FedAvP: Augment Local Data via Shared Policy in Federated Learning
Authors: Minui Hong
Junhyeog Yun
Insu Jeon
Gunhee Kim
Venue: NeurIPS 2024 poster (2024)
Keywords: federated learning
data augmentation
Primary area: machine_vision
TL;DR: we introduce a federated data augmentation algorithm that shares the augmentation policies.

Abstract: Federated Learning (FL) allows multiple clients to collaboratively train models without directly sharing their private data. While various data augmentation techniques have been actively studied in the FL environment, most of these methods share input-level or feature-level data information over communication, posing potential privacy leakage. In response to this challenge, we introduce a federated data augmentation algorithm named FedAvP that shares only the augmentation policies, not the data-related information. 
For data security and efficient policy search, we interpret the policy loss as a meta update loss in standard FL algorithms and utilize the first-order gradient information to further enhance privacy and reduce communication costs. Moreover, we propose a meta-learning method to search for adaptive personalized policies tailored to heterogeneous clients. Our approach outperforms existing best performing augmentation policy search methods and federated data augmentation methods, in the benchmarks for heterogeneous FL.

FedAvP: Augment Local Data via Shared Policy in Federated Learning
Minui Hong" Junhyeog Yun' Insu Jeon Gunhee Kim"
Seoul National University, Seoul, South Korea
(falsmm1133, 1 junhyeog, Csnhe ac. (unnneeeggggneee
[[insuj3on] @gmail
Abstract
Federated Learning (FL) allows multiple clients to collaboratively train models without directly sharing their private data. While various data augmentation tech- niques have been actively studied in the FL environment, most of these methods share input-level or feature-level data information over communication, posing potential privacy leakage. In response to this challenge, we introduce federated data augmentation algorithm named FedAvP that shares only the augmentation poli- cies, not the data-related information. For data security and efficient policy search, we interpret the policy loss as a meta update loss in standard FL algorithms and utilize the first-order gradient information to further enhance privacy and reduce communication costs. Moreover, we propose a meta-learning method to search for adaptive personalized policies tailored to heterogeneous clients. Our approach outperforms existing best performing augmentation policy search methods and federated data augmentation methods, in the benchmarks for heterogeneous FL.
Introduction
Federated Learning (FL) is collaborative learning approach that allows multiple clients learn without sharing their private information 16 central server coordinates the training process across multiple devices and aggregates the locally trained models into global one; thus reducing the communication cost of exchanging raw data and mitigating the risk of privacy leakage associated with data sharing (7).
However, the limited accessibility of data in FL still poses many challenges, such as insufficient training data and local data bias. To address these challenges, there has been growing interest in federated data augmentation techniques [+] They aim to increase the diversity and volume of data available at each client, thereby improving the overall robustness and performance of the federated models. For example, FedMix [8] improves performance and privacy by averaging multiple images to facilitate data mixup among clients. Similarly, FedFA [1] utilizes feature statistics mitigate local data biases, to improve model generalization. Despite their benefits, these methods often apply or feature-level [13 information. Such information sharing poses additional privacy concerns since malicious attackers could potentially reconstruct original data by applying gradient matching loss [14) the additional input and feature information.
the sharing of input-level g 10 12
We propose a novel federated data augmentation algorithm named FedAyP (Augmet Local Data via Shared Policy in Federated Learning), which shares only the augmentation policies during training. Thus, each client does not need to share its own data or data-related information directly but obtains collective knowledge how to augment the dataset at local learning. Previously, AutoAugment [15] utilizes reinforcement learning (RL) to automatically find the optimal data augmentation policy for a target dataset. While AutoAugment requires extensive GPU resources, more efficient and faster policy search has been studied [66 20). However, these methods are not designed for FL environments but
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

they perform policy search for public batch datasets. The data scarcity and heterogeneity in FL could fail these standard policy search frameworks,
To improve the robustness and generalization of model training in the heterogeneous FL setting, we first introduce Federated Meta-Policy Loss (FMPL) specifically designed to compute a gradient of augmentation policy that updates shared data augmentation policy for each client's unique environment. Our approach guides the policy gradient to account for the effects of data augmentation on the unseen local data. The policy gradient utilizes higher-order information; the impact of the data augmentation is estimated by its effect on the validation loss observed after a few gradient descent steps with the initial augmented data. However, computing the direct meta meta-policy gradient in FL requires an additional communication step between the server and clients. To bypass this, we also develop an alternative meta meta-policy search method that utilizes a first-order approximation. We further demonstrate that the adaptive policy search technique can adapt to heterogeneous data distributions among clients in the FL environment.
In the experiments, our FedAvP demonstrates superior performance on CIFAR-10/100 [2]] SVHN (22). and FEMNIST [23] datasets within an FL context, compared to existing federated learning algorithms, including FedAvg (2]. FedProx 44. FedDyn (5), FedExP (6, and federated data augmentation algorithms, including FedGen (9). FedMix [), and FedFA I.] Moreover, to further
leverage the potential performance of these algorithms, we also conducted experiments applying data augmentation techniques such as Rand Rugment [17] and Trivial for comparison. We also evaluate our algorithm in environments where data is non-i.i.d. with heterogeneous clients [5 We further compare the effectiveness of the utility of sharing this policy across clients for searching, in contrast to conducting local policy search.
(24) to these algorithms
Our primary contributions are as follows.
1. We propose FedAvv(Auument Local Data via Shared Policy in Federated Learning) as the first algorithm in federated learning that facilitates shared augmentation policies among clients for federated policy search, to the best of our knowledge.
2. We introduce the federated meta-policy loss for effective policy search, and further propose first-order approximation to this loss to enhance privacy and reduce communication costs.
3. Enabling meta-learning, our algorithm allows for rapid adaptation of a personalized policy by each client, addressing the challenge of highly heterogeneous data distributions among clients in the FL environment.
2 Related Work
Automated Data Augmentation. AutoAugment [15] utilizes RL to find an optimal data augmenta- tion policy for target dataset automatically, FastAA [66 proposes a more efficient search strategy by training small NNs in parallel without iterative training, using the density matching method. RandAugment [17 suggests a simplified search method composed of two hyper-parameters, which find the augmentation policy without a separate search process. TrivialAugment 224 further sim- plifies the algorithm and applies a single augmentation to each image as parameter- free method. Meta/uugeett [19] proposes a sample-awars awwre augmentation policy network to capture the variability of training samples more accurately than previous mataset-based search methods. Deep AutoAug- ment [18] proposes fully automated search method that builds a multi-layer data augmentation pipeline from scratch by stacking augmentation layers. All of these recent data augmentation methods were developed under the assumption that all training data is accessible on a server. This assump- tion is invalid in FL since data privacy is a significant concern and is challenging to tune these algorithms for each of the numerous heterogeneous local datasets. Therefore, our study aims to develop a new data augmentation policy search algorithm that takes into account the distributed FL process while preserving data security. RandAugment [17] and TrivialAugment 24 can be applied simultaneously to many clients in a federated learning environment, so we compared these methods in our experiments.
Federated Data Augmentation. The standard Federated Learning (FL) framework, such as Fe- dAvg 22, typically performs iterative local model updates at each client and a global update at server. Since the clients and server only communicate through the model parameters instead of raw data, it enables secured and decentralized learning 33. Despite its benefits, FL still has challenges

---

such as convergence degradation and model overfitting due to heterogeneity and sparsity among the data caused by the differences in client's 's actions and preferences (25 To address these challenges, federated data augmentation (FDA) employs a data augmentation approach instead of model-centric approach. FedMix [8] applies Mixup [26] to Fl., augmenting data by linear interpolation of two random training examples and their labels. For privacy reasons, FedMix transfers mixup data to the server by averaging multiple images from the local device. In FedGen [2], the server learns a lightweight generator to ensemble user information, which is then broadcasted to users to regulate local training using the learned knowledge. FedFA [ assumes that the data distribution of the clients can be summarized by the statistics of the latent features (i.e., mean and standard deviation). This allows learning local models by regularizing the gradients of the latent representations, weighted by the variances of the feature statisties estimated from the entire client federation. StatMix [I3] sends the mean and standard deviation information of local client images to the server and makes it available for learning for each client. These methods use input-level data (image) averaging or feature-level statistics to prevent direct data transfer. Unlike previous methods, our methodology focuses on transmitting only the policy information optimized for local datasets from each client. ATSPriavacy [27 has demonstrated that searching for transformation policies can also protect against reconstruction attacks in Federated Learning (FL), while preserving performance. We compare our algorithm with this approach in terms of both vulnerability to reconstruction attacks and performance in the experimental section
3 Approach: FedAvP
We introduce FedAvP (Augment Local Data via Shared Policy in Federated Learning). which performs data augmentation search by sharing policies among clients in federated learning (FL) environment. Starting from the problem formulation ($3.1). I) we address the challenges of heterogeneous clients with proposal for adaptive policy search ($3.2 Finally, we extend its applicability through integration with the FedAvg algorithm μ and joint learning ($3.3)
3.1 Problem Formulation
Our approach is based on the idea of centralized FL 77 it is not possible to share personal data neither between the server and clients nor among clients. This is different from traditional automated policy search algorithms, which find the optimal policy in a single batch dataset [15 16 20 19 18
Objective. We begin with the standard FL algorithm, FedAvg [1 aiming to find augmentation policies that minimize given objective function as follows:
K Σ agl (w; DW.) k=1
Model: min Σ agl l (w; tpo (DKai))) Policy: min
Pe
K is the number of clients used to train the global model w. and D3 is the local data of client k. The transformation policy po is used to augment the data denoted by (pp (Dgain) with coefficients ag satisfying Σa, az = 1 and aq 2 O. Assuming client & has n& data samples, og is defined as ag = nh where n = Σ. ng. Under a global policy assumption, all clients share the same ps. Alternatively, if we assume that each client has its own transformation policy local we represent placal = {ploral local ..... Ploaal)
Search Space. We use the augmentation space having sequence of two operations. following the search space from previous studies on automated policy search [17 19). We examine a set of 17 operations in total, including {Identity, ShearX/Y, TranslateX/Y, Rotate, AutoContrast, Equalize, Solarize, Posterize, Contrast, Color, Brightness, Sharpness, RandFlip, RandCutout, RandCrop). Each operation includes a random magnitude, rescaled and uniformly sampled from the normalized interval [0, 1.. Assuming each of the K clients has individual policy, the entire search space consists of K joint distributions, each having size of 17 x 17. For global policy, learn single 17 x 17 dimensional joint distribution corresponding to the two operations. Specifically, Pe has a value in [0, 1] using the sigmoid function on 0. For augmentation sampling, we normalize the policy parameter vector pe whose sum to be one, and sample from a joint distribution with a regularization term e. Operation pairs (opl, op2) are drawn from a mixed distribution:
Po
(opl, ~ (1 - e)
(2)
((o)
172
3

---

Server
Server
Global parameters
Global parameters
Clients
Os
Clients
Local model update
0g-
Bby
Local model policy update
Model aggregation
Model Pullccy aggregaatin
Local policy update
IPA a 10
Wirst
op ....?
80
20gg
wh.
Policy aggregation
82
ot
65
Oove
Triss
0,+
(a) Federated policy optimization using our FMPL
(b) First-order approximation foderated policy opti-
mization
Figure I: Overview of FedAvP. (a) The server sends global model parameters W'g. and policy parame- ters 0g. to clients. Clients train local models with augmented data, and the server aggregates them to compute Wg-+1- Clients update policies on Wgg++1 using validation data, and the server aggregates these policies. (b) Clients update the model and policy parameters via first-order approximation. The server aggregates client updates to form the updated global model gg++1 and policy parameters l g
This sampling strategy utilizes a uniform probability across all operation pairs for balanced exploration and exploitation, as adopted in previous work [9].
3.2 Policy Optimization
To search the policy in differentiable manner, we adopt the concept from meta-learning (28). where a model trained on training data n times by SGD algorithm (n inner steps), followed by validation of one outer step. In our context, training is performed on augmented data, followed by evaluation on validation data (2 19]. However, directly applying this concept of inner and outer steps to FL is quite challenging due to the added complexity of FL., which involves training local models and aggregating them to update the global model.
Since our goal is to optimize the global augmentation policy, we redefine the inner and outer steps from the FL perspective. In standard FL setting, the server sends a global model the clients for each round, which is trained with their local training data. Afterward, the aggregation process occurs on the server to update the global model. We can regard one round of local training and aggregation as one inner step. After rounds, where the global model is updated r times, validating the final updated model on each client can be considered one outer step. We set r 1, meaning validation occurs after each round.
Federated Meta-Policy Loss. In single round of client updates, we first perform local training on each client and aggregate the local models to update the global weights, which are then redistributed the clients for computing the validation loss. Figure (a) illustrates this process. In each round, the initial weight for a client k, denoted wfe is set to the global weight Wg., The local training consists of N iterations, with a batch size B of the training data Digie at each iteration n. A transformation according to the policy Poe: is applied to each data sample. The local loss at iteration n for client is calculated
B E
Local Loss
1
Pa (ww Pog
(Deriio()))
where P/ is the unnormalized probability Pog (op1, op2) for the i-th transformation, when the is the operations (op1, op2). This reweighting strategy is inspired by recent sample reweighting we aggregate the results to obtain the new global weights Wg.+1. which are redistributed the clients for validation loss assessment. At the start of round r, after distributing the global weights Wg. to
sampled transformation 'es 29 19 Following the local updates with the augmentation policy pa*,

