FedFed: Feature Distillation against Data Heterogeneity in Federated Learning
Authors: Zhiqin Yang
Yonggang Zhang
Yu Zheng
Xinmei Tian
Hao Peng
Tongliang Liu
Bo Han
Venue: NeurIPS 2023 poster (2023)
Keywords: Federated Learning
Data Heterogeneity

Abstract: Federated learning (FL) typically faces data heterogeneity, i.e., distribution shifting among clients. 
Sharing clients' information has shown great potentiality in mitigating data heterogeneity, yet incurs a dilemma in preserving privacy and promoting model performance. To alleviate the dilemma, we raise a fundamental question: Is it possible to share partial features in the data to tackle data heterogeneity?
In this work, we give an affirmative answer to this question by proposing a novel approach called **Fed**erated **Fe**ature **d**istillation (FedFed).
Specifically, FedFed partitions data into performance-sensitive features (i.e., greatly contributing to model performance) and performance-robust features (i.e., limitedly contributing to model performance).
The performance-sensitive features are globally shared to mitigate data heterogeneity, while the performance-robust features are kept locally.
FedFed enables clients to train models over local and shared data. Comprehensive experiments demonstrate the efficacy of FedFed in promoting model performance.

FedFed: Feature Distillation against Data
Heterogeneity in Federated Learning
Zhiqin Yangl2 Yonggang Zhang?* Yu Zheng?
Xinmei Tian
Hao Pengl.6' Tongliang Liu
Bo Han
Beihang University
Hong Kong Baptist University *Chinese University of Hong Kong
Syynnyy Al Centre, The University of Sydney UUniersityy of Science and Technology of China Kunming University of Science and Technology
Abstract
Federated learning (FL) typically faces data heterogeneity, i.e., distribution shifting among clients. Sharing clients' information has shown great potentiality in mitigat- ing data heterogeneity, yet incurs dilemma in preserving privacy and promoting model performance. To alleviate the dilemma, we raise a fundamental question: Is it possible share partial features in the data to tackle data heterogeneity? In this work, we give an affirmative answer to this question by proposing a novel approach called Federated Feature distillation (FedFed). Specifically, FedFed partitions data into aefformannc-sensitiv features (i.e., greatly contributing to model performance) and performance-robut features (i.e., limitedly contributing to model performance). The performance-sensttiee features are globally shared to mitigate data heterogeneity, while the performance-robust features are kept locally. FedFed enables clients to train models over local and shared data. Comprehensive experiments demonstrate the efficacy of FedFed in promoting model performance. The code is publicly available at: https: / / github.... cww tt/rmmmrraee /t/tttlrooropp////o FedFed cwwmtmlr.
Introduction
Federated learning (FL), beneficial for training over multiple distributed data sources, has recently received increasing attention [1, 3]. In FL, many clients collaboratively train global model by aggregating gradients (or model parameters) without the need to share local data. However, the major concern is heterogeneity issues [4, 5, 6] caused by Non-IID distribution of distributed data and diverse computing capability across clients. The heterogeneity issues can cause unstable model convergence and degraded prediction accuracy, hindering further Fl. deployments in practice [1].
To address the heterogeneity challenge, the seminal work, federated averaging (FedAvg), introduces the model aggregation of locally trained models [4]. It addresses the diversity of computing and communication but still faces the issue of client drift induced by data heterogeneity [7]. Therefore, branch of works for defending data heterogeneity has been explored by devising new learning objectives [6], aggregation strategies [8], and constructing shareable information across clients [9]. Among explorations aforementioned, sharing clients' information has been considered to be straightforward and promising approach to mitigate data heterogeneity [9, 10].
However, the dilemma of preserving data privacy and promoting model performance hinders the practical effectiveness of the information-sharing strategy. Specifically, it shows that a limited amount of shared data could significantly improve model performance [9]. Unfortunately, no matter for sharing raw data, synthesized data, logits, or statistical information [10, 11, 12, 7] can
"quual contributions.
i Corresponding author (penghao @ act. buw..cdu.cn)
37th Conference on Neural Information Processing Systems (NcurIPS 2023).

---

incur privacy concerns [13, 14, 15]. Injecting random noise to data provides provable security for protecting privacy [16. 17]. Yet, the primary concern for applying noise to data lies in performance degradation [18] as the injected noise negatively contributes to model performance. Consequently, effectively fulfilling the role of shared information necessitates addressing the dilemma of data privacy and model performance.
We revisit the purpose of sharing information to alleviate the dilemma in information sharing and performance improvements and ask:
Q. Is it possible to share partial features in the data to mitigate heterogeneity in FL? This question fundamental to reaching a new phase for mitigating heterogeneity with the information-sharing strategy. Inspired by the partition strategy of spurious feature and robust feature [19], the privacy and performance dilemma could be solved if the data features were separated into performance- robust and werffoommane--sssttin parts without overlapping, where the performance-robus features contain almost all the information in the data. Namely, the performance-robut features that limitedly contribute to model performance are kept locally. Meanwhile, the performance-sensittvy features that could contribute to model generalization are selected to be shared across clients. Accordingly, the server can construct global dataset using the shared performance-sensitvv features, which enables clients to train their models over the local and shared data.
Q.2 How to divide data into performance-robute features and performance-sensitree features? The question is inherently related to the spirit of the information bottleneck (IB) method [20]. IB, ideal features should discard all information in data features except for the minimal sufficient information for generalization [21]. Concerning the information-sharing and rnfformance-improeeeeee dilemma, the features discarded in IB may contain performance-robust features, i.e., private information, thus, they are unnecessary to be shared for heterogeneity mitigation. Meanwhile, the performance-sensee features contain information for generalization, which are the minimum sufficient information and should be shared across clients for heterogeneity mitigation. Therefore, IB provides an information- theoretic perspective of dividing data features for heterogeneity mitigation in FL.
Q.3 What if performunce-sensitiiee features contain private information? ? This question lies in the fact that a non-trivial information-sharing strategy should contain necessary data information to mitigate the issue of data heterogeneity. That is, the information-sharing strategy unavoidably causes privacy risks. Fortunately, iefformmance-ensssivv features because the noise injection approach can provide a de facto standard way for provable security [16]. Notably, applying random noise to anfformance-sensitii features differs from applying random noise for all data features. More specifically, sharing partial features in the data is more accessible preserve privacy than sharing complete data features, which is fortunately consistent with our theoretical analysis, see Theorem 3.3 in Sec. 3.3.
follow the conventional style in applying random noise protect
Our Solution. Built upon the above analysis, we propose a novel framework, named Federated Feature distillation (FedFed), to tackle data heterogeneity by generating and sharing performance- sensitive features. According to the question Q.1, FedFed introduces a competitive mechanism by decomposing data features E Rdd with dimension into performance and performance--ensittve features X, E Rd, i.e., x = X, + X,. Then following the question Q.2, FedFed generates performance-robust features x, in IB manner for data In line with Q.3, FedFed enables clients to securely share their protected features xp by applying random noise n to performance sensitive features X,, i.c., Xp = x, + n, where n drawn from a Gaussian distribution (0 I with variance oZ. To this end, the server construct global dataset to tackle data heterogeneity using the protected features Xp. enabling clients to train models over the local private and globally shared data.
features x, Rd
We deploy FedFed on four popular FL algorithms, including FedAvg [4), FedProx [6], SCAF- FOLD [7], and FedNova [22]. Atop them, we conduct comprehensive experiments on various scenarios regarding diffcrent amounts of clients, varying degrees of heterogeneity, and four datasets. Extensive results show that the FedFed achieves considerable performance gains in all settings.
Our contributions are summarized as follows:
We pose a foundation question to challenge the necessity of sharing all data features for mitigating heterogeneity in FL with information-sharie shariing strategies. The question sheds light on solving the privacy and performance dilemma, in a way of sharing partial features that contribute to data heterogeneity mitigation (Sec 3.1)

---

2. To solve the dilemma in information sharing and performance improvements, we propose new framework FedFed. In FedFed, each client performs feature distillation- -oitin--pattiiiingggg local data into performance-rohuu and performance-sensitee shares the latter with random noise globally (Sec 3.3). Consequently, FedFed can mitigate data heterogeneity by enabling clients to train their models over the local and shared data. 3. We conduct comprehensive experiments show that FedFed consistently and significantly enhances the convergence rate and generalization performance of FL models across different scenarios under various datasets (Sec 4.2).
features (Sec 3.2) and
2 Preliminary
Federated Learning. Federated learning allows multiple clients to collaboratively train global model parameterized by é without exposing clients' data [4, 1]. In general, the global model aims to minimize a global objective function L(Ø) over all clients' data distributions:
min (())
Σ AxLx(dn),
where K represents the total number of clients, AE is the weight of the k-th client. The local objective function ((((b) of client & is defined the distribution P(X,; le Yk) with random variables Xx, Ye:
(Øx) A (xxx))))((X, ( x)):
(2)
where x is input data with its label y and E(-) stands for the loss function, e.g., cross-entropy loss. Due the distributed property of clients' data, the global objective function L()) is optimized round-by- round. Specifically, within the r-th communication round, a set of clients C' are selected to perform local training their private data, resulting in |C| optimized models {okjk=1 These optimized models are then sent to a central server to derive a global model for the (r + 1)-th communication round by an aggregation mechanism AGG(.), which may vary from different FL algorithms:
o r+
AGG((
(3)
Differential Privacy. Differential privacy [16] is a framework to quantify to what extent individual privacy in dataset is preserved while releasing the data.
Definition 2.1. (Differential Privacy). A randomized mechanism M provides (e, 8) d-dfifferential privacy (DP) if for any two neighboring datasets D and D' that differ in a single entry, VS C (M)
Pr(M(D) E S) Pr(M(D') SS) 5
where is the privacy budget and 8 is the failure probability.
The definition of (e, 0)DD shows the difference of two neighboring datasets in the probability that the output of M falls within an arbitrary set is related to and an error term 8. Similar outputs of M D, D' (i.e., smaller e) represent stronger privacy guarantee. In sum, DP as a de facto standard quantitative privacy, provides provable security for protecting privacy.
Information Bottleneck. Traditionally, in the context of the Information Bottleneck (IB) framework, the goal to effectively capture the information relevant to the output label Y. denoted as Z, while simultaneously achieving maximum compression of the input X. Z represents the latent embedding, which serves as a compressed and informative representation of X, preserving the essential information while minimizing redundancy. This objective can be formulated as:
LB = T(X; YIZ), s.t. [(X; Z) S TIB
where I(-) denote the mutual information and Iı is a constant. This function is defined as rate-distortion problem, indicating that IB is extract the most efficient and informative features.
3 Methodology
We detail the Federated Feature distillation (FedFed) proposed to mitigate data heterogeneity in FL. FedFed adopts the inoommtiionsharing strategy with the spirits of information bottleneck (IB). Roughly, it shares the minimal sufficient features, while keeping other features at clients!.
Appeendi A displays FedFed's overview.
3

---

A
B
C
Figure 1: Have Guessing Game! Question: Which one is the first image from? A or B or C?
3.1 Motivation
Data heterogeneity inherently comes from the difference in data distribution among clients. Aggregat- ing models without accessing data would inevitably bring performance degradation. Sharing clients' data benefits model performance greatly, but intrinsically violates privacy. Applying DP to protect shared data looks feasible; however, it is not a free lunch with paying the accuracy loss on the model.
Draw inspiration from the content and style partition of data causes [19], we investigate the dilemma in information sharing and performance improvements through a feature partition perspective. By introducing an appropriate partition, we can share performance sensitive features while keeping performance-sensiiivee performance-robust features locally. Namely, perforrmance-sensiiie features in the data are all we need for miligating data heterogeneity!
We will elucidate the definitions of performance-sensitvy features and performance-robus. features. Firstly, we provide a precise definition of valid partition (Definition 3.1), which captures the desirable attributes when partitioning features. Subsequently, adhering to the rules of a valid partition, we formalize the two types of features (Definition 3.2).
Definition 3.1. (Valid Partition). partition strategy is to partition variable X into two parts in the same measure space such that X = Xi + X2. We say the partition strategy is valid if it holds: (i) (X1, X2 O; (ii) (X] X2) - 0: (iii) I(X1; = 0; where H() denotes the information entropy and I(-) is the mutual information.
Definition 3.2. cerfooraance-enssiine
and Performance-roie robustt Features). Let X = X, + X, be a valid partition strategy. We say X₃ are iettorrannne-eessinne features such that I(X:Y|X,) where Y is the label of X. Accordingly, X, are the performunce-robus! features.
Intuitively, performance- sensitive features contain all label information, while performance-robust features contain all information about the data except for the label information. More discussions about Definition 3.1 and Definition 3.2 can be found in Appendix C.I. Now, the challenge turns out to be: Can we derive performance-sensitiv features to mitigate data heterogeneity? FedFed provides an affirmative answer from an IB perspective, boosting a simple yet effective data-sharing strategy.
3.2 Feature Distillation
Given the motivation above, we propose to distil features such that data features can be partitioned features favourable
into performance-robust features depicting mostly data and performance-sensee to model performance. We design feature distillation and answer Q.2 below.
We draw inspiration from the information bottleneck method [21]. Specifically, only minimal suffi- cient information is preserved in learned representations while the other features are dismissed [21]. This can be formulated as 2:
min T(XXY s.I. T(X; < TIB
(5)
where Z represents the desired representation extracted from input X with its label Y, I(-) is the mutual information, and /ıB stands for a constant. Namely, given the learned representation Z, the mutual information between X and Y is minimized. Meanwhile, Z dismisses most information about the input X so that the mutual information I(X; Z) is less than constant LiB-
Similarly, in FedFed, only minimal sufficient information is necessary to be shared across clients to mitigate data heterogeneity, while the other features are dismissed before sharing data, i.e., kept locally on the client. The differences between IB and FedFed have two folds: 1) FedFed aims to make
We follow the formulation used in Tishby and Zaslavsky [21, 23J.

---

the dismissed features close to the original features (i.e., depict most private data information), while IB focuses on the dissimilarity between the preserved and original features (i.e., contain minimal sufficient information about data); 2) FedFed dismisses information in the data space while IB does that in the representation space. More specifically, the objective of feature distillation is:
min / (X; s.t. X ZIZ) 2 IFF:
(6)
where represents the performance-sensiee for performance-robust features that are unnecessary to be shared, and IFF constant. In Eq. (6), the (X Z) should represent data mostly conditioned on performance--ensitivy features Z. while the Z should contain necessary information about the label Y. Consequently, learning with the objective can divide data features into performance-sente senssiiive features and performance-robust features, achieving the goal of feature distillation.
features in X, Y is the label of X, (X Z) stands
To make the feature distillation tractable, we derive an objective equal to the original objective in Eq. (6) (see Appendix C.2 for more details) for client i as follows:
min Pxxx.)))((x..)) log (x;;)//zx;))))))))))) 0)), s.t. || 0) S S.
where f is the parameter be optimized for generating performance-sensineee represents the input pair drawn from the joint distribution P(X,, Ys)) of client k; p(yl-) is the probability of predicting Y y, and p > 0 stands for constant. The underlying insight of the objective function in Eq. (7) is intuitive. Specifically, the learned performance-sensitive features 2(:0) are capable of predicting the label y while having the minimal fn-norm.
features z1: 8). (x. y)
Unfortunately, the original formulation in Eq. (7) can hardly be used for dividing data features. This because the feature distillation in Eq. cannot make the preserved features x <xx 0) similar to the raw features Namely, the original Eq. (7) cannot guarantee the desired property of the preserved features. To solve the problem, we propose an explicit competition mechanism in the data space. Specifically, we model preserved features, i.e., performance-robut features, with (xx; explicitly and model the performance-sensitee features 2xx; 0) _ x q(x; 0) implicitly:
min - Pxx.))=P(xx..) logp(y x - g(x: 0)), s.r. ||x g(x; 0) S. #
(8)
Thus, by Eq. 8, performance-sensitive features can predict labels and performance-robeeee features almost the same as raw features.
The realization of Eq. (8) is straightforward. To be specific, we can employ a generative model parameterized with to generate performance-robus features, i.e., g(x; 0) in Eq. (8). Meanwhile, we train a local classifier [(;: wx) parameterized with wa for client-k model the process of predicting labels, i.e., - log p(y (-) Eq. (8). Accordingly, the realization of feature distillation formulated as follows with z(x; 0) 2 x - -qxx;);; (([((x;;))) wk).y),
min 0.we
< p.
where E(.) is the cross-entropy loss, (xx; f) stands for a generative model, and represents a tunable hyper-parameter. Built upon Eq. (9), can perform feature distillation, namely, the outputs of a generator (x; 0) serve as performance-robust features and x (x; 0) are used as performance- sensitive features. We merely share x (xx; 0) tackle data heterogeneity by training models over both local and shared data. Algorithm summarizes the procedure of feature distillation.
3.3 Protection for Performance-Sensitie Features
Until now, have intentionally overlooked the overlap between performancc-sensitti features and performance-robus. features. Since we prioritize data heterogeneity, overlapping is almost unavoid- able in practice, i.c., performance-sensitvv features containing certain data privacy. Accordingly, merely sharing cettrmmaanne-eessttiie features can risk privacy. Thus, we answer Q. 3 below.
Why employ DP? The constructed serformance-senssiive features may contain individual privacy, thus, the goal introducing a protection approach for individual privacy. addition, the employed protection approach is expected to be robust against privacy attacks [24, 253. According to the above analysis, differential privacy (DP) naturally suitable in our scenario of feature distillation. Thus, employ DP to protect performance- senssiiiiveeeeevvveeeeeeeeeeeeee features before sending them to the server.
5

