Differentially private partitioned variational inference
Authors: Mikko A. Heikkilä
Matthew Ashman
Siddharth Swaroop
Richard E Turner
Antti Honkela
Venue: Accepted by TMLR ()

Abstract: Learning a privacy-preserving model from sensitive data which are distributed across multiple devices is an increasingly important problem. The problem is often formulated in the federated learning context, with the aim of learning a single global model while keeping the data distributed. Moreover, Bayesian learning is a popular approach for modelling, since it naturally supports reliable uncertainty estimates. However, Bayesian learning is generally intractable even with centralised non-private data and so approximation techniques such as variational inference are a necessity. Variational inference has recently been extended to the non-private federated learning setting via the partitioned variational inference algorithm. For privacy protection, the current gold standard is called differential privacy. Differential privacy guarantees privacy in a strong, mathematically clearly defined sense.

In this paper, we present differentially private partitioned variational inference, the first general framework for learning a variational approximation to a Bayesian posterior distribution in the federated learning setting while minimising the number of communication rounds and providing differential privacy guarantees for data subjects.

We propose three alternative implementations in the general framework, one based on perturbing local optimisation runs done by individual parties, and two based on perturbing updates to the global model (one using a version of federated averaging, the second one adding virtual parties to the protocol), and compare their properties both theoretically and empirically.  We show that perturbing the local optimisation works well with simple and complex models as long as each party has enough local data. However, the privacy is always guaranteed independently by each party. In contrast, perturbing the global updates works best with relatively simple models. Given access to suitable secure primitives, such as secure aggregation or secure shuffling, the performance can be improved by all parties guaranteeing privacy jointly.

Published in Transactions on Machine Learning Research (04/2023)
Differentially private partitioned variational inference
Mikko A. Heikkilä
Telefónica Research
Matthew Ashman
m.ca39@com.ccc uk
Department of Engineering University of Cambridge
Siddharth Swaroop
Bettaaatt@@eessaaaaaaaaa edu
School of Engineering and Applied Sciences Horvard University
Richard E. Turner
ret26@com.ac.. uk
Department of Engineering University of Cambridge
Antti Honkela
www.hoonkelahhessiik...
Deportment of Computer Science University of Helsinki
Reviewed on OpenReview:
Abstract
Learning privacy-preserving model from sensitive data which are distributed across multiple devices is increasingly important problem. The problem is often formulated in the federated learning context, with the aim of learning a single global model while keeping the data distributed. Moreover, Bayesian learning a popular approach for modelling, since naturally supports reliable uncertainty estimates. However, Bayesian Icarning generally intractable even with centralised non-private data and so approximation techniques such as variational inference are necessity. Variational inference has recently been extended the non-private federated learning setting via the partitioned variational inference algorithm. For privacy protection, the current gold standard is called diffcrential privacy. Differential privacy guarantees privacy in strong, mathematically clearly defined sense.
In this paper, we present differentially private partitioned variational inference, the first gen- oral framework for learning a variational approximation to a Baycsian posterior distribution in the federated learning setting while minimising the number of communication rounds and providing differential privacy guarantees for data subjects.
We propose three alternative implementations in the general framework, one based on done by individual partics, and two based perturbing
perturbing local optimisation updates to the global model (one using version of federated averaging, the second one adding virtual parties to the protocol), and compare their properties both theoretically and empirically. We show that perturbing the local optimisation works well with simple and complex models as long as each party has enough local data. However, the privacy is always guaranteed independently by each party. In contrast, perturbing the global updates works best with relatively simple models. Given access to suitable secure primitives, such secure aggregation or secure shuflling, the performance can be improved by all parties guaranteeing privacy jointly.

---

Published in Transactions on Machine Learning Research (04/2023)
1 Introduction
Conmmiication-eficceett distributed methods that protect user privacy are basic requirement for many machine lcarning tasks, where the performance depends on having access to sensitive personal data. Federated learning (Brendan McMahan et al. 2016 Kairouz et al. 2019 is a common approach for increasing communication efficiency with distributed data by pushing computations to the parties holding the data, thereby leaving the data where they are. While it has been convincingly demonstrated that federated learning by itself does not guarantee any kind of privacy (Zhu et al.) 2019 it can be combined with differential privacy (DP, Dwork et al. 2006b Dwork & Roth 2014), which does provide formal privacy guarantees.
In settings which require uncertainty quantification as well as high prediction accuracy, Bayesian methods are a natural approach. However, Bayesian posterior distributions are often intractable and need to be approximated. Variational inference (V1, Jordan et al. 1999 Wainwright et al. 2008) is a well-known and widely used approximation method based on solving a related optimisation problem; the most common formulation minimises the Kullback-Leibler divergence between the approximation and the true posterior.
In this paper, we focus on privacy-preservinn federated VI in the cross-silo setting (Kairouz et al. 2019 We consider common and important setup, where the parties (or 'clients') have sensitive horizontally partitioned data, i.e,, local data with shared features, and the aim is to learn a single model on all the data. Such a setting arises, for example, when several hospitals want to train a joint model on common features without sharing their actual patient data with any other party. Our main problem is to learn a posterior approximation from the partitioned data under DP, while trying to minimise the amount of server-client communications.
We propose general framework to solve the problem based on partitioned variational inference (PVI, Ashunai et al. 2022). On conceptual level, the main steps of PVI are the following: i) server sends current global model to clients, ii) clients perform local optimisation using their own data, iii) clients send updates to server, iv) server updates the global approximation. In our solution, called differentially private partitioned variational inference (DP-PVT), the clients enforce DP either independently or, given access to some suitable secure primitive, jointly with the other clients. We consider three different implementations of DP-PVI, one based on perturbing the local optimisation at step ii) of PVI (called DP optimisation), and two perturbing the model updates at step iii) of PVI (called local averaging and virtual PVI clients).
Crucially, we empirically demonstrate that with our approaches the number of communication rounds between the server and the clients can be kept significantly lower than in the existing DP VI baseline solution, that requires communicating gradients for each regular VI optimisation step, while achieving nearly identical performance in terms of accuracy and held-out likelihood. Additionally, while the baseline requires communicating the gradients using some suitable secure primitive to achieve good utility, our approaches do not require any such primitives, although they can be easily combined with two of our approaches (local averaging and virtual PVT clients) [ Finally, compared to the communication minimising baselines given by DP Bayesian committee machines, that require a single communication round between the server and the clients, our solutions provide clearly better prediction accuracies and held-out likelihoods in a variety of settings.
Our contribution Our main contributions are the following:
We introduce DP-PVI, communication-effiiieet general approach for DP VI on horizontally partitioned data.
Within the general framework, we propose three differing implementations of DP-PVI, one based on perturbing local optimisation, termed DP optimisation, and two based on perturbing model updates, that we call local averaging and virtual PVI clients.
Compared to the bascline of standard (global) DP VI, we experimentally show that our proposed implementations need orders of magnitude fewer server-client communication rounds, and can be
In this paper, instead of considering any specific secure primitive implementation, such secure aggregator or secure shuffler, we assume access to a black-box trusted aggregator in the comparisons.
2

---

Published in Transactions on Machine Learning Research (04/2023)
trained without any secure primitives, while achieving comparable model utility under various settings. Compared to the DP Bayesian committee machine baselines, all our implementations can significantly improve on the resulting approximation quality under various models and datasets.
We compare the relative advantages and disadvantages of our methods, both theoretically and experimentally, and make recommendations on how to choose the best method based on the task at hand:
We demoustrate that no single implementation outperforms the others in all settings.
We show that DP optimisation works well when there is enough local data available, both simple and complex models. However, it not benefit from access to secure primitives. It can therefore lag behind the other methods when there are many clients without much local data, but with access to a trusted aggregator.
In contrast, local averaging and virtual PVI clients work best with relatively simple models, but can struggle with more complex ones. Since they can directly benefit from access to a trusted aggregator, they can outperform DP optimisation in setting with many clients, little local data on each, and trusted aggregator available. We find that using virtual PVT clients tends to be more stable than local averaging,
2
Related work
In the non-Bayesial setting, federated learning, with and without privacy concerns, has seen a lot of recent research (Kairouz et al. 2019).
VI without privacy has been considered in wide variety of configurations, a considerable proportion of which can be interpreted as specific implementations of PVI. With just single client, the local free-energy is equivalent to the global free-energy and global VI is recovered (Hinton & Van Camp 1993). PVI with multiple clients unifies many existing local VI methods, in which each factor involves a subset of datapoints and may also include only a subset of variables over which the posterior is defined. This includes variational
message passing (Winn et al. 2005 and its extensions (Knowles & Minka 2011
Archambeau & Ermis 2015
Wand 2014), and is related to conjugate-computateee
VI (Khan & Lin 2017p. When only a single pass is
made through the clients, PVI recovers online VI @Ghahramani & Attias 2000),
streaming VI (Broderick
et al. 2013) and variational continual learning (Nguyen al. 2018). See Ashman et al. 2022 for more detailed overview of the relationships between PVI and these methods.
There is a rich literature on Bayesian learning with DP guarantees in various settings. Perturbing sufficient statistics in exponential family models has been applied both with centralised data (Dwork & Smith 2010 Foulds et al. 2016 Zhang et al. 2016 Honkela et al. 2018) as well as with distributed data (Heikkilä el al, 2017). In the centralised setting, Dimitrakakis et al. (2014) showed that under some conditions, drawing samples from the true posterior satisfies DP. Posterior sampling under DP has been extended (Zhang et al., 2016 Geumlek et al.] 2017 Dimitrakakis et al. 2017). and generalised also based on, e.g., Langevin and Hamiltonian dynamics Wang el al.] 2015 Li et al. 2019 Räisä et al. 2021) well as on general Markov
chain Monte Carlo (Heikkilä et al. 2019 Yildrmm & Ermis 2019). As an orthogonal direction for combining
Bayesian learning with DP, Bernstein & Sheldon (008))
proposed method for taking the DP noise into account when estimating the posterior with exponential family models to avoid model overconfidence.
DP-VT has been previously considered the centralisod sotting. Jälkö ct al. (017)) first introducod DP-VI for non-conjugate models based on DP-SGD, while Foulds et al. (2020) proposed a related variational Bayesian expectation maximization approach based on sufficient statisties perturbation for conjugate exponential
family models.
Also in the ralised selting, Vinaroz & Park 2202]) recently proposed DP stochastic expectation propagation, an alternative approximation method to VI that also has some close ties to the PVI framework (see e.g. Ashman ct al. (,22), based on natural parameter perturbation. While there are several technical differences in how DP guaranteed, and [Vinaroz & Park (2021) do not discuss the distributed setting or propose a federated algorithm, would expect that there fundamental reason why their approach could not be made to
3