---

each participating client, the procedure for the federated meta-policy loss can be summarized as follows:
Each client performs local updates by optimizing their local weights w using the aug- mented data with the local loss in Eq. 43). 'The updated local weights are then aggregated according to Wgg+1 = Σx a-
2. The aggregated global weights Wa-+1 are then sent back to the same clients.
3. The Federated Meta-Policy Loss (FMPL. is computed each client's validation set.
FMPL
E E (Wg++1)
(4)
For this loss, the gradient with respect to the augmentation policy pe is computed using backpropaga- tion. Nonetheless, this approach presents two significant challenges. Firstly, it necessitates access to validation gradient information of other clients, which poses privacy concerns. Secondly, it requires revisiting the same clients for additional updates, thereby doubling the communication overhead.
First-order Approximation. To ensure security by preventing access to other clients' gradients and to reduce communication costs, we derive approximation for the policy gradient with respect to 0 at the local step n of the client by a Taylor expansion, as the following proposition. See Appendix for more details.
Proposition 1. Consider the federated meta-policy loss derived from the updated weight w for client lo at step n using a first-order Taylor expansion:
l paul (w (wg+)) se (w))) + Vy (wg. w
(5)
When computing the policy gradient of the loss with respect to - the first-order gradient approxi- mation is
d( (w
Vl,
(w
(Dr.
OOk Ir
(6)
06
where w -gg. Ir
aug Fw
un lr gark
and ag is a coefficient proportional to the client's s
data size.
In Proposition
Awh Ve, (Dwin) (w is the gradient obtained from the local loss in Eq.
at step n for client k. We calculate the gradient within the same client to prevent gradient leakage across clients. We optimize policy that maximizes the inner product of the gradient obtained from sampling the validation data and the gradient obtained through augmentation using Ppt The validation data not used separately: instead, they replaced by sampling the next batch, inspired by Reptile [30]. Proposition also indicates that policy gradients can be computed concurrently with local updates. We utilize this approach to joint training ($ 3.3). which enables simultancous model and policy training.
Gradient Clipping. From the policy gradient of Eq. 66 it becomes evident that policy search aims to maximize the dot product of the gradients derived from both augmentation and validation data. This approach, however, can introduce bias toward augmentations with larger gradient magnitudes due to the nature of the dot product. Inspired by [8], we mitigate the influence of gradient magnitude
by gradient clipping 332
333 We apply gradient clipping to the gradients from both validation and
augmentation data in Eq.
6 using a regularizer hyperparameter c.
Adaptive Policy Search. Our first-order approximation computes policy gradients at each local update step without aggregation. These gradients are then averaged across all steps for each client to update the policy after single communication round. However, this method can slow the policy search, since only permits one gradient descent update per communication round. Drawing inspiration from meta- meta-learning [28] 30 34], which quickly adapts to various tasks using neural network training, we propose an adaptive policy search. The augmentation policy is represented as vector parameter Pa = sigmoid((;, Oz..... (2s9)). where 02,02..... [2a9] denotes an 17 x 17 joint distribution. We use neural network comprising the following dense layers: one dummy embedding layer, two 100-dim hidden layers, and an output layer shaped to the 17 x 17 distribution
5

---

Algorithm FedAyP: Joint Training
of communication round R, of client N, server policy learning v,, client model learning policy learning rate X, local sleps E, gradient clipping threshold c, regularization term e.
Input:
procedure LOCALUPDATEE(u, 0)
client
Initialize wn ms, f8
for Each local step from
Sample transformations fyo, from Pa.
Initialize the global model parameter wg, and the global policy parameter gg. for I,... R do
Sample batch data Epo,, (D.m) from Dx and Eyen. Compute V Vetpo,
tpon (Dg.n) (w
) using Eq.
w/t w 7V too. (mpiin (wwh)
Sample clients from 1, ..., clients
for l..... K
Sample hatch data Diin from Da
Set wy = Wa- and of = Bgr w., 09 LOCAL.PDAATRRU 0%)
Compute VeDa (w++1) ) at wh+1
H + 0 AAVE (0%) using Proposition | 12 12
W0r+1 Igagu
AO < E0a 0g.)
Set w = - and = 6
0g.+1 <- 0g. + 9/30
Send w and 0 to the server
That is, the local policy updates on each client correspond to the inner steps in the Reptile, while the global policy updates on the server are analogous to the outer steps, detailed in Algorithm We train the policy neural network by increasing the dot-product between policy gradients on each client as follows:
size. We update our policy done in Reptile
30 35
gg = gg. Ti
θ O0B
E
Σ
LR.j
Lk. VLK,o)
j=0 ==0
where T.k.- = /FMPL (ot) is the federated meta-policy loss Eq. computed on the client k's j-th
validation data batch using the global policy parameters 65. <V VL,..) is the dot-product between policy gradients on the client k. See Appendix [opendix[[oor more details. This process enables the policy neural network to learn in a direction that enhances the dot- not-product between the policy gradients of each client, thereby facilitating efficient policy search and enabling personalized policy search. We incorporate this strategy in the joint training in $33 An experiment result regarding this will be conducted in $4
3.3
Joint Training
As done in Autonug,ent, one could employ a pretrained network to perform policy search [6 However, such methods require separate training phase and present complications in FL environments, since training a pretrained network beforehand is cumbersome, and the separate phase disadvantageous for parallel training. Note that we previously adopt an adaptive policy search that can simultaneously train the model and policy search. At each local update step n, the weights w and gradients concurrently update the model and policy by comparing the gradient on validation data at w
18].
Algorithm iillstrrates this joint training of our FedAvP. It begins by initializing the global model parameter Wg. and the policy parameter 0g.. which are then sent to the clients from the server. Each client generates augmented data tpo,, (Dimin) using the policy parameter po., at every step n and updates the model accordingly. Subsequently, the gradient Vl (wi+1) is computed using the newly updated w Following Proposition]] 1 the policy parameter 0%: is updated to maximize the gradient on both validation and augmentation data Vlipy, (DD..) ( This process of model and policy updates is repeated in every local update. Afterwards, the model and policy parameters from each client are aggregated at the server using a'g.
Fast Update One limitation of joint learning is that requires backpropagation for the policy gradient at every step. To reduce the computation load on local clients, the policy can be updated periodically our experiments, we set 7 = 5. See the variant of the algorithm in Appendix A.3 We also reduced the hidden size of
instead of at every local step n, specifically when n. mod T = 0.
the policy neural network to two 25-dimensional hidden layers. In our experiments $4 we will compare the performance of the Fast Update.

---

Dataset
CIFAR-I00 100
CIFAR-10
SVHN
FEMNIST
a 5.0
0.1
5.0
0.1 Test (%)
Method
Test (%)
Test (%)
Test (%)
Test (%)
FedAvg + Default
40.05
37.34
79.76
85.58
80.65
+ RandAugment
47.29
43.60
82.82
84.84
79.40
Augment
46.61
42.16
82.00
83.36
79.01
FedProx + Default
40.57
37.71
80.64
86.79
81.45
RandAugment
45.97
41.39
82.56
85.52
77.11
+ TrivialAugment
46.61
41.81
81.83
84.11
79.67
FedDyn + Default
42.09
38.52
80.36
87.60
80.47
RandAugment 45.70
42.24
82.51
81.47
77.64
+ TrinialAugment
46.83
41.10
82.03
83.41
79.31
FedExP Default
42.76
38.28
80.64
86.66
81.45
+ RandAugment
16.13
12.23
82.86
84.63
79.69
+ TugminlAugment
48.55
42.09
82.51
83.72
80.20
FedGen + Default
42.14
38.27
80.23
86.79
81.86
+ RandAugment
17.11
43.10
81.90
84.39
79.31
TrimialAugment
17.71
40.76
82.58
83.23
77.35
FedMix Default
40.26
38.69
80.99
86.02
81.63
RandAugment
46.69
43.00
83.08
83.44
79.46
+ TrivialAugment
46.64
42.63
81.83
82.34
77.84
FedFA + Default
43.70
41.21
82.61
87.33
81.13
+ RandAugment
48.86
43.44
82.44
81.32
78.71
+ TrivialAugment
47.86
43.45
80.12
78.62
78.96
FedAvP (W/ Local Policy)
49.04
43.86
83.64
87.05
83.94
FedAvP (Fast Update)
49.97
(=0.04)
45.08
(1.0.01)
83.55
(4:0.06)
87.86
(11.53)
84.47
(1.0.006
FedAvP
50.47
(0.03)
45.96
(+0001)
83.
(+0.004)
89.81
(+155
84.27
(+007
Table I: Classification accuracies with different heterogeneity degrees (a = 5.0 and a 0.1) across CIFAR-100/10, SVHN, and FEMNIST datasets. We report results averaged over random seeds with variances for FedAvP (Fast Update) and FedAvP.
4
Experiments
4.1 Experimental setup
Environments. Previous FL studies have demonstrated that the standard algorithms are effective and converged when the data is i.i.d. (3) To evaluate robust performance in non-i.i.d. data, we set up our experimental environment by distributing the CIFAR-10/100 [21] and SVHN [22] datasets with different levels of data heterogeneity among clients. We assign the data to 130 clients based on Dirichlet distribution with different hyperparameters
5..0, 0.1], done in pFL. Bench 25 The smaller a is, the higher the degree of heterogeneity is. Among these clients, only 100 randomly selected clients participate in the training, while the remaining 30 are nominated as out-of-distribnn (OOD) clients. In each communication round, only 10 clients are sampled. We employed a standard CNN model, consistent with those in previous studies [39 [3,441, for the global model. Experiments involving the larger model and OOD clients are provided in Appendix A.2 For the FEMNIST dataset [23), we introduced variability in data size by distributing data based on the Further environments details are provided in Appendix A Our code is available at
writers 88 [1I.
Baselines. For comprehensive evaluation, we compared our method with state-of-the-an federated learning algorithms such as FedAvg (2), FedProx [4. FedDyn [5]. FedExP [6], and federated data augmentation algorithms including FedGen ( FedMix [8) and FedFA [I]] To further explore the potential performance these algorithms, we conducted experiments applying data augmentation techniques such as RandAugment [17] and
[24]. We also compared the results with those using default augmentations (random crops and horizontal flipping). Additionally, for comparison with proposed model, included FedAvP (W/ Local Policy), which trains each

---

+
(a) CIFAR- 100, a = 5.0 (b) CIFAR-100, a SVHH,,
(d) FEMNIST
Figure 2: Visualization of global policies learned in CIFAR-100, SVHN and FEMNIST.
local client without policy aggregation, and FedAvP (Fast Update) which reduces computation load on local clients (Algorithm) 2). Further details baselines are provided in Appendix
4.2 Performance on Non-i..dd Settings
Settings. Table reports the test accuracy, which measures the accuracy the test dataset of the 100 participating clients. The test accuracy is calculated as the weighted average of each client's 's accuracy by the number of data points they have. We compared each baseline with three data augmentations: +Default (random crops and horizontal flipping), +RRnnAuggmn and +TrivialAugment. For FedAvP (W/ Local Policy), each client has its own transformation policy and policy aggregation is removed from our algorithm (Algorithm D. For FedAvP (Fast Update), we used periodic local updates (Algorithm 2 For FedAvP, we used full local updates (Algorithm I
Results. The application of automated data augmentation algorithms such as RandAugment and TrivialAugment within federated learning framework does not consistently enhance performance across all cases. In contrast, our algorithm learned distinct augmentations for each dataset, as depicted in Figure When compared to FedAvP (W/ Local Policy) and FedAvP, notable performance improvements were observed in highly non-i.i.d. scenarios such as a = 0.1 in CIFAR-100 and SVHN. For instance, the standard deviation of local dataset sizes in CIFAR-100 with a 5.0 was relatively small at 19.43, while it was significantly higher at 1 118.00 for CIFAR-100 100 and 533.60 for SVHN with a 0.1, indicating that imbalanced datasets in non-i.i.d. settings pose challenges for training local policies with smaller local datasets. Although FedAvP (Fast Update) experienced some performance declines compared to FedAvP. generally achieved higher performance than baseline methods across most datasets.
4.3 Policy Adaptation on Clients
In our FedAvP, at the beginning of each round, the participating clients receive a global policy from the server, which is then optimized into local policy using each client's local data. That is, this optimization adapts the global policy into a personalized pol- icy the local data of each client. The clients use the personalized policy to train their local model to achieve high performance and to aggregate well with other local models in the server. Figure shows the statistics on the Euclidean distances between the personalized policies of clients participating in each round and the global policy for that round. With a 5.0 CIFAR-100, 100, the data sufficiently i.i.d., and thus the personalized policies of clients tend not to deviate from the global policy. On the other hand, with = 0.1, the deviation from the global policy is initially high but decreases as training progresses, particularly after about 100 rounds. The variance of the Euclidean distances also follows this pattern.
0.6
0.5
5.0
0.1
0.4
0.3
0.2
0.1
0.0
200
400
600
800
1000
Round
Figure 3: Statistics of personalized policies between different
clients CIFAR-100.