---

Algorithm Feature Distillation
Server input:
communication round Ta. DP noise level o Client k's imput: local epochs of feature distillation Ed, k-th local dataset D& and rescale [0.
Initialization: server distributes the initial model w", 0 to all clients
Server Executes:
for each round t = 1, .... Ta do
server samples subset of clients C₁ C (1,,..,, KJ. server communicates w', , 8 to selected clients for each client & E C₁ in parallel do w o + Local FeatDis (w', 0", ,,)
end for w gc+1 + AGG (wl, 82 C.)
end for D (D Collecting Xp generated by k-th client use Eq (9), where X, - X, +
Local_ FeatDis(w', N0,,,,,0000 o²)))
for each local epoch with I.... EE do
w 0 <- SGD update use Eq (9).
end for
Return w+11 0 to server
How to apply DP? Applying noise (e.g.. Gaussian Laplacian) to performance-sensiteee features before sharing can protect features with DP guarantee [26, 16], i.e., Xp x, + n. Consequently, the server can collect protected features Xp from clients construct global dataset and send the dataset back to clients. To give a vivid illustration, we provide a guessing game? Figure 1, showing 4 images. The first image represents the DP- DP-protected performance-sensitie features of one image (A, B, or C). hard to identify which one of the raw images (A, B, C) the first image belongs to.
Training with DP. The protected performance-senstoe
features are shared, thus, the server can construct globally shared dataset. Using the global dataset, clients can train local classifier f(; dx) parameterized by de with the private and shared data:
min E ((x)) E. dx).y) @R
(10)
where f(i (x) is trained for model aggregation, (Xp, y) are protected performance--ensiitiee features that are collected from all clients, and h(Xx) == 2(X²) + with noise Pseudo-code of how to apply FedFed are listed Appendix B.
DP guarantee. Following DP-SGD [27]. we employ the idea of the 4--n clipping relating the selection of the noise level a.. Specifically, we realize the constraint Eq. (9) as follows: ||z(x; f)ll2 S p||x|| with 0 < < (i.e., ||x,|| S p|]x[)). ). For aligning analyses with conventional DP guarantee, we the random mechanism on performance-roous features x, be x, + n, NO If.). Similar for performance-sensiiiv features, we have X, + n, n (N0 IT.). Since kept locally, an adversary views nothing (or random data without any entropy). This keeps equal to adding sufficiently large noise, i.e., 0, FedFed can provide strong privacy guarantee. Moreover, for each client, we show that FedFed requires a relatively small noise level for achieving identical privacy, which is given in Theorem 3.3 (detailed analysis left in Appendix D).
X, to make it random enough. Consequently,
Theorem 3.3. Let a be the noise scale for FedFed and be the noise scale for sharing raw x. Given identical 5, we altain o' such that |2
Besides each client, give the privacy analysis for the FL system paired with the proposed FedFed.
Theorem 3.4 (Composition of FedFedd. For k clients with (c, -diff-eairrrettiall
privacy, FedFed
satisfies
(2g. (1 8)11,(1 diff-iiffeenntia privacy,
We reveal the answer in Appendix F22

---

Table I: Top-1 accuracy with with(without) FedFed under different heterogeneity degree, local epochs, and clients number on CIFAR-10.
centralized training ACC = 95.48%
w/(w/o) FedFed
ACC1
Gain
Round 4
Specdupt
ACCt
Gaint
Round
Speedup"
0.1, E'
1, K
10 (Target ACC =795)
0.05, E
K,
10 (Tarel ACC =69%)
FodAvg
92.34(79.33)
12.99t
39(284)
x7.3(x10))
90.02/69.360
20.66t
44(405)
x9.2(x
FedProx
92.12(83.06)
9.061
62(192)
x4.6(x 1.5)
90.73(78.98)
11.75t
48/203)
x8.4(x2.0)
SCAFFOLD
89.66(83.67)
5.991
34(288)
x8.4(x 1.0)
81.04(37.87)
43.171
37(None)
(0.9(Nome)
FedNova
92.23(80.95)
11.281
33(349)
x8.6(x0.8)
91.21(65.08)
26.131
32(None)
12.7(None)
= F. 5, K
10 (Target ACC:=550)
a= 0.1, F
1, K
100 (Target ACC =49%)
FedAvg
93.24(83.79)
9.45
17(261)
x15.4((1.0)
84.06(49.72)
34.341
163(967)
x..9(x100)
FedProx
(1.39(82.32)
8.97
76(Nonc)
x3.4(None)
(5.01(50.01)
37.001
127(831)
(.2)
SCAFFOLD
92.34(85.31)
7.03
15(66)
x17.0(
79.60(52.76)
26.841
171(627)
x..7(x
FedNova
92.85(8
6.64 f
31(120)
x8.4xx..2)
(6.64(45.97)
40.671
199(None)
x4.9(None)
"Round"::
communication rounds arriving at the target accuracy. "None": not attaining the target accuracy. Results in "(")"
indicutes truining without Fedi'ed.
Table 2:
Top-1 accuracy with(without) FedFed under different heterogeneity degree, local epochs, and clients number on FMNIST.
centralized training ACC 95.64%
w/(w/o) FedFed
ACC1
Gaint
Round |
Speedupt
ACC1
Gaint
Round
Speedupt
0.1, E
K,K
10
(Target ACC =86%)
a 0.05, E' = 1, K
10 (Target ACC =78%)
FodAvg
92.34(86.73)
5.61f
14(121)
L..6(x100)
90.69(78.34)
12.351
16(420)
x26.3((1..)
FedProx
92.09(87.73)
4.36 f
32((299)
x2.1(x0.9)
89.68(82.03)
7.65t
16(44)
x26.3(9.5)
SCAFFOLD
91.62(86.31)
3.891
29(147)
x4.2(x 0.8)
80.48(76.63)
3.85t
139(None)
x6.2(None)
FedNova
92.39(87.03)
5.36t
18(88)
(6.7()1.4)
89.72(79.98)
9.741
16(531)
x26.3(x 0.8)
0.1,
5, K
10 (Target ACC =87%)
0.1, E K,
100 (Target ACC =90%)
FedAvg
92.26(87.43)
4.831
19(276)
x14.5(x1.0) 1.0)
92.71(90.21)
2.51
243(687)
x.28(x1.0))
FedProx
91.79(86.63)
5.161
34(Nune)
x8.1(None)
92.82(90.17)
2.65t
284(501)
x2.4(x
SCAFFOLD
(2.92(87.11)
5.71
8(112)
x34.5xx2.5
90.28(84.87)
5.41f
952(Nonc)
x 0.7 (None)
FedNova
92.30(87.67)
4.63t
8(187)
xx5.5(x1.5)
91.04(85.32)
5.721
589(Nonc)
x 1.2(Nonc)
kpy 1/5)
PV Rlog(1/0)) 1/0)
where,
Eg
min
k
log(e
0,
(pv kRt (ol(oo/)))////2))) my (1/((1/8)
e V ls
V 122 1 log(1/))))
G,
eev e
Atop composition theorem [28], Theoreom 3.4 shows that FedFed is able to provide a strong privacy guarantee for FL systems.
4 Experiments
We organize this section in the following aspects: a) the main experimental settings that we primarily followed (Sec 4.1); b) the main results and observations of applying FedFed to existing popular FL algorithms (Sec 4.2); c) the sensitívity study of hyper-parameter on effecting model performance (Sec 4.3); and d) empirical analysis of privacy with two kinds of attacks (Sec 4.4).
4.1 Experimental Setup
Federated Non-IID Datasets. Following previous works [10, 29], we conduct experiments over CIFAR- 10 CIFAR [30],
[31], and SVHN [32]. Following [5], we employ latent Dirichlet sampling (LDA) [33] to simulate Non-IID distribution.Ih In our experiments, following [5, 34], we set = 0.1 and = 0.05 by LDA. Besides, we evaluate FedFed with other two widely adopted partition strategies: #C [4, 5] and Subset method [9], mainly including label skew and quantity skew (Appendix F.1 shows more detail of data distribution).
7

---

Table 3: Top-1 accuracy with(without) FedFed under different heterogeneity degree, local epochs, and clients number on CIFAR-100.
centralized training ACC = 75.56% w/(w/o) FedFed
ACC1
Gain
Round :
Specdupt
ACC1
Gaint
Round J
Specdupt
a = 0.1, E 1.
10 (Target =67%)
a 0.05, E
1. K
10 (Tanget ACC =61%)
FodAvg
69.64(67.84)
1.81
283(495)
x1.7 (x1.0)
68.49162.01)
6.481
137(503)
x3.7(x110)
FedProx
70.02(65.34)
4.68
233(Nonc)
x2.1(None)
69.03(61.29)
7.741
141(485)
x3.6(10)
SCAFFOLD
70.14(67.23)
2.91
198(769)
x2.5(x 0.6)
(9.32(58.78)
10.54f
81(Nonc)
X 6,2((None)
FedNova
70.48(67.98)
2.5t
147(432)
x314xx.11)
68.92(60.53)
8.391
87(None)
5.8(None)
0.1, E
K
10 (Target ACC =69%)
0.1,
1,
100 (Tangel ACC =48%)
FodAvg
70.96(69.34)
1.62
79(276)
60.58(48.21) x3.5(x100)
12.37f
448(967)
x2.2(x110))
FedProx
69.66(62.32)
7.347
285(None)
x1.0(None)
67.69(48.78
18.91
200(932)
x4.8(x1..0
SCAFFOLD 70.76(70.23)
0.531
108(174)
x..6(
66.67(55.03)
15.641
181(832)
x xxxx1x1)) 1.2)
FedNova
69.98(69.78)
0.21
89(290)
x3.1(x100)
67.62(48.03)
19.59
198(976)
x4.9( 1.00)
Table 4: Top-1 accuracy with(without) FedFed under different heterogeneity degree, local epochs, and clients number SVHN.
centralized training ACC 96.56%
w/(//o) FedFed
ACC1
Gaint
Round
Specdupt
ACC1
Gaint
Round
Specdupt
0.1,
(Target ACC =88%)
0.05,
10 (Target ACC =82%)
FodAvg
93.21
4.871
105(264)
x2.5(x1.0)
93.49(82.76)
10.731
194(365)
x1,9(x L.0)
FedProx
91.80(86.23)
5.574t
233(Nonc)
x1.1(None)
93.21(79.43)
13.781
37(None)
x9.9(None)
SCAFFOLD
88.41(80.12)
8.291
357(Nonc)
x0.(None)
90.27(75.87)
14.4f
64(None)
x5.7(Nonc)
FedNova
92.98(89.23)
3.751
113(276)
x2.3(x1.0)
93.05(82.32)
10.731
37(731)
x9.9(x0.5)
0.1, E = 5, K
10 (Target ACC =87%)
0.1, E
1, K
100 (Tagget ACC =89%)
FedAvg
93.77(87.24)
6,531
105(128)
x x1,2(x 1.0)
91.04(89.32)
1.721
763(623)
x0.8(x
FedProx
91.15(77.21)
13.94
142(None)
x0.9(None)
91.41(88.76)
2.651
733(645)
x00.((x10))
SCAFFOLD
93.78/80.98)
12.81
20(None)
x6.4(None)
92.73(88.32)
4.411
507(687)
x1.2(x0.9)
FedNova
93.66(89.03)
4.631
52(177)
x2.5(x0.7)
84.05(81.87)
2.18f
None(None)
None(None)
Models, Metrics and Baselines. We use ResNet-18 [35] both in the feature distillation and classifier FL.. We evaluate the model performance via two popular metrics in Fl.: a) communication rounds and b) best accuracy. Typically, the target accuracy is set to be the best accuracy of vanilla FedAvg. As plug-in approach, we apply FedFed to prevailing existing FL. algorithms, such as FedAvg [4], FedProx [6], SCAFFOLD [7], and FedNova [22] to compare the efficiency of our method. More experimental settings and details are listed in Appendix B.I.
4.2 Main Results
Generative Model Selection. We consider two generative models in this paper to distill raw data, i.c., Resnet Generator, kind of vanilla generator used in many works [36, 37], and 3-VAE [38], an encoder-decoder structure by variational inference. We verify the effectiveness of FedFed with different generative models. According results shown in Figure 2 (a), we observe that 3--VE gets better performance in FedFed. Thus, we mainly report the results of 8 3-VAE in the rest.
Result Analysis. The experimental results on CIFAR-10, CIO,R- FMNIST, and SVHN shown respectively in Tables 1, 2, 3, and 4. It can be seen that the proposed method can consistently and significantly improve model accuracy under various settings. Moreover, FedFed can promote the convergence rate of different algorithms". Specifically, FedFed brings sigmificant performance gain in CIFAR-10 under the K 100 setting shown in Table 1 and also notably speeds up the convergence rate in FMNIST under the = 0.05, E = 1, K = 10 setting. However, attributable to the original FL methods almost reaching a performance bottleneck, FedFed achieves limited performance gain in SVHN and FMNIST. FedFed also has limited improvement in CIFAR-100. A possible reason
More supporting tigures of convergence rate moved appendix F.4
8

---

Text Text.Accuray 190
80
80
Test Avcuracyu [%6]
60
Tea Accuracy
60
Privacy e
40
FedFeed A-VAE
40-
FollegrhaFee
Fecheg
93-
DP e
20
FedFied with Roant Gonsnoor
20-
Beehree
SCASFOLD
Acc
tredArg
Bochion
250
500
750
1000
250
750
1000
0.2
0.3
Roand
Round
Level of (c)
(a)
(b)
Figure 2: More facts of FedFed. (a) Convergence rate of different generative models (i.e., 9- VAE[38 and ResNet generator[37]) compared with vanilla FedAvg. (b) Test accuracy and convergence rate on different federated learning algorithms with or without FedFed under = 0.1, E' = 1, K = 100. (c) Test accuracy on FMNIST with different noise level o Theorem 3.3, obtaining various privacy (lower e is preferred). As the noise increased, the level of protection gradually increased.
Table 5: Experiment results of different Non-IID Table 6: Experiment results with different noise partition methods on CIFAR- 10 with 10 clients.
adding on CIFAR-10.
Partition Method
Test Accuracy witwio) FedFed
Test Accuracy Different Noise with FedFed
FedArg
FedProx
SCAFFOLD
FedNova
Noise Type
FedAvg
FedProx
SCAFFOLD
FodNova
#C 2
o 0.1
92. 02.34(79.35)
89.2342.54
92.12(83.06)
88.17/58.45
84.4346.82
89.66183.67)
92.23(80.95)
89 54.4445.44 42
Gaussian Noise
92.34
92.12
89.66
92.23
Subset
90.29/39.53
89,11/32887
89.92/35,26
90.00/8.52
Laplacian
91.36
is that existing methods can achieve performance comparable to centralized training. Moreover, we conducted additional experiment involving sharing the full data with DP protection. The results, presented in Appendix F.3, indicate that sharing the full data with DP protection leads to a degradation in the performance of the FL system. This degradation occurs because protecting the full data necessitates a relatively large noise to achieve the corresponding protection strength required to safeguard performance-sente sensitive features.
Surprising Observations. We find that training among 100 clients CIFAR- 10 and CIFAR 100 reaches significant improvement (e.g., at most 40.67%!). A possible reason is that the missed data knowledge can be well replenished by FedFed. Moreover, all methods paired with FedFed under various settings can achieve similar prediction accuracies, demonstrating that FedFed endows FL models robustness against data heterogeneity. Table shows that two kinds of heterogeneity partition cause more performance decline than LDA (a 0.1). Yet, FedFed attains noteworthy improvement, indicating the robustness against Non-IID partition.
4.3 Ablation Study
DP Noise. To explore the relationship between privacy level and prediction accuracy, conduct experiments with different noise levels o?. As shown in Figure 2(c), the prediction accuracy decreases with increasing noise level (more results in Appendix F.5). To verify whether the FedFed is robust against the selection of noise, we also consider Laplacian noise in applying DP to privacy protection. The results of Laplacian noise are reported in Table 6, demonstrating the robustness of FedFed.
pappeeppraaeters. further evaluate the robustness of FedFed against hyper-parameters. During the feature distillation process, as the constraint parameter p in Eq. 9 decreases, the DP strength to protect verformance-sensiinn features decreases, and the performance of the global model decreases, owing the less information contained in performance-sensitive features.
4.4 Privacy Verification
Besides the theoretical analysis, we provide empirical analysis to support the privacy guarantee of FedFed. We wonder whether the globally shared data can be inferred by some attacking methods. Thus, we resort to model inversion attack [39], widely used in the literature to reconstruct data. The results' in Figure 3 (a) and (b) indicate that FedFed could protect globally shared data. We also conduct another model inversion attack [40] and the results can be found in Appendix E.I.
MMore details and results can be found in Appendix E.