---

Published in Transactions on Machine Learning Research (04/2023)
work in the federated setting well, given enough changes to the centralised algorithm. With reasonable privacy parameters, we would expect comparisons to reflect the general properties of the underlying non-DP approaches (see e.g. Minka 2005 Li et al. 2015 Ashman et al. 2022 and the references therein for discussion on the propertics non-DP variational and EP-style algorithms). The application of such methods to the private federated setting would be an interesting direction for future work.
In the non-Bayesian DP literature, the basic idea in our local averaging and virtual client approaches is close to the subsample and aggregate approach proposed by Nissim et al. (2007). In the same vein as our local averaging, Wei et al. (2020) proposed training separate model for each single data point and combining the models by averaging the paramcters in the context of learning neural network weights under DP. They do not consider other possible partitions or the trade-off between DP noise and the estimator variance.
3 Background
In this section we give a short overview of the most important background knowledge, starting with PVT in Section 3.1 and continuing with DP in Section 3.2
3.1
Partitioned variational inference (PVI)
In Bayesian learning, we are interested in the posterior distribution
p(0|z) x p(z)0)p(0).
where p(f) is prior distribution, p(x[() is a likelihood, x E X is some dataset of size n, and @ are the model parameters. Note that these are all different distributions, but overload the notation in standard way and identify the distributions by their arguments to keep the writing less cumbersome, For example, instead of (0) we simply write p(0) for the prior. In this paper, we typically have 0 E Rd for some d, and each clement 2; E Rd ; 1...., n for some d'.
When the posterior is in the exponential family of distributions, is always tractable (see, e.g., Bernardo & Smith 1994):
Definition 1. distribution over æ E X", indexed by a parameter vector 0 E 0 Rd is an exponential family distribution, if it can be written as
p(=00) = h(x)) exp (T(x) - n(0) - A(r(O)))
(3.1)
for some functions h X + R,T Xm Rd, A: θ + R. When n(0 = n, the parameters n are called natural paramelers, T are sufficient slatislics, A is the log-parlilion function, and h is a base measure.
When the posterior is not in the exponential family, however, we need to resort to approximations. VI is a method for approximating the true posterior by solving an optimization problem over some tractable family of ristribussons (see e.g. Jordan et al. 1999 for an introduction to VT and Zhang el al. 2019 for a survey of more recent developments).
Writing (8 A) for the approximating distribution paramcterisod with variational parameters E Rdvr for some dyr, the main idea. in VI is to find optimal parameters Ai, that minimise some notion of distance between the approximation and the true posterior, with the most common choice being Kullback-Leibler divergence:
A arg min [Pxu_(((0)))p((]]1])]] qE@
(3.2)
where Q some tractable family of distributions. However, since the optimisation problem in Equation 3.2 is usually still not easy-enough for solving directly, the actual optimisation is typically done by maximising the so-called evidence lower bound (ELBO, also called negative variational free-energy):
X = arg max ((x(0) {
(3.3)
4

---

Published in Transactions on Machine Learning Research (04/2023)
It can be shown that the optimal solution Xyy that solves Equation 3.3 also solves the original minimization problem in Equation 3.2
In the setting we consider, there are M clients with shared features, and client j holds ny samples. In the PVI framework (Ashman et al., 2022 this federated learning problem solved iteratively. We start by defining the following variational approximation:
1 (() II (01N)== ((0)))
1 7 =7)))
II p(r)10) -p(02)) ==1
(3.4)
Zg
5=1
where X, Ay are variational parameters, Zg are normalizing constants, Hy is the jth data shard, and &y are client-specific factors refined over the algorithm run. The basic structure of the general PVI algorithm is given in Algorithm |
Note that in Algorithm [ during the local optimisation (Equation 3.5 the cavity distribution (Equation 3.6 works as an effective prior: the variational parameters for the factors 4. j # m are kept fixed to their previous values.
Algorithm Non-private PVI (Ashman et al. 2022
Require: Number of global updates S, prior p(0), initial client-specifie factors + 1, M.
1: for == to S do
2: Server chooses a subset b(*) C (I,...,, } of clients according to an update schedule and sends the
current global model parameters (
Each chosen client m E 6(5) finds a new set of parameters by optimising the local ELBO:
3:
X arg max log (x (---))
(3.5)
&EQ
where (0-1) is the so-called cavity distribution:
M p (0-1) x p(0) II (012))--1) jmm
(3.6)
pm
Each chosen client sends update Atm (0), given by
tm (0
(0112))
Al (0)
(3.7)
Lm (0 (
(01\16-111
to the server. Server updates the global model by incorporating the updated local factors:
((0))()) & ((0))(-11)
II A (0))
mEblo)
end for return Final variational approximation (()}(19))
As high-level overview, the PVT learning loop consists of the server sending current model to clients, the clients finding new local parameters via local optimisation, the clients sending an update to the server, and the server updating the global approximation.
Depending on the update schedule different variants of PVI are possible. In this paper, we use sequential PVI, where each client is visited in turn, and synchronous PVI, where all clients update in parallel (see Ashman et al. 2022 for more discussion on the PVT variants). The main idea in PVT is that the information from other
5

---

Published in Transactions on Machine Learning Research (04/2023)
sites is transmitted to client via the other t-factors, while client m runs optimisation with purely local data. This reduces the number of server-client communications by pushing more computation to the clients.
Ashman et al. (0022) show that PVI has several desirable properties that connect it to the standard non- distributed (global) VI. Most importantly, optimising the local ELBO as in Equation 3.5 can be shown to be equivalent to variational KT. optimisation, and fixed point of PVT is guaranteed to be a fixed point of the global VI.
3.2
Differential privacy (DP)
DP is essentially a robustness guarantee for stochastic algorithms (see e.g. Dwork & Roth 2014 for an introduction to DP and discussion on the definition of privacy). Formally we have the following:
Definition 2 @work et al. 2006b a). Let E > O and â E [0, A randomised algorithm A xn - O is (e, if for every neighhouring x, x' E x and every measurable set E C
Pr(A(x) E E) S PP(((()))) E E)
The basic idea in the definition is that any single individual should only have limited effect on the output. When this is guaranteed, the privacy of any given individual is protected, since the result would have been nearly the same even if that individual's data had been replaced by an arbitrary sample. Definition 2 formalises this idea by requiring that the probability of seeing any given output is nearly the same with any closely-related input dataset (the neighbouring datasets x, x'). The actual level protection depends on the privacy parameters E, 8: larger values mean less privacy.
The type and gramularity of the privacy guarantee can be tuned by choosing an appropriate neighbourhood definition. Typical examples include sample-level (x, differ by single sample) and user-level (x, x' differ by a single user's data) neighbourhoods. In this work, we use the bounded neighbourhood definition, which is also known as substitution neighbourhood, and assume that each individual has a single sample in the full combined training data, i.c., datasets x, are neighbours, [xr| = |a'), and they differ by a single sample. With these definitions, individual privacy guarantees correspond to sample-level DP.
DP has several nice properties as a privacy guarantee, but the most important ones for our purposes are composability (repeated use of the same sensitive data crodes the privacy guarantees in a controllable manner), and immunity to post- procesrocsssigg (if the output of stochastic algorithm is DP, then any stochastic or deterministic post-processing results in the same stronger DP guarantees).
We use the well-known Gaussian mechanism, that is, adding i.i.d. Gaussian noise with equal variance to each component of a query vector, as a basic privacy mechanism:
Definition 3 (Gaussian mechanism, Dwork et al. 2006a). Let f Xm + Rd be a function s.t. for neighbouring 2, x' E Am, there erists a constant C satisfying
sup llf(z) - f(x')l22 SC
2.2¹
A randomised algorithm 9 g(x) = f(x) &,, where & NO ala) is called the Gaussian mechonism.
When a privacy mechanism, c.g., the Gaussian mechanism, run by first subsampling a minibatch of the full data, and running the mechanism using only the minibatch instead of the full data, the mechanism is referred to as subsampled mechanism. For subsampling, we use sampling without replacement:
Definition (Sampling without replacement). A randomised function WOR, : X" - x is a sampling without replacement subsampling function, if it maps a given dalasel into a uniformly random subsel of size of the input data.
The main benefit for privacy when using data, subsampling is the effect of privacy amplification, i.c., the additional randomisation due the subsampling enhances the privacy guarantees depending on the subsampling method and the subsampling fraction given by (sample b where b is the minibatch size and n