---

4.4 Reconstruction Attack
Settings. In collaborative learning systems, has been reported that gradient leakage attacks can occur [14] 42 [3], leveraging gradients to reconstruct the original training data. We conducted these reconstruction attack [I4] experiments evaluate whether our algorithm, which shares policies in federated learning setting, provides enhanced privacy compared to FedGen, FedMix, and FedFA. Specifically, FedGen shares information the generator and label distribution levels, FedMix shares at the input level, and FedFA shares at the feature level.
We included defense algorithm in the performance comparison, ATSPrivacy (27]. Our experiments were conducted on CIFAR- 100 with = 0.1, involving two
Metric
PSNR
Accuracy
Method
Client(S)
Client(L))
Test(%)
FedAvg
10.88
11.36
37.34
clients: Client(L), which had the most train- ing data (895 data points), and Client(S), with the least (156 data points). For AT- SPrivacy, we used policies from (7 that showed the highest accuracy performance. Further experimental details are provided in Appendix I
FedGen
8.86
9.27
38.27
FedMix
10.27
10.48
38.69
FedFA
10.86
11.82
41.21
FedAvP
8.72
9.25
45.96
FedGen label generator
9.21
9.81
38.27
FedMix input FedFA feature FedAvP + policy gradients
11.89
12.40
38.69
12.11
12.87
41.21
Results. The experimental results for the Reconstruction Attack are summarized in Table 2 Lower PSNR values indi- cate that the reconstructed images are less similar to the original data, thereby re- flecting better privacy preservation. Fed- Gen+label+-enerraor utilizes the label distribution of local data and the generative model. Fed- Mix+input and FedFu+fe represent the results of attacks utilizing input level and feature level information, respectively. FedAvP+policy gradients denotes the results of attacks using the policy gradient our algorithm. ATSPrivacy recorded the lowest PSNR values, indicating that makes reconstruction difficult. However, this was coupled with decline in accuracy performance. Despite increases in PSNR for FedGen, FedMix and FedFA, our algorithm's 's use of policy gradients did not elevate PSNR values.
8.77
9.20
45.96
ATSPrivacy (7-4-15)
8.45
8.89
ATSPrivacy (21-13-3,7-4-15)
6.70
6.69
36.42
Table 2: Reconstruction Attack Results
4.5
Computation and Communication Cost
CIFAR- 100 dataset
CIFAR- 100 dataset
Method
Rounds(35%) Time(35%)
Method
Before(MB) Per round(MB)
FedAvg Default
300
1.05 hours
FedAvg
0.00
15.35
FedAvg RandAuugent
300
1.62 hours
FedMix
1.27
15.35
FedAvg TrivialAugment
450
2.17 hours
FedFA
0.00
15.38
FedAvP (Fast Update)
200
1.18 hours
FedAvP (Fast Update)
0.00
15.73
FedAvP
200
4.01 hours
FedAvP
0.00
17.47
Table 3: Computation Time in CIFAR-100
Table 4: Communication costs in CIFAR-100
For computational comparison, we measured the time taken to reach a target accuracy of 35% on the CIFAR- 100 dataset with 0.1. Regarding communication comparison in FedMix, the method involves sending an average image to the server prior to training, which is detailed in the "Before" section of the table. For FedAvP (Fast Update) using small neural networks, although it is higher than these baselines, the increase of 0.38MB from the cost of FedAvg is about 2.48% compared to the gradient transmission cost of the model. See Appendix A.4 for additional results.
5 Conclusion
We proposed novel federated data augmentation method named FedAvP (Augment Local Data via Shared Policy in Federated Learning). It shares the augmentation policies during training rather than preprocessed or encoded data such as the average of data or statisties of features. Direct exposure of personal information constrained, yet clients still benefited from the policies learned and shared

---

across the clients to augment their local data. We also proposed Federated Meta- Meta-Policy Loss (FMPL) and used the first-order gradient information enhance privacy with reduced communication costs. A potential limitation of our algorithm is the introduction of Joint Training. This approach requires consideration when applying our federated data augmentation method to existing federated learning algorithms. Also, our algorithm assumed the use of FedAvg, which does not account for model personalization [44] 45] in the computation of FMPL. Investigating a policy loss that aligns with model personalization algorithms would be interesting.
Acknowledgment
This work was partially supported by Institute of Information & communications Technology Planning & Evaluation (IITP) grant funded by the Korea govermment (MSIT) (No. RS-2021-1121 Artificial Intelligence Graduate School Program (Seoul National University)), by Samsung Advanced Institute of Technology. and Center for Applied Research in Artificial Inteligenne grant funded by Defense Acquisition Program AdministratioonDAAAA) and Agency for Defense Development(ADD) (UD230017TD)
References
[1] Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication-effiee learning of deep networks from decentralized data. In AISTATS, pages 1273-1282. PMLR, 2017.
[2] Jakub Konečný, H Brendan MeMahan, Daniel Ramage, and Peter Richtárik. Federated optimization: Distributed machine learning for on-device intelligence. arXiv preprint arXiv:1610.02577. 2016.
[3] Viraaji Mothukuri, Reza M Parizi, Seyedamin Pouriyeh, Yan Huang, Ali Dehghantanha, and Gautam Srivastava. A survey on security and privacy of federated learning. Future Gener. Comput. Syst., 115:619- 640, 2021.
[4] Tian Li, Anit Kumar Sahu, Manzil Zaheer, Maziar Sanjabi, Amect Talwalkar, and Virginia Smith. Federated optimization in heterogeneous networks. Proceedings of Machine learning and systems, 2:429-450, 2020.
[5] Durmus Alp Emre Acar, Yue Zhao, Ramon Matas, Matthew Mattina, Paul Whatmough, and Venkatesh Saligrama. Federated learning based on dynamic regularization. In International Conference on Learning Representations, 2020.
[6] Divyansh Jhunjhunwala, Shiqiang Wang, and Gauri Joshi. Fedexp: Speeding up federated averaging via extrapolation. In The Eleventh International Conference Learning Representations, 2022.
[7] Sawsan AbdulRahman, Hanine Tout, Hakima Suld-Slimane, Azzam Mourad, Chamseddine Talhi, and Mohsen Guizani. A survey on federated learning: The journey from centralized to distributed on-site learning and beyond. IEEF Internet Things J., 8(7):547-5547,, 2020.
Tehrim Yoon, Sumin Shin, Sung Ju Hwang, and Eunho Yang. Fedmix: Approximation of mixup under mean augmented federated learning. In ICLR, 2020.
Zhuangdi Zhu, Junyuan Hong, and Jiyy Zhou. Data-free knowledge distillation for heterogeneous federated learning. In International conference on machine learning, pages 12878-12889. PMLR, 2021.
[10] MyungJae Shin, Chihoon Hwang. Joongheon Kim, Jihong Park, Mehdi Bennis, and Seong-Lyun Kim. Xor mixup: preseccii data augmentation for one-shot federated learning. arXiv preprint 20Xiv22006.05149 2020.
[11] Tianfci Zhou and Ender Konukoglu. Fedfa: Federated feature augmentation. In ICLR, 2022.
[12] Mohammad Rasouli, Tao Sun, and Ram Rajagopal. Fedgan: Federated generative adversarial networks for distributed data. arXiv preprint arXiv:2006.0777 07228, 2020.
[13] Dominik Lewy, Jacek Mańdziuk, Maria Ganzha, and Marcin Paprzycki. Statmix: Data augmentation method that relies on image statistics in federated learning. In ICONIP, pages 575-585. Springer, 2022.
[14] Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. Advances in neural information processing systems, 32, 2019.
10

---

[15] Ekin D Cubuk, Barret Zoph. Dandelion Mane, Vijay Vasudevan, and Quoc V Le. Autoaugment: Learning augmentation policies from data. arXiv preprint 1rX5v 09501, 2018
[16] Sunghin Lim, Ildoo Kim, Taesup Kim, Chiheon Kim, and Sungwoong Kim. Fast autoaugment. Advances in neural information processing systems, 32, 2019.
[17] Ekin D Cubuk, Barret Zoph, Jonathon Shlens, and Quoc V Le. Randaugment: Practical automated data augmentation with reduced search space. In CVPRW, pages 702-703, 2020.
[18] Yu Zheng. Zhi Zhang, Shen Yan, and Mi Zhang. Deep autoaugment. arXiv preprint arXiv:2203.06172. 2022.
[19] Fengwei Zhou, Jiawei Li, Chuanlong Xie, Fei Chen, Lanqing Hong. Rui Sun, and Zhenguo Li. Mctaaug- ment: Sample-aware data augmentation policy learning. AAAI, volume 35, pages 11097 11105, 2021.
[20] Xinyu Zhang, Qiang Wang. Jian Zhang, and Zhao Zhong. Adversarial autoaugment. arXiv preprint urXiv:1912.11188. 2019.
[21] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
[22] Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y. Ng. Reading Digits in Natural Images with Unsupervised Feature Learning. NIPSW, 2011.
[23] Sebastian Caldas, Sai Meher Karthik Duddu, Peter Wu, Tian Li, Jakub Konecny, H. Brendan McMahan, Virginia Smith, and Amect Talwalkar. LEAF: A Benchmark for Federated Settings. arXiv preprint arXiv: 10X1017812.01097, 2019.
[24] Samuel G Müller and Frank Hutter. Trivialaugment Tuning- free yet state-of-the data augmentation. In ICCV, pages 774 1144-782,77 2021.
[25] Daoyuan Chen, Dawei Gao, Weirui Kuang, Yaliang Li, and Bolin Ding. pfl-bench: A comprehensive benchmark for personalized federated learning. Advances in neural information processing systems. 35:9344-9360, 2022.
[26] Hongyi Zhang, Moustapha Cisse, Yann N Dauphin, and David Lopez-Paz Paz. mixup: Beyond empirical risk minimization. In ICLR, 2018
[27] Wei Gao, Shangwei Guo, Tianwei Zhang, Han Qiu, Yonggang Wen, and Yang Liu. Privacy- pivaecy-reserving collaborative learning with automatic transformation search. In CVPR, pages 1 114-123, 2021.
[28] Chelsea Finn, Pieter Abbeel, and Sergey Levine. Model-agnostic meta-learning for fast adaptation of deep networks. In ICMI., pages 1 1126-11 1135. PMLR, 2017.
[29] Jun Shu, Qi Xie, Lixuan Yi, Qian Zhao, Sanping Zhou, Zongben Xu, and Deyu Meng. Meta deta-weight-net Learning an explicit mapping for sample weighting. Advances neural information processing systems, 32, 2019.
[30] Alex Nichol and John Schulman. ArXiv:1803.0m 1803.08999999 2(3)4, 2018
Reptile: a scalable metalcaming algorithm.
arXiv preprint
[31] Xinyi Wang, Hieu Pham, Paul Michel, Antonios Anastasopoulos Jaime Carbonell, and Graham Neubig. Optimizing data usage via differentiable rewards. In JCML, pages 9983-9995. PMLR, 2020.
[32] Razvan Pascanu, Tomas Mikolov, and Yoshua Bengio. On the difficulty of training recurrent neural networks. In JCML, pages 1310-1318. Pmlr, 2013.
[33] Tomas Mikolov, Anoop Deoras, Stefan Kombrink, Lukas Burget, and Jan Cernocký. Empirical evaluation and combination of advanced language modeling techniques. In Interspeech, number I. pages 605-608, 2011.
[34] Zhenguo Li, Fengwei Zhou, Fei Chen, and Hang Li. Meta-sgd: Learning to learn quickly for few-shot learning. arXiv preprint arXiv: 1707 1707.09855, 2017.
[35] Yihan Jiang, Jakub Konečny, Keith Rush, and Sreeram Kannan. Improving federated learning personaliza- tion via model agnostic meta learning arXiv preprint 1909 /2488, 2019.
[36] Xiang Li, Kaixuan Huang, Wenhao Yang, Shusen Wang, and Zhihua Zhang. On the convergence of FedAvg on Non-IID data. arXiv preprint arXiv: 1907.0089., 2019.
11