---

Recall [%]]
60
share xp with DP
share with DP
20
0.0
0.1
0.2 Noise Level d²
0.3
(a)
(b)
(c)
Figure 3: Attack results on FedFed. (a) shows the protected data Xp. (b) reports the model inversion attacked data. (c) shows results of membership inference attacks: the green star represents the recall for FedFed, while the blue stars show the searching process varying with of for sharing raw data.
Additionally, we perform membership inference attack [41] to illustrate the difference between FedFed and sharing all data features with DP protection. The results illustrated in Figure 3 (c) show that noise level x² 0.3 over raw data x can achieve similar protection as noise o² 0.15 over globally shared data Xp, which aligns with Theorem 3.3. More details can be found in Appendix E.2
5 Related Work
Federated Learning (FL) models typically perform poorly when meeting severe Non-IID data [2, 7]. To tackle data heterogeneity, advanced works introduce various learning objectives calibrate the updated direction of local training from being far away from the global model, e.g., FedProx[6], FedIR [42], SCAFFOLD [7]. and MOON [43]. Designing model aggregation schemes like Fe- dAvgM [33], FedNova [22], FedMA [44], and FedBN [45] shows the efficacy on heterogeneity mitigation. Another promising direction is the information-shan sharing strategy. which mainly focuses on synthesizing and sharing clients' information mitigate heterogeneity [9, 46, 47J. To avoid exposing privacy caused by the shared data, some methods utilize the statistics of data [48], representations
of data [12]. logits [49, 10], embedding [50]. However, advanced attacks pose potential threats to methods with data-sharing strategies [51].
FedFed is inspired by [34], where pure noise is shared across clients to tackle data heterogeneity. In this work, we relax the privacy concern by sharing partial features in the data with DP protection. In addition, our work is technically similar to an adversarial learning approach [52]. Our method distin- guishes by defining various types of features and delving into the exploration of data heterogeneity within FL.. More discussion can be found in Appendix G.
Conclusion
In this work, we propose a novel framework called FedFed to tackle data heterogeneity in FL by coommation-sharingg approach. Our work extends the research line of
employing the promising constructing shareable information of clients by proposing share partial features in data. This shares a new route of improving training performance and maintaining privacy. Furthermore, FedFed has served as a source of inspiration for new direction focused on improving performance in open- set scenarios [53]. Another avenue of exploration involves deploying FedFed in other real-time FL application scenarios, such as recommendation systems [54] and healthcare system [55], to uncover its potential benefits.
Limitation. In reality, limited local hardware resources may limit the power of FedFed, since FedFed introduces some extra overheads like communication and storage overheads. We leave it as future works to explore a nordware-friende version or real-world application [56, 57]. Additionally, FedFedd raises potential privacy concerns that we leave as a future research exploration, such as integrating cryptography [58, 59]. We anticipate that our work will inspire further investigations to comprehensively evaluate the privacy risks associated with cntormattoo-ssaaiiii strategies aimed at mitigating data heterogeneity.
10

---

Acknowledgments and Disclosure of Funding
We thank the reviewers for their valuable comments. Hao Peng was supported by the National Key R&D Program of China through grant 2021YFB1714800 NSFC through grants 62002007, U21B2027, 61972186, and 62266027, S&T Program of Hebei through grant 20310101D, Natural Science Foundation of Beijing Municipality through grant 4222030, and the Fundamental Research Funds for the Central Universities, Yunnan Provincial Major Science and Technology Special 002202AD0800R and 202303AP140008 General Projects of Basic Research Yunnan Province through grant 202301 AS070047. Yonggang Zhang and Bo Han were supported by the NSFC Young Scientists Fund No. 62006202, NSFC General Program No. 62376235, Guangdong Basic and Applied Basic Research Foundation No. 1512 1652, CCF-Baidu Open Fund, HKBU Faculty Niche Research Areas No. RC--NRA-GI/222238IIIM, and HKBU CSD Departmental Incentive Scheme. Tongliang Liu was partially supported by the following Australian Research Council projects: FT220100318, DP220102121, LP220100522 LP220200949, and IC190100031. Xinmei Tian was supported in part by NSFC No. 62222117.
Plan Projects through grants 202103
References
[1] Peter Kairouz, H Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Bennis, Ar- jun Nitin Bhagoji, Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, al. Advances and open problems in federated learning. Foundations and Trends in Machine Learning, 14(1-2): 1-210, 2021.
[2] Qinbin Li, Zeyi Wen, Zhaomin Wu, Sixu Hu, Naibo Wang, Yuan Li, Xu Liu, and Bingsheng He. A survey on federated learning systems: vision, hype and reality for data privacy and protection. IEEE Transactions on Knowledge and Data Engineering, 2021.
[3] Qiang Yang, Yang Liu, Tianjian Chen, and Yongxin Tong. Federated machine learning: Concept and applications. ACM Transactions on Intelligent Systems and Technology (TIST), 10(2):1-19, 2019.
[4] Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication-effice learning of deep networks from decentralized data. In Artificial intelligence and statistics, pages 1273-1282. PMLR, 2017.
[5] Qinbin Li, Yiqun Diao, Quan Chen, and Bingsheng He. Federated learning on non-iid data silos: An experimental study. In 2022 IEEE 38th International Conference on Data Engineering (ICDE), pages 965-978. IEEF, 2022.
[6] Tian Li, Anit Kumar Sahu, Manzil Zaheer, Maziar Sanjabi, Ameet Talwalkar, and Virginia Smith. Federated optimization in heterogeneous networks. Proceedings of Machine Learning and Systems, 2:429 450, 2020.
[7] Sai Praneeth Karimireddy, Satyen Kale, Mehryar Mohri, Sashank Reddi, Sebastian Stich, and Ananda Theertha Suresh. Scaffold: Stochastic controlled averaging for federated learning. In International Conference Machine Learning, pages 5132-5 2143. PMLR, 2020.
[8] Mikhail Yurochkin, Mayank Agarwal, Soumya Ghosh, Kristjan Greenewald, Nghia Hoang, and Yasaman Khazaeni. Bayesian nonparametric federated learning of neural networks. In International Conference on Machine Learning, pages 7252-7261. PMLR, 2019.
[9] Yue Zhao, Meng Li, Liangzhen Lai, Naveen Suda, Damon Civin, and Vikas Chandra. Federated learning with non-iid data. arXiv preprint 1rXiv:1806.00 00582, 2018.
[10] Mi Luo, Fei Chen, Dapeng Hu, Yifan Zhang, Jian Liang, and Jiashi Feng. No fear of hetero- geneity: Classifier calibration for federated learning with non-iid data. Advances in Neural Information Processing Systems, 34:5972-5984, 2021.
[11] Jack Goetz and Ambuj Tewari. Federated learning via synthetic data. arXiv preprint arXiv:2008.00 2020.
11

---

[12] Weituo Hao, Mostafa El-Khamy, Jungwon Lee, Jianyi Zhang, Kevin J Liang, Changyou Chen, and Lawrence Carin Duke. Towards fair federated learning with zero-shot data augmentation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 3310-3319, 2021.
[13] Milad Nasr, Reza Shokri, and Amir Houmansadr. Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In 2019 IEEE symposium on security and privacy (SP), pages 739-753. IEEE, 2019.
[14) Viraaji Mothukuri, Reza Parizi, Seyedamin Pouriyeh, Yan Huang, Ali Dehghantanha, and Gautam Srivastava. A survey security and privacy of federated learning. Future Generation Computer Systems, 115:619-6400 2021.
[15] Hongyang Yan, Shuhao Li. Yajie Wang, Yaoyuan Zhang, Kashif Sharif, Haibo Hu, and Yuanzhang Li. Membership inference attacks against deep learning models via logits dis- tribution. IEEE Transactions on Dependable and Secure Computing, 2022.
[16] Cynthia Dwork, Aaron Roth, et al. The algorithmic foundations of differential privacy. Founda- tions and Trends@ in Theoretical Computer Science, 9(3 4):211 19:211-407, 1-407, 2014.
[17] Minxin Du, Xiang Yue, Sherman S. M. Chow, Tianhao Wang. Chenyu Huang, and Huan Sun. Dp-forward: Fine-tuning and inference language models with differential privacy in forward pass. In CCS, 2023.
[18] Florian Tramer and Dan Boneh. Differentially private learning needs better features (or much more data). In ICLR, 2021.
[19] Yonggang Zhang, Mingming Gong, Tongliang Liu, Gang Niu, Xinmei Tian, Bo Han, Bernhard Schölkopf, and Kun Zhang. Adversarial robustness through the lens of causality. In International Conference on Learning Representations, 2021.
[20] Naftali Tishby, Fernando C Pereira, and William Bialek. The information bottleneck method. In Proceedings of the 37th Annual Allerton Conference on Communication, Control and Computing, 1999.
[21] Ravid Shwartz-Ziv and Naftali Tishby. Opening the black box of deep neural networks via information. Information Flow in Deep Neural Networks, page 24, 2022.
[22] Jianyu Wang, Qinghua Liu, Hao Liang, Gauri Joshi, and H Vincent Poor. Tackling the objective inconsistency problem in heterogeneous federated optimization. Advances in neural information processing systems, 33:7611-7623, 2020.
[23] Naftali Tishby and Noga Zaslavsky. Deep learning and the information bottleneck principle. In 2015 ieee information theory workshop (itw), pages 1-5. IEEE, 2015.
[24] Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In S&P. 2017.
[25] Wanrong Zhang, Shruti Tople, and Olga Ohrimenko. Leakage of dataset properties in multi-pann party machine learning. In USS, 2021.
[26] Avrim Blum, Katrina Ligett. and Aaron Roth. A learning theory approach to non non-interactive database privacy. Proceedings of the 40th Annual ACM Symposium on Theory of Computing. pages 609-6188 2008.
[27] Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, llya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pages 308-318, 2016.
[28] Peter Kairouz, Sewoong Oh, and Pramod Viswanath. The composition theorem for differential privacy. In Proceedings of the 32nd International Conference on Machine Learning, volume 37 of JMLR Workshop and Conference Proceedings, pages 1376-1385, 2015.
12

---

[29] Jie Zhang, Zhiqi Li. Bo Li, Jianghe Xu, Shuang Wu, Shouhong Ding, and Chao Wu. Federated learning with label distribution skew via logits calibration. In International Conference on Machine Learning, 2022.
[30] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. Technical report, University of Toronto, 2009.
[31] Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms. arXiv preprint arXiv: / 1708.07747, 2017.
[32] Yuval Netzer, Tao Wang. Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits in natural images with unsupervised feature learning. In NIPS Workshop, 2011.
[33] Tzu-Ming Harry Hsu, Hang Qi, and Matthew Brown. Measuring the effects of non-identical data distribution for federated visual classification, arXiv preprint
2019.
[34] Zhenheng Tang, Yonggang Zhang, Shaohuai Shi, Xin He, Bo Han, and Xiaowen Chu. Vir- tual homogeneity learning: Defending against data heterogeneity in federated learning. In International Conference on Machine Learning. 2022.
[35] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770-778, 2016.
[36] Jun- Yan Zhu, Taesung Park, Phillip Isola, and Alexci A Efros. Unpaired mmage-to-image translation using cycle-consistent adversarial networks. In Proceedings of the IEEE international conference on computer vision, pages 2223-2232, 2017.
[37] Omid Poursaeed, Isay Katsman, Bicheng Gao, and Serge Belongie. Generative adversarial per- turbations. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 4422 4431, 2018.
[38] Irina Higgins, Loic Matthey, Arka Pal, Christopher Burgess, Xavier Glorot, Matthew Botvinick, Shakir Mohamed, and Alexander Lerchner. beta-vae: Learning basic visual concepts with constrained variational framework. In ICLR, 2017.
[39] Zecheng He, Tianwei Zhang, and Ruby B Lee. Model inversion attacks against collaborative inference. In Proceedings of the 35th Annual Computer Security Applications Conference, pages 148-162, 2019.
[40] Yuheng Zhang, Ruoxi Jia, Hengzhi Pei, Wenxiao Wang, Bo Li, and Dawn Song. The secret revealer: Generative model-inversion attacks against deep neural networks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2020.
[41] Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pages 3-18. IEEE, 2017.
[42] Tzu-Ming Harry Hsu, Hang Qi, and Matthew Brown. Federated visual classification with real- world data distribution. In European Conference on Computer Vision, pages 76-92. Springer, 2020.
[43] Qinbin Li, Bingsheng He, and Dawn Song. Model- federated learning. In Proceedings of the IEEF/CVF Conference on Computer Vision and Patlern Recognition, pages 10713-10722 2021.
[44] Hongyi Wang, Mikhail Yurochkin, Yuekai Sun, Dimitris Papailiopoulos, and Yasaman Khaz- aeni. Federated learning with matched averaging. In International Conference on Learning Representations, 2020.
[45] Xiaoxiao Li, Meirui Jiang, Xiaofei Zhang, Michael Kamp, and Qi Dou. Fedbn: Federated learning non-iid features via local batch normalization. In ICLR, 2021.
13

---

[46] Eunjeong Jeong, Seungeun Oh, Hyesung Kim, Jihong Park, Mehdi Bennis, and Seong- Lyun Kim. Communication-effioee on-device machine learning: Federated distillation and augmen- tation under non-iid private data, arXiv preprint arXiv: /81 1. 1479, 2018.
[47] Yunhui Long, Boxin Wang, Zhuolin Yang, Bhavya Kailkhura, Aston Zhang, Carl Gunter, and Bo Li. G-pate: Scalable differentially private data generator via private aggregation of teacher discriminators. Advances in Neural Information Processing Systems, 34:2965-2977,, 2021.
[48] MyungJae Shin, Chihoon Hwang, Joongheon Kim, Jihong Park, Mehdi Bennis, and Seong-Lyun Kim. Xor mixup: Proceedings of the International Conference on Machine Learning, 2020.
data augmentation for one-shot federated learning. In
[49] Hongyan Chang, Virat Shejwalkar, Reza Shokri, and Amir Houmansadr. Cronus: Robust and heterogeneous collaborative learning with black-box knowledge transfer. arXiv preprint 1rXiv:1912.11279, 2019.
[50] Yue Tan, Guodong Long, Lu Liu, Tianyi Zhou, Qinghua Lu, Jing Jiang, and Chenggi Zhang. Fedproto: Federated prototype learning across heterogeneous clients. In AAAI Conference on Artificial Intelligence, volume I, page 3, 2022.
[51] Nanxuan Zhao, Zhirong Wu, Rynson WH Lau, and Stephen Lin. What makes instance discrimination good for transfer learning? In ICIR, 2021.
[52] Kaiwen Yang, Tianyi Zhou, Yonggang Zhang, Xinmei Tian, and Dacheng Tao. Class- disentanglement and applications adversarial detection and defense. Advances in Neural Information Processing Systems, 34: 16111665116600 2021.
[53] Zhen Fang, Yixuan Li, Jie Lu, Jiahua Dong, Bo Han, and Feng Liu. Is -fitt-idisti detection learnable? Advances in Neural Information Processing Systems, 2022.
[54] Zhiwei Liu, Liangwei Yang. Ziwei Fan, Hao Peng, and Philip S Yu. Federated social recommen- dation with graph neural network. ACM Transactions on Intelligent Systems and Technology (TIST), 13(4):1-22 2022.
[55] Houliang Zhou, Yu Zhang, Brian Y Chen, Li Shen, and Lifang He. Sparse interpretation of graph convolutional networks for multi-modal diagnosis of alzheimer's 's disease. In International Conference on Medical Image Computing and Computer-Assiste Intervention, pages 469-478. Springer, 2022.
[56] Kong Huang, Yutong Zhou, Ke Zhang, Jiacen Xu, Jiongyi Chen, Di Tang, and Kehuan Zhang. HOMESPY: the invisible sniffer of infrared remote control of smart tvs. In 32nd USENIX Security Symposium, USENIX Security 2023, Anaheim, CA, USA, August 9-11, 2023. USENIX Association, 2023.
[57] Wenrui Diao, Rui Liu, Xiangyu Liu, Zhe Zhou, Zhou Li, and Kehuan Zhang. Accessing mobile user's privacy based on IME personalization: Understanding and practical attacks. J. Comput. Secur., 26(3):283-309, 2018.
[58] Lucien K. L. Ng and Sherman S. M. Chow. Sok: Cryptographic neural-network computation. In IEEE S&P, 2023.
[59] Yu Zheng, Qizhi Zhang, Sherman S. M. Chow, Yuxiang Peng. Sijun Tan, Lichun Li, and Shan Yin. Secure softmax/sigmoid for machine-learning computation. In ACSAC, 2023.
[60] Ran Canetti. Universally composable security: A new paradigm for cryptographic protocols. In FOCS, 2001.
[61] Salil P. Vadhan and Tianhao Wang. Concurrent composition of differential privacy. In Kobbi Nissim and Brent Waters, editors, Theory of Cryptography 19th International Conference, volume 13043, pages 582-604, 2021.
[62] Si Chen, Mostafa Kahla, Ruoxi Jia, and Guo-Jun Qi. Knowledge-enriched distributional model inversion attacks. In Proceedings of the IEEF/CVE international conference on computer vision 2021.
14