---

Published in Transactions on Machine Learning Research (04/2023)
is the total data size in Definition 4 Given base mechanism Ag and a minibatch size b, the subsampled mechanism using sampling without replacement is the combined mechanism As o WORS.
To quantify the total privacy resulting from (iteratively) running (subsampled) DP algorithms, we use the following privacy accounting oracle:
Definition 5 (Accounting Oracie). An accounting oracle is a function O that evaluates ()P privacy bounds for compositions of (subsampled) mechanisms. Specifically, given 5, a sub-sampling ralio isampte E (0, 1), the number of iterations T 2 and base mechanism Ao, the oracle gives an c, such that T-fold composition of Ao using sub- sampling with ratio (sample is ().P) i.e.,
O : (6, Asample; T, P.Ao)++ c.
In the experiments, we use the Fourier accountant (Koskela et al.) 2020) as an accounting oracle to keep track of the privacy parameters, since it can numerically establish an upper bound for the total privacy loss with a given precision level.
4 Differentially private partitioned variational inference
In the setting we consider, there are M parties or clients connected to a central server, with client j holding some amount ny of data (we assume there is exactly one sample per individual protected by DP in the full joint data) with common features (horizontal data partitioning). The clients do not want to share their data directly but agree to train a model given DP guaranlees. The DP guarantees are enforced on a sample-level, that is, we assume that any given individual we want to protect has a single data sample that is held by exactly one client. The central server aims to learn single model from the clients' data, while minimising the number of communication rounds between the server and the clients.
As discussed in Section 3.1 the PV1 framework allows for effectively reducing the number of global communi- cation rounds by pushing more computation to the clients. This also enables several options for guarantecing DP on the client side, either by each client alone or jointly with the other clients via secure primitives. We consider two general approaches the clients can use for enforcing DP in PVI learning:
1. Perturbing the local optimisation (step 3 in Algorithm
2. Perturbing the model parameter updates (step 4 in Algorithm 1.
The first option, which we term DP optimisation, relies on the fact that at each optimisation step in Algorithm [ the local ELBO in Equation 3.5 only depends on the local data at the given client. To guarantec DP independently of others, each client can therefore perturb the local optimisation with a suitable DP mechanism. In practice, this approach can be implemented, e.g., using DP-stochastic gradient descent. (DP-SGD) as we show in Section 4.1
For the second option, since given client only affects the global model through the parameter updates at step 4 in Algorithm| 1 each client can enforce DP by perturbing the update, either independently or jointly with the other clients. Besides the naive parameter perturbation, we propose two improved alternatives in Section 4.2 We call these approaches local averaging and adding virtual PVI clients.
In this paper, instead of considering any particular secure primitive like secure aggregation (see e.g. Shamir 1979 Rastogi & Nath 2010) or secure shufiling (see e.g. [Chaum 1981 Cheu al. 2019). we assume a black-box trusted aggregator capable of summing reals, where necessary. In these cases we also assume that the clients themselves are honest, i.e. they follow the protocol and do not try to gain additional information during the protocol run (or honest but curious, that is, they follow the protocol but will try to gain information such as actual noise values used for DP randomisation during the prolocol run, with minor modifications to the relevant bounds). Any actual implementation would need to handle problems arising, for example, from finite precision (soe c.g. AAgaral et al. 2021: Chen et al. 2002 and references therein for a discussion on implementing distributed DP). These considerations apply equally to all variants, and hence do not affect their comparisons or our main conclusions. We leave these issues to future work.
7

---

Published in Transactions on Machine Learning Research (04/2023)
Table 1 highlights the most important DP noise properties of our proposed solutions: whether the DP noise level can be affected by the local data size (intuitively, we could hope that guaranteeing DP with plenty of local data gives better utility), and whether the approach can benefit from access to a trusted aggregator (this enables the clients to guarantec DP jointly, so the total noise level can be less than when every client enforces DP independenly)..
noise scale affected by local data size
benefit from a trusted aggregator
DP optimisation parameter perturbation local averaging
virtual PVI clients
Table 1:
Properties of DP-PVI approaches
In the rest of this section we state the formal DP guarantees for each approach and discuss their properties. For case reading, since the proofs are fairly straight-forward, all proofs as well as the properties of non-DP local averaging can be found Appendix A
4.1 Privacy via local optimisation: DP optimisation
To guarantee DP during local optimisation, one option is to use differentially private stochastic gradient descent (DP-SGD) (Song et al., 2013 Bassily et al. 2014 Abadi et al. 2016); for every local optimisation step, clip each per-example gradient and then add Gaussian noise with covariance o² to the sum. The formal privacy guarantees are stated in Theorem
Theorem 6. Running DP-SGD for client-level optimisation in Algorithmm 4 using subsampling fraction Qsample E [0,1] the local data level for T local optimisation steps in total, with S global updates interleaved with the local steps, the resulting model is (E,8 with 8 E (0,1) s.t. = 0(66 9sample: T.Go).
Proof. See proof A.1 in the Appendix.
Although DP-SGD in general is not guaranteed to converge, there are some known utility guarantees in the empirical risk minimization (FRM) framework, e-g.; for convex and strongly convex loss functions (Bassily et al. 2014). It has also been empirically shown to work well on a mumber of problems with non-convex losses, such as learning neural network weights (Abadi et al. 2016).
In our setting, DP-SGD can directly benefit from increasing local data size on a given client via the sub- sampling amplification property: adding more local data while koeping the batch size fixed results smaller sampling fraction Gsample and hence gives better privacy.
In contrast, when using DP-SGD with limited communication budget, it is non-trivial to derive direct privacy benefits from adding more clients to the setting. This is the case even when we assume access to a trusted aggregator, since the gradients of the local ELBO in Equation 3.5 only depend on a single client 's data.
4.2 Privacy via model updates
To guarantee DP when communicating an update from client m to the server at global update s, we can clip and perturb the change in model parameters corresponding to Ar(s) at step in Algorithm [ directly. This naive parameter perfurbation approach often results in having to add unpractical amounts of noise each
query, which severely degrades the model utility. The problem arises because the local data size in this case will typically have no direct, effect hir the DP noise level or the query sensitivity.
8

---

Published in Transactions on Machine Learning Research (04/2023)
To improve the results by allowing the local data size have direct effect the noise addition, propose two possible approaches that generalise the naive parameter perturbation: i) local averaging and ii) adding virtual PVI clients. Both are based on partitioning the local data into non-overlapping shards and optimising a separate local model on each, but they differ on the objective functions and on how the local results are combined after training for global model update. Additionally, virtual PVT clients with DP requires all virtual factors be in common exponential family As limiting case, when using a single local data partition both methods are equivalent to the naive parameter perturbation.
Assuming trusted aggregator, with both of our proposed methods can scale the noise level with the total number of clients in the protocol using (MS) sorver-client communications, where M is the number of clients and S the total number of global updates, the same number as running non-DP PVI with synchronous updates.
Next, we present the methods and show that they guarantee DP, starting with local averaging Section 4.2.1 and continuing with virtual PVI clients in Section 4.2.2
4.2.1 Local averaging
Algorithm
2 describes the main steps needed for running (non-private) PVI with local averaging.
Algorithm PVI with local averaging
Each client = ,......b. M partitions its local data into Nm non-overlapping shards.
2: for s= to S do
3: Server chooses a subset ((*) C (1...,,M)) of clients according to an update schedule and sends the current global model parameters (a-1)_
4: Each chosen client m 6(²) finds Nm sets of new parameters by optimising the local objectives all starting from common initial value (the previous global model parameters ((=-1):
Xm. arg max p(Fm ge
1 Nm
DRL (((((())))))))
(--"
1,....., Ne:
(4.1)
where (e-1) is the cavity distribution as in Equation 3.6. The new parameters used for calculating an update for client m in PVI are given by the local average:
x
m
(4.2)
n7 k=
Each chosen client sends the update At (0), defined as
tm (fl2
(0122))
A+!
tm (0 11-11)
((0))(01117'
to the server. Server updates the global model by incorporating the updated local factors:
((0))())) q(0))(-11)
II A A (0).
7: end for
return Final variational approximation {(8))(8)).
"Non-DP PVI with syuchronous updates has similar restriction: all factors need be in the exponential family the prior due with proper normalization, see Asshman et al. 2022 Therefore, when using synchronous PVT server all our approaches, including DP optimisation, inherit. this assumption as well.

---

Published in Transactions on Machine Learning Research (04/2023)
Note that the objective in Equation 4.1 is the regular PVI local ELBO where the KL-term is re-weighted to reflect the local partitioning. This is equivalent to using the PVT objective with tempered (cold) likelihood p(=m,x|0)=* In Appendix A we show that PVI with local averaging has the same fundamental properties, with minor modifications, as rogular PVI. For example, with local averaging the local ELBO optimisation is equivalent to variational KL. optimisation, and (local) optinum for local averaging is also an optimum for global VI.
DP with local averaging Assuming 4.3 I,..., M are exponential family factors, the client update step in Algorithm we can write
(0) = AA
(4.3)
1a (=-1)
(4.4)
Nm
Xmxx (
(4.5)
N
k=1
Nmn
- A (a-
(4.6)
N
We then have the following for guarantecing DP with local averaging: Theorem 7. Assume the change in the model parameters 1|mm ((-_1) 1l2 S = l,..., Nm for
known conslant C, where Xma is proposed solution Equation 4.1 and ((s-1) is the vector of common initial values. Then releasing A is 8),P), with 8 E (0,1) s.t. E 0(d, qsample 1, Go), when
Nm
A
1
(Aima - (x(111 + E)
(4.7)
Nm
where g 02 T).
Proof. See A.6 in the Appendix.
For quantifying the total privacy for S global updates using local averaging, we immediately have the following: Corollary 8. A composition of S global updates with local averaging using a norm bound C' for clipping is (E,8)-DP, with 8 e (0,1) s.t. E = 0(6, gsample 1,),
Proof. See A.7 in the Appendix.
As is clear from Corollary g with local averaging pay privacy cost for each global update, while the local optimisation steps are free. This the opposite of the DP optimisation result in Theorem 6 As mentioned in
Corollary in practice we generally need to guarantee the norm bound in Theorem by clipping the change
in the model parameters g
Considering how increasing the local data size affects the DP noise level, we have the following:
Theorem 9. With local averaging, the DP noise standard deviation can be scaled as O ()))), where Nm is the number of local portitions. Therefore, the effect of DP noise will vanish on the local factor level when the local dataset size and the number of local partitions grow.
Proof. See A.8 in the Appendix.
WWe could also enforce DP (including without exponential family factors) clipping and adding noise directly to the parameters instead privatising the change parameters; the clipping would then enforce the parameters fg-norm ball of radius C around the origin.
10

