cross-device and cross-silo FL settings; characteristics of cross-silo privacy; and fundamental trade-off between privacy and heterogeneity in cross-silo FL with the strong baseline (MR-MTL). The role of the important hyper-parameter in the MR-MTL is well explored with empirical and theoretical analysis.  ", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "6D3pMlYY4H0", "reviewer": "Reviewer_dzK1", "summary": "This paper proposes a mean-regularized multi-task learning based cross-silo federated learning for privacy and model personalization.\nIn cross-silo federated learning, each silo has different item-level different privacy budget on its local dataset\nThe paper empirically shows that local finetuning fails to achieve the high average silo test accuracy (model personalization) with differential privacy noise after FedAvg steps. \nTo achieve model personalization under data heterogeneity with differnetial privacy, a network is trained with a mean-regularization penalty.\nThis penalty is controlled by the hyperparameter \\lambda, and the authors propose an optimal value of \\lambda in \\mu-strongly convex scenario with theoretical analysis. \n", "questions": "I wonder that the same regularization effect will hold for CIAFR-10/100.", "limitations": "The paper shows an interesting observation in personalized federated learning with guranteeing diffrential privacy. Mean-regularized multi-task learning method has already been used in personalized FL widely, so I think it will be great if the authors prove the lower bounds of convergence in a nonconvex setting.", "rating": 3, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strength\n* The proposed approach for personalized FL with guaranteeing differential privacy is simple\n* The empirical analysis on several simple benchmark datasets is well demonstrated to help readers to understand.\n\nWeakness\n* The paper only provides a theoretical analysis for the convex setting, which may not be directly applied to deep learning scenarios. If it is hard to find the optimal \\lambda for a nonconvex setting, the authors may need to give empirical evaluation at least for CIFAR-10/100.\n* The references [32] in this paper has already analyzed the personalized federated learning with mean-regularization penalty. This paper simply extends this to the case with the concept of differential privacy. For example, the references [26], [32] in this paper proposed personalized FL algorithms with theoretical guarantee in a nonvex setting, and demonstrated the empirical evaluation for harder cases such as CIFAR-10/100. Therefore, the novelty is not enough to satisfy the standard of this venue. \n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ["I don’t know"]}, "extra_text": {}}]

Author rebuttal:

Decision: Accept