---

[37] Peter Kairouz, H Brendan McMahan, Brendan Avent. Aurélien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji. Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, et al. Advances and open problems federated learning. Found. Trends Mach. Learn., 14(1-2):1-210, 2021.
[38] Mohammed Aledhari, Rehma Razzak, Reza M Parizi, and Fahad Saeed. Federated learning: A survey on enabling technologies, protocols, and applications. IEEE Access, 8:140699- 140725, 2020.
[39] Aviv Shamsian, Aviv Navon, Ethan Fetaya, and Gal Chechik. Personalized federated learning using hypernetworks. In International Conference on Machine Learning, pages 9489-9502. PMLR, 2021.
[40] Paul Pu Liang, Terrance Liu, Liu Ziyin, Nicholas B Allen, Randy P Auerbach, David Brent, Ruslan Salakhutdinov, and Louis-Philippe Moreney. Think locally, act globally: Federated learning with local and global representations. arXiv preprint wrXiv:2001.015233 2020.
[41] Jachoon Oh, Sangmook Kim, and Se- Young Yun. Fedbabu: Towards enhanced representation for federated image classification, arXiv preprint vrXiv:2106.06i00 2021.
[42] Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller. Inverting gradients how easy is it break privacy in federated learning? Advances in neural information processing systems, 16337-7616 2020.
[43] Bo Zhao, Konda Reddy Mopuri. and Hakan Bilen. idlg: Improved deep leakage from gradients. arXiv preprint 00:::0001.02100 2020.
[44] Viraj Kulkarni, Milind Kulkarni, and Aniruddha Pant. Survey of personalization techniques for federated learning. In WorldS4, pages 794 794-797. IEEE, 2020.
[45] Alysa Ziying Tan, Han Yu, Lizhen Cui, and Qiang Yang. Towards personalized federated learning. IEEE Trans Neural Netw Learn Syst, 2022.
[46] Takuya Akiba, Shotaro Sano, Toshihiko Yanase, Takeru Ohta, and Masanori Koyama. Optuna: next gext-generation hyperparameter optimization framework. In Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining, pages 2623 2631, 2019.
[47] Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. Pytorch: An imperative style, high-performance deep learning library. Advances in neural information processing systems, 32, 2019.
[48] Terrance Vries and Graham W Taylor. Improved regularization of convolutional neural networks with cutout. arXiv preprint arXiv:1708 /tti:/770.0440 778.04552, 2017.
[49] Diederik P Kingma and Jimmy Ba. Adam: method for stochastic optimization. arXiv preprint 2014.
[50] Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recogni- tion. arXiv preprint arXiv: 14X.:1400..5330 1556, 2014.
[51] Felix Sattler, Simon Wiedemann, Claus-Rohert Müller, and Wojeiech Samek. Robust and communication- efficient federated lcarning from non-iid data. IEEE transactions on neural networks and learning systems, 31(9):3400-3411 2019.
[52] Alexey Dosovitskiy. An image is worth 16x 16 words: Transformers for image recognition at scale, arXiv preprint or Xiv:2010. / 1929, 2020.
[53] Liangqiong Qu. Yuyin Zhou, Paul Pu Liang. Yingda Xia, Feifei Wang. Ehsan Adeli, Li Fei-Fei, and Daniel Rubin. Rethinking architecture design for tackling data heterogeneity in federated learning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10061-10071, 2022.
[54] Jianyu Wang, Qinghua Liu, Hao Liang, Gauri Joshi, and H Vincent Poor. Tackling the objective incon- sistency problem in heterogencous federated optimization. Advances in neural information processing systems, 33:7611-7623, 2020.
[55] Sai Praneeth Karimireddy, Satyen Kale, Mehryar Mohri, Sashank Reddi, Sebastian Stich, and Ananda Theertha Suresh. Scaffold: Stochastic controlled averaging for federated learning. In Inter- national conference on machine learning, pages 5132-5143. PMLR, 2020.
[56] Qinbin Li. Yiqun Diao, Quan Chen, and Bingsheng He. Federated learning on non-iid data silos: An experimental study. In 2022 IEFF 38th international conference on data engineering (ICDE), pages 965-978. IEFF, 2022.
[57] Alex Nichol, Joshua Achiam, and John Schulman. On first-order meta-learning algorithms. arXiv preprint 1803v 02999, 2018
12

---

A Implementation Details
Model Consistent with prior studies, we employed a standard CNN model for all experiments as referenced in [РH The global model consists of three convolutional layers with 64 filters and 3x3 kemels, followed by three fully-connected layers of 256, 128, and the final classification layer. All experiments run cluster of 32 NVIDIA GTX 1080 GPUs.
Datasets To evaluate robust performance in non-i..d. data, we set up our experimental environment by distributing the CIFAR-10/100 (2]) and SVHN (22 datasets with varying levels of data heterogeneity among clients. We allocated the data 130 clients based on Dirichlet distribution with different hyperparameters
of a = [5.0, 0.1], following the procedure in pFI.-Rench 25). The lower the a, the higher the degree of heterogeneity. Among these clients, only 100 were randomly selected to participate in the training. while the remaining 30 were designated as out-of distribution (OOD) clients. For the CIFAR 10FAR10/II 00/000, the number of training rounds R was set 1000. For the FEMNIST, the number of training rounds R was set to 500. For the SVIIN, the number of training rounds R was set 100, 300, and 500, as reported Table The results reported in the main paper, [ are for the 500 round. In each communication round, only 10 clients are sampled, and the remaining 30 clients serve as out-of- of-distribution (OOD) clients.
Hyperparameters For the FedAvP algorithm, the hyperparameters include the server policy learning rate rj client policy learning rate X. gradient clipping threshold c, and regularization term c. In our experimentation. we tuned i within [0.4, 0.9). À within j0.1 ~ 0.9). c within [0.4 ~ L.0). and e within [0.0 ~ 0.5). The validation batch size was also explored within [64, 128, 192). A common hyperparameter across all methods was local epoch set to 5, and local batch is set to 64. The client model learning rate y was searched within the range of [0.1 0.3). This comprehensive parameter optimization was conducted using an optimization tool known as Optund] [46). We utilized both the Tree-structured Parzen Estimator algorithm and Random Sampler as hyperparameter samplers within Optuna. The Adaptive Policy Network was consistently implemented in all experiments with FedAvP, comprising the following dense layers: an embedding layer, two hidden layers with 100 neurons each, and an output layer shaped to the 17 x 17 distribution size. With FedAvP (Fast Update), it comprised the following dense layers: an embedding layer, two hidden layers with 25 neurons each, and an output layer shaped to the 17 x 17 distribution size.
Baselines all baseline experiments, Random Crop and HorizontalFlip were applied as default augmen- tations. For the baseline algorithms' hyperparameter settings, specifically for RandAugment (RA) [17]. we leveraged PyTorch implementation (47). Hyperparameter values were determined in alignment with the procedures described by the authors. For the CIFAR-100 dataset, the hyperparameter M was investigated within the range of [2, 6, 10, 14] and N within [1, 2]. For CIFAR-10, the hyperparameter M was investigated within [4, 5, 7, 9, 11] and N within [2. 3]. For FEMNIST, the hyperparameter M was investigated within [4. 5, 7, 9, 11] and N within [1, 2, 3]. For SVHN, the hyperparameter M was investigated within [5. 7.9. 9, 11] and N within [3]. For TrivialAugment (TA) 24 we utilized the PyTorch library's 's built-in algorithm (47. For RundAngment and TrivialAugment, Random Crop and HorizontaiFlip were applied first, followed by RandCutout 443 As for FedMix 88. the hyperparameter À was investigated within (0.01 0.1]. The client model learning rate y was searched within the range of [0.005 ~ 0.3]. The hyperparameter M used " "All", meaning the average image of all images of each client was used, In the case of FedFA [I], we searched the hyperparameters and o, each within the range of [0.0 ~ 1.0]. The client model learning rate " was searched within the range of [0.005 0.3].
A.1 Reconstruction Attack Details
We performed experiments using reconstruction attacks [4] to assess if our policy-sharing algorithm offers better privacy in federated learning context, in comparison to FedMix [ and FedFA MЛ.. which share data the input and feature levels respectively. Additionally, we conducted experiments to compare our algorithm with FedGen [9) which shares the label distribution of the client's training data and a generative model that produces latent from learned latent feature space over the clients' local training data. Despite our algorithm not being specifically designed as defense against reconstruction attacks, we included ATSPrivacy 27 in our performance evaluation for comparison. ATSPrivacy aims to identify the best policy counter reconstruction attacks by conducting a policy search. Although ATSPrivacy's primary goal isn't 't to enhance performance through policy sharing in collaborative learning environments, we chose it as a baseline because it also involves policy search in the context of collaborative learning. We have described below the attack algorithms that utilize input-level, feature-level, and policy gradient information.
'tttps///ptuna..or/
13

---

A.1.1 Reconstruction Attack using Additional Information
It has been reported that in Collaborative learning systems, Gradient leakage attacks are feasible 14 42 43 These attacks use gradients to reconstruct the training data. We consider scenario with a central server and clients where learning occurs through the exchange of gradients. Assume we have given gradient (W v). then we can optimize for dummy data and label pair (a', ,/', by minimizing the following objective:
x y arg min x'.V'
[V y) VW (x'..)))) .1)1
(8)
where ||- denotes norm distance measure, VW y) is the given gradient, (x. is client's sample data and label, and (a', y') are the targets of optimization. Following [42]. we utilize cosine similarity as a cost function instead of norm distance, like in the case of
y arg min [1 ((VW (w
x'.y''
where {(x, 3) (ac, u) /[|=]]| ||y]
Here, we assume that input-level information available, specifically the image of the client's data Xmeon the FedMix (8). The method for reconstruction attack utilizing input-level information is as follows:
x 1 = arg min [L asspput) (1 E(V v). VW (z'.))))
r'
(10)
+Olippt || Zmean
where Oiinpt is hyperparameter for the additional term, it is fixed at 0.1 in experiments where input-level information is available and to in scenarios without input-level information. Zmean represents the image of the client's data. Cosine similarity was utilized to measure gradient distance, as described in Similarly, in cases where the client provides feature-level information to the server, as in the FedFA 11. this information can also be used to help with reconstruction. The method for reconstruction attack utilizing feature-level information is as follows:
Ø y
arg min
(1 - affaat - Byeat) (1 L(VW (W(d.
x'.6
faat
T n
1*
(11)
+BJeat Es
where n and ø² are the momentum updated feature statisties of layer & the client model, f and oe are the feature statistics of layer & with regard to x', fefe and Breat are hyperparameters for the additional terms fixed at 0.1 and 0.0, respectively.
In the FedGen algorithm, clients transmit the label distribution of their local training data and the generative model. This information allows us improve the cost function for reconstruction, which is formulated as follows:
J' x'.y" arg min (1 O'gen Bgen) (1 ((VW(z, v). (W(x'.
+a |l'l
(12)
+Bgen (1 L(WP(2|z ~ G(y))), W('')).
where G is generative model to generate the latent distribution, W7 refers to the final layer in the client model that takes latent as an input and outputs prediction logits, e is label distribution of the client's local training data, O'gen and geen are hyperparameters for the additional terms fixed at 0.0001 and 0.0001, respectively. Also, we can initialize y' with c.
A.1.2 Reconstruction Attack using Policy Gradient Information
For the FedAvP algorithm, clients send the policy gradient information. Such policy gradient information can also be utilized as term of cost function for reconstruction in the following manner:
y arg min [1
Oppotic))
(1 ((VW v), (W v/)))
(13)
+apolsey (1 L(V AMPL (0), V PMPL
(0)))
where Aipolicy hyperparameter for the additional term fixed at 0.1.
When additional information, such as input-level or feature-level, available in addition to gradient information, it can be utilized, potentially posing a security risk. On the other hand, we have contirmed that even when utilizing the policy gradient information additionally, the reconstruction risk does not increase. The results of the experiments regarding this summarized in Table
14