---

Published in Transactions on Machine Learning Research (04/2023)
Note that Theorem 9 does not say that the DP noise will necessarily vanish the global approximation level if one client gets more data and does more local partitions, since the total noise level depends on the factors from all the clients. Looking only at Theorem g it would seem like increasing the number of local partitions is always beneficial as it decreases the DP noise effect. However, this is not generally the full picture. Zhang eet al. (2013) have shown that. under some assumptions, the convergence rate of mean estimators (similar the one we propose) will deteriorate when the number of partitions increases too much. In effect, having fewer samples from which to estimate each local set of parameters increases the estimator variance, which hurts convergence. We have experimentally confirmed this effect with local averaging (see Figure in the Appendix).
The optimal number of local partitions therefore usually balances the decreasing DP noise level with the increasing estimator variance. However, as we show in Theorem [0] there are important special cases, such as the exponential family, where there no trade-off since the number of local partitions can be increased without affecting the non-DP posterior.
Theorem 10. Assume the effective prior Pol(i), and the likelihood p( E (1,..., M} are in a conjugale exponential fomily, where are the natural parameters. Then the number of portitions used in local averaging does not affect the non-DP posterior.
Proof. See A.9 in the Appendix.
Finally, Theorem shows that assuming trusted aggregator, the global approximation noise level can stay constant when adding clients to the protocol, i.e., increasing the number of clients allows every individual client to add less noise while getting the same global DP guarantees.
Thcorem 11. Using local averaging with M clients and shared number of local portitions N Vj assume the cliends have access to trusted aggregalor. Then for any given privacy paramelers e, 2,6, the noise slandard deviation added by a single client con be scaled O (MT) while guaranteeing the same privacy level.
Proof. See A.10 in the Appendix.
4.2.2 Virtual PVI clients
Running (non-private) PVI with virtual clients is described Algorithm 3
The full local factor for client m is now fm = -i lm,k, which is updated only through the virtual factors, and only the change in the full product is ever communicated to the server. This means that when all the the parameters for the full local factor tm are virtual factors for client m are in the same exponential family 4 given by
Nm
Am,ks
(4.10)
where Am, are the parameters for the kth virtual factor, and At (0) at step 5 in Algorithm can be written
No (hi
A
(0-1)).
With virtual PVI clients without DP, doing both local and global updates synchronously corresponds to 3M regular non-DP PVI run with a synchronous server and Σ5= N, clients. Therefore, all the regular PVT properties (Ashman et al. 2022) derived with a synchronous server immediately hold for non-DP PVI with added virtual clients. In particular, the local ELBO optimisation in this case is equivalent to a variational KT, imiitttoo and any optimum of the algorithm is also an optimum for global VI.
With DP, having all factors from single exponential family is required bound the sensitivity.
11

---

Published in Transactions on Machine Learning Research (04/2023)
Algorithm PVI with virtual clients
Each client 1, ,,...,M M partitions it's local data into Nn non-overlapping shards and creates corre- sponding virtual clients, i.c., separate factors tm,k with parameters Am,k, k N,...,.Nm.
2: for 8 to S do
3: Server chooses a subset b(*) C {l..... 3 of clients according to an update schedule and sends the current global model parameters X (
4: Each chosen client m E b(5) updates its virtual clients by locally simulating a single regular PVI
update (steps 3-4 in Algorithm| 1 with synchronous update schedule (/ [1,...,,N. Nm The optimised parameters for the kth virtual client are given by
my = arg max
Egllog((zm.(00) DKL (m h 1, 1,..., Nm:
(4.8)
qEQ
where (0-1)
Pim,k is the cavity distribution:
No II
P p
p()) II i
mm se (0) (mr)))))
(4.9)
it kf
5: Each chosen client m updates the local factor and sends the update Artnl (0), defined as
(m fm (0) Am
Nm O II A=1 ((0))()11))
q(())mp))
A At &
(B|
(a-1))
to the server.
6: Server updates the global model by incorporating the updated local factors:
((0))())) ((01)(-1))
II mEb())
(0).
7: end for
8: return Final variational approximation ())))
DP with virtual PVI clients For ensuring DP with virtual clients, again via noising the change in the model parameters in Scction 4.2.1 have:
Theorem 12. Assume the change in the model parameters [Mm, Xl5-11112 C, k: ,,,,, Nm for some known constant C, where Xm, is a proposed solution to Equation 4.8, and ( is the vector of common initial values. Then releasing Adt is (e,8)-DP, with 5 (0. s.t. 0(d, gsample = 1, 1, Go), when
Nm Σ k=1
(Xms ((0-1)) + +
(4.11)
where& ~ 020, I).
Proof. See
A.11 the Appendix.
As an immodiate result, Corollary 13 quantifics the total privacy when doing S global updates using virtual
PVI clients:
Corollary 13. composition of S global updates with virtual PVI clients using norm bound C' for clipping is (DP with 5 10 s.t. 068, Asample S,
Proof. See A.12 in the Appendix.
12

---

Published in Transactions on Machine Learning Research (04/2023)
As with local averaging in Corollary 8 and contrasting with DP optimisation in Theorem 6 using Corollary 13 we pay privacy cost for each global update, but the local optimisation ion steps are free. And as with local averaging, we usually need to guarantee the assumed norm bound by clipping.
Note that unlike with local averaging in Theorem g the noise variance in Equation 4.11 will stay constant
with increasing number of local partitions Nm- Increasing the number of partitions will decrease the relative effect of the noise if it increases the non-DP sum.
Assuming access to trusted aggregator, Theorem is counterpart to Theorem with local averaging: again, the global approximation noise level can stay constant when adding clients to the protocol, meaning that each individual client needs to add less noise while maintaining the same global DP guarantees. The main difference is that with virtual PVI clients each client can choose the number of local partitions freely.
Assume there are M real clients adding virtual clients, and access to a trusted aggregator. Then for any given privacy porometers e, 8, the noise standard deviation added by a single client can be scaled O /M
Theorem 14.
while guoranteeing the same privacy level.
Proof.
See proof A.13 in the Appendix.
4.3 Summary of technical contributions
We have presented three different implementations of DP-PVI: DP oplimisation, that is based on perturbing the local optimisation in Section I.] as well as local averaging in Section 1.2.1 and adding virtual PVI clients in Section 4.2.2 which are both based on perturbing the global model updates.
The main idea in DP optimisation is to replace the non-DP optimisation procedure by a DP variant, our main choice being DP-SGD. Hence, DP optimisation inherits all the properties of standard DP-SGD, such as utility guarantees with convex and strongly convex losses. In the more general case of non-convex losses, DP optimisation has no known utility guarantecs. Considering the privacy guarantees, with DP optimisation each client enforces DP independently (see Theorem G]: while the global model guarantees result from parallel composition.
In contrast, local averaging and virtual PVI clients are both based on the general idea of adding local data partitioning to mitigate the utility loss from DP noise: each client trains several models on disjoint local data shards, and then combines them for a single global update.
We first showed that local averaging does not fundamentally break the general properties of PVT (see Appendix [A]: the local ELBO optimisation can be interpreted as a variational KL optimisation, and an optimum of the local averaging algorithm is optimum for global VI. Privacy for local averaging can be guaranteed by clipping and noising (the change in) the local parameters (see Theorem 7). We showed that the local average under DP approaches the non-DP average on the local factor level when the number of local data shards increases (Theorem g and that in the special case of conjugatte-xxooeeniil family there is no price for increasing the number of local data shards (Theorem 10.. Finally, we showed that given access to suitable secure primitive, we can leverage the other clients to guarantee DP jointly, thereby reducing the amount of noise added by each client while keeping the global model guarantees unchanged (Theorem
Adding virtual PVI clients without DP inherits the properties of non-DP PVI with synchronous updates (e.g., the local ELBO optimisation can be interpreted as a variational KL optimisation, and an optimum of the virtual PVI clients am is an optimum for global VI). We can guarantee privacy via clipping and noising (the change in) the local parameters (Theorem 12 We also showed that, as with local averaging, assuming a suitable secure primitive and guaranteeing DP jointly, the amount of noise added by each client can be reducod while keeping the global model guarantces unchanged (Theorem 14..
Next, test our proposed methods in Section under various settings to see how they perform in practice.
13