---

[63] Alain Hore and Djemel Ziou. Image quality metrics: Psnr vs. ssim. In 2010 20th international conference on pattern recognition, pages 1366-2369 IEEE, 2010.
[64] Zhenbo Song, Zhenyuan Zhang, Kaíhao Zhang, Wenhan Luo, Zhaoxin Fan, Wenqi Ren, and Jianfeng Lu. Robust single image reflection removal against adversarial attacks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24688-24698, 2023.
[65] Daliang Li and Junpu Wang. Fedmd: Heterogenous federated learning via model distillation. arXiv preprini 1910,0391, 2019.
[66] Tao Lin, Lingjing Kong, Sebastian U Stich, and Martin Jaggi. Ensemble distillation for robust model fusion in federated learning. Advances in Neural Information Processing Systems, 33:2351-2388 2020.
[67] Lin Zhang, Li Shen, Liang Ding, Dacheng Tao, and Ling- Yu Duan. Fine-tuning global model via data-free knowledge distillation for non-iid federated learning. Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 10174-10183, 2022.
[68] Felix Sattler, Tim Korjakow, Roman Rischke, and Wojeiech Samek. Fedaux: Leveraging unlabeled auxiliary data in federated learning. IEEE Transactions on Neural Networks and Learning Systems, 2021.
[69] Yae Jee Cho, Jianyu Wang, and Gauri Joshi. Client selection in federated learning: Convergence analysis and power-of-choice selection strategies. arXiv preprint arXiv:2010.01243, 2020.
[70] Antoine Chatalic, Vincent Schellekens, Florimond Houssiau, Yves-Alexandre De Montjoye, Laurent Jacques, and Rémi Gribonval. Compressive learning with privacy guarantees. Informa- lion and Inference: A Journal of the IMA, 1 11(1):251-305 2022.
[71] Kuntai Cai, Xiaoyu Lei, Jianxin Wei, and Xiaokui Xiao. Data synthesis via differentially private markov random fields. Proceedings of the VLDB Endowment, 14(1 (((11)2110-2202, 2021.
[72] Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, and Dawn Song. The secret sharer: Evaluating and testing unintended memorization in neural networks. In USENIX Security, 2019.
[73]
Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. In NeurIPS, 2019.
[74] Milad Nasr, Reza Shokri, and Amir Houmansadr. Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In SP, 2019.
[75] Zonghao Huang, Rui Hu, Yuanxiong Guo, Eric Chan-Tin and Yanmin Gong. DP-ADMM: idmm-based distributed learning with differential privacy. JEEE TIFS, 2020.
[76] Kang Wei, Jun Li, Ming Ding, Chuan Ma, Howard H. Yang, Farhad Farokhi, Shi Jin, Tony Q. S. Quek, and H. Vincent Poor. Federated learning with differential privacy: Algorithms and performance analysis. In IEEE TIFS, 2020.
[77] Galen Andrew, Om Thakkar, Brendan McMahan, and Swaroop Ramaswamy. Differentially private learning with adaptive clipping. Advances in Neural Information Processing Systems, 34:17455-17466 117666 2021.
[78] Dirk van der Hoeven. User-specified local differential privacy in unconstrained adaptive online learning. In NeurIPS, 2019.
[79] Lichao Sun, Jianwei Qian, and Xun Chen. L.DP-FL: practical private aggregation in federated learning with local differential privacy. In IJCAI, 2021.
[80] Hao Peng, Haoran Li, Yangqiu Song. Vincent Zheng, and Jianxin Li. Differentially private fed- crated knowledge graphs embedding. In Proceedings of the 30th ACM International Conference on Information & Knowledge Management, pages 1416-14 142511255000 2021.
15

---

A Overview of FedFed Framework
Server
Feature Distillation Phase
Data Sharing Phase
Globally Shared Data
Training
Protected Performance- Sensitive Features
Model Update Phase
Figure 4: Overview of FedFed
Feature Distillation
X Xy Xx
Local elassifier f(:
Protected Performance
Generative q(:0) 0)
X,
Sensitive
Raw Data
Pro Protection
Loss
Figure 5: The Pipeline of Feature Distillation
The training process of the federated learning system with FedFed can be summarized into four phases. Firstly, every participant of FL distils the local private raw data and decouples x into performance- robust features x, and performance-sente sensiiive features x, during the feature distillation phase. Then all clients send Xp to construct a global dataset, X, with DP protection and keep x, locally. In local training phase, the selected clients sample subset from the globally shared dataset and update the local model with local raw data x and sampled information x, from server. Finally, clients upload the latest local model and aggregate a global model based the weighted average strategy in FedAvg. Figure shows the overview of FedFed framework, while Figure 5 depicts its pipeline of feature distillation. The loss function of feature distillation in Figure can be formulated as Eq (9).
certain aggregation algorithm, like
B Federated Learning Algorithms with FedFee
B.1 Implementation Details
We list all relevant parameters in this paper in Table 7. We fine-tune learning rate in the set of {0.0001, 0.001, 0.01, 0.1) and report the best results and corresponding learning rate. Whereas, use 0.01 as the learning rate. In our work, we deploy FedFed on SCAFFOLD and set the learning rate 7/ to 0.0001 for the SVHN dataset. Furthermore, use 7 0.001 in SVHN while FedNove deployed with our method.
The batch size is set as 64 when K = 10 and 32 for K = 100. On the server side, we select clients for aggregation per round when K 10, and clients per round when K 100. This corresponds to sampling rate of 50% for 10 clients (K = 10) and 10% for 100 clients (K 100). The noise level in our experiments is (O, 0.15). Besides, all experiments are performed on Python 3.8, 36 core 3.00GHz Intel Core 19 CPU, and NVIDIA RTX A6000 GPUs.
16

---

Table 7: The values of all parameters in this paper
Symbolic representation
Value
Description
Federated Learning Relevant
0.1/0.05
heterogeneity degree
Ta
communication round feature distillation
T.
1,000
communication round of classifier training
Fid
local epochs of feature distillation
/
Er
1/5
local epochs of classifier training
0.15
DP noise level, added to X, #selected clients every communication round
5/10
K
10/100
#clients of federated system
Training Process Relevant
0.01/0.001/0.0001
learning rate
B
32/64
batch size
M
0.9
momentum
wd
0.0001
weight decay for regularization
"#" represents the number of, and "f" denotes we try these values for these symbolic representations.
B.2 Pseudo-code and Explaination
In this section, we give the pseudo-code of FL algorithm with FedFed. Algorithm 2 gives the procedure of FedAvg and FedProx with FedFed. The difference between FedAvg and FedProx the local objective function, and we highlight it in the following equation:
min xx, ox), + (( (x(x(((xp)))))) + 111 - (1I) 64
6312,
SCAFFOLD attempts to estimate the client shift degree to correct client update direction. Particularly. works through server control variate e and client control variate с of client k. SCAFFOLD with FedFed is summarized in Algorithm 3. And FedNova is proposed to resolve the objective inconsistency for defying data heterogeneity. The outline of our plugin deploys on FedNova the Algorithm 4. In accordance with our process of how to apply FedFed, every participant of the FL system can deploy our framework easily without any modification of objective function or aggregation scheme in their own methods.
C Full Analysis on Information Theory Perspective
C.1 Features Partition
From an information theory perspective, we present formal definitions, namely Definition 3.1 and Definition 3.2, to define performance-robust features and performance-senste
features. Specifically. Definition 3.1 captures the desirable attributes when we partition the features, which are abstracted to be variable in general. A valid partition should maintain all information of the original variable X losslessly. That is, neither extra information introduced nor key information is lost. So we can get (i) and (ii) in Definition 3.1. After determining the measure space, we partition the X to be X X1 + X2. The mutual information of X, and X₂ none. Here, X, and X₂ can be symmetric. Or saying, there is overlap between X1 and X2, as described by (iii) in Definition 3.1.
17

---

Algorithm 2 FedAvg/FedProx with FedFed
Server Input: initial global model ΦD, communication round Ty. Client k's Input: local epochs Er, local private datasets D*, learning rate M/e
Initialization: server distributes the initial model 6 all clients,
Generate globally shared dataset D Detail in Algorithm 1
Distribute De to all clients and D D UD*
Server Executes:
for each round r = 1.2. .T. do
server samples subset of clients C S. fI...., K}
server communicates o" to selected clients l Cr for each client & E C. parallel do
@f-1 +- Client_ "oant_Traanin(kk 6*)
end for Φ++1 < AGG(
end for
Client Training(k; )"):
o' initialize local model oz
for each local epoch with 1,2, E, do
0+1 SGD update with Di using Eq. (10), FedProx uses Eq. (11)
end for Return of to server
Built upon the Definition 3.1, we present the definition of performance--eessitvee features and performance-robust features, in Definition 3.2. Intuitively, performaacee-snsiitve features contain all label information, while performance-robus features contains all information about the data except for the label information. That is, the features be partitioned are either performance-sente senssiive features or performance-robus features.
C.2 FedFed on Information Bottleneck Perspective
In this section, analyse FedFed under information bottleneck(IB) aspect. In conventional, information bottleneck [21] can be formalized as:
min I(X; YI2), s.t. 2
la.
(12)
where restrict the complexity of encoding Z. Information entropy is denoted H-) and [(::))
is the mutual information of two variables. In FedFed, our competitive mechanism stems from IB getting the following definition:
min I(XYYIZ); s.t. I(X Z;X 2 Ic.
min (Y), s.1. H()) S He,
(13)
2
min E log 22, s.1. |//| < p.
According framework, be defined get the optimization view of FedFed:
x, 9(x; 0): and then the
Degply'x-(xxx min - (x..))) logplyix - 9(x;0)), s.t. || ((x; 0)13 <
(14)
Ultimately, in an information bottleneck perspective, min, E log ply| (xx; intend contain more information that can be used for generalization. ||x (xx; 0) aims distilling raw data for minimum features which means maximal compression of x..
18

---

Algorithm 3 SCAFFOLD with FedFed
Server Input: initial global model Φº, communication round T., server control variate c = 0. Client k's Input: local epochs Er, local private datasets D learning rate 7j,, variate
Initialization: server distributes the initial model Φ0 to all clients, Generate globally shared dataset D f- Detail in Algorithm
Distribute D to all clients and D D UD* Server Executes:
for each round 1. do server samples subset of clients C, S (L,
server communicates o" selected clients & Cr for each client &s E C, in parallel do
A Ac Client Client_Training( Training(k;, ,", c))
end for Φ+11 < AGG(A ct c+ Cc Ac
K
end for
Client Training(k, ,),c);
o" initialize local model of for each local epoch with 1,2, ... E, do Φ5t1 end for
+ -%
n Vo (x(
ct + c). (SGD update with D use Eq. (10))
o + (i) oz (o( or (ii)c cc
Ene
Act of
Ck
A t ox r+ o"
Ck f- ck
Return (AØtt), Ae) server
Proof.
To get Eq (13), we firstly have:
I(X;Y Z) = I(X;Y) -IX;)=
+ - (((;)) - I(Y:
+ H())) -
(()))
H(Y) H(Z)
-XXX))))+
=H(X)- ((X)))H(XY)---- H(Z) H(Y -
(IX;Z)-((2) H(2) 2(
H(())+((Y(2) H(2) -((IXX
H(Y -XXZ))
(XYZ))H((YXX)
1(X - Z = I(X - Z;X) - -1(X -2;;2
H(X - +2) H(X - - 1(X 2)
Н(X -()+ H(X - -XXX---XXXX,)
H(X,
+
Z,2)]
H(X -()+ - H(X 7,X) (x))-(()) -(X)-H(C (18)-H(1) H())
H(X,2)+#(XII -)- -(X
-I) - -Z,X) -,X)-H((2) + -I())+((XXX,,, H(XXX - -Z)
([(--] H(X) - H(Z)+ H(X)+H((X)) -7)
H(X
+ +
H(X,X-2) H(Z)
H(X)-H() -H(Z).
- 2;X 2 1. & H(X) -H(2) 2 T. H(Z) < H(x) T, H. H(2) S H
(15)
19

---

Algorithm 4 FedNova with FedFed
Server Input: initial Φ², communication round T...
Client kss Imput: Epochs Er, local private datasets D learning rate Wee momentum factor Pk- Initialization: server distributes the initial model 6 all clients,
Generate globally shared dataset D Detail in Algorithm I
Distribute De to all clients and D D D
Server Executes:
for each round r = 1, .... Tr do
server samples subset of clients C, S fI...., K} server communicates o" to selected clients l Cr for each client ls E C, in parallel do
A t- Client Training k, 6*) end for Φ++1 -- Exeg, Ekec. K
Aor
K
end for
Client Training(k: xr): 6" initialize local model o%
for each local epoch with 1, ... E, do
Φx+1 SGD updata with Dj use Eq. (10))
end for OK Adk
E 0n g en)) 2k)
(Ø)+1 (1a((1)a))
Return AØr aa. server
Then, get minz I(X;YIZ), s.t. I(X Z;XIZ) Ie + minz H(YlZ), H(Z) s He. Furthermore, we have:
H(V = ((2)H((V12 = =2)d2 f
p(z)) / p(y 2)) log
p(ylz) dydz
[ ply, 2) ply 2)dydz
= E Elog p(ylz).
1 d
1 d
H(Z) <
In Var 2me 2 1=1
Σ
In Var(z,)
Σ 2 1=1
In 2ne
(16)
1=1
$
In Var(z;) + dlnn 2xe
Σ In E(z²)
In 25e
d
=
E
z + dln 2 $ Ho
1=1
=1112113 < e 2H 2 P.
which completes the proof.
D Full Analysis on Differentially Private Features
Our security analyses contain steps, saying, differential privacy for each client and the overall analyses for FedFed. Built upon previous works [27, 16), we derive Lemma D. below. For FedFed, attain Lemma D.2 by limiting o, cc.
Lemma D.I. For sharing raw features x, (e, D)DD holds if'' Ol//Rlog(/////// + p))a,))
20

---

Lemma D.2. For sharing performance-senstivv features X,, (c,8)-DP holds if
Oppy/t (ooo/ooog////s/
D.1 Analysis and Proof for Theorem 3.3
Recall that DP-SGD [27] samples i..d. noise from unbias Gaussian distribution (O, S70"), where Sy is the sensitivity. At the algorithmic level, the noise sampled from (V, O0, I² is added to a batch of gradients handled by clipping value C.
For aligning analyses with conventional DP guarantees, we adopt similar notations and expressions. Specifically, we denote the noise distribution operated on x, to be be o and the noise distribution operated on x, to be (0, I.... Notably, FedFed only adds DP noise X, in practice, Since X,- is kept by the corresponding client, an adversary could attain nothing (or be regarded as random data without any entropy). This could be regarded as adding a sufficiently large noise on x,, thus we consider the o, + oc. As for Xg, we employ the f2-norm clipping when selecting the noise level o,,
be two parts, i.e., x x= =x, + X5 for the latter comparison to FedFed. This trick motivated by cryptographic standard proof with ideal/real paradigm [60]. For both x, and X,, the noise addition follows DP-SGD's idea, except for adding noise to the sampled data for updating gradients, rather than the latter-computed real gradients. We remark that this method works for FL but may be different for centralized training (with identical training set in the whole training process).
Now, let's come back the setting of sharing all raw data x. We still regard
Using the property of post-proce processocssing [16], the noise added to the data passes to (or projects to) the following gradient updates. For the view of each client, we know that Theorem D.3 holds for a operated on from [27].
Theorem D.3. There exist constants C1 and C2 so that given the sampling probability q = L/N and the number of steps T, for any < C19"T. The algorithm of DP-SGD is (c, didfffeerettlll private for any d > 0 if we choose o = =2 2V T (1/()
For strong composition theorem, the choice of in Theorem D.3 is Olg ( log In DP- SGD, the 7' denotes the number of training steps, which means the times of using/sampling private data for DP training. Such meaning represents communication rounds in FL, in which each client receives globally shared data at each round of communication. In the FedFed, we denote the number of communication rounds to be R. Now, let's handle the q. where q represents the ratio of lot size and the inputting dataset size. In DP-SGD, the per-lot data is directly sampled from the database of size N. In other words, lot of data is the subset of the input dataset. In the FedFed, the training data fed to each client's 's model is the same as the database size, i.e., N/N = 1.
DP-SGD asks for the generality and thus bounds [lf(-)] e. Yet, FedFed sets x ||xe||. which does not ask for general case. We use the notation ||x,||2 to represent the domain of performance- sensitive features. On the other hand, ||x||2 represents the domain of all features (namely, the "domain of datasets"). We additionally borrow the definition of ly-norm and move ||x, ll out in the proof. By Equation 8, the client takes p||x|| for selecting a.. Since we aim to make an asymptotic analysis here, we ignore the scalars and constants here. Thus, we attain Oppv R Rog(( (1/))/e) for selecting a. By rearranging variables, we have = PV logg8)8) for a loose analysis.
Before continuing the proof, we derive Lemma D.4 to get the relation between ||x,||| and ||ز|| for latter usage.
Lemma D.4. Letx, = X x-XXX Xy. Then, it holds that (1 (1-1ph (bppp] < satisfies.
||x,||| p) if [x|| p||x||
Proof of Lemma D.4: ||x x, || pl p||x|| = ||x
x, 1 p² ||x|| = ||x||2 + x, || 2xTx,
p² |x| =
|2
+ ||x,| 2 ----22222 |||x||||X cOS x,) = p² |x| Since ||x|| > 0 and
||x,|| || > 0, we get,
||||\/|>=|| + ||xx|/ - 2 cos x,) = |||||] |||||
Let ||x,||| a a||||||, and our objective is to get the By replacing ||x| ||x||| and
| ||/||||||||| with
1/a and a respectively, we get,
1/a + 2 cos(x, (x x,) = p² p²/a.
'Previously "2", take the special case "=" the same DG-
21