---

A.1.3 Experimental details
Our reconstruction attack experiments were conducted on CIFAR- 100 with a 0.1, featuring heterogeneous data distribution, Specifically, after 1000 rounds of training, we selected clients for the reconstruction attack. The selection criteria were the client with the most training data (895 data points), Client(I.), and the one with the least (156 data points), Client(S). For both clients, randomly sampled 150 training data points perform the reconstruction attack. all experiments, the batch size and reconstruction step for the reconstruction attack were set to and 2400, respectively. We used the Adam optimizer [49] Gradients obtained from round after 1000 rounds of training were used for the reconstruction attack.
For ATSPrivacy, trained the 6 policies with FedAvg used in the CIFAR-100 dataset of the author's s paper [27].
namely 3-1-7, 43-18-18, (3-1-7, 43-18-18), 18)),818),888 21-13-3, 7-4-15, and (21-13-3, 7-4-15), in the CIFAR-100 with (a 0.1) environment. We performed the reconstruction attack which showed the best accuracy performance. The (21-13-3, 7-4-15) policy is hybrid policy described in the author's s paper 27.. and we applied it by randomly sampling one of the two policies.
policies (7-4-15) and (21-13-3, 7-4-15),
A.2 Additional Results with Larger Model
We conducted experiments on model with more parameters than those used the main experiments. model used these experiments a simplified version of VGG11 [50 ST), where all dropout and batch normalization layers are removed, and the filters and the size of all fully- conneceddd layers are reduced by a factor of 2. This model contains about three times more network parameters than the networks used in the main paper. We verify the performance of our model on non-IlI on-IIID datasets, specifically SVHN-10 communication rounds.
0.1), with different
R
100
R
300
R = 500
Method
Test (%)
OOD (%)
Test (%)
OOD (%)
Test (%)
OOD (%)
FedAvg+Default
76.01
74.18
83.92
82.59
90.38
91.64
FoulAvg-RandAuggment
59.30
53.52
81.04
77.74
89.75
89.96
FedAAgg-TriiaaAAugmentt
44.74
40.79
78.83
75.59
89.51
89.80
FedExP+Default
84.89
84.97
87.17
87.44
90.03
90.72
FedExX4RandAAugmie
74.44
71.87
87.56
85.31
88.20
88.92
TrdEExP*ThivilAAuummen
43.56
40.47
83.26
81.51
88.07
88.68
DedFA+Default
83.19
83.10
88.99
89.45
91.18
92.03
CedFA+-RanAAugment
62.62
63.74
86.77
86.23
90.92
91.97
FedFA++TrivallAuggeen
8.477
10.63
68.42
70.29
86.87
88.00
FedAvP (Fast Update)
86.14
87.24
91.56
92.13
93.85
93.34
Table 5: Classification accuracies with the different communication rounds of R [100, 500, in SVHN dataset with a using the VGG1 Is model.
15

---

A.3 Fast Update Algorithm
To reduce computation for local clients from joint learning, we perform periodic policy updates. specifically when mod 0. In all experiments, we = 5 and reduced the hidden size of the policy neural network to two 25-dimensional hidden layers with FedAvP (Fast Update) algorithm.
Algorithm 2 FedAvP (Fast Update): Joint Training
of communication round R, of client N, server policy learning rate y), client model learning rate 7,, client policy learning rate A, local steps E, gradient clipping threshold c, regularization term e.
Input:
procedure LOCALUPDATTH((,
Initialize wr ws, 0j
for Each local step n from do
Sample transformations fpo, from Po..
Sample batch data fps,, (Dim)) from Dy and tpe..
Initialize the global model parameter Wg. and the global policy parameter gr-
Compute Vltogn (DE.n) y (w using Eq B
w +- M/ VV tye, (DET (w+)
for I,.... R do
Sample clients from 1,..., N clients
if mod O then
for = I,... K do
Sample batch data Di,, from D2
Set wy = Mg. and 0 = Ogr, w 0g LOCALUPDATE(UG. 0g) Wa. Eearut
Compute V (w w
0 + 8% - -AV (0%) using Prop kin
AO + (0 0g.))
Set w = w and = 6
01 fgr m29
Send wb and of to the server
A.4 Additional Results of Computation cost
For additional computational comparisons, we measured the time taken to reach a target accuracy of 40% on the CIFAR-100 dataset with = 5.0 and the time taken to reach a target accuracy of 75% on the CIFAR-10 dataset with a 5.0. In the case CIFAR-100 with a = 5.0, FedAvP (Fast Update) achieved results more than hour faster than FedAvg. Our method generally produced faster results compared to applying RandAugment and TrivialAugment which enhanced the performance of FedAvg in table
CIFAR- 100 (a 5.0)
CIFAR- 10 (a = 5.0) Rounds (75%) Time (75%)
Method
Rounds (40%)
Time (40%)
Method
FedAvg + Default
600
2.90 hours
FedAvg Default
200
0.77 hours
FedAvg RA
300
1.90 hours
FedAvg RA
200
1.35 hours
FedAvg TA
400
2.10 hours
FedAvg TA
350
1.68 hours
FedAvP (Fast Update)
200
1.50 hours
FedAvP (Fast Update)
150
1.08 hours
FedAvP
150
3.39 hours
FedAvP
150
2.00 hours
Table 6: Computation Time in CIFAR-100
Table 7: Computation Time in CIFAR-10
A.5 Ablation Results of Hyperparameters
0.1
0.3
0.4
0.5
Method
Test (%)
Test (%)
Test (%)
Test (%)
FedAvP
83.36
83.38
83.98
83.09
Table 8: CIFAR-10 with 5.0.
16

---

sum
14:8
10.05
Iuop
10.43 FedAvg Client(I.)
(a) FedAvg Client(S)
(c) FedGen Client(S)
(d) FedGen Client(L)
14.40
24.4
1822 (f) FedMix Client(L)
20.00
3035
(c) FedMix Client(S)
3444
14.31
1043
20.2
1221
1400
SART
17:44 (h) FedFA Client(L.)
18:0
13.6
10
AM 200
(g) FedFA Cl
FedAvP- Client(S)
i FedAvP Cliien(())
1243
31.9
10.00
(k) FedGen+label-gemeee gennrrat Client(S)
()) FedGGn=label+ Client(L)
20.14 (m) FedMix+input Client(S)
14:00
TM
Iuee
14.0
(n) FedMix+input Client(L)
(o) FedFA+featrue
Client(S)
(p) Feeatue
Client(LL)
(g) FedAvP+pg
Client(S)
(r) FedAvP+pg
Client(L)
The first row of each result represents the random client's training samples, and the second row is the reconstructed samples by the server. We visualized high-PSNR samples selected from random samples. The numbers below indicate the PSNR values the reconstructed samples.
Figure 4: Results of the reconstruction attacks in Table 2
17

---

1.5
0.5
200
600
(a) CIFAR-100 100 with 5.0
200
400
600
800
1,000
(b) CIFAR- 100 with 0.1
0.4
0.2
200
400
600
800
1,000
(c) CIFAR-10 with 5.0
0.4
100
(d) SVHN with a = 0.1
Figure 5: Training loss convergence of FedAvP algorithm
18

---

A.6
Additional Results of Non-ii.d. Experiments
Dataset
CIFAR 100
CIFAR-10
SVHN
FEMNIST
5.0
0.1
5.0
a 0.1
5.0
O 0.1
Method
Test (%)
Test (%)
Test (%)
Test (%)
Test (%)
Test (%)
Test (%)
FedAvg
Default
40.05
37.34
79.76
72.60
92.78
85.58
80.65
RandAugment
47.29
43.60
82.82
73.73
92.48
84.84
79.40
TugmenlAugment
46.61
42.16
82.00
71.09
91.99
83.36
79.01
FedProx
Default
40.57
37.71
80.64
73.23
93.15
86.79
81.45
RandAugment
45.97
41.39
82.56
73.71
92.33
85.52
77.11
Tugment
46.61
41.81
81.83
70.89
91.67
84.11
79.67
FedDyn
Default
42.09
38.52
80.36
73.86
93.16
87.60
80.47
RandAugment
45.70
42.24
82.51
72.78
92.16
81.47
77.64
TrivialAugment
46.83
41.10
82.03
70.34
92.22
83.41
79.31
FedExP
Default
42.76
38.28
80.64
73.70
92.77
86.66
81.45
Rugment
46.13
42.23
82.86
70.78
92.12
84.63
79.69
TrivialAugment
48.55
42.09
82.51
71.07
92.64
83.72
80.20
FedGen
Default
42.14
38.27
80.23
72.74
92.71
86.79
81.86
RandAugment
17.11
43.10
81.90
73.42
91.84
84.39
79.34
TuiminlAugment
47.71
40.76
82.58
70.87
91.73
83.23
77.35
FedMix
Default
40.26
38.69
80.99
74.54
92.80
86.02
81,63
RandAugment
46.69
43.00
83.08
74.25
92.36
83.44
79.46
TrivialAugment
46.64
42.63
81.83
71.50
91.85
82.34
77.84
FedFA
Default
43.70
41.21
82.61
76.02
92.77
87.33
81.13 13
RandAugment
48.86
43.44
82.44
73.53
91.21
81.32
78.71
TrivialAugment
47.86
43.45
80.12
72.89
91.89
78.62
78.96
FedAvP
Local Policy)
49.04
43.86
83.64 64.64
73.43
94.71
87.05
FedAvP FedAvP
(Fast Update)
49.97
45.08
83.55
77.20
95.14
87.86
84.47
50.47
45.96
83.78
77.10
95.02
89.81
84.27
Table 9: Classification accuracies with different heterogeneity degrees (a 5.0 and a 0.1) across 100RR- SVHN, and FEMNIST datasets.
A.7 The Scalability of FedAvP
Method
Round 100
Round 300
Round 500
FedAvP (Fast Update) 2 layers FedAvP (Fast Update) layers
86.85
87.84
87.86
84.04
89.72
92.07
Table 10: Test accuracy (%) of FedAvP (Fast Update) on SVHN with 0.1 across different rounds and search spaces.
Method
Round 100
Round 300
Round 500
FedAvP (Fast Update) / 2 layers FedAvP (Fast Update) layers
92.76
94.67
95.14
92.73
94.44
95.01
Table 11: Test accuracy (%) of FedAvP (Fast Update) SVHN with and search spaces.
5.0 across different rounds
19

---

A.8 Additional Results with VIT-T
We present additional results using the ViT-T model 52 geneity degrees.
on CIFAR-100 with different hetero-
Method
CIFAR- 100 /
CIFAR-100/ 0.1
FedAvg Default
31.75
30.71
FedAvg + RandAugment
42.39
41.70
FedAvg TrivialAugment
41.58
33.75
FedExp + Default
37.33
35.77
FedExp + Rand/Augent
46.36
45.50
FedExp + Tuimiel
44.37
40.08
FedAvP (Fast Update)
51.10
47.85
Table 12: Test accuracy (%) using VIT-T on CIFAR-100 with 5.0 and a 0.1.
A.8.1
Computation Time of ViT-T on CIFAR-100
Method
Rounds (30%)
Time (30%)
FedAvg Default
400
3.08 hours
FedAvg + Rugment
300
2.18 hours
FedAvg + TuivealAAgment
400
2.63 hours
FedAvP (Fast Update)
220
3.23 hours
Table 13: Computation time and rounds to reach 30% test accuracy on CIFAR-100 with a = 5.0.
Method
Rounds (25%)
Time (25%)
FedAvg + Default
300
4.33 hours
FedAvg + Rand
400
6.02 hours
FedAvg + Trivial/ugment
480
8.27 hours
FedAwP (Fast Update)
260
3.73 hours
Table 14: Computation time and rounds to reach 25% test accuracy on CIFAR-100 with = 0.1.
A.9
Comparison with Other Classic Non-IID Methods
We conducted additional experiments with non-lII algorithms, including FedNova S4
and SCAF.
FOLD [55]
Method
CIFAR-100/
CIFAR-10/0.1
SVHN 0.1
FEMNIST
FedNova Default
38.52
74.45
88.16
81.21
FedNova RandAugment
42.43
74.08
84.42
79.79
FedNova + TrivialAugment
40.23
71.99
82,96
78,92
SCAFFOLD Default
44.94
75.67
87.26
83.17
SCAFFOLD RandAugment
43.57
72.40
77.07
79.31
SCAFFOLD TrivialAugment
42.14
64.12
14.70
78.06
FedAvP (Fast Update) FedAvP
45.08 45.96
77.20
87.86
84.47
77.10
89.81
84.27
Table 15: Test accuracy (%) on various datasets under non-IID settings with 0.1.
20