---

Published in Transactions on Machine Learning Research (04/2023)
5 Experiments
In this Section empirically test our proposed methods using logistic regression and Bayesian neural network (BNN) models. Our code for running all the experiments is openly available from https: com/ DFBayes/DPPVI
We utilise a mean-field Gaussian variational approximation in all experiments. For datasets and prodiction tasks, we employ UCI Adult. (Kohavi, 1996; Dua & Graff] 2017) predicting whether an individual has income > 50k, as well as balanced MIMIC-III health data (Johnson et al.) 2016b a Goldberger et al., 2000) with an
in-hospital mortality prediction task (Harutyunyan et al. 2019).
An important and common challenge in federated learning is that the clients can have very different amounts of data, which cannot usually be assumed to be ii.d. between the clients. We test the robustness of our approaches to such differences in the data held by each client by using two unbalanced data splits besides the balanced split. In the balanced case, the data is split evenly between all the clients. In both unbalanced data cases half of the clients have a significantly smaller share of data than the larger clients. In the first. alternative the small clients only have a few minority class examples, while in the second one they have a considerably larger fraction than the large clients. We defer the details of the data splitting to Appendix B
In all experiments, we use sequential PVI when not assuming a trusted aggregator, and synchronous PVT otherwise. The number of communications is measured as the number of server-client message exchanges performed by all clients. The actual wall-clock times would depend on the method and implementation: with sequential PVI only one client can update at any one time but communications do not need encryption, while with synchronous PVI all clients can update at the same time but the trusted aggregator methods would also need to account for the time taken by the secure primitive in question. All privacy bounds are calculated numerically with the Fourier accountant (Koskela et al., 2020) The reported privacy budgets include only the privacy cost of the actual learning, while ignore the privacy leakage due to hyperparameter tuning. More details on the experiments can be found in Appendix B
We use two baselines: i) DP Bayesian committee machines (BCM with same and split prior, Tresp 2000; Ashiman et al. 2022), which are trained with DP-SGD and use a single global communication round to aggregate DP results from all clients, and ii) a centralised DP-VI, which can be trained in our setting with DP-SGD when we assume trusted aggregator without any communication limits (global VI, trusted aggr., Jälkö al. 2017
To measure performance, we report prediction accuracy on held-out data, as well as model log- likeliood as we are interested in uncertainty quantification. Model likelihood effectively measures how well the model can fit unseen data and whether it knows where it is likely to be wrong.
Logistic regression
The logistic regression model likelihood is given by
x))00,)) o 00 - a(T '3)
where y (0, = -+t is the sigmoid function, and ă = [L, x J is the augmented data vector with a bias term. In the experiments, we use standard normal prior for the weights p(0) -N(000, I) and Monte Carlo (MC) approximate the posterior predictive distribution.
Figures J & 2 show the results for logistic regression on Adult and balanced MIMIC-III datasets, respectively, for the thrce different data splits for 10 clients.
Global VT (global VT, trusted aggr.) is a very strong model utility baseline, that approximately the best we could hope for. However, as is evident from the results, achieving this baseline requires trusted aggregator and it uses orders of magnitude more communications than the DP-PVI implementatiins D
The minimal single-round communication baselines are given by the two BCM variants (BCM same, BCM split). While they are very communication-cffcionni the utility varies markedly between the different
5 Available from https://gi wwt/c/////////// Peom/DDBaays/PPPee Pttp////.-.-Acc.ttttt..t.t. Note that the results global do not depend on the data split and hence this baseline curve is the same for all the splits.
14

---

Published in Transactions on Machine Learning Research (04/2023)
settings and they are outperformed by the DP-PVI methods (DP optimisation, local avg, virtual) in several experiments.
For DP-PVI methods, we report results separately without a trusted aggregator (DP optimisation, local avg. virtual) and with a trusted aggregator (local avg, trusted aggr.; virtual, trusted aggr.). In terms of communications, all DP-PVT methods are on par with each other: requiring around an order of magnitude more communications than the minimal communication BCM baselines, and two orders less than the strong utility global VI baseline that always assumes trusted aggregator.
Our DP optimisation method performs overall well in terms of model utility, always performing slightly worse than the strong utility global VI baseline (global VI, trusted aggr.), being on par with DP-PVI using virtual clients (virtual), and regularly outperforming the BCM baselines (BCM same, BCM split) as well as DP-PVT with local averaging (local avg).
The performance of our local averaging method without access to a trusted aggregator (local avg) seems unstable: it lags behind our other two methods (DP optimisation, virtual) as well as the minimal communica- tion BCM methods (especially BCM split) in several experiments. Given access to a trusted aggregator (local avg. trusted aggr.) the performance improves, as can be expected from the noise scaling in Theorem 11 in several settings significantly so. While it now outperforms our DP optimisation (which does not benefit from the trusted aggregator) and the BCM baselines in many settings, it still regularly lags behind our virtual PVI clients with a trusted aggregator (virtual, trusted aggr.).
Our virtual PVI clients with no trusted aggregator (virtual) performs consistently well in terms of model utility: it lags somewhat behind the strong utility baseline (global VI, trusted aggr.), is on par with our DP optimisation, and outperforms both our local averaging (local avg) and the BCM baselines (BCM same, BCM split) in several experiments, With a trusted aggregator (virtual, trusted aggr.) the model utility improves in line with the noise scaling in Theorem bascline (global VI, trusted aggr.) in several settings.
14 sometimes by clear margin and even reaching the strong utility
While the results for our local averaging and virtual PVT clients in Figures I & 2 improve given access to a trusted aggregator even with a very limited communccation budget (compare local avg vs. local avg, trusted aggr. and virtual vs. virtual, trusted aggr.), the benefits of having the DP noise scale according to Theorems k 14 become more marked with less local data and more clients. Figure 3 shows the results for Adult data with 200 clients: our DP optimisation, which does not benefit from access to a trusted aggregator, now performs clearly worse than local averaging (local avg, trusted aggr.) or virtual PVI clients (virtual, trusted aggr.) which use a trusted aggregator. In contrast to the results in Figures D 2 in the more demanding setting in Figure 3 all of our DP-PVT methods clearly outperform the minimum communication BCM baselines (BCM same, BCM split) in model utility.
BNNs We expect local averaging and virtual PVI clients to work best when the model has a single, well-defined optimum, since then the local data partitioning should not have a major effect on the resulting model. To test. the methods with a more complex model, we use a BNN with one fully connected hidden layer of 50 hidden units, and ReLU non-lincarities. Writing fo(x:) for the output from the network with parameters 0 and input x E Rd, the likelihood for E {0, 1} is a Bernoulli distribution p(y]0,x) = Bern(ylT), where the class probability π = o (f)(x)), i.e. the logit is predicted by the network. We use a standard normal prior on the weights p(0) = (V T), and MC approximate the predictive distribution:
ply- = 1/0 "1l",,,,10 v..))
1 NMC
BMC
x²) -100(),x0),00 Σ ply" = =1
x²),00) 000 ~ q(0) Vi.
The results are shown in Figure for Adult data and 10 clients. The minimum communication basclines (BCM same, BCM split) are very poor in terms of model utility: to achieve good utility with the BNN model in this setting requires some communication between the clients (compare to BCM same and BCM split results in Figure using a tighter privacy budget but simpler logistic regression model). Our DP optimisation works very well in terms of model utility, being almost on par with the high-utility baseline that uses a trusted aggregator (global VT, trusted aggr.). In contrast, both our local averaging (local avg) and virtual
15

---

Published in Transactions on Machine Learning Research (04/2023)
Log.regr. with Adul,, 10 clientts balanced split
Accuracy
0.40
6.78
DP optimisation
Communications
local avg
local avg, trusted aggr.
virtual
-0.4
Logl
virtual, trusted aggr.
-3.4
global VI, trusted aggr.
BCM same
-6.35
BCM split
10
12
10
101
Cammunications
Log.regr with Adult, 10 clients, unbalanced split 1
Log.regr. with Adult, 10 clients, unbalanced split
Accuracy
Accuracy
0.80
0.50
0:38
0.70
Communications
Communications
.040
-2.00
-2.40
-0.55
-2.5
20'
10
Communication tions
Communications
(b)
(c)
Figure 1: (1,10-5)-DP logistic regression, Adult data with 10 clients: mean over 5 seeds with SEM. a) balanced split, b) unbalanced split. 1, e) unbalanced split 2.
16

---

Published in Transactions on Machine Learning Research (04/2023)
Log.regr. with bai anced MIMIC-III, 10 clients, balanced split
Accuracy
0.55
DP optimisation
0.53
Communications
100
local avg
-4.225
local avg, trusted aggr.
-4.50
virtual
-4.35
Logl
virtual, trusted aggr.
-4.925
global VI, trusted aggr.
6.455
BCM same
BCM split
12
101
Communications
Log.regr. with balanced MIMIC-III, 10 clients, unbal anced split
Log.regr. with balanced MIMIC-III III, 10 clients, unbalanced split
Accuracy
Accuracy
0.60
6.65
0.60
0.00
0.55
655
0.58
Communications
Communications
60.25
-305
-0.50
+1.00
-3575
Log
825
-3.525
-3.50
30
11*
10
Communications
Communications
(b)
Figure 2: (1, 50 logistic regression, balanced MIMIC-II data with 10 clients: mean over 5 seeds with SEM. a) balanced split, b) unbalanced split 1, c) unbalanced split 2.
17

---

Published in Transactions on Machine Learning Research (04/2023)
Log.regr. with Adult, 200 clienis, balanced split.
Accuracy
0.40
6.78
Communications
DP optimisation
local avg, trusted aggr.
virtual, trusted aggr.
-4.43
Logl
global VI, trusted aggr.
-2.4
BCM same
BCM split
-4.35
10
1P
Cammunications
Log.regr. with Adult, 200 clients, unbalanced split
Log.regr. with Adult, 200 clients, unbalanced split 2
Accuracy
Accuracy
0.80
0.50
0:38
0.70
Communications
Communications
.040
-2.00
6.40
1.0
-2.40
-0.55
-255
10
32
10
Communication tions
Communications
(b)
(c)
Figure 3: (1, 10 DDP logistic regression with Adult data and 200 clients: mean over 5 seeds with SEM. a) balanced split, b) unbalanced split 1, c) unbalanced split 2.
18