---

Since 5 cos(x, S 1, we get,
-2 1 + a -2 -2a 2// 20. 2a.
Since 0 < we take 1/ a p² 2a and get (a 1)2 p². Then, get the meaningful 1 p. Therefore, we attain,
answers -- - -
- [) - a | & (1 + |||| = (1 [ Σ ||x||| = (1 + ||||=||
|>||
Following above, we can establish the relationship between ||x||2 and ||x, 2l2 as follows:
||x||22 S e||x||2-
And the relation between noise level 0g and x, is:
Ox < x S p||x||2 p.M,
where we re-scale data into [0, and assume the fn-norm of data is less than M 0. To ensure the |x $ p.M, we clip the norm for each sample, which is widely used in DP [27].
O
Now, let's go back to derive Lemma D.1 and Lemma D.2, and continue the proof. For sharing raw data x, we employ the same method as aforementioned. Since ||x,|| = -||x||, we get c' PV R log(1//)/o By Lemma D.4, know that (1 p) I
|| x (1 p) holds. Thus, attain,
(1 - p) / R Rlog (1/8)/, s c, S (1 + p) R log((1 (1/5)//r
Here, we take e 2 (1 p) v Rlog(1/0) since expect loose case. By combining &e and éy. we attain,
e' O Rt Rlog((//))(///.. + +1--)/oo.)
for sharing raw as Lemma D. Now, let's take FedFed into consideration. The major difference that x, is kept locally in the whole training process. The root cause lies in that the x, owned by the client is privacy-nnsesiiti to this corresponding client. We regard ar operated on x, to be sufficiently large value. Thus, given << 1, we get,
lim 6, p) p)v Rlog(1/8)/or + Gr +00
That is, for sharing x, in FedFed, we have e = - 6, 0(p/on (lll//.//og())))) log(t)), as Lemma D.2.
Let's conversely think Lemma D.1 and Lemma D.2. Now, the proof in the following is very straightforward. If we take identical 0, operated x, for FedFed and sharing raw x. We know that e' > e. Conversely, if we take identical e' we should increase 1/o,, and thus reduce a., given constant /V R (1)) Thus, for protecting training data in FI., we can attain Theorem 3.3 to summarize the superiority of FedFed when asking for identical privacy guarantee. Theorem 3.3 explains the reason for the superior model performance of FedFed, which intrinsically boils down to a relatively small a compared with sharing raw data x.
D.2 Analysis and Proof for Theorem 3.4
Previously, we showcase the view of each client for analyzing privacy. Albeit we do not aim at new DP theorem, we expect a tighter privacy analysis for FedFed by using the advanced result [28]. Vadhan and Wang [61] prove that when the interactive mechanisms being composed are pure differentially private, their concurrent composition achieves privacy parameters (with respect to pure or approximate differential privacy) that match the (optimal) composition theorem for noninteractive differential privacy. To be specific, we follow the proof logic of Theorem D.7 [28] for analyzing globally shared data from all clients.
Given (eg, DDP at each client side, we utilize the composition theorem to analyze overall privacy in FedFed. The concept of sensitivity below is originally used for sharing dataset for achieving (c, 6) difffereentaa privacy.
Definition D.5 (Sensitivity [28]). The sensitivity of query function D - for any two neighboring datasets D, D' is A maxp,D' [[D) F(D')),, where || denotes L1 or L2 norm.
22

---

Privacy loss is random variable that accumulates the random noise added to the algorithm/model, which is utilized in Theorem D.7.
Definition D.6 (Privacy Loss (28)). Let M : + R be a randomized mechanism with impul domain D and range R. Let D, D' be a pair of adjacent dataset and aux be an auxiliary input. For an oulcome E R. the privacy loss at o is defined by Epr - Log((r(MM(aux, D) ol o)/Pr[M(axx, D') ol)-
Theorem D.7 (Composition Theorem [28]). For any E > 0, E [o. 1]. and E [0, 1), the class of (e, 6) diffferrentlll private mechanisms
-differrnnnt privacy under (Ez: ( 6,)
k-fold adaptive composition for E3 = min kke, (e (c' + +1)++1 (c" +1) + ev 2h log (o8))
+ e 2 logle + (k22/8) (c
Proof. Definition D.6 gets c(po on an outcome variable over databases D and D'. This proof starts with a particular random mechanism M with further generalization. The mechanism M does not depend on the database or the query but relies on hypothesis hp. For hp = O, the outcome O₂ of M is independent and identically distributed from discrete random distribution Ohp= pi.o (i)(() is defined to be: 8 for 0 = 0; (1 6)e²/( + e5) for o 1; 8) + e*) for o 2: O for o 3. For hp- 1, the outcome O of M. is Ohp=1 pi, (o) is defined be: 0 for o = 0; - () + e²) for o = 1; 6)e /(1 + E²) for o = 2; for = 3.
Let R(c, 5) be privacy region of a single access to M The privacy region consists of two rejection regions with errors, i.e., rejecting true null-hypothesis (type-l error) and retaining false null-hypothesis (type-Il error). Let E 8 be MM.ss parameters for defining privacy. R(M, D, D') of any mechanism M can be regarded as an intersection of ((e) } privacy regions. For an arbitrary mechanism M, we need to compute its privacy region using the (cl. 5%) pairs. Let D, D' be neighbouring databases and O be the outputting domain. Define (symmetric) P, P' to be probability density function of the outputs M(D), M(D"), respectively. Assume a permutation over O such that ('()) (()(
Let S denote the complement of rejection region. Since R(M, D, D`) is convex, have 1 of + P(S) - P'(S) S o%. Define Dt. (P, P') maxsco (P(S) e ce'P'(S). Thus, M's privacy region the set: f(e), 5%) : c [0, oo)] s.t. P(o) = e (o), (P)P"). Next, we consider composition on random mechanisms Mi,.... M,. By accessing Dt 4
P(S) 2 P's) (
M P(OLhhp 01, 01, 0.) P (0;). By algebra on two discrete distributions, Dt(i-2jje (Pi, (P')) = 1- 5) + (1- 53 (I (Hee(i-)) ()(i-2)+))) (11 + et)*t Hence, privacy region is an interaction i regions, parameterized by - (1 - -1 - 5.).
Now, by Lemma D.2, we get Theorem 3.4 directly. In summary, FedFed protects two types of data features using two different protective manners, i.e., small noise for performance-sensitre features and extremely large noise for performance-robust features, and thus attains higher model performance and stronger security in the same time.
E
More Results on Attack
E.1
More Details on Model Inversion Attack
In this section, we present additional results of the model inversion attack. When the central server assumes the role of the attacker without access to the original data, it exhibits a diminished performance in attacking the model. The raw data of Figure 3 (a) and (b) can be found in Figure 6(a). As we can see, x, still causes privacy leakage and Figure 6(b) also gives the intuitive necessity of DP protection on x,.
Inspired by generative model inversion methods [40, 62], we conduct another experiment where one of the clients acts as the attacker. Similar to GMI [40], the method involves leveraging auxiliary dataset and public dataset to launch an attack on the target model. In our experiments, we utilize the globally shared dataset as the auxiliary dataset, while the local private data serves the public
23

---

(a) Raw data x
(b) Attack on X,
(c) Attack on Xp
Figure 6: Model inversion attack. White- White-Box attack performance- features x, and globally shared data Xp, Xp X, + +n, o2))
Figure 7: Generative-based model inversion attack results.
dataset because the client has access to its own local data. Under this scenario (results in Figure 7), the attacker's s performance is better than when the server acts as the attacker, while the attacker is still unable to recover data from the shared features. The model architectures of generative-buse based model inversion attack are listed in Table
E.2 More Details on Membership Inference Attack
80
Recall [%]
60
40
share with 0
share with =
20
share x with 0.15
=.25
share with 002
share with o² 0.3
0
100
200
300
400
500
Round
Figure 8: Attack process. Perform membership inference attack on global model per 10 communica- tion rounds.
Theorem 3.3 true empirically?
Membership inference attack(MIA) [41, 15] attempts to infer whether a particular data point is in the target model's 's training set. Specifically, the global model on the server side can be regarded as the target model in FL. In our setting, we train shadow model with globally shared data. Then the membership attack can be regarded
binary classification task, member data or non-member data. The input of the attack model is the top-k vector of the output from the shadow model. To compare the superiority of sharing partial data rather than the complete data with DP, we conduct MIA to explore the divergence experimentally. Sharing raw data cause more information leakage (higher

---

Table 8: The model architectures used in generative-based model inversion attack
The encoder structure of the generator takes input the globally shared data
Type
Kernel
Dilation
Stride
Outputs
5x5
1xl
32
conv
3x3
2x2
64
3x3
1x1
64
conv
3x3
2x2
128
3x3
1x1
128
conv
3x3
1x1
128
3x3
1xl
128
conv
3x3
4
1xl
128
3x3
8
1x1
128
conv
3x3
16
Ixl
128
The encoder structure of the generator takes input the latent vector
linear
2048
deconv
5x5
1/2x1/2
256
deconv
5x5
1/2x1/2
128
The decoder structure of the generator
deconv
5x5
1/2x1/2
128
deconv
5x5
1/2x1/2
64
conv
3x3
Ixl
32
conv
3x3
Ixl
3
The global discriminator structure
conv
3x3
2x2
64
3x3
2x2
128
conv
3x3
2x2
256
3x3
2x2
512
conv
1x1
4x4
recall of MIA) than partial data with the same DP level. However, the FedFed needs relatively small noise a to achieve comparable protection. The attack process is shown in Figure 8.
Supplementary for Experiments
Visualization of Data Heterogeneity
client
(a) LDA (a = 0.1)
(b) #C =
(c) Subset
Figure 9: Data distribution in various FL heterogeneity scenarios. Different colours denote different labels and the length of each line denotes the data number. As see, in FL setting, mainly perform on two kinds of Non-IID scenarios, including label skew and quantity skew.
We show the visualization of data distribution in Figure 9. The LDA partition and the #C partition have the label skew and the quantity skew simultancously. And the Subset partition only has
25

---

the label skew. #C = & means each client only has different labels from dataset, and k controls the unbalanced degree. The subset method makes each client have all classes from the data, but one dominant class far away outnumbers other classes.
F.2 More Guessing Games
3
A
B
C
A
B
C
76 A
7
B
Figure 10: Guessing Games
Question: Which one is the first image from in each row? A or B or C?
Let's play more guessing games here. We selected samples from the same category for the purpose of reducing the difficulty. The answer in Figure I is C. The answers in Figure 10 are (B, A, A) in order.
E33 Sharing Protected Partial Features vs. Protected Raw Data
Accoracy [14]
-00
60
40
Share partial feature with DP
20
Share raw data with DP
500
750
1000
Round
Figure 11: Performance on different information sharing strategies with DP protection: raw data and Xp under the same protection strength.
In this section, we compare the performance divergence of applying DP to protect different sharing information, i.c., performance-sensitiv features Xp and raw data x. The results is shown in Figure
F4 More experimental results
We provide more comparison results this section to demonstrate superiority of FedFed. Fig-
ure 12, Figure 13, Figure 14, Figure 15 have shown our enhancement in four datasets. In this paper, we mainly have four settings in our experiments: (1) 0.1, = 1, = 10: (2)
0.1, E 5, K 10; (3) 0.05, E K, 10; (4) a 0.1, E 1,11, 1, 100.
26

---

Table 9: Different sampling rates of FedFed under a = 0.1, E = 1, K = 100 over CIFAR-10 10
Sampling rates
5%
10%
20%
40%
60%
Accuracy
83.67
84.06
87.98
89.17
89.62
Round to reach target accuracy
182
163
90
70
61
Test Aucuracy [S5]
80
Tox. Accuuuurrr (%)
$0
N0
60
60
60
80-
#0
Foodeg
SCNPFOLD Paiifce
SCAFFOLD
20
20
20
250
500 Round
750
1000
0
100
200
300
400
250
500
750
1000
Round
Round
(a) a 0.1, 1, K 10
(b) a 0.1, E 5, K
10
(c) a = 0.1, E. =
1, 100
Figure 12: Convergence and test accuracy comparison on CIFAR-10.
In addition, we investigate the impact of varying sampling rates on the performance of our FL system, and present the results in Table 9. We observe that increasing the sampling proportion leads to gradual improvements in the model's performance, as well as faster convergence. This is due to a larger number of clients participating in each round, resulting in more consistent update directions for the aggregated model and the global model.
We also conduct tests on FedFed using various levels of heterogeneity, such as 0.5 and a 1. The results are presented in Tables 10 and 11. As the value increases, the original performance of FedAvg demonstrates significant improvement, while the performance enhancement of FedAvg deployed with FedFed is comparatively lower. This discrepancy can be attributed to the reduction in heterogeneity increases. When reaches 1.0, the data distribution among clients becomes nearly homogeneous. As a result, the effectiveness of FedFed in mitigating heterogeneity through information sharing diminishes significantly.
F.5 More Results Impact of DP noise
In this section, we present additional results on the impact of DP noise on three other datasets, as shown in Figure 16. Our findings indicate that as the level of DP noise increases, the privacy budget decreases and the ability to protect information increases, but the performance of the model decreases accordingly. Thus, it is crucial to find a balance between privacy and performance practical applications of our FedFed.
Tist Accunccy (86)
60.
Teet courscyy [N]]
60
60
60
40
-0
2
20
SCAPFOLD-FolSs
250
500
750
1000
0
100
200
500
400
250
500
750
1000
Round
Round
Round
(a) a 0.1, E
(b) a 0.1, 5,
10
(c) a
100
Figure 13: Convergence and test accuracy comparison on CIFAR-100.
27

---

Test Accurnoy (P6]
80
Text Accorcc [%]
30
60
80
Teat Beeeenee
60
+0
40
Febhig SCAFFOLD
Tedleg
Feduuz
SCAFROE
SCAFFOLD
SCAFFOLDI
SCAFFOLD Fatted
Faltedd
SCAFFOLD
Felhoot Tected
Tesfrcx
Fetloon Felleed
Fachooa
250
400
250
500 Round
750
1000
Round
Round
(a) 0.1, E 1,K 10
0.1, K,
(c) a 0.05, E
1, 10
Figure 14: Convergence and test accuracy comparison SVHN.
80
Text Accurecy [16]
80
Toxt Accunacy
150
60
50
$0
50
Pachea
Fedtep- Fadiia
PuskegtPachhd
Pedlyy
20
SCAFFOLDPPOdhI
SCAPTOLD
20
SCAFFOLD Di
Fallhoa
SCAFFOLD
26
Peefrrs Faaifed
SCAPPOLI*PaRe
SCAPOLD
Fatfre
Techiins TedFedd
Techooa
Fothera
TechinstPedddd
Fathors
250
1000
100
2010 Round
500
400
250
750
1000
(a)
0.1, E 1, K 100
(b) 0.1, K,
10
(c)
0.05, E = 1, K 10
Figure 15: Convergence and test accuracy comparison on FMNIST.
F.6
More Explanation: Performance-Sensitiv Features vs. Performance-Rohie Features
For an intuitive understanding of why there is no drastic performance degradation for utilizing x, as a substitute for raw data x. Formally, c.g. in the classification task, classifier trained by x gets comparable test accuracy on X, giving the verification that x, contains the primary features for generalization and vice versa. Specifically, three classifiers trained on x, Xs, and x,, Then test the generalization ability on x, x,,, and x,, separately. The result is shown in Figure 17.
As described above, X, extract from x in an IB manner contains more visual information about private data x than xs. To measure the visual similarity among performance-robust features X,, performance-sensitiv features X,, and raw data x. We choose PSNR [63, 64], prominent visual information comparisons of images, to calculate pixels error, the result is shown Table 12.
Consequently, higher PSNR denotes that X,, has the most visual information of x than X,- While x, shares similarities with in terms of its form structure, exhibits limitations that hinder its ability to enhance performance. At the same time, X, has the commensurate generalization ability like x to achieve our goal.
F.7 Overheads Analysis of FedFed
For the extra computation induced by FedFedd provide two views demonstrate the limited costs of extra computation, i.c., training time and FLOPs.
Table 13 shows that training generator requires less than 10% of the time needed to train classifier. Therefore, the additional training time required for the generator is limited.
Table 10: Top-1 Accuracy of a = 0.5, E = 1,K 10 with 50% sampling rate.
CIFAR-10
FMNIST
SVHN
CIFAR-100
FedAvg
87.68
90.32
91.11
68.98
FedFed (Ours)
93.21
94.01
93.71
69.52
28

---

29
Table 11: Top-1 Accuracy af
E.0, 1,K 10 with 50% sampling rate.
CIFAR-10
FMNIST
SVHN
CIFAR-100
FedAvg
89.45
92.38
92.03
69.02
FedFed (Ours)
94.01
94.31
93.89
70.31
85
75
JentAcuracy
los Tos.Accuracy
Ted Accoracy(5)
85
Privacy
Provady
70
Privacy
DP
Acc
Acc
65
Acc
0.2
0.5
0.1
0.2
0.3
Noise Level
Noise Level
(a) Test accuracy CIFARIO (b) Test accuracy SVHN with (c) Test accuracy CIFARI00 with different noise level
different noise level of
with different noise level o?
Figure 16: The impact of DP noise different datasets.
X
80
100
60
40
100
40
1000
X
X
X
X,
Xr
X,
(a) The generalization ability of classifier trained by raw data x.
(b) The generalization abil- ity classifier trained by performance-sensitive features X..
(c) The generalization abil- ity classifier trained by performance-robus features x..
The generalization ability graphs of three classifiers trained by different data types. The generalization ability means well-trained model tests unseen information and measures the capability to finish a certain task, i.e., classification test accuracy. our setting, we evaluate generalization ability of classifiers different information forms: data x, performance-sensitivee features X., performance-robeee features X,-
Figure 17:
Table 12: The visual similarity of various feature types. PSNR of x and x,, and x,-
X,
X,
31.47 + 1.57 18.87 + 0.98