---

A.10 Additional Results of Non-ii.. Experiments with Equally-Weighted Metric
In the main paper, we followed the weighted accuracy metric as described in the pFL-Bench 25 Here, we provide additional results for non-i.idd experiments using an equally- metric on CIFAR- 1000
Method
CIFAR- SMAAR-100/55 1
CIFAR-100/ / 0.1
FedAvg
Default
40.04
36.98
+ RandAugment
47.30
43.17
Tugmett
46.61
42.04
FedProx
Default
40.56
37.61
+ Rugment
45.95
41.25
Augment
46.59
41.67
FedDyn
+ Default
42.11
38.23
RandAugment
45.68
42.08
Trivial/ugment
46.84
40.92
FedExp
+ Default
42.78
38.22
Rand/uugent
46.14
41.97
Augment
48.54
42.01
FedGen
Default
42.12
38.05
+ RandAngment
47.11
42.96
Augment
47.73
40.62
FedMix
Default
39.59
38.46
+ RandAugment
46.67
42.70
TuimealAugment
46.62
42.49
FedFA
+ Default
43.68
41.18
RandAugment
48.87
43.26
+ Trivial
47.86
43.36
FedAvP
(W/ Local Policy)
49.05
43.64
FedAvP
(Fast Update)
49.94
45.09
FedAvP
50.59
45.93
Table 16: Test accuracy (%) CIFAR-100 with metric.
5.0 and
0.1 using equally-weighted
21

---

A.11 Experiments on Extreme label-skew Settings
The table below presents the results across different datasets and partitioning strategies, specifically the quantity-based label skew settings described in [56]. Here, C' is the number of different labels held by each client. In extreme label skew cases, such as where data labels are highly partitioned, our algorithm shows slightly lower performance on CIFAR-100 (C 1). However, in all other cases, our algorithm demonstrates improved performance.
Method
CIFAR-100
SVHN
C = 3
C'= 2
C= =
C 3
C'= 2
C= 1
FedAvg + Default
27.75
24.55
7.59
89.50
85,34
8.45
FedAvg + RandAugment
25.38
22.94
6.69
85.75
79.05
7.64
FedAvg + Augment
24.36
19.58
4.84
85.35
77.99
7.64
FedProx Default
27.10
24.26
7.51
89.18
85.87
9.39
FedProx + RandAugment
26.10
24.46
5.66
86.19
80.11
7.63
FedProx TrivialAugment
24.15
20.14
3.17
84.73
78.56
8.34
FedDyn + Default
27.84
24.89
7.39
89.59
86.65
14.56
FedDyn + RandAugment
25.80
23.34
1.57
83.64
80.06
9.52
FedDyn+ + TrivialAugment
24.50
19.70
3.81
84.34
79.06
9.40
FedFA Default
27.51
23.23
6,83
89.91
82.94
11.60
FedFA RandAugment
21.58
25.13
3.09
87.97
59.52
11.60
FedFA + TrivialAugment
23.33
20.07
5,58
87.05
68.69
11.87
SCAFFOLD Default
29.75
20.09
1.18
90.07
85,02
9.39
SCAFFOLD + RandAugment
26.56
17.06
1.18
82.57
6.52
14.45
SCAFFOLD TrivialAugment
19.21
12.02
1.17
79.17
6.53
7.64
FedAvP (Local) FedAvP (Fast Update)
27.74
24.35
5.38
91.74
88.74
11.60
31.54
30.96
6.17
92.53
90.13
18.92
Table 17: Test accuracy (%) on CIFAR-100 and SVHN datasets under quantity-based label skew settings. denotes the number of different labels held by each client.
22

---

B Proof of Proposition 1
Consider the federated meta- peta-pooicy loss derived from the updated weight w for client step using a first-order Taylor expansion:
Do Eo (w + Ve (w) (Wg.11 w//
(14)
When calculating the policy gradient of this loss with respect to 0% for client k, the first-order gradient approximation follows:
V(V Dral (w Ve.
) (w 1))
(D
Ohpo lr
(15)
00
where : Wgr
lr
br 9 u
(16)
9
ang Vl Vlingy (Dgin ) (w
(17)
W gr41
Σ axw.
(18)
Proof.
Of (1 00h
Ol (e Ogk n-
A(V. Dr
( wxi)
(Taylor's theorem)
(19)
00h -
First, let's calculate starting from the left term in Eq. 19
pe agh カ-
(20)
Ow
-V (w
(using the chain rule)
(21)
00
O w
Ir
(w)
(using the definition of w in (6)
00k
(22)
ag aug wp
(using Ow
-Ir V (w
= 0)
(23)
30
00
1
-lly
(Dini (wh
(using the definition of aug
9
in 17
00k
(24)
23

---

Next, we calculate the right term in Eq. 19
p (w (W ))
00 R-
Dw
V (1)
O (1 w
(W - wa) + Vl (w)))
00t
Ow
00"
(using the chain rule and (fg)² = l'g 1zg
(25)
= Dy (w a(Wg-11 w
00 n-1
(26)
(treating Vl Di (w constant for first-order)
pu O(ag - wh)
O6
(27)
(using the definition of gg++ in (8))
= (w a((x - 1) w
00
(using the definition of w in 16 and treating I as constant for first-order)
(28)
(ww)))
= =aa= -1-1 1) Ve ( (w
(29)
00
O (w
Ir Yark
= (ak -1) V De (w
00%
(30)
(using the definition of w in (6)
aug 0(-Ir.
(ax - 1). VZ (w
0gh n-
(31)
(using Ow = 0)
0gk
=ll (akk - 1). Vl
VeDro (w))
(32)
d(VE (w+)"
Vlenot
(Dmh (w (w
(Dii
-Ir (ax 1).
00k
(using the definition of g in
(33)
By combining Eq. 24p and Eq.
33
8( p (w)))
(Dean (((
dl pm (Wartz)
top
so -Ock
(34)
00h #-
00k
24

---

C Proof of Adaptive Policy Search
j-1 Lk.j VLk,
0gr gr+s = fg an
Laj
(35)
2 j=0 ==0
where Lx, = AMMPL (0t) represents the the federated meta-policy loss in computed on the client k's
DE,
j-th validation data batch using the global policy parameters 0f received from the server. (V La
V Lk,s) represents the dot-product between policy gradients the client k.
Proof. We refer to the proof of reptile 30 57 and use the following definitions:
0 ar+1 0g. + Σ (0 0g.)
(server policy update rule)
(36)
0h n+ 0% F. (0%)
(client policy update rule)
(37)
In Fr (0%)
(gradient during SGD using Cr. Drrd
(38)
Th = Frr (6%)
(gradient at initial policy 8 = 0g.))
(39)
H &. (ob)
(hessian at initial policy 0 = 0g.)) (initial policy at client)
(40)
0g 9- = B
(41)
6 t +1
(updated policy at client)
(42)
Lx.J AMPL (M)))(B LF,
(abbreviation for FMPL)
(43)
First, let's calculate ott in Eq. 38 to O(23) as follows:
ghh = FF (0%) + 0r (0 06) + O(22)
(Taylor's theorem)
(44)
= -hi + H 00 - 0g) 0
(using the definitions of
39 and (40
(45)
= = S n
0 + 0
(using 0 0 = = Σ
(46)
j=0
n-1 = th I
Σ 3 + 0(2))
(using 9¹ - -Ø +(23))
(47)
j=0
(48)
Then, define the following in (36):
0² = 0gr
Aghnner
(49)
0¹ A
(using the definitions of 41 and 442
(50)
ginnrr
Σ Cr (0
(using 0 = 0 A
E (0*))
(51)
1=0
==0
9
(using the definition of Cr, (8) in 38
==0
(52)
n
f (8t)
ΣΣ
t2 (0+) FT (0%)
(using the definition of g in 47
(53)
0=
j=0
25

---

By combining Eq. 36) and Eq. 449
and taking the expectation over the clients and local updates,
0g 9-+1 = 0g. + 1 Aonnerl
(54)
0gr 1
Cr (0))
E3 (05)
(using Eq. (53))
==
j=0
(55)
3. AB
F (0%)
f (00) (0)) + Cr (00) f/ (0)))
(56)
2
j= xm00
A
V VLK.N)
g-
Lk.j
(using Eq.
(43
2
1=0
1=0 s=0
(57)
26

---

NeurIPS Paper Checklist
Do not remove the checklist: The papers not including the checklist will be desk rejected.
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
We stated the paper's contributions and scope in Section
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results
be expected to generalize to other settings. It is fine to include aspirational goals as motivation long it is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
We stated the paper's 's limitations in Section
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors encouraged to create separate "Limitations" section in their paper.
The paper should point any strong assumptions and how robust the results are violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-text system might not be used reliably provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
27

---

Answer:
[Yes]
Justification:
We provided the paper's proof in appendix B and
C
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proof's can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided not)?
Question:
Answer: [Yes]
Justification: We provide algorithms including Appendix A
and 2 and their experimental settings in
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, descríbing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e-g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing verifying the results.
5. Open access to data and code
28

---

Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes)
Justification:
We provide the code for our paper and its instructions zip file.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips... cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
/ "cippscc/puullc//uuu /tto://uuuddeeoooouuuubmmiibia ssionPolicy) for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (c.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification:
We provide detailed experimental settings Appendix
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification:
We provided our algorithm's accuracies with their variances in Table T
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)

---

The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
OK to report 1-sigma error bars, but one should state The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative eтror rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
We provided computation time and communication cost in 4 and
A
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g.. preliminary or failed experiments that didn't make into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics httpp:///aarrps...cppoppp//ettee
Answer: [Yes]
Justification: Our research proposes a federated data augmentation method, is non-harmful, and complies with the Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.
The authors should make to preserve anonymity (e.g.. if there special consid- eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: Our research proposes a federated data augmentation method that does not have negative impacts on society.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
30

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Question:
Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, scraped datasets)?
Answer: [NA]
Justification: Our research proposes a federated data augmentation method that does not have high risk for misuse.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g.. code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification:
We have cited all the assets used in the paper.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the Datasets.paaersstt
package should be provided. For popular datasets, paperswi thcode. cow/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
31

---

If this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: paper does not release assets.
Guidelines:
The answer NA means that the paper does not release new assets,
Researchers should communicate the details of the dataset/code/moodl as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: our paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According the NeurIPS Code of Ethies, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: our paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
32