---

Published in Transactions on Machine Learning Research (04/2023)
PVI clients (virtual) perform clearly worse. They are also much more likely to diverge and seem to require generally more careful tuning of the hyperparameters to reach any reasonable performance.
6 Discussion
We have proposed three different implementations of DP-PVI, one based perturbing the local optimisation (DP optimisation), and two based on perturbing the model updates (local averaging and virtual PVT clients). As is clear from the empirical results in Section 5 no single method dominates the others in all settings. Instead, the method needs to be chosen according to the problem at hand. However, we can derive guidelines for choosing the most suitable method based on the theoretical results as well as on the empirical experiments.
DP optimisation is a good candidate method with simple or complex models regardless of the number of clients as long the clients have enough local data. However, with little local data and more clients, since it cannot easily benefit from secure primitives, the performance
be sub-optimal.
In contrast, local averaging and virtual PVI clients work best with relatively simple models, while the performance with more complex models can easily lag behind DP optimisation results. However, given access to trusted aggregator both methods can leverage other clients to reduce the amount of DP noise required. Based on our experiments, from the two methods local averaging is harder to tune properly and can be unstable whereas using virtual PVI clients is more robust alternative.
Acknowledgments
The authors would like to thank Mrinank Sharma, Michael Hutchinson, Stratis Markou and Antti Koskela for useful discussions. The authors acknowledge CSC IT Center for Science, Finland, and the Finnish Computing Competence Infrastructure (FCCI) for computational and data storage resources.
Mikko Heikkilä was at the University of Helsinki during this work.
Matthew Ashman is supported by the George and Lilian Schiff Foundation.
Siddharth Swaroop was at the University of Cambridge during this work, where he was supported by an EPSRC DTP studentship and a Microsoft Research EMEA PhD Award.
Richard E. Turner is supported by Google, Amazon, ARM, Improbable and EPSRC grant EP/ EP/T00536//1.
This work was supported by the Academy of Finland (Flagship programme: Finnish Center for Artificial Intelligence, FCAI; and grant 325573), the Strategic Research Council at the Academy of Finland (Grant 336032) as well as the European Union (Project 101070617). Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or the European Commission. Neither the European Union nor the granting authority can be held responsible for them.
References
Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Commanications Security, pp. 308 318, 2016.
Naman Agarwal, Peter Kairouz, and Ziyu Liu. The Skellam mechanism for differentially private federated learning. October 2021.
Codric Archambean and Beyza Ermis. Incremental variational inference for latent Dirichlet allocation. arXiv preprinl XrXi::1507.0006, 2015.
Matthew Ashman, Thang D. Bui, Cuong Nguyen, Stratis Markou, Adrian Weller, Siddharth Swaroop, and Richard E. Turner. Partitioned variational inference: A framework for probabilistic federated learning. 2022. doi: 10.48550/
12275. URL http:s//aaxxx.oor///////00002.20
19

---

Published in Transactions on Machine Learning Research (04/2023)
BNN with Aduit, 10 clients, balanced split
Accuracy
0.40
6.78
0.78
Communications
DP optimization
local avg
virtual
-4.4
Logl
global VI, trusted aggr.
-2.4
BCM same
-4.3
BCM split
-4.35
121
12
10'
Cammunications
(a)
BNN with Adult, 10 clients, unbalanced split 1
BNN with Adult, 10 clients, unbalanced split 2
Accuracy
Accurary
0.80
7.50
0:38
0.70
Communications
Communications
-0.0
-3.30
.040
-2.00
Log
1.0
-2.40
-0.55
-255
10'
-3.00
107
22"
10
Communications
Communications
(b)
(c)
(2, 10 50,1DP 1-layer BNN with Adult data and 10 clients: mean over 5 seeds with SEM. a) balanced split, b) unbalanced split 1, c) unbalanced split 2.
Figure 4:
20

---

Published in Transactions on Machine Learning Research (04/2023)
Raef Bassily, Adam Smith, and Abhradeep Thakurta. Private empirical risk minimization: Efficient algorithms and tight error bounds. In Proceedings of the 2014 IEEE 55th Annual Symposium on Foundations of Computer Science, FOCS '14, pp. 464 473, Washington, DC, USA, 2014. IEEE Computer Society. ISBN 978-1-4799-6517-5 doi: 10.1109/FOCS.2DLE 2014.66. URL http::////// dx doi. ort.orrgg/.......oooooooooo.o... 10...1100/FOCCC 2014. 56
José M Bernardo and Adrian F M Smith. Bayesian Theory. John Wiley & Sons, Inc., 1994.
Garrett Bernstein and Daniel Sheldon. Diffcrentially private bayesian inference for exponential families. In S. Bengio and H. Wallach and H. Larochelle and K. Grauman and N. Cesa-Bianchi and R. Garnelt (ed.), Advances in Neural Information Processing Systems, volume 31, 2018.
H Brendan McMahan, Fider Moore, Daniel Ramage, Seth Hampson, and Blaise Agüera y Arcas. Communiestion-n-ifeiei learning of deep networks from decentralized data. February 2016.
Tamara Broderick, Nicholas Boyd, Andre Wibisono, Ashia C. Wilson, and Michael I. Jordan. Streaming variational Bayes. In Advances in Neural Information Processing Systems, 2013.
Thang D Bui, Cuong V Nguyen, Siddharth Swaroop, and Richard E Turner. Partitioned variational inference: A unified framework encompassing federated and continual learning. November 2018.
David L Chaum. Untraceable electronic mail, return addresses, and digital pseudonyms. Commun. ACM, 24 (2):84-90 90, February 1981.
Wei-Ning Chen, Christopher A Choquette-Choo Peter Kairouz, and Ananda Theertha Suresh. The funda- mental price of secure aggregation in diffcrentially private federated learning. March 2022.
Albert Cheu, Adam Smith, Jonathan Ullman, David Zeber, and Maxim Zhilyaev. Distributed differential privacy via shuffling. In Annual International Conference on the Theory and Applications of Cryptographic Techniques, pp. 775-403. Springer, 2019.
Christos Dimitrakakis, Blaine Nelson, Aikaterini Mitrokotsa, and Benjamin I. P. Rubinstein. Robust and private Bayesian inference. In Proc. ALT 2014, pp. 291 101-305.222 2014.
Christos Dimitrakakis, Blaine Nelson, Zuhe Zhang, Aikaterini Mitrokotsa, and Benjamin 1. P. Rubinstein. Differential privacy for Bayesian inference through posterior sampling. Journal of Machine Learning Research, 18(11):1-39, 2017.
Dheeru Dua and Casey Graff. UCI machine learning repository, 2017. CRL http:://acchieee iic.iieeeii............ uci edu/ml
Cynthia Dwork and Aaron Roth. The algorithmic foundations of differential privacy. Found. Trends Theor. Comput. Sci., 9(3 4):211 407, August 2014. ISSN 1551-305X. doi: 10.1561/0400000042. URL
http://dx: www.diii.oooooo org/0.0......... 1tte:/11..11111610 101400000
Cynthia Dwork and Adam Smith. Differential privacy for statistios: What we know and what we want learn. Journal of Privacy and Confidentiality, 1(2), Apr. 2010. doi: 10.29012/jpc..112.570.. URL winiiiidxxxi/i hnttps://jouree settas://hornaallrivayycyo wtw.r/eoooiiinnnnnnaaiiai htt.aa/i.aaaaa.o.ooo///eeee/eeep http:/www..ppppppp/tttllleleeeee
Cynthia Dwork, Krishnaram Kenthapadi, Frank McSherry, llya Mironov, and Moni Naor. Our data, ourselves: Privacy via distributed noise generation. In Annual International Conference on the Theory and Applications of Crgplographic Techniques, pp. 486 503. Springer, 2006a.
Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Proc. TCC 2006, pp. 265-284 2006b. ISBN 978-3-540-32732-5, doi: 10.1007/11681873 14.
URL sktp://css /tt/://w..........00000000///110
James Foulds, Josoph Geumlek, Max Welling, and Kamalika Chaudhuri. On the theory and practice of Bayesian data analysis. In Proc. 32nd Conf. on Uncertainty in Artificial Intelligence (UAT 2016), 2016.
21