---

Tables 15 and 14 show the model complexity results, which indicate that the computation required for the generator is approximately 8.2% of that required for the classifier. Additionally, the number of communication rounds needed for the generator is significantly lower than that required by the classifier, with only 15 rounds compared to 1000 rounds for the classifier (namely, Ta = 15 and T, = 1000).
The use of FedFed incurs additional memory usage, as the size of the globally-sharg dataset is equívalent to the combined size of all clients' data. This may have limited impacts on the bandwidth, as the generated data is only sent once. To quantitatively measure its effects, we compared the size of the dataset with that of the classifiers in Table 16. Sharing the generated dataset is equivalent to sharing classifiers in multiple rounds. For example, for CIFARIO 10, the data requires approximately 586MB of memory, while the classifier requires about 48MB, Thus, sharing the global dataset requires the same amount communication as sending a classifier in approximately
communication rounds.
Based on the aforementioned analysis, we provide a comprehensive examination of the communi- cation overheads associated with the FedFed. Consider clients the FL system. Let m be the size of single local model. The size of local private data is || | = a. Then, the ratio of the entire aK ~ 14. The extra communication cost for a single client is (m + m) Ta + ak where (m + m) Ta denotes the cost of download/upload models for Ta rounds in Algorithm 1. Here, the a denotes the performance-sensitivv features sent by each client, and aK is the data received by each client from the globally shared dataset. In the general process of FL, the overall communication costs are (m + m where 3 is the sampling rate of client. Therefore, the ratio of the extra communication overhead to the general FL process is:
dataset to a model parameter is 7, where
(m + +m) Ta a(K + 1)
To
a(K +
Ta Tx
+ 7
Y 2K T. 8
+
(17)
(m + m) T,
T,
2m T,
2T, B B
Here, we detail two examples our experiments:
For K = 10, Ta = 15, T, 1000, and B = 50%, the extra communication costs are approximately 4.54%.
When K = 100, To 15, T, 1000, and 8 10%, the extra communication costs are approximately 22.07%.
To facilitate the further deployment of FedFed, we offer three strategies tailored to different storage hardware configurations:
1. One-time download: Local clients download the globally shared dataset once. A globally shared dataset costs approximately 14x the storage of classifier model.
2. Partial download: A small portion of the globally shared dataset is selected and downloaded. This strategy incurs approximately 1.5x communication cost compared to the previous strategy, while the storage required by the clients is the same as that of local private data. This represents porage--rienddl choice that may involve trade-off in terms of performance.
3. Intermittent download: A small set of globally shared dataset is downloaded after every Z rounds. This approach reduces the communication overhead to ł of that of strategy 2 while maintaining the storage overhead at the size of the local data.
Table 13: Comparison of training time between Table 14: Parameters of Classifier and Generator Classifier and Generator
Parameters of Generator
48M
Training time of Generator 5,251 s
Parameters of Classifier
42MB
Training time of Classifier
62,901
G More Related Works
G.1 Federated Learning with Heterogeneous Data.
FI. allows the distributed clients to train a model across multiple datasets jointly. "protects" user privacy by controlling data accessibility among different clients, i.c., only the data owner has the right
30

---

Table 16: Parameters of Local Classifier and Globally-shared Data
Table 15: FLOPs of Classifier and Generator
FLOPs training Generator
16.03M FLOPs
Parameters of Local Classifier
42MB
FLOPs training Classifier 556.66M FLOPs
Parameters of Globally-shared Data
586MB
Table 17: Existing method about information sharing strategy to mitigate data heterogeneity in Federated Learning.
Shared Info
Protection on Shared Info
Attack Test
FD+FAug [46]
Model output & Synthetic info
FedMD [65]
logits
XorMixHL [48]
Statistic of data
FedDF [66]
Statistic of logits
X
FedProto [50]
Abstract cluss prototypes
FedFTG [67]
Synthetic info
CCVR [10]
Statistic logits
Model inversion attack
Fed-ZDAC [12]
Batch normalization features
FedAUX [68]
Synthetic info
Model inversion attack
FedFed (ours)
Protected partial features
Membership inference attack
access the corresponding data. FedAvg [4] is the seminal work designed reduce communication via more local training epochs and fewer communication rounds. In the following, many works [9, 5] observe that the FedAvg's 's divergence is considerable compared with centralized training if clients hold heterogeneous distribution. Even worse, the gap accumulates as the weight aggregates, potentially hurting model performance.
Recently, a series of works have tried to calibrate the updated direction local training from the global model. FedProx [6] adds an L2 distance as the regularization term in the objective function, providing a theoretical guarantee of convergence. Similarly, FedIR [42] operates on a mini-batch by self-normalize weights address the non-identical class distribution. SCAFFOLD [7] restricts the model using the previous knowledge. Besides, MOON [43] introduces contrastive learning at the model level correct the divergence between clients and the server.
Meanwhile, recent works propose designing new model aggregation schemes. FedAvgM [33] performs momentum on the server side. FedNova [22] adopts a normalized averaging method to eliminate objective inconsistency. A study [69] also indicates that biasing client selection with higher local loss speed up the convergence rate. The coordinate- wist averaging of weights also induces noxious performance. FedMA [44] conducts Bayesian non conpparacctric strategy for heterogencous data. FedBN [45] focuses feature shift Non-IID and performs local batch normalization before averaging models.
Another existing direction for tackling data heterogeneity is sharing data. This line of work mainly assembles the data of different clients to construct global IID dataset, mitigating client drift by replenishing the lack of information of clients [9]. Existing methods include synthesizing data based on the raw data by GAN [46]. However, the synthetic data is generally relatively similar to raw data, leading to privacy leakage at some degree. Adding noise to the shared data is another promising strategy [70, 71]. Some methods employ the statistics data [48] to synthesize for sharing, which still contains some data content. Other methods distribute intermediate features [12], logits [49, 10], or learn the new embedding [50]. These tactics will increase the difficulty of privacy protection because some existing methods can reconstruct images based on feature inversion methods [51]. Most of the above methods share information without a privacy guarantee or with strong privacy- preeaccypreeervingg but poor performance, posing the
dilemma.
Concretely, in [46] all clients leverage a generative model collaboratively for data generation in homogeneous distribution. For better privacy protection, G-PATE [47] performs discriminators with local aggregation in GAN. Fed-ZDDCC(ee-ZIDAS) [12), depending on which side to play augmentation, introduce zhro data augmentation by gathering intermediate activations and batch
31

---

normalization(BN) statistics to generate fake data, Inspired by mixup data. Cronus [49] transmits the logits information while CCVR [10] collects statistical information of logits to sample fake data. FedFTG [67] use generator to explore the input space of the local model and transfer local knowledge the global model. FedDF [66] utilizes knowledge distillation based on unlabeled data or generator and then conducts AVGLOG//S.. We summarize existing information-sharing methods in Table 17 to compare the dissimilarity with FedFed. The main difference between FedDF and FedFed is that method distils raw data into two parts (performance-sensitivee features æ, and performance-robue features x,) rather than transferring distilled knowledge. We provide hierarchical protections to preserve information privacy while overcoming the arivacy-performan dilemma.
G.2 Differential Privacy with Federated Learning
Carlini et.al [72] found that memorizing sensitive data occurs early training, regardless of data rarity and model.
Training with differential privacy [73, 74] is feasible solution to avoid its risk, albeit at some loss in utility. Differential privacy guarantees that an adversary should not discern whether a client's data was used.
Huang et al [75] and Wei et al [76] are the first (to their knowledge) to analyze the relation between convergence and utility in FL. Andrew et al [77] explore setting adaptive clipping norm in the federated setting rather than using a fixed one. Andrew et al [77] explore setting an adaptive clipping norm in the federated setting rather than using fixed one. They show that adaptive clipping to gradients can perform as well as any fixed clip chosen by hand. Hoeven et al [78] introduce data- dependent bounds and apply symmetric noise in online learning. which allows data providers to pick noise distribution. Sun et al [79] explicitly vary ranges of weights at different layers in a DNN and shuffle high-dimensional parameters at aggregation for easing explodes of privacy budgets. Peng et [80] study the knowledge embedding problem using DP protection in FL. Applying differential privacy and its variants to the federated setting become more prevailing nowadays.
32