Reviews:
[{"review_id": "NjPWzONgyW", "reviewer": "Reviewer_zQTG", "summary": "This paper proposes FedAvP, which performs data augmentation search by sharing policies among clients in a federated learning (FL) environment. They introduce federated meta-policy loss and utilize the first-order gradient information to further enhance privacy and reduce communication costs. The proposed algorithm allows for rapid adaptation of a personalized policy by each client, relieving the challenge of non-iid.", "questions": "1. Regarding W2, could you please add more intuitive explanations of the shared policy strategy?\n\n2. Regarding W3, could you please explain what is the advantage of the reweighting in Eq.(3)?", "limitations": "The authors provide discussions on the limitations of the work in Sections 5.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. This paper proposes a novel federated data augmentation algorithm that shares only the augmentation policies during training. It allows to augment the data without revealing data privacy. \n\n2. Although FedAvP will introduce some additional computation and communication costs, they introduce various techniques to overcome like first-order approximation and fast update.\n\n3. The experiments are well done, and there were experimental data for all possible judging criteria. My concern is that the number of datasets is somewhat limited.\n\n4. This paper is logically clear, and describes the possible problems and solutions one by one, which is easy to understand.", "weaknesses": "1. If the focus of this paper is on addressing non-iid using data augmentation, then the baselines used for comparisons are actually lacking. Classic methods for addressing non-iid, such as FedNova and Scaffold, have not been compared.\n2. Additionally, to address the non-iid problem, it would be helpful to have some more vivid and intuitive explanations of why the shared policy can alleviate the non-iid issue.\n3. One weakness affecting readability is that when the article references some inspired works to address certain issues, it opts for direct citations without more detailed explanations, such as gradient clipping and the reweighting in Eq. (3).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**W1. Comparison with other classic non-IID methods, such as FedNova and Scaffold.**\n\nIn Table 1 of the manuscript, we compare our model with baselines, including state-of-the-art federated learning and federated data augmentation algorithms. As the review suggested, we conducted an additional experiment with non-IID algorithms, including FedNova [1] and Scaffold [2].\n\n|Dataset / heterogeneity degree α|CIFAR100/0.1|CIFAR10/0.1|SVHN/0.1|FEMNIST|\n|-|-|-|-|-|\n|FedNova + Default        |38.52|74.45|88.16|81.21|\n|FedNova + RandAugment    |42.43|74.08|84.42|79.79|\n|FedNova + TrivialAugment |40.23|71.99|82.96|78.92|\n|Scaffold + Default       |44.94|75.67|87.26|83.17|\n|Scaffold + RandAugment   |43.57|72.4|77.07|79.31|\n|Scaffold + TrivialAugment|42.14|64.12|14.70|78.06|\n|FedAvP(Fast Update)             |45.08|**77.2**|87.86|**84.47**|\n|FedAvP                   | **45.96**|77.1|**89.81**|84.27|\n\n\"Default\" refers to the default augmentation, which applies Random Crop and Horizontal Flip. Both the FedNova and Scaffold algorithms were tested with default augmentation, as well as with RandAugment and TrivialAugment. FedAvP (Fast Update) was trained using the Fast Update method described in Section 3.3 of the paper. We examined the performance under diverse heterogeneity conditions on highly non-IID environments using CIFAR100, CIFAR10, SVHN, and FEMNIST datasets. Our FedAvP method outperformed across all tested scenarios.\n\n\n\n**W2. Why the shared policy can alleviate the non-iid?**\n\nWhen the client's data distribution follows non-i.i.d. in federated learning, local models are trained on the different data distributions, which can lead to poor global model aggregation due to distribution shifts. However, our shared data-augmentation policy and meta-policy search strategy can generate additional data samples that help balance the data across clients, thereby reducing the disparity and scarcity in data distributions and improving model convergence and accuracy. As shown in Figure 1(a), under the 'local policy update,' our algorithm updates the augmentation policy so that the aggregated model performs well across the various local data distributions (non-iid, pre-augmentation).\n\n**W3. The detailed explanations of gradient clipping and reweighting**\n\nWe sincerely thank the reviewer for the suggestion regarding the improvement of the readability of our paper. Gradient clipping [3,4] is performed using the method $g \\leftarrow \\frac{c}{||g||}$ when $||g|| > c$, and it is applied to the gradients of $D_{k}^{val}$ and $D_{k,n-1}^{train}$ in Eq. (6). Reweighting [5,6] is performed using the sigmoid output of the neural network $P_{\\theta}$ in Eq. (3). Specifically, when the search space is a 17x17-dimensional neural network output $P_{\\theta}$, each dimension $P_{\\theta}(1), ..., P_{\\theta}(17 \\times 17)$ corresponds to a two-operations augmentation, where a higher value indicates a higher probability of selecting that augmentation. During training, when there is a batch size of $B$, $B$ samples are drawn from a multinomial distribution based on the value of $P_{\\theta}$, resulting in $P_{\\theta}^1,..., P_{\\theta}^B$. Here, each $P_{\\theta}^i$ corresponds to one of the 17x17 neural network output dimensions.\nFor each data sample, two-operations augmentation is applied based on $P_{\\theta}^i$, and the weight of the augmented data sample is determined by the corresponding $P_{\\theta}^i$. We will include this explanation in the Appendix.\n\n**Q1.**\n\nPlease refer to our response to W2.\n\n**Q2. The advantage of the reweighting in Eq.(3).**\n\nWe applied the corresponding two-operations to each data sample in the batch using the 17x17-dimensional neural network output, where the weight of the augmented sample was determined by $P_{\\theta}^i$.  After training the local model, our policy loss tries to improve the performance on the validation data.\nIn this process, two-operations that hinder the performance on the validation data are updated through backpropagation using the weight $P_{\\theta}^i$, causing the weight $P_{\\theta}^i$ to decrease.\n\nOur Federated Meta-policy (FMPL) approach updates a shared data augmentation policy for each client’s unique environment to mitigate data heterogeneity. The sampling operation is non-differentiable in the typical data-augmentation approach. However, the reweighting approach in Eq.(3) enables differentiation, which is a key advantage.\n\n\n[1] Wang, Jianyu, et al. “Tackling the objective inconsistency problem in heterogeneous federated optimization.” NeurIPS, 2020.\n\n[2] Karimireddy, Sai Praneeth, et al. “Scaffold: Stochastic controlled averaging for federated learning.” ICML, 2020.\n\n[3] Pascanu, Razvan, et al. “On the difficulty of training recurrent neural networks.” ICML, 2013.\n\n[4] Mikolov, Tomas, et al. “Empirical evaluation and combination of advanced language modeling techniques.” Interspeech, 2011.\n\n[5] Shu, Jun, et al. “Meta-weight-net: Learning an explicit mapping for sample weighting.” NeurIPS, 2019.\n\n[6] Zhou, Fengwei, et al. “Metaaugment: Sample-aware data augmentation policy learning.” AAAI, 2021.\n\n[7] Li, Qinbin, et al. “Federated learning on non-iid data silos: An experimental study.” ICDE. IEEE, 2022.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "XJFeXdOBSt", "reviewer": "Reviewer_WeMd", "summary": "The paper introduces a novel federated data augmentation algorithm, FedAvP, designed for data augmentation of the client-side without the need to share client data information. Specifically, the authors propose a meta-learning method that allows multiple clients to collaboratively learn data augmentation policies and design a Federated Meta-Policy Loss (FMPL) for the optimization of data augmentation policies. Moreover, to prevent the gradient updates of the data augmentation policies from leaking local data privacy, they propose using first-order approximation optimization to protect privacy and reduce communication costs. Finally, the authors conducted experiments in different data heterogeneity scenarios across multiple datasets to validate the effectiveness of the method.", "questions": "1. Why were the performance experiments on the Cifar-10, SVHN, and FEMNIST datasets only conducted in one scenario?\n2. The gradient calculation of the policy loss introduces significant additional overhead. Could this be a hindrance to applying this method to larger visual pre-training models like ViT?", "limitations": "The method proposed in the paper seems to be applicable only for federated training of small-scale visual models. Its performance on tasks involving text, speech, or multi-modalities and larger-scale models still needs to be further validated.", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1) The paper innovatively applies the method of automatic data augmentation using policy loss to the federated learning scenario, to mitigate the data heterogeneity issues faced by federated learning.\n2) The paper provides theoretical proof for the proposed method, and validates its effectiveness through performance experiments, privacy protection experiments, and cost experiments.\n3) The paper is logically coherent and well-organized.\n4) The method of multiple clients collaboratively learning automatic data augmentation policies may provide new research ideas for dealing with data heterogeneity issues in federated learning.", "weaknesses": "1) The augmentation policy search method in the paper only supports image data augmentation and includes only two types of augmentation methods. Moreover, as the number of augmentation methods increases, the search space will grow exponentially. The authors should analyze the scalability of FedAvP in this regard.\n2) The paper lacks comparisons with the latest federated data augmentation methods, and there are few non-iid scenarios involved in the performance experiments, with only one scenario on some datasets.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**W1. The scalability of FedAvP**\n\nWhen using two operations, the neural network output $P_{\\theta}$ in the paper has a 17x17 dimension, represented as $P_{\\theta}(1), ..., P_{\\theta}(17 \\times 17)$. From this output, we sample $P_{\\theta}^{1}, ..., P_{\\theta}^{B}$ based on the batch size $B$ and apply the augmentation. Since the augmentation sampling is performed from the output $P_{\\theta}$ obtained through a single forward pass, even if the search space expands to 17x17x17 for three operations, the computational load of FedAvP does not increase exponentially due to only requiring one forward pass of the neural network.\nTo assess whether our algorithm can effectively search within this expanded search space, we conducted the following experiment.\nWe extend the layers in FedAvP to experiment with 17x17x17 possible combinations of three operations on the SVHN dataset under different heterogeneity conditions, with $\\alpha = 5.0$  and $\\alpha = 0.1$. The results, recorded as test accuracy per training round, are presented below.\n\n|SVHN / α=0.1|Test(%) at Round 100|Test(%) at Round 300|Test(%) at Round 500|\n|-|-|-|-|\n|FedAvP (Fast Update) / 2 layers|86.85|87.84|87.86|\n|FedAvP (Fast Update) / 3 layers|84.04|89.72|92.07|\n\n|SVHN / α = 5.0|Test(%) at Round 100|Test(%) at Round 300|Test(%) at Round 500|\n|-|-|-|-|\n|FedAvP (Fast Update) / 2 layers|92.76|94.67|95.14|\n|FedAvP (Fast Update) / 3 layers|92.73|94.44|95.01|\n\nTable: Test accuracies with different search spaces on the SVHN dataset.\n\nAs shown in the table, despite the 17-fold increase in the search space when using three layers on the SVHN/0.1 dataset, FedAvP’s performance significantly improved compared to the two-layer setup reported in the main table of the paper. This demonstrates that FedAvP can effectively search the expanded search space. On the SVHN/5.0 dataset, the performance remained consistent with that of the two-layer setup. We observed that even with a 17-fold increase in the search space due to the use of three layers, FedAvP effectively searches for policies that either improve performance or maintain consistent results, depending on the data distribution.\n\n**W2. More experimental results of non-IID scenarios**\n\nWe conducted additional experiments on CIFAR-10/0.1 and SVHN/5.0, which were not included in the previous paper version. The alpha in FEMNIST is not further explored due to the absence of an adjustable heterogeneity parameter. The results are provided in the official comment.\n\n**Q1.**\n\nThis question is related to W2. We conducted additional experiments in non-IID environments. For a detailed explanation, we kindly ask you to refer to our response to W2. Additionally, please refer to our response to Reviewer 866Z W1, which addresses quantity-based label skew settings[7], where labels are highly partitioned.\n\n**Q2. The application of our methods to larger visual model like ViT**\n\nWe reported the performance of a larger model, specifically the VGG11-s model with approximately 3x more parameters in Appendix A.2. To further investigate, we conduct experiments using the ViT-T model[1,2] on the CIFAR100/5.0 and CIFAR100/0.1, and the results are presented below.\n\n|ViT-T model|CIFAR100/5.0|CIFAR100/0.1 |\n|-|-|-|\n| FedAvg + Default       |31.75|30.71|\n| FedAvg + RandAugment   |42.39|41.7 |\n| FedAvg + TrivialAugment|41.58|33.75|\n| FedExp + Default       |37.33|35.77|\n| FedExp + RandAugment   |46.36|45.5 |\n| FedExp + TrivialAugment|44.37|40.08|\n| FedAvP (Fast Update)   |**51.1**|**47.85**|\n\nIn the table, \"Default\" refers to the default augmentation, which applies Random Crop and Horizontal Flip. Both the FedAvg and FedExp algorithms were tested with default augmentation, as well as with RandAugment and TrivialAugment. FedAvP (Fast Update) was trained using the Fast Update method described in Section 3.3 of the paper. Our algorithm demonstrates improved performance over the CNN-based models reported in the original paper. For baseline algorithms, we observe overfitting due to the increased size of model parameters.\n\nWe also compare the computation time on the client side needed to reach the target accuracy, similar to the methods reported in the paper. The results are as follows.\n\n| Computation Time of the ViT-T on CIFAR-100/5.0 | Rounds(30%) | Time(30%)    |\n|-|-|-|\n| FedAvg + Default       |400|3.08 hours|\n| FedAvg + RandAugment   |300|2.18 hours|\n| FedAvg + TrivialAugment|400|2.63 hours|\n| FedAvP (Fast Update)   |220|3.23 hours|\n\n| Computation Time of the ViT-T on CIFAR-100/0.1 | Rounds(25%) | Time(25%)    |\n|-|-|-|\n| FedAvg + Default       |300|4.33 hours|\n| FedAvg + RandAugment   |400|6.02 hours|\n| FedAvg + TrivialAugment|480|8.27 hours|\n| FedAvP (Fast Update)   |260|3.73 hours|\n\nIn the first CIFAR-100/5.0 table, we recorded the number of rounds and computation time required for the global model to reach a target accuracy of 30% when trained with ViT-T model. In the CIFAR-100/0.1 table, we recorded the rounds and computation time needed to reach a target accuracy of 25%. We compared the FedAvP (Fast Update) to the FedAvg with each of the Default Augmentation, RandAugment, and TrivialAugment applied, as explained above.\nCompared to the FedAvg, FedAvP (Fast Update) takes slightly longer on the CIFAR-100/5.0 dataset. However, on the CIFAR-100/0.1 dataset, FedAvP (Fast Update) actually achieves faster learning with the ViT-T model. Overall, applying our algorithm to the ViT-T model does not result in a significant increase in computation time.\n\n[1] Dosovitskiy, Alexey, et al. \"An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale.\" ICLR, 2021.\n\n[2] Qu, Liangqiong, et al. \"Rethinking architecture design for tackling data heterogeneity in federated learning.\" CVPR, 2022.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "VOKU81Ah9a", "reviewer": "Reviewer_1shA", "summary": "This paper points out that the shared input-level and feature-level information poses potential privacy leakage. FedAvP only shares the augmentation policy which is not related to the data. This method leverages the first-order information as a replacement to reduce privacy leakage and communication costs. Comprehensive experiments demonstrate the efficacy and efficiency of FedAvp.", "questions": "- As FedAvp is also a learning policy for augmentation strategy. So whats the performance of FedAvg+AutoAugment which is also an automation policy?\n- What is the meaning of OOD client is not mentioned.\n- This paper claims that the reported accuracy is calculated as the weighted average of each client’s accuracy by the number of data points they have. However, most of the methods report the accuracy of global model. How the test dataset is partitioned of each client?", "limitations": "See weakness.", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "- Empirical evidence shows that the proposed method is effective in enhancing model performance.\n- This method avoids the privacy leakage of the information-sharing strategy.\n- This method can be deployed on different methods.", "weaknesses": "- The writing of this paper should be improved to express ideas clearly.\n- A deeper analysis is needed to reveal why different $\\alpha$ learn different augmentation methods under the same data as depicted in Figure 1. There is also no in-depth insight about how the different augmentation influences the performance in different FL setting", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**W1. Improvement to the explanation**\n\nThank you for your valuable suggestion to improve our paper. In response, we will provide more detailed explanations to address your points, including the effect of different heterogeneity levels $\\alpha$, an additional baseline, the meaning of OOD (Out-of-distribution), and the weighted average metric.\n\n\n**W2. Why does different alpha learn different augmentations?**\n\nThe alpha controls the degree of data heterogeneity among clients. As the value of alpha decreases, the degree of heterogeneity increases. As the heterogeneity increases, the distribution of labels among the clients becomes more uneven, resulting in the model in each client trained from vastly different distributions even when the same dataset is used. This explains why the optimal augmentations learned by our algorithm vary with the changes in alpha. We will include figures of the dataset distributions in the appendix to further aid readers' understanding.\n\n**Q1. The performance of FedAvg + AutoAugment**\n\nThe AutoAugment paper proposes a method where multiple child networks based on a controller RNN are trained through reinforcement learning. This approach was not developed with FL in consideration, where data privacy is essential. Therefore, applying AutoAugment directly to FL is challenging without further development. The original AutoAugment also requires significant computational resources, as the paper reports 5000 GPU hours for CIFAR-10 and 100 GPU hours for SVHN, making it impractical for FL environments regarding computation time and communication costs.\n\nTo facilitate comparison, we applied the “pre-trained” augmentation policies reported in AutoAugment to the FedAvg algorithm. We used the CIFAR-10 and SVHN AutoAugment policies from the paper and compared the results. For CIFAR-100, we used the augmentation policy trained on CIFAR-10, as done in AutoAugment. The “Default” augmentation refers to using Random Crop and Horizontal Flip. As shown in the following table, our algorithm FedAVP shows superior performance across various heterogeneity settings for CIFAR-100, CIFAR-10, and SVHN.\n\n| Main Table               | CIFAR100/5.0 | CIFAR100/0.1 | CIFAR10/5.0 | CIFAR10/0.1 | SVHN/5.0 | SVHN/0.1 |\n|--------------------------|--------------|--------------|-------------|-------------|----------|----------|\n| FedAvg + Default         | 40.06        | 37.34        | 79.76       | 72.6        | 92.78    | 85.58    |\n| FedAvg + AutoAugment     | 47.74        | 43.45        | 81.92       | 72.12       | 92.65    | 87.02    |\n| FedAvP (Fast Update)     | 49.97        | 45.08        | 83.55       | **77.2**    | **95.14**| 87.86    |\n| FedAvP                   | **50.47**    | **45.96**    | **83.78**   | 77.1        | 95.02    | **89.81**|\n\n**Q2. The meaning of OOD client**\n\nThe OOD client stands for the out-of-distribution (OOD) client, which refers to the one that does not participate in training but is used to evaluate the global model’s performance during the test. Evaluating OOD clients allows us to determine how well the FL model generalizes to new clients. Even though we briefly mentioned the OOD client in Section 4.1, the actual comparison and experimental results are exhibited in Appendix A; we will clarify this. As shown in Table 5, our approach also outperforms the experiment with the OOD clients, confirming superior generalization capacity.\n\n**Q3. The weighted average of each client’s accuracy**\n\nWe followed the weighted accuracy metric according to the pFL-bench paper [1]. Based on each client's data size, the weighted average metric ensures fair representation and robustness to data imbalances, providing a more accurate overall performance evaluation. It reflects the real-world impact of larger datasets and mitigates the noise from smaller datasets, leading to a more stable assessment in FL.\n\nThe label distribution of each client's test dataset is the same as the label distribution of their own training dataset. For example, in the case of the CIFAR-10 dataset, if the number of data samples per label in Client A's training dataset is [100, 30, 50, 70, 10, 80, 20, 90, 40, 60], then the number of data samples per label in Client A's test dataset will be [20, 6, 10, 14, 2, 16, 4, 18, 8, 12].\n\nAdditionally, the distribution of the number of test data samples among clients is the same as the distribution of the number of training data samples among clients. Therefore, the weighted average of the global model's accuracy on each client's test dataset by the number of data samples they have is equal to the global model's accuracy on the entire test dataset.\n\n\n[1] Chen, Daoyuan, et al. \"PFL-bench: A comprehensive benchmark for personalized federated learning.\" NeurIPS, 2022.\n\n[2] Pascanu, Razvan, et al. \"On the difficulty of training recurrent neural networks.\" ICML, 2013.\n\n[3] Mikolov, Tomas, et al. \"Empirical evaluation and combination of advanced language modeling techniques.\" Interspeech, 2011.\n\n[4] Shu, Jun, et al. \"Meta-weight-net: Learning an explicit mapping for sample weighting.\" NeurIPS, 2019.\n\n[5] Zhou, Fengwei, et al. \"Metaaugment: Sample-aware data augmentation policy learning.\" AAAI, 2021.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "waNFcFlG02", "reviewer": "Reviewer_866Z", "summary": "This paper proposes FedAvP, a novel algorithm to perform data augmentation via shared policy in federated learning (FL). Extensive experiments verify the effectiveness of the proposed algorithm.", "questions": "Please see weaknesses. The authors are suggested to conduct more comprehensive experiments. I will adjust the score based on the author response.", "limitations": "Please see weaknesses.", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "S1: The proposed algorithm is novel with solid theoretical analysis.\n\nS2: The experiments are comprehensive, with open-source code submitted.", "weaknesses": "W1: The authors can conduct more experiments on more comprehensive non-IID settings. For example, in a previous FL benchmark on non-IID data [1], the quantity-based label skew settings are challenging. The authors are suggested to experiment on such settings to further support the effectiveness of the proposed algorithm. \n\n[1] Li, Qinbin, et al. \"Federated learning on non-iid data silos: An experimental study.\" 2022 IEEE 38th international conference on data engineering (ICDE). IEEE, 2022.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**W1. More experiments on FL benchmark on non-IID data**\n\nWe conduct experiments on comprehensive non-IID settings suggested by the reviewer, specifically the quantity-based label skew settings described in [1]. The table below presents the results across different datasets and partitioning strategies. Here, C is the number of different labels held by each client. In extreme label skew cases, such as  C = 1, where data labels are highly partitioned, our algorithm shows slightly lower performance on CIFAR-100 (C = 1). However, in all other cases, our algorithm demonstrates improved performance.\n\n|Niid-bench(dataset/C)[1]|CIFAR100(C=3)|CIFAR100(C=2)|CIFAR100(C=1)|SVHN(C=3)|SVHN(C=2)|SVHN(C=1)|\n|-|-|-|-|-|-|-|\n|FedAvg+Default|27.75|24.55|**7.59**|89.5|85.34|8.45|\n|FedAvg+RandAugment|25.38|22.94|6.69|85.75|79.05|7.64|\n|FedAvg+TrivialAugment|24.36|19.58|4.84|85.35|77.99|7.64|\n|FedProx+Default|27.1|24.26|7.51|89.18|85.87|9.39|\n|FedProx+RandAugment|26.1|24.46|5.66|86.19|80.11|7.63|\n|FedProx+TrivialAugment|24.15|20.14|3.17|84.73|78.56|8.34|\n|FedDyn+Default|27.84|24.89|7.39|89.59|86.65|14.56|\n|FedDyn+RandAugment|25.8|23.34|1.57|83.64|80.06|9.52|\n|FedDyn+TrivialAugment|24.5|19.7|3.81|84.34|79.06|9.4|\n|FedFA+Default|27.51|23.23|6.83|89.91|82.94|11.6|\n|FedFA+RandAugment|21.58|25.13|3.09|87.97|59.52|11.6|\n|FedFA+TrivialAugment|23.33|20.07|5.58|87.05|68.69|11.87|\n|Scaffold+Default|29.75|20.09|1.18|90.07|85.02|9.39|\n|Scaffold+RandAugment|26.56|17.06|1.18|82.57|6.52|14.45|\n|Scaffold+TrivialAugment|19.21|12.02|1.17|79.17|6.53|7.64|\n|FedAvP(local)|27.74|24.35|5.38|91.74|88.74|11.6|\n|FedAvP(Fast Update)|**31.54**|**30.96**|6.17|**92.53**|**90.13**|**18.92**|\n\n**Q1.**\n\nThis question is related to W1. We conducted experiments in non-IID settings as suggested by the reviewer. We kindly ask you to refer to our response to W1. Additionally, please refer to our responses to Reviewer zQTG W1 and Reviewer WeMd W2, which include comparisons with more non-IID settings.\n\n[1] Li, Qinbin, et al. \"Federated learning on non-iid data silos: An experimental study.\" 2022 IEEE 38th international conference on data engineering (ICDE). IEEE, 2022.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
**More experimental results**
We conducted additional experiments to answer Reviewer WeMd's W2 and Reviewer 866Z's W1, considering more non-IID settings and highly partitioned label skew settings [1], respectively.