---

Published in Transactions on Machine Learning Research (04/2023)
James R. Foulds, Mijung Park, Kamalika Chaudhuri, and Max Welling. Variational Bayes in private settings (VTPS) (extended abstract). In Christian Bessiere (ed.), Proceedings of the Twenly-Ninll International Joint Conference on Artificial Intelligence, LJCAI-20, pp. 5050 5054. International Joint Conferences on Artificial Intelligence Organization, 7 2020. doi: 10.24963 0tt.2496/jjcai..oo fjcaai.2220/7000 URL https: http://ddoo.orr/1// 24963/ijcai 2020/705 Journal track.
Joseph Geumlek, Shuang Song, and Kamalika Chaudhuri. Rényi differential privacy mechanisms for posterior sampling. In Proceedings of the 31st International Conference on Neural Information Processing Systems, NIPS'17, pp. 5295 5304, USA, 2017. Curran Associates Inc.
Zoubin Ghahramani and H. Attias. Online variational Bayesian learning. In NIPS Workshop on Online Learning, 2000.
A. Goldberger, L. Amaral, L. Glass, J. Hausdorff, P. C. Ivanov, R. Mark, J.E. Mietus, G.B. Moody, C.K Peng, and H. E. Stanley. PhysioBank, PhysioToolkii and PhysioNet: Components of new research resource for complex physiologic signals. Circulation, 101(23), 2000.
Hrayr Harutyunyan, Hrant Khachatrian, David C Kale, Greg Ver Steeg, and Aram Galstyan. Multitask learning and benchmarking with clinical time series data. Scientific Data, 6(96), June 2019.
Mikko Heikkilä, Eemil Lagerspetz, Samuel Kaski, Kana Shimizu, Sasu Tarkoma, and Antti Honkela. Differen- tially private bayesian learning on distributed data. In I. Guyon, U. Von Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Garnett (cds.), Advances in Neural Information Processing Systems, volune 30. Curran Associates, Inc., 2017. URL htttpp:://proceed..ngg iigs new.rrreg........uiii........... cctppp//.ccccpppp/1/ pdf
Mikko Heikkilä, Joonas Jälkö, Onur Dikmen, and Antli Honkela. Differentially private markov chain monte carlo. In H. Wallach, Н. Larochelle, A. Beygelzimer, F. d'Alché-Buc, E. Fox, and R. Garnett (eds.), Advances in Newral Information Processing Systems, volume 32. Cur- ran Associates, Inc., 2019. URL Paper. .ddf 074177d3eb337ee2cc 6c55a3b8 7060
Geoffrey E Hinton and Drew Van Camp. Keeping the neural networks simple by minimizing the description length of the weights. In Conference on Computational Learning Theory, pp. 5-13, 1993.
Antti Honkela, Mrinal Das, Arttu Nieminen, Onur Dikmen, and Samuel Kaski. Efficient. differentially private learning improves drug sensitivity prediction. Biology Direct, 13(1):1, 2018.
Joonas Jälkö, Antti Honkela, and Onur Dikmen. Differentially private variational inference for non-conjugate models. In Proc. UAI 2017, 2017. URL pdf
Alistair Johnson, Tom Pollard, and Roger Mark. MIMIC-III clinical database (version 1.4). PhysioNet, 2016a. URL https:://oi. org/ /10. wtt./////......//.1...... 13026/C2XW26
Alistair E W Johnson, Tom J Pollard, Lu Shen, Li-Wei H Lehman, Mengling Feng, Mohammad Ghassemi, Benjamin Moody, Peter Szolovits, Leo Anthony Celi, and Roger G Mark. MIMIC-III, a freely accessible critical care database. Scientific Data, 3(160035), May 2016b.
Michael I Jordan, Zoubin Ghahramani, Tommi S Jaakkola, and Lawrence K Saul. An introduction to variational methods for graphical models. Mach. Learn., 37(2):183322) 233, 1999.
Peter Kairouz, H. Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, Rafael G. L. D'Oliveira, Hubert Eichner, Salim El Rouayheb, David Evans, Josh Gardner, Zachary Garrett, Adrià Gascón, Badih Ghazi, Phillip B. Gibbons, Marco Gruteser, Zaid Harchaoui, Chaoyang He, Lie He, Zhouyuan Huo, Ben Hutchinson, Justin Hsu, Martin Jaggi, Tara Javidi, Gauri Joshi, Mikhail Khodak, Jakub Koncčný, Aleksandra Korolova, Farinaz Koushanfar, Sanmi Koyejo, Tancrède Lepoint, Yang Liu, Prateck Mittal, Mehryar Mohri, Richard Nock, Ayfer Ozgür, Rasmus Pagh, Mariana Raykova, Hang Qi, Daniel Ramage, Ramesh Raskar, Dawn
22

---

Published in Transactions on Machine Learning Research (04/2023)
Song, Weikang Song, Sebastian U. Stich, Ziteng Sun, Ananda Theertha Suresh, Florian Tramer, Pranecth Vepakomma, Jianyu Wang, Li Xiong, Zheng Xu, Qiang Yang, Felix X. Yu, Han Yu, and Sen Zhao. Advances and open problems in federated learning. 2019. doi: 10.48550 018550/ARXIV11112.449777 URL
attps://arxiv.orq/ 2ttp.//00rr//bb11111.04044..
Mohammad Emtiyaz Khan and Wu Lin. Conjugate-computttion variational inference: : Converting variational inference in non-conjugate models to inferences in conjugate models. In International Conference
Artificial Intelligence and Statistics, 2017.
Diederik Kingma and Jimmy Ba. Adam: A method for stochastic optimization, 2014. URL https:
//axxvv. waaxiv.org/abs/112.. 6980.
David A. Knowles and Tom Minka. Non-conjugate variational message passing for multinomial and binary regression. In Advances in Newral Information Processing Systems, pp. 1701 1709, 2011.
Ron Kohavi. Scaling up the accuracy of naive-bayes classifiers: A decision-tree hybrid. In Proceedings of the Second International Conference Knowledge Discovery and Data Mining, KDD' D'96, pp. 202-207. AAAI Press, 1996.
Antti Koskela, Joonas Jälkö, and Antti Honkela. Computing tight. differential privacy guarantees using FFT. In International Conference on Artificial Intelligence and Statistics, pp. 2560 2569. PMLR, 2020.
Bai Li, Changyou Chen, Hao Liu, and Lawrence Carin. On connecting stochastic gradient meme and differential privacy. In Kamalika Chaudhuri and Masashi Sugiyama (eds.), Proceedings of the Twenty- Second International Conference on Artificial Intelligence and Statistics, volume 89 of Proceedings of Machine Learning Research, pp. 557-566. PMLR, 16-18 Apr 2019. URL htttss://procedd mml html
press/v89/15
Yingzhen Li, José Miguel Hornández-Lobato, and Richard E Turner. Stochastic expectation propagation. In C. Cortes, N. Lawrence, D. Lee, M. Sugiyama, and R. Garnett (eds.), Advances in Newral Information Processing Systems, volume 28, Curan Associates, Inc., 2013. URL
neurip
Tom Minka. Divergence measures and message passing. Technical Report MSR-TR-2005-
173, January 2005. URL ht.p::/ww.mmerrsffff.co http://www.rrooo.oooooeeeea///// htt.:///t...oo/eeeee//////////aa
www
divergence measures and message--asssiee passing/
Cuong V. Nguyen, Yingzhen Li, Thang D. Bui, and Richard E. Turner. Variational continual learning. In International Conference on Learning Representations, 2018.
Kobbi Nissim, Sofya Raskhodnikova, and Adam Smith. Smooth sensitivity and sampling in private data analysis. Proceedings of the thirty-ninth annual ACM symposium on Theory of computing - STOC '07, pp. 75, 2007.
Vibhor Rastogi and Suman Nath. Differentially private aggregation of distributed time-scrics with transforma- tion and encryption. In Proceedings of the 2010 ACM SIGMOD International Conference on Management of Data, SIGMOD '10, pp.
New York, NY, USA, 2010. ACM.
Ossi Räisä, Antti Koskela, and Antti Honkela. Differentially private Hamiltonian Monte Carlo, 2021. URL https::/aaxxvv.or////a
09376
Adi Shamir. How to share a secret. Commun. ACM, 22(1)):612 613, November 1979.
Mrinank Sharma, Michael Hutchinson, Siddharth Swaroop, Antti Honkela, and Richard E. Turner. Differen- tially private federated variational inference, 2019. URL htt.:ttpss//axxlv..o///////////1 10563]
Shuang Song, Kamalika Chaudhuri, and Anand D. Sarwate. Stochastic gradient descent with differentially private updates. In Proc. GlobalSIP 2013, pp. 245 248, 2013. doi: D0.1009/GlobalSIP.20 http://0....r//1.11100////////// oba STP. 20 3.033.40 6736611
URL
23

---

Published in Transactions on Machine Learning Research (04/2023)
Volker Tresp. A Bayesian committee machine. Neural Computation, 12(11):2719-272 2000.
Margarita Vinaroz and Mijung Park. Dificrentially private stochastic expectation propagation (DP-SEP), 2021. URL https:://arxi...rr///aassa 13219
J Wainwright, M I Jordan, Martin J Wainwright, and Michael I Jordan. Graphical models, exponential families, and variational inference. Mach. Learn., 1:1-2, 2008.
Matt P. Wand. Fully simplified multivariate Normal updates non-conjugate variational message passing. Journal of Machine Learning Research, 15:1351 1369, 2014.
Yu-Xia fu-Xiang Wang, Stephen Fienberg, and Alex Smola. Privacy for free: Posterior sampling and stochastic gradient monte carlo. In Francis Bach and David Blei (cds.), Proceedings of the 32nd International Conference on Machine Learning, volume 37 of Proceedings of Machine Learning Research, pp. 1493-2502, Lille, France, 07-09 Jul 2015. PMLR. URL https::///// http:///oceedddee /
www.m vv7 httpa/ss///////aggg////// hwwp///nnggg......o .html
Kang Wei, Jun Li, Ming Ding, Chuan Ma, Howard H Yang, Farhad Farokhi, Shi Jin, Tony Q S Quek, and H Vincent Poor. Federated learning with differential privacy: Algorithms and performance analysis. IEEE Trans. Inf. Forensics Secur., 15:3454 3469,, 2020.
John Winn, Christopher M. Bishop, and Tommi Jaakkola. Variational message passing, Journal of Machine Learning Research, 16661-694, 2005.
Sinan Yildrım and Beyza Ermiş. Exact MCMC with differentially private moves. Statistics and Computing, (W65)994-963,, sep 2019. ISSN 0960-3174. doi: 10.1007/s11222-011--000 URL httpps::/doi..rrg////// L007/1122-018-9987-
Cheng Zhang, Judith Bütepage, Hedvig Kjellström, and Stephan Mandt. Advances in variational inference. IEEE Transactions on Pallern Analysis and Machine Intelligence, 41(8):2008 2026, 2019. doi: 10.1109/
UPAMM.2018.288999
Yuchen Zhang, John C Duchi, and Martin J Wainwright. Communication-effciieett algorithms for statistical optimization. J. Mach. Learn, Res., 14:3321 3363, 2013.
Zuhe Zhang, Benjamin Rubinstein, and Christos Dimitrakakis. On the differential privacy of Bayesian inference. In Proc. Conf. AAAI Artif. Intell. 2016, 2016.
Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. In H. Wallach, H. Larochelle, A. Beygelzimer, F. d' d'Alché-Ban Buché-Buc, E. Fox, and R. Garnett (eds.), Advances in Newral Information Processing Systems, volume 32. Curran Associates, Inc., 2019. URL https: /ttttp::/pproeeeiiiii http://pooccccceeee/eeeee ngs. neur Seuurips. pss cc/paper/ 221///1ee00acc0000c1111361111113 Paper.
A Appendix: theorems and proofs
This Appendix contains all proofs and some additional theorems omitted from the main text. For easy of reading, we state all the theorems before the proofs.
Privacy via local optimisation: DP optimisation
Theorem A.1. Running DP-SGD for client-level optimisation in Algorithm 1 using subsampling fraction Usample E 1) on the local data level for local oplimisation sleps total, with S global updates interleaved with the local steps, the resulting model is DDP, with 5 E (0, s.t. 0(6, @sample: T,9x).
Proof. Standard DP-SGD theory (Song et al. 2013 Bassily et al. 2014 Abadi et al. 2016) ensures that the local optimised approximation DP after a given number of local optimisation steps by given client m, when on every local step we clip each per-example gradient to enforce a known my-mrrm bound C, add iid Gaussian noise with standard deviation scaled by C to each dimension, and the privacy amplification by
24