Reviews:
[{"review_id": "GfCvmuNIQX", "reviewer": "Reviewer_xchj", "summary": "Authors propose method (Federated Feature distillation) to share partial features in the data to tackle data heterogeneity, while the privacy issue is not compromised too much. FedFed partitions data into performance-sensitive features and performance-robust features. The performance-sensitive features are globally shared to mitigate data heterogeneity, while the performance-robust features are kept for local training.", "questions": "See weakness", "limitations": "Yes", "rating": 5, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. Authors claim to propose a new prospect on alleviating date heterogeneity in Federated Learning: sharing partial features. It is a new high-level idea to solve heterogeneity in FL.  \n2. To achieve the idea, authors further propose a method (FedFed). More specifically, it proposed to partition data into performance-sensitive features and performance-robust features is reasonable. The performance-sensitive features are globally shared to mitigate data heterogeneity, while the performance-robust features are kept locally. This idea is resonable. \n3. It outperfroms baselines\n\n ", "weaknesses": "1. Insufficient baselines. I wonder how the choices of baselines are made? FedAvg, FedProx, FedNova and SCAFFOLD are early FL models. The latest among them is proposed in 2020. Why not adopt more recent FL models? For instance, FedGen (ICML 2021)[1]. Besides, I believe there are more FL models in recent years.\n\n[1] Zhu et al., Data-Free Knowledge Distillation for Heterogeneous Federated Learning. ICML 2021.\n\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "## Response to Reviewer xchj:\n> Q1: Adopt recent baselines, e.g., FedGen (ICML 2021)[R6]\n\n**A1:**  Following your constructive suggestion, we have compared FedFed with open-source mainstream information-sharing-based works that aim to mitigate data heterogeneity.\nThe results are reported in Table 1. We can see that FedFed outperforms existing methods. We will add the results and discussion to our updated revision.\n\nTable 1. Comparison with baselines under $\\alpha=0.1, E=1, K=100$ over CIFAR-10. \n\n|FedAvg [R1]|FedAvg with CCVR [R2]|FD+FAug [R3]|FedMD [R4] |FedDF [R5]|FedGen[R6]|FedProto [R7]|FedFTG [R8]|FedAvg with FedFest(Ours)|\n|:------:|:--------:|:-------:|:-----------:|:--:|:--:|:--:|:-:|:-:|\n|49.72%| 59.19%|63.54%|67.32%|73.41%|76.45%|77.08%|80.73%|**84.06%**|\n\n**Reference**\\\n[R1] McMahan B, Moore E, Ramage D, et al. Communication-efficient learning of deep networks from decentralized data. In AISTAS,2017.\\\n[R2] Luo M, Chen F, Hu D, et al. No fear of heterogeneity: Classifier calibration for federated learning with non-iid data. In NeurIPS, 2021.\\\n[R3] Jeong E, Oh S, Kim H, et al. Communication-efficient on-device machine learning: Federated distillation and augmentation under non-iid private data. arXiv preprint arXiv:1811.11479.\\\n[R4] Li D, Wang J. Fedmd: Heterogenous federated learning via model distillation. arXiv preprint arXiv:1910.03581.\\\n[R5] Lin T, Kong L, Stich S U, et al. Ensemble distillation for robust model fusion in federated learning. In NeurIPS, 2020.\\\n[R6] Zhu Z, Hong J, Zhou J. Data-free knowledge distillation for heterogeneous federated learning. In ICML, 2021.\\\n[R7] Tan Y, Long G, Liu L, et al. Fedproto: Federated prototype learning across heterogeneous clients. In AAAI, 2023.\\\n[R8] Zhang L, Shen L, Ding L, et al. Fine-tuning global model via data-free knowledge distillation for non-iid federated learning. In CVPR, 2022."}, {"review_id": "RXYKeyn9QK", "reviewer": "Reviewer_LGae", "summary": "The paper introduces a federated learning framework (FedFed) to tackle data heterogeneity by utilizing an information-sharing approach. The method partitions data into performance-sensitive features and performance-robust features, based on their contribution to model performance. The performance-sensitive features are shared globally to mitigate data heterogeneity, while the performance-robust features are kept locally. The method employs DP to protect performance-sensitive features before sending them to the server.", "questions": "This is an interesting approach but it's unclear how practical it is.\nThe method appears to have several overheads that are not quantified: the computation overhead to generate the performance-robust/sensitive features and to train the local classifier, communication overhead to collect protected features from clients to construct a global dataset and send the dataset back to the clients, and storage overhead to save the models and the private and public datasets on each client. This might make the method not feasible for edge devices with limited capabilities.\n\nThe experimental results focus on image classification task, with no experiments with other tasks. Also, the experiments rely on extreme non-IID partitions ( α=0.1 and α=0.05 ). It would be useful to test the method with different levels of heterogeneity (e.g., α=0.5 and α=1) and with datasets with natural non-IID partitions like Stack Overflow or Reddit.\n\nThe evaluation should consider other baselines. It is good that FedFed can be applied on top of FL algorithms. But other extensions to those algorithms should be considered as a baseline too: an obvious one was mentioned by the authors, where the full data + random noise is shared. This baseline will tell us how much better FedFed is than the naive solution. The authors mentioned that this will result in an accuracy loss, but, without evidence to support this.\n\nThe hyperparameters used in the experiments are not clear, and we don't know if they were tuned to get the best performance for each algorithm or not. The client selection hyperparameter is not mentioned. It is not clear how many clients will be sampled from the $K$ clients and what the selection method is.\n\nThe method is described as an extension on top of FL algorithms, but the paper does not explain how the extension can be used with other algorithms. In fact, algorithm 1 depicts FedFed as a new FL algorithm and not an extension.\n\nIt is not clear where $\\mathcal{D}^s$ is used, which is why the entire algorithm is proposed! Note that there is a typo in eq. 8.\n\nThe preliminaries section should introduce information bottleneck. \n\nOther questions that come up:\n\n1. FedFed uses eq. 8 in the local update; but how does it extend SCAFFOLD, FedProx, and FedNova since they modify the local update as well?\n2. The reported FedNova performance in table 1 does not seem to agree with the performance reported in their paper, where they always outperformed FedAvg; why is that?\n3. Why the local epochs E was set to 1 and 5? Why 5 local epochs is not used with the experiment with 100 clients?\n4. How many clients were sampled at every round? What is the value of the client selection hyperparameter?\n\n*I acknowledge I have read the authors' rebuttal and answers to my questions.*", "limitations": "* The paper has discussed the storage limitation but didn't clarify how much extra storage overhead was required and the size of the shared global datasets. \n* The paper didn't address how much per-round extra communication overhead the method required; although the approach seems to reduce the number of communication rounds significantly in most cases, there were some cases (table 4) that required more communication rounds compared to the other baselines. Moreover, communicating $x_p$ and $\\theta$ adds extra communication overhead. Clearly, FedFed gains are not a free lunch, and these limitations must be considered, discussed, and be part of the evaluation.", "rating": 6, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "+ Improving how to handle data heterogeneity in federated learning is a timely and important problem.\n+ The idea of tackling data heterogeneity from the Information Bottleneck perspective is interesting.\n+ The solution appears to significantly boost training performance of various FL algorithms and (in most cases) reduces the required number of communication rounds, while maintaining privacy.", "weaknesses": "- Overall the practicality of the method is unclear.\n- The evaluation only considers a single task and uses synthetic non-IID data.\n- The evaluation should include additional baselines.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "## Response to Reviewer LGae:\n> Q1: Some overheads are not quantified\n\n**A1:** Thank you for your insightful comments. Accordingly, we add analysis about overheads in **Joint Response**.\n\n> Q2: Test with different levels of heterogeneity and datasets with natural non-IID partitions.\n\n**A2:** Thanks for your detailed suggestions.\n- Heterogeneity levels. We conduct additional experiments on $\\alpha=0.5$ and $\\alpha=1.0$, $\\beta$ is the sampling rate. The results are reported in Tables 1-4. \n\nTable 1. Accuracy of $\\alpha=0.5$ with 10 clients, $\\beta=$50%.\n|| CIFAR-10|CIFAR-100|SVHN|FMNIST|\n|--|--|--|--|--|\n| FedAvg | 84.56% | 68.78%| 90.21%| 88.78%|\n| FedFed(Ours)| **93.37%** | **70.91%** | **93.71%** | **94.01%**|\n\nTable 2. Accuracy of $\\alpha=1.0$ with 10 clients,$\\beta=$50%.\n| | CIFAR-10| CIFAR-100| SVHN| FMNIST|\n|--|--|--|--|--|\n|FedAvg| 87.18%| 69.12%| 92.37%|90.98%|\n|FedFed(Ours)|**94.07%**|**71.01%**|**93.98%**|**95.12%**|\n\nTable 3. Accuracy of $\\alpha=0.5$ with 100 clients,$\\beta=$10%.\n||CIFAR-10|CIFAR-100|SVHN|FMNIST|\n|--|--|--|--|--|\n| FedAvg       | 59.78%     | 54.56%     | 90.31%     | 91.78%     |\n| FedFed(Ours) | **89.19%** | **63.78%** | **92.09%** | **93.13%** |\n\nTable 4. Accuracy of $\\alpha=1.0$ with 100 clients, $\\beta=$10%.\n|| CIFAR-10|CIFAR-100|SVHN|FMNIST|\n|--|--|--|--|--|\n|FedAvg|63.19%|57.19%|91.01%|92.98%|\n|FedFed(Ours)|**90.31%**|**66.89%**|**93.01%**|**93.81%**|\n\nWe can see that FedFed significantly improves performance.\n- Realistic Non-IID Partitions. We have verified the effectiveness of FedFed on the FEMNIST dataset [R4], which has more realistic non-IID partitions. The results are reported in Table 5. We can see that FedFed performs well on FEMNIST. We did not conduct experiments on the Stack Overflow and Reddit datasets as mentioned, as these datasets are typically used for the next character prediction, which differs from the classification task studied in our work. Inspired by your valuable comments, we will explore FedFed under more complex scenarios.\n\nTable 5. The results on FEMNIST\n||FEMNIST|\n|--|--|\n|FedAvg|79.28%|\n|FedFed(Ours)|85.74%|\n\n We will add these results to our updated revision.\n> Q3: Add baseline: the full data + random noise is shared\n\n**A3:** We apologize for omitting important information. We will highlight the results (reported in Appendix F.3) on the main page. These results show that simply applying noise to the data causes performance degradation. Other comparisons with existing sharing strategies can be found in the table provided in **A1 of response to Reviewer xchj**.\n\n> Q4. The client selection hyperparameter is not mentioned and what the selection method is.\n\n**A4:** Thank you for pointing out the confusing parts. We list hyperparameters in Table 7 in Appendix B.1 (i.e., Implementation Details). We apologise for missing how to determine the hyperparameter $\\rho$. In FedFed, each client retains a small portion of data that is not used for training. After several rounds of training, these reserved data are utilized to select the hyperparameter $\\rho$. We set the sampling rate to be 10% for 100 clients and 50% for 10 clients. We randomly select clients from the client list. Motivated by your comments, we conduct experiments with different sample rates to verify the efficacy of FedFed. Results are given in Tables 1-11 in **Joint Response**.\n\n> Q5. The paper does not explain how the extension can be used with other algorithms.\n\n**A5:** Thank you for your detailed comments. Algorithm 1 presents how we can obtain the globally shared dataset $D^s$. In Appendix B.2 (Pseudo-code and Explanation), we demonstrate how to implement FedFed with existing methods as a plug-in module. We highlight the modification of the original algorithms with only two lines. We will elaborate on the contents in our updated revision.\n\n> Q6. The reported FedNova performance in Table 1 does not seem to agree with the performance reported in their paper; why is that?\n\n**A6:** In FedNova, the main results were reported using $K=16$ and $\\alpha=0.1$, while the results using $K=100$ clients and $\\alpha=0.05$ were omitted. Our experiments are consistent with those reported in [R1].\n\n> Q7. Why 5 local epochs is not used in the experiment with 100 clients?\n\n**A7:** We followed the settings used in previous works [R2][R3]. In response to your valuable comments, we conducted additional experiments using 100 clients with 5 local epochs. The results reported in Table 6 demonstrate that FedFed can provide a significant improvement. We will include these results in our updated revision.\n\n Table 6 The accuracy of $\\alpha=0.1, E = 5, K= 100$  over various datasets.\n|Method|CIFAR-10 |FMNIST|SVHN|CIFAR-100|\n|--|--|--|--|--|\n|FedAvg|60.78%|91.21%|90.31%|51.69%|\n|FedFed(Ours)|**88.21%**|**92.19%**|**92.78%**|**62.77%**|\n\n> Q8. there is a typo in eq. 8.\n\n**A8:** We have fixed the typo in the revision. Thanks for your attentive review!\n\n> Q9. The preliminaries section should introduce an information bottleneck.\n\n**A9:** Thanks for your valuable suggestions. We will add the necessary introduction in the revised version\n\n> Q10. How many clients were sampled at every round? \n\n**A10:** We set the sample rate to be $10\\%$ for 100 clients and $50\\%$ for 10 clients. More details of experiments can be found in **Joint Response**. \n\n> Q11: limitations must be considered, discussed, and be part of the evaluation.\n\n**A11:** Please see **Joint Response**. Following your constructive suggestion, we will highlight the overhead introduced by FedFed on the main page.\n\n**Reference**\\\n[R1] Li et al. Federated learning on non-iid data silos: An experimental study. In ICDE, 2022.\\\n[R2] Tang et al. Virtual homogeneity learning: Defending against data heterogeneity in federated learning. In ICML, 2022.\\\n[R3] Hsu et al. Measuring the effects of non-identical data distribution for federated visual classification. arXiv:1909.06335.\\\n[R4] Caldas et al. Leaf: A benchmark for federated settings. arXiv:1812.01097."}, {"review_id": "01VG6REv2d", "reviewer": "Reviewer_bAmN", "summary": "The paper proposes Federated Feature distillation, a method that addresses the tradeoff between privacy and model performance. It involves extracting performance-robust and performance-sensitive features from local data. The latter is shared among clients after applying differential privacy for privacy preservation. The paper also includes an empirical evaluation demonstrating the effectiveness of the proposed approach.\n", "questions": "- What is the model's performance when trained solely on the constructed global dataset ($D^s$)?\n- Are the models ($w_k^t$) trained in the Feature Distillation phase identical to the global model ($\\phi_k^t$) in the local training phase? If they are the same, do the empirical results, in both cases with and without FedFed, initialize the global model in the local training phase with the identical parameters?\n- In section F.3, it is observed that sharing the partial feature with DP achieves higher accuracy compared to sharing the raw data with DP, which seems counterintuitive. What is the underlying insight or explanation for this phenomenon?\n", "limitations": "Limitation about storage overhead is stated while potential societal impact has not been addressed.", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "The paper is well-written and easily comprehensible, with clear motivation and contribution.\nThis paper theoretically shows that the proposed method achieves the same level of privacy with a relatively smaller noise compared to sharing the raw data.\nThe proposed method can be seamlessly combined with existing universal methods,\n", "weaknesses": "- Additional communication costs:\nAs sharing globally shared data to all clients, it requires additional communication costs. In F.7 the authors analyze additional communication costs is as same as sending a classifier in approximately 14 communication rounds. But this analysis doesn’t consider the partial participating of federated learning. If we assume the 10% participation rate, sharing the global dataset is equal to the communication costs of 140 communication rounds, which is not small. \n\n- More local iterations on training:\nThe presence of a globally shared dataset in FedFed results in each client having a significantly larger amount of local training data, K+1 times more than before. It also results in K+1 times local iterations, which can be computationally expensive for edge devices in federated learning, especially when dealing with massively distributed data in realistic settings. \nFurthermore, the considerably higher number of local updates in FedFed compared to the approach without FedFed makes it hard to attribute the observed gain in empirical results to a specific factor. It is well-known that increasing local updates can expedite the convergence speed in federated learning. Therefore, the observed gain in empirical results cannot be solely attributed to the FedFed approach, as the increased local iterations inherently provide an advantage. This factor should be taken into consideration when evaluating and comparing the performance of FedFed against other approaches.\n\n- There are lines of work that try to share the client data while preserving the privacy inspired by mixup, such as [Shin et al., 2020] and [Yoon et al., 2021]. These methods are not compared as baselines in evaluation results.\n\n\n[Shin et al., 2020] MyungJae Shin, Chihoon Hwang, Joongheon Kim, Jihong Park, Mehdi Bennis, and Seong-Lyun Kim. Xor mixup: Privacy-preserving data augmentation for one-shot federated learning. In ICML, 2020.\n\n[Yoon et al., 2021] Tehrim Yoon, Sumin Shin, Sung Ju Hwang, Eunho Yang. Fedmix: Ap- proximation of mixup under mean augmented federated learning. In ICLR, 2021.\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "## Response to Reviewer bAmN:\n> Q1. Additional communication costs: As sharing globally shared data to all clients, it requires additional communication costs. F.7 doesn’t consider the partial participation of federated learning. \n\n**A1:** Thank you for bringing this potentially confusing problem to our attention. We will address it in the upcoming revision by incorporating a detailed explanation and analysis. In FedFed, the constructed dataset is shared only once, leading to extra communication costs. Detailed analysis of communication costs can be found in **Joint Response**.\n\n> Q2: More local iterations on training: The presence of a globally shared dataset in FedFed results in each client having a significantly larger amount of local training data, K+1 times more than before. Increasing local updates can expedite the convergence speed in federated learning. Therefore, the observed gain in empirical results cannot be solely attributed to the FedFed approach, as the increased local iterations inherently provide an advantage. This factor should be taken into consideration when evaluating and comparing the performance of FedFed against other approaches.\n\n**A2:** Thanks for your constructive suggestions. We will highlight the local iterations issue in our revision.\n- The local iterations are doubled in our experiments since we merely sample the same number of samples in each round to perform local training. In our implementation, we expand the batch size (shared and local samples), rather than increase the local iteration, leading to the same number of local iterations as FedAvg without FedFed.\n- The perspective about more local iterations is insightful and consistent with our empirical observations. Accordingly, we will follow the direction to explore more possibilities of FedFed. Note that we also find (only one case) increasing local iterations does not always work (c.f. Table 4 on the main page). We believe it would bring something informative, and we are willing to share it with you.\n\n> Q3: More relative baselines.\n\n**A3:** Following your constructive suggestion, we add more experiments to compare FedFed with other information-sharing strategies [R2][R3]. The results are listed in Table 1. The findings clearly demonstrate that FedFed surpasses advanced information-sharing methods in terms of performance. We will include these results and provide a comprehensive discussion in our revision.\n\nTable 1. Comparison with information-sharing methods under $\\alpha=0.1, E=1, K=100$ over CIFAR-10. \n|FedAvg [R1]|Xor mixup [R2]|FedMix [R3]|FedAvg with FedFest(Ours)|\n|:------:|:--------:|:-------:|:-----------:|\n|49.72%|76.18%|78.35%|**84.06%**|\n\n> Q4. What is the model's performance when trained solely on the constructed global dataset $(D)^s$\n\n**A4:** Thanks for the inspiring question! Following the interesting direction, we train models merely on the constructed global dataset and report the results as follows in Table 2. We can see that the model's performance is bad. We guess the distribution shift between the constructed data and the natural data causes bad performance. However, we believe that training models merely on noisy data is a promising direction and we will explore it in our future work.\n\nTable 2. The difference between training in FedFed manner and solely on shared data.\n|  \t| CIFAR-10 \t|\n|:---:|:---:|\n| FedFed(Ours) | 92.34% |\n| Solely on constructed global dataset \t| 27.68% \t|\n\n> Q5. Are the models ($\\omega^t_k$) trained in the Feature Distillation phase identical to the global model ($\\phi_k^t$) in the local training phase? If they are the same, do the empirical results, in both cases with and without FedFed, initialize the global model in the local training phase with identical parameters?\n\n**A5:** Thanks for your inspiring questions.\n- In our experiments, the model parameters $\\omega^t_k$ and $\\phi_k^t$ are not the same. The $\\omega^t_k$ is used to extract performance-sensitive features while $\\phi_k^t$ is the local classifier like other FL methods.\n- We agree with your point that it is promising to initialize the global model with models trained for feature generation. Accordingly, we use the same model for the mentioned two models and initialize the global model with local models trained for feature generation.\nThe results are listed in Table 3. The results show that employing the same model will further promote the performance and speed up the convergence rate of FedFed. Thanks again for the inspiring and helpful questions!\n\nTable 3. Comparison between the initialization of $\\phi_k^t$  with/without $\\omega^t_k$.\n|  \t| Accuracy | Round |\n|---|---|---|\n| FedFed(the initialization of $\\phi_k^t$  without $\\omega^t_k$) | 92.34% | 39 |\n| Inspired experiment(the initialization of $\\phi_k^t$  with $\\omega^t_k$) | 92.94% | 31 |\n\n> Q.6 In section F.3, it is observed that sharing the partial feature with DP achieves higher accuracy compared to sharing the raw data with DP, which seems counterintuitive. What is the underlying insight or explanation for this phenomenon?\n\n**A6:** Thanks for pointing out the potentially confusing problem. Models trained over raw data with noise perform worse than those trained over partial data since the privacy budget for these two cases is the same. Namely, to achieve the same privacy budget, raw data are injected with noise on a larger scale than partial data. We will add the explanation to our revision to fix the problem.\n\n**Reference**\\\n[R1] McMahan B, Moore E, Ramage D, et al. Communication-efficient learning of deep networks from decentralized data. In AISTAS,2017.\\\n[R2] MyungJae Shin, Chihoon Hwang, Joongheon Kim, Jihong Park, Mehdi Bennis, and Seong-Lyun Kim. Xor mixup: Privacy-preserving data augmentation for one-shot federated learning. In ICML, 2020.\\\n[R3] Tehrim Yoon, Sumin Shin, Sung Ju Hwang, Eunho Yang. Fedmix: Ap- proximation of mixup under mean augmented federated learning. In ICLR, 2021."}, {"review_id": "X26vvPmwjL", "reviewer": "Reviewer_wKGY", "summary": "The paper proposes a method based on feature distillation to tackle data heterogeneity. The main contribution , as I see it, is in identifying performance-robust and performance-sensitive features and sharing the latter among clients to mitigate the impact of heterogeneity.", "questions": "Feature distillation idea is proposed in [1]. Isn't the idea same? Please cite [1]. \n[1] Romero, A., Ballas, N., Kahou, S. E., Chassang, A., Gatta, C., & Bengio, Y. (2014). Fitnets: Hints for thin deep nets. arXiv preprint arXiv:1412.6550.", "limitations": "- Do not see discussion on whether performance-sensitive features indeed leak information.\n- Formal definitions of performance-robust and performance-sensitive features are missing. Please also make a subsection to provide detailed descriptions of how these two types of features are identified.\n- The experiments are only performed using ResNet-18.", "rating": 7, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 3, "strengths": "- The method is simple (this is very important) and can be easily used with existing FL algorithms.\n- DP is incorporated to protect the leakage of privacy-sensitive information when sharing performance-sensitive features.", "weaknesses": "- The evaluation is quite limited to vision datasets, which makes me unsure if it is going to generalize across modalities.\n- Number of clients (K) are also quite limited. In real-world setting 100-1000s of clients are involved in FL process. \n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "## Response to Reviewer wKGY:\n\n> Q1. The evaluation is quite limited to vision datasets, which makes me unsure if it is going to generalize across modalities.\n\n**A1:** Thanks for your insightful comments. In this work, we merely focus on the image modality, while omitting the results on other modalities, e.g., text data. This is because applying information bottleneck (the core of FedFed) to text data requires a special design. In response to your valuable comments, we will explore approaches to applying FedFed to text data.\n\n\n> Q2: The number of clients (K) is also quite limited. In real-world settings, 100-1000s of clients are involved in the FL process.\n\n**A2:** Thanks for your valuable suggestion.\n- We followed the experimental settings used in our experiments, omitting results evaluated using more clients.\n- In response to your valuable comments, we conduct experiments using more clients, i.e., a more realistic setting. We test $K=500$ and $K=1000$ under $\\alpha=0.1$ and the sampling rate is 5%, the results are listed in Tables 1 and 2. The results show that FedFed can improve the performance of the baseline method under a more realistic setting. We will add the results to our revision.\n\n Table 1. The accuracy of $\\alpha=0.1, E = 1, K= 500$  over various datasets.\n|Method|CIFAR-10 |FMNIST|SVHN|CIFAR-100|\n|:-----:|:-----:|:-----:|:-----:|:-----:|\n|FedAvg|47.15%|85.34%|86.31%|45.31%|\n|FedFed(Ours)|**81.67%**|**87.63%**|**87.56%**|**57.78%**|\n\n Table 2. The accuracy of $\\alpha=0.1, E = 1, K= 1000$  over various datasets.\n|Method|CIFAR-10 |FMNIST|SVHN|CIFAR-100|\n|:-----:|:-----:|:-----:|:-----:|:-----:|\n|FedAvg|43.15%|81.34%|82.31%|41.31%|\n|FedFed(Ours)|**78.36%**|**83.63%**|**84.56%**|**52.78%**|\n\n> Q3: Do not see a discussion on whether performance-sensitive features indeed leak information.\n\n**A3:** We will add the discussion in our revision. \n- Theoretically. The sharing strategy will leak information, but FedFed employs differential privacy to protect the shared feature. Thus, FedFed can share information with a given privacy budget, theoretically guaranteed with DP theory.\n- Empirically. We conduct privacy verification experiments including model inversion attack and membership inference attack in Sec 4.4. Besides, we perform an additional model inversion attack. The results are reported in the response to Reviewer #ezSw.\n\n> Q4: Formal definitions of performance-robust and performance-sensitive features are missing. Please also make a subsection to provide detailed descriptions of how these two types of features are identified.\n\n**A4:** Thanks for your kind suggestions. We will add the following descriptions to our revision.\nFedFed is built upon the information bottleneck theory, leading to the decision of performance-sensitive and performance-robust features. Specifically, performance-sensitive features $X_s$ statisfy that: $I(Y;X|X_s)=0$, namely, $X_s$ contains all information about the label $Y$. In contrast, the performance-rbust features $X_r$ contains all information about $X$ except for information about label $Y$, i.e., $I(Y;X_r)=0, I(X_r;X)=I(X_r;X|X_s)$. That is, $X_r$ contains all the left information about $X$ when removing $X_s$ from $X$. Thus, we define the performance-robust feature $X_r$ as the difference, i.e., $X_r = X - X_s$, and propose Eq.(5) to realize the intuition.\n\n> Q5: The experiments are only performed using ResNet-18.\n\n**A5:** Thanks for the valuable suggestions, motivating us to conduct additional experiments on two different model architectures.\nAs reported in Tables 3-4, FedFed can improve model performance under various model architectures.\n\nTable 3. The comparison of our methods on various datasets with the VGG classifier.\n|Dataset|CIFAR-10|CIFAR-100|SVHN|FMNIST|CINIC-10|FEMNIST\n|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:---:|\n|FedAvg|76.32% |63.14% | 85.29%| 84.87% |74.62%|76.73%\n|FedFed(Ours)|**82.64%** |**67.32%** | **89.42%**| **88.34%** |**86.39%**|**82.98%**\n\nTable 4. The comparison of our methods on various datasets with the ResNet-18 classifier.\n|Dataset|CIFAR-10|CIFAR-100|SVHN|FMNIST|CINIC-10|FEMNIST\n|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:---:|\n|FedAvg|79.35% |67.84% | 88.34%| 86.37% | 78.19%|79.28%\n|FedFed(Ours)|**92.34%**|**69.64%** | **93.21%**| **92.34%** | **90.72%**|**85.74%**\n\n> Q6: Feature distillation idea is proposed in [R1].\n\n**A6:** Thanks for the kind suggestion. In our revision, we will add the following discussion to highlight the difference between our work and previous work [R1] introducing feature distillation.\n\n- Both [R1] and FedFed aim to distil features in the data for better generalization performance. However, the following differences make these two works distinct.\n- 1) [R1] distils features in the representation space, i.e., features extracted by a hidden layer of deep neural networks, while FedFed distil features in the data space.\n- 2) [R1] distils features to guide student models to generate outputs similar to teacher models, while FedFed distils features to share across clients to tackle data heterogeneity.\n\n**Reference**\\\n[R1] Romero A, Ballas N, Kahou S E, et al. Fitnets: Hints for thin deep nets. arXiv preprint arXiv:1412.6550."}, {"review_id": "5joeFLV8EY", "reviewer": "Reviewer_ezSw", "summary": "This paper proposes a novel approach called Federated Feature Distillation (FedFed) to mitigate the data heterogeneity problem while preserving privacy. In particular, FedFed partitions data into performance-sensitive features and performance-robust features based on the information bottleneck method. Only performance-sensitive features are shared among clients as they contain minimal private information and significantly contribute to performance. Moreover, incorporating the differential privacy (DP) mechanism can provide an additional layer of privacy protection. In summary, this work is interesting, and the authors provide some theoretical analyses to support their claims.", "questions": "1. How to conduct the model inversion attack? The reviewer has checked both the experiment section and Appendix E, but some details appear to be missing.\n\n2. Table 14 in the Appendix summarizes the currently available information-sharing methods. According to the authors, the FedFed method provides hierarchical protections to preserve information privacy while overcoming the privacy-performance dilemma. Does this mean that the FedFed method achieves better performance and privacy protection than all the baselines in Table 14? Take Fedproto as an example. This method only exchanges prototypes (i.e., the mean of features) instead of model parameters, while FedFed shares both the model parameters and features. The authors correctly pointed out that FedProto lacks protection on the shared information, but the shared model parameters in FedFed also lack privacy guarantees. Further discussion and empirical results are required to demonstrate the effectiveness of the FedFed method in comparison to previous works.", "limitations": "The authors correctly pointed out that the performance of FedFed is limited by the storage capacity of clients.", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "This study mitigates the issue of data heterogeneity in Federated Learning (FL) by utilizing a promising approach to information-sharing. Empirical evidence shows that the proposed method is effective in enhancing model performance.", "weaknesses": "The reviewer believes the evaluation of the privacy leakage is insufficient. The details are as follows:\n\n1. In Section 4.4, the authors conducted a model inversion attack to infer private data using shared features. However, quantitative measurement is missing in this evaluation. Previous studies [1, 2] have utilized metrics such as peak signal-to-noise ratio (PSNR) and Frechet inception distance (FID) to assess the quality of reconstructed data. We recommend that the authors include some quantitative results to strengthen the empirical evidence.\n\n2. Federated learning is known to leak private information when sharing model parameters [3,4]. The FedFed method, which shares both model parameters and features, creates an opportunity for attackers to exploit these two types of information for privacy attacks. However, the experiment showed that the attacks only targeted the privacy information contained in the features, which is not a comprehensive representation of potential privacy leaks.\n\n3. Tables 1, 2, 3, and 4 demonstrate that the FedFed method achieves a higher Top-1 accuracy than FedAvg. However, it's worth considering whether this increased accuracy comes at the cost of higher privacy leakage.\n\n[1] The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural\nNetworks. https://openaccess.thecvf.com/content_CVPR_2020/html/Zhang_The_Secret_Revealer_Generative_Model-Inversion_Attacks_Against_Deep_Neural_Networks_CVPR_2020_paper.html\n\n[2] Knowledge-Enriched Distributional Model Inversion Attacks. https://openaccess.thecvf.com/content/ICCV2021/html/Chen_Knowledge-Enriched_Distributional_Model_Inversion_Attacks_ICCV_2021_paper.html\n\n[3] Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning. https://ieeexplore.ieee.org/abstract/document/8835245?casa_token=1iwvBNyN5q4AAAAA:BdxQzounj3eoNv0HIcdMoW7nCaM6xWJFPwZQIosqhvpiXWNaJd-q0MeW_xmiZJkZGVmZXDRE\n\n[4] Beyond Inferring Class Representatives: User-Level Privacy Leakage From Federated Learning. https://ieeexplore.ieee.org/abstract/document/8737416?casa_token=zyEVcT_x3oQAAAAA:FfpfqLHOsQJ33Br2OqnYE6fRI3EIgdNPlCSUOC74Yu6qhFjcgJvqHwFLAsPaShPaigK3sjz1\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "## Response to Reviewer ezSw:\n> Q1:Quantitative measurement is missing in the evaluation of model inversion attack in Sec.4.4, e.g., PSNR and FID.\n\n**A1:** Thank you for your valuable suggestion. Accordingly, we employ PSNR and FID, used in [R1][R2], to provide quantitative results for the samples reconstructed by model inversion attack.  We will add these results to our revision.\n- As in Table 1, if the central server acts as the attacker, it does not have access to the original data, resulting in a poorer performance in attacking the model. \n- Inspired by your comments, we conducted another experiment where one of the clients acts as the attacker. The client has access to its local data. Under this scenario, the attacker's performance is better than when the server acts as the attacker, while the attacker is still unable to recover data from the shared features.\n\nTable 1. The PSNR and FID comparison under two kinds of attack methods.\n|  | PSNR| FID|\n|---|---|---|\n| Server acts as a malicious attacker | 15.56 |404.16|\n| One of the clients acts as a malicious attacker | 18.31 |378.21|\n> Q2: How to conduct the model inversion attack?\n\n**A2:** We assume that the server is a malicious attacker, i.e., the server can access the globally shared data and the global model to conduct a model inversion attack. The results reported in Sec. 4.4 (PSNR is 15.56). \nFollowing the valuable comments, we conduct another model inversion attack introduced in [R1]. Specifically, the attacker (one client in the FL system) uses a public dataset (the local data of the malicious client) and auxiliary data (the shared features of FedFed) to train a GAN to attack target models, namely, the GAN used to reconstruct other clients' private data. In our experiments, the attacker hardly recovers others' private data, where the PSNR of the recovered results is 18.31. \n\n> Q3:  The experiment showed that the attacks only targeted the privacy information contained in the features, which is not a comprehensive representation of potential privacy leaks.\n\n**A3:** We agree that sharing model parameters may risk privacy. In this regard, sharing more information could creates an opportunity for attackers to exploit these two types of information for privacy attacks. \n- Consequently, as mentioned in the comments, we conducted privacy attacks to show that attackers hardly get information in the shared features. \n- Until now, our work has explored the most sufficient attacks compared with previous works [R3-R4], which employ an information-sharing strategy to tackle data heterogeneity in FL. \nWe totally agree with your comments that a comprehensive analysis of privacy attacks is promising and important. \n- Actually, we would like to remind you that it seems to be out-of-scope for a 9-page conference paper since our work aims at a new approach to tackle data heterogeneity. We prioritize mitigating the dilemma introduced by the information-sharing strategy. \n- Moreover, we believe that the reviewer may look forward to more work on investigating privacy attacks in FL, for those with the information-sharing strategy. In this regard, we sincerely expect that FedFed could serve as a baseline model for conducting privacy/attack research in the future. Also, the authors hope to contribute to the deep learning community more.\n\n> Q4:Tables 1-4 demonstrate that the FedFed method achieves a higher Top-1 accuracy than FedAvg. However, it's worth considering whether this increased accuracy comes at the cost of higher privacy leakage.\n\n**A4:** Sharing information of clients will inevitably introduce some privacy leaks, e.g., sharing models or features. Thus, FedFed distils performance-sensitive features and shares these features with DP protection to mitigate privacy leakage. We will add the discussion in our revision.\n\n> Q5: Does Table 14 mean that the FedFed method achieves better performance and privacy protection than all the baselines in Table 14? Further discussion and empirical results are required to demonstrate the effectiveness of the FedFed method in comparison to previous works.\n\n**A5:** We appreciate your valuable time and detailed comments. We will add further discussion in our revision.\n- We listed many excellent works in the research of the information-sharing strategy in Table 14, aiming to highlight the difference between FedFed and these works. Specifically, FedFed shares information with protection, while previous works do not protect the shared information. Thus, it is not fair for previous works to make a direct comparison. This is the reason why we do not report the comparison with these methods.\n- When talking about privacy and security, we need to consider the attacker's ability and privacy goals. Empirically, we have conducted multiple attacking experiments to explore and verify the improved protection in different settings.  \n- Besides, analyzing all existing attacks with a sufficient theoretical guarantee for shared FL models is out-of-scope for a 9-page conference paper. The shared features are protected with DP. For the mentioned both shared parameters and features, we agree that studying how to perform an attack is a promising direction for FL security. However, our work focuses on tackling data heterogeneity through an information-sharing strategy with a DP guarantee. \nThanks for the valuable comments, we will investigate more attacks induced by FL with the information-sharing strategy in our future work.\n\n**Reference:**\\\n[R1] Zhang Y, Jia R, Pei H, et al. The secret revealer: Generative model-inversion attacks against deep neural networks. In CVPR, 2020.\\\n[R2] Chen S, Kahla M, Jia R, et al. Knowledge-enriched distributional model inversion attacks. In CVPR, 2021.\\\n[R3] Li D, Wang J. Fedmd: Heterogenous federated learning via model distillation. arXiv preprint arXiv:1910.03581.\\\n[R4] Lin T, Kong L, Stich S U, et al. Ensemble distillation for robust model fusion in federated learning. In NeurIPS, 2020."}]