|Dataset/heterogeneity degree α|CIFAR100/5.0|CIFAR100/0.1|CIFAR10/5.0|CIFAR10/0.1|SVHN/5.0|SVHN/0.1|FEMNIST|
|------------------------------|------------|------------|-----------|-----------|--------|--------|-------|
|FedAvg+Default|40.06|37.34|79.76|72.6|92.78|85.58|80.65|
|FedAvg+RandAugment|47.29|43.6|82.82|73.73|92.48|84.84|79.4|
|FedAvg+TrivialAugment|46.61|42.16|82|71.09|91.99|83.36|79.01|
|FedProx+Default|40.57|37.71|80.64|73.23|93.15|86.79|81.45|
|FedProx+RandAugment|45.97|41.39|82.56|73.71|92.33|85.52|77.11|
|FedProx+TrivialAugment|46.61|41.81|81.83|70.89|91.67|84.11|79.67|
|FedDyn+Default|42.09|38.52|80.36|73.86|93.16|87.6|80.47|
|FedDyn+RandAugment|45.7|42.24|82.51|72.78|92.16|81.47|77.64|
|FedDyn+TrivialAugment|46.83|41.1|82.03|70.34|92.22|83.41|79.31|
|FedExp+Default|42.76|38.28|80.64|73.7|92.77|86.66|81.45|
|FedExp+RandAugment|46.13|42.23|82.86|70.78|92.12|84.63|79.69|
|FedExp+TrivialAugment|48.55|42.09|82.51|71.07|92.64|83.72|80.2|
|FedGen+Default|42.14|38.27|80.23|72.74|92.71|86.79|81.86|
|FedGen+RandAugment|47.11|43.1|81.9|73.42|91.84|84.39|79.34|
|FedGen+TrivialAugment|47.71|40.76|82.58|70.87|91.73|83.23|77.35|
|FedMix+Default|40.26|38.69|80.99|74.54|92.8|86.02|81.63|
|FedMix+RandAugment|46.69|43|83.08|74.25|92.36|83.44|79.46|
|FedMix+TrivialAugment|46.64|42.63|81.83|71.5|91.85|82.34|77.84|
|FedFA+Default|43.7|41.21|82.61|76.02|92.77|87.33|81.13|
|FedFA+RandAugment|48.86|43.44|82.44|73.53|91.21|81.32|78.71|
|FedFA+TrivialAugment|47.86|43.45|80.12|72.89|91.89|78.62|78.96|
|FedAvP(local)|49.04|43.86|83.64|73.43|94.71|87.05|83.94|
|FedAvP(Fast Update)|49.97|45.08|83.55|**77.2**|**95.14**|87.86|**84.47**|
|FedAvP|**50.47**|**45.96**|**83.78**|77.1|95.02|**89.81**|84.27|

Our algorithm achieves the highest performance across all scenarios.

[1] Li, Qinbin, et al. “Federated learning on non-iid data silos: An experimental study.” ICDE. IEEE, 2022.

Meta-review: This paper proposes FedAvP, a data augmentation methods by sharing policies among clients in a federated learning environment. It focuses on an important and challenging aspect in federated learning. The effectiveness of the proposed solution is verified by extensive experiments. We recommend accept it.
Decision: Accept (poster)