Author rebuttal:
## Response to All Reviewers:
We sincerely appreciate all reviewers' great efforts on review and comments on our work. We especially thank the nice words:
- timely and important problem (Reviewer #LGae)
- new and interesting high-level idea (Reviewer #xchj & #LGae) and  reasonable and simple method (Reviewer #xchj & #wKGY) 
- significantly boosts training performance, reduces communication rounds, and maintains privacy (Reviewer #LGae )
- empirical evaluation (Reviewer #ezSw & #xchj & #LGae) and theoretical justification (Reviewer #bAmN & #wKGY)
- seamless combination or easy adoption in further research (Reviewer #xchj & #LGae & #bAmN & wKGY & ezSw)

Due to limited space, we extract a similar question and answer it in response to your valuable comments.

### Joint Response
> Various overheads (Reviewer #LGae & #bAmN) introduced by FedFed:

Thanks for the comments. According to the empirical analyses given in Appendix F.7, we can see that the communication and computation overheads are relatively mild:

#### 1. Computation Overhead
-  The computation overhead, introduced by FedFed to generate performance-robust/sensitive features, is less than 10% of the overall training computation for the local classifier. 

#### 2. Communication Overhead
- Consider $K$ clients in the FL system. Let $m$ be the size of a single local model. The size of local private data is $\|D_k\| = a$. Then, the ratio of the entire dataset to the model parameter  is $\gamma$ as in Appendix F.7,
$$ \gamma = \frac{aK}{m}\approx14,$$

- The extra communication cost for a single client is $$(m+m)*T_d+a+aK$$ where $(m+m)*T_d$ denotes the cost of download/upload models for $T_d$ rounds in Algorithm 1. Here, the $a$ denotes the performance-sensitive features sent by each client, and $aK$ is the data received by each client from the globally shared dataset. 

- In the general process of FL, the overall communication costs are $(m+m)T_r\beta$, where $\beta$ is the sampling rate of a client. Therefore, the ratio of the extra communication overhead to the general FL process is:
$$\frac{(m+m)\cdot T_d+a(K+1)}{(m+m)\cdot T_r\cdot \beta} = \frac{T_d}{T_r\cdot\beta}+\frac{a(K+1)}{(m+m)\cdot T_r\cdot\beta} = \frac{T_d}{T_r\cdot\beta}+\frac{\gamma}{2\cdot T_r \cdot\beta}+\frac{\gamma}{2\cdot K\cdot T_r \cdot \beta}$$

Here, we detail two examples in our experiments.
- For $K=10, T_d=15$, $T_r=1000$, and $\beta=$50%, the extra communication costs are approximately 4.54%. 
- When $K=100$, $T_d=15$, $T_r=1000$, and $\beta=$10%, the extra communication costs are approximately 22.07%.

#### 3. Storage Overhead
FedFed offers three trade-off strategies regarding communication bandwidth and storage. 
- (i) One-time download: Local clients download the globally shared dataset once. Globally shared dataset costs approximately $14 \times$ storage of classifier model. 
- (ii) Partial download: A small portion of the globally shared dataset is selected and downloaded. This strategy incurs approximately $1.5\times$ communication cost compared to the previous strategy, while the storage required by the clients is the same as that of local private data. 
- (iii) Intermittent download: A small set of globally shared dataset is downloaded after every $Z$ rounds. This approach reduces the communication overhead to $\frac{1}{Z}$ of that of strategy (ii) while maintaining the storage overhead at the size of the local data.

> Experiments for different sampling rates (Reviewer #LGae):

Thanks for the comment. Inspired by Reviewer #LGae, we conduct experiments to investigate the impact of different sampling rates on performance and convergence speed, the results can be found in Tables 1-11.

Table 1. The accuracy of  $\alpha=0.1, E = 1, K= 10$ over CIFAR-10.
|Sampling rate|10% |20%|30%|40%|50%|
|--|--|--|--|--|--|
|Accuracy|88.58%|89.34%|91.66%|91.94%|92.34%
|Round|102|73|52|48|39|

Table 2. The accuracy of $\alpha=0.05, E = 1, K= 10$ over CIFAR-10.
|Sampling rate|10% |20%|30%|40%|50%|
|--|--|--|--|--|--|
|Accuracy|82.77% |84.47% | 86.82%| 88.98% | 90.02%
|Round| 97| 74| 62| 57| 50|44

 Table 3. The accuracy of $\alpha=0.1, E = 1, K= 100$ over CIFAR-10.
|Sampling rate|5% |10%|20%|40%|60%|
|--|--|--|--|--|--|
|Accuracy| 83.67%|84.06%|87.98%|89.17%|89.62%
|Round|182|163|90|70|61|

 Table 4. The accuracy of $\alpha=0.1, E = 1, K= 10$ over CIFAR-100.
|Sampling rate|10% |20%|30%|40%|50%|
|--|--|--|--|--|--|
|Accuracy|63.34%|64.29% | 66.47%|67.32% |69.64%| 
|Round| 405| 389 | 331| 291 | 283|

 Table 5. The accuracy of under $\alpha=0.05, E = 1, K= 10$ over CIFAR-100.
|Sampling rate|10% |20%|30%|40%|50%|
|--|--|--|--|--|--|
|Accuracy|63.77%|65.12% | 66.02%|66.82% |68.49%| 
|Round| 302| 234 | 198| 156 | 137|

 Table 6. The accuracy of $\alpha=0.1, E = 1, K= 100$ over CIFAR-100.
|Sampling rate|5% |10%|20%|40%|60%|
|--|--|--|--|--|--|
|Accuracy| 57.32%|60.58%|64.34%|66.53%|68.71%
|Round|534|448|401|382|298|

Table 7. The accuracy of $\alpha=0.1, E = 1, K= 10$ over FMNIST.
|Sampling rate|10% |20%|30%|40%|50%|
|--|--|---|--|--|--|
|Accuracy|88.36%|90.34% | 91.78%|92.01% |92.34%| 
|Round| 60| 35 | 28| 21 | 14|

 Table 8. The accuracy of $\alpha=0.05, E = 1, K= 10$ over FMNIST.
|Sampling rate|10% |20%|30%|40%|50%|
|--|--|--|--|--|--|
|Accuracy|87.34%|88.78% | 90.11%|90.34% |90.69%| 
|Round| 43| 32 | 30| 22 | 16|

 Table 9. The accuracy of $\alpha=0.1, E = 1, K= 100$ over FMNIST.
|Sampling rate|5% |10%|20%|40%|60%|
|--|--|--|--|--|--|
|Accuracy| 90.87%|92.71%|92.88%|93.51%|93.69%
|Round|287|243|213|157|104|

Table 10. The accuracy of $\alpha=0.1, E = 1, K= 10$ over SVHN.
|Sampling rate|10% |20%|30%|40%|50%|
|--|--|--|--|--|--|
|Accuracy|89.74%|91.23% | 92.08%|92.82% |93.21%| 
|Round| 273| 200|188| 143 | 105|

 Table 11. The accuracy of $\alpha=0.1, E = 1, K= 100$  over SVHN.
|Sampling rate|5% |10%|20%|40%|60%|
|--|--|---|--|--|--|
|Accuracy| 89.37%|91.04%|92.88%|93.51%|93.69%
|Round|803|763|701|637|541|

Meta-review: This paper presents a novel approach named federated feature distillation (FedFed) to deal with the data heterogeneity issue in federated learning. Reviewers agreed that this paper investigates a timely and important problem, the proposed method is very novel, and the experiments are extensive and convincing. The authors' rebuttal has also successfully addressed the concerns from reviewers, such as additional baselines and overhead analysis. The authors are highly encouraged to incorporate the suggestions from reviewers to the final version of this paper.
Decision: Accept (poster)