---

Published in Transactions on Machine Learning Research (04/2023)
subsampling factor 9sampte for the sampling without replacement function (see Definition 4 is calculated from the fraction of local data utilised each step. Since the global update does not access the sensitive data, the global model is DP w.r.t. data held by client m after the global update due to post-processing guarantees. Hence, when accounting for DP for client m, the total number compositions T, regardless of the number of global updates. The lotal privacy is therefore (e, d), when å is such that & = (6, Aeample T, go).
With Theorem A.1 DP is guaranteed independently by each client w.r.t. their own data, and hence the global model will have DP guarantees w.r.t. any clients' data via parallel composition, i.e, the global model is (Emax: Omax) w.r.t. any single training data sample with Emaz = max(e1.... 6M 6mar = max(61,...,,5.. where Cm: 6m are the parameters used by client m. In all the experiments in this paper, wo use a common (e, budget shared by all the clients, and sampling without replacement on the local data level the subsampling method.
Propertics of non-DP local averaging The following properties are the local averaging counterparts to the regular PVI properties shown by Ashman al. 2022)) We write nm for the number of samples in
shard at client m after the initial partitioning, so Σ k= Am. =
1m-
Property A.2 (cf. Property 2.1 of Ashman al. 2022). Marimizing the local ELBO
c/0 (g(()) = dlc(()) log [0)] (=0
(())z (8)
is equivalent to the KL optimization
(0)) = arg min DKL (1())))) (0),
where x (0) = zIo D()) Ilymm 150- (0) (8) (0mmmmm,1000)0 is the tempered tilted distribution before global update for local shard k al cliend m.
Proof. The proof is identical to the one in (Ashman et al. 2022 A.1) when we replace the full local likelihood p(zm)0) by the tempored likelihood [p(=m,,(0) for shard k.
Property A.3 (ef. Property 2.2 of Ashman et al. 2022
Let (0) = p(0) II (7 be a fixed point for local ELBO at the fixed point w.r.t. shard k at
local averoging, (m)((((0)) d0g log (p)pzz. 100"
q(0)e_100 (0)
client m, and L(g(t)) = ddq(())
(8) log p(())(a)0)
global ELBO. Then
q(0)
M ΣØ N, Ee' Ci (0) log Zy..
1f lq" (0) arg max, (g)((((0) for all j, then q" (0) = arg max, L(q(0)).
25

---

Published in Transactions on Machine Learning Research (04/2023)
Proof. 1. Directly from the definition we have
(0)) log Zg- = d00' log p(0)p(x10)
(A.1)
(0)0)
/ (0)[0g]((0())) log p(0) IT (0)
(A.2)
p(0)
M
d0q" (0) (0)
II p( log (
(A.3)
M
logp(z,, 0) log (0(0)=((0)
d0q" (0) N
N
(A.4)
(0)
j=1
M
d0q (0) (0)0((2,,,00)
(A.5)
N₂
(0))
M (1)())
(A.6)
Assume q² (0) = arg max, fi, (1()) for all k. Then (²) = arg max, (7,( for all j, implying that dA, x (a" = for all j. k. Furthermore, since q² (0) a maximizer, the Hessian de
Tda F2, (q (0)) is
negative definite for all j, k. Looking at the first part of the proof we write
N
d (l)
Σ
1
d
0, and (q)
(A.7)
d2g
Nj
dig
j=1
d2
M
N
d2
dAydAT (0)
Σ
d'yd27 L (0)).
(A.8)
N
From Equation A.7 we see that q- (0) is a fixed point of C(q(0)), and since the Hessian in Equation A.S can expressed by summing negative definite matrices and multiplying them by positive numbers, the resulting Hessian is also negative definite, and hence q" (0) maximizes the global ELBO L(q(0)).
Property A.4 (cf. Property 3.2 of Ashman al. 2022
Assume the prior and approcimate likelihood factors the variational distribution is in the normalized exponential family q()) exp(1 T()) A(2,)). Then stationary point of the local dc (0) 0, implies dA,
are in the unnormalized exponential family tm (0) tm 0; Am) exp(XT
ELBO at global update for the kth local model at client m,
Nm dipg -Bgoo- logpl mm 0))
In addition, stationary point for all Nm local models" ELBO implies
Nm N
d duige-1) Eyt- [log p(og(((m0)))
(s)
An
m.k
which malches the regular PVI sared point equation.
Proof. Writing ((0) A (0) = (0) log [p(2m.*10)) Mm 1)() and noting that all Nm, local models are (0)
started in parallel from the same point (so (ylu-1) = 19(0-13, ob (a-1) = g(--1) vk), then following the proof in
26

---

Published in Transactions on Machine Learning Research (04/2023)
Ashman al. 2022 Supplement A.4) with minor changes establishes the first claim:
\ Nm d
d(ggi-11) 1y [log p 10)]
Looking now at the average of local parameters we have
1 Nm
(A.9)
Nm
m.k
k=1
d
N
E B)
log xm
(A.10)
dp
d
Eyto log p(mm [0)]]
(A.11)
=
dpggo-11
where the last equality assumes that the data are conditionally independent given the model parameters.
Property A.5 (cf. Property 5 of Bui et al. 2018). Under the ossumptions of Prop. A.4 using local averaging with parallel global updates result in identicol dynamics for g(f), given by the following equation, regardless of the partition of the data employed:
Σ
1 = oo + d
d
E (- [[gg((]0)]] Ao
Bytn-1 [log (0);
d
where Ta is the ith data point, and ny is the number of local samples on client j.
Proof. With M clients doing a parallel update, from Property A.4 we have
(1)
Ao +
(A.12)
i=1
d
Ao
B [lo (ogg((,)))))
(A.13)
dlgg 1)
M
d Blo-nlloggppmmm000)
oo
+
(A.14)
dpggi-1)
where Equation A.14 follows due to data being conditionally independent given the model parameters. On the other hand, with M 1 Property A.4 reads
d
(s) 9
do
+
(lg [(z()()())
(A.15)
dp
= 2o +
(A.16)
diegre-1
which matches Equation A.14
since n = ΣM ny for any M.
DP with local averaging
27

---

Published in Transactions on Machine Learning Research (04/2023)
Theorem A.6. Assume the change in the model parameters [| 1(0-1)112 1|2 S C, 1,... Nu for some known constant C, where Xm is proposed solution Equation 4.1 and ((5-1) is the vector of common initial values. Then releasing A is (e, (),P), with 8 E 1) 8.1. 0(d, Asample = 1, 9,),,, when
Nm
A
(Xix
1 +
(A.17)
Nm
where ~ NN, I).
Proof. Considering neighbouring datasets as the DP definition 2 denoted by m, m', only one of the local models is affected by the differing clement, w.l.o.g. assume is Am, For the difference in the sum query between neighbouring datasets we therefore immediately have
Nm
Nm (Nin - -1(6-1))12z = 1 - (((-1) Xmn + +1(0-1)112
(mmy - 1(0-1))
(A.18)
S 1 - -1(6-1)112 11 1(0-1)
(A.19)
< 2C.
(A.20)
The sum query therefore corresponds to single call to the Gaussian mechanism with sensitivity 2C and noise standard deviation o, and since DP guarantees are not affected by post-processing such taking average, the claim follows.
Corollary A.T. A composition S global updates with local averaging using norm bound C for clipping is (e,8)-DP, with 5 E (0,1) s.t. & == 066, (sample
1o).
Proof. Since each global update is DP by Theorem A.6 when enforce the norm bound by clipping, the result follows immediately by composing over the global updates.
Theorem A.8. With local averaging, The DP noise standard deviation be scaled as O N ) where Nm is the number of local partitions. Therefore, the effect of DP noise will vanish on the local factor level when the local dataset size and the number of local partitions grow.
Proof. Rewriting Equation A.17
N
A
Xmp
(s--1)) +
E N
(A.21)
N
where & 02 1).
Letting the number of local partitions grow, we immediately have
lim Ait
lim A
(A.22)
No. 700
N.. 0000
where AX;, is the corresponding non-DP average.
Theorem A.9. Assume the effective prior (y))), and the likelihood p(æ,ln), (1...., M) are conjugate exponential fomily, where n are the natural parameters. Then the number of portitions used in local averaging does not affect the non-DP posterior.
Proof. To avoid notational clutter, we drop the client index j the rest of this proof, and simply write, e.g., for the local data æy and p(1) for the effective prior (1))
28

---

Published in Transactions on Machine Learning Research (04/2023)
Due to the conjugacy can write the effective prior and the likelihood
p(æln) = h(z) exp(1) T(x) -An)), p(n no) H (To, no) exp(To mg)())),
(A.23)
(A.24)
where T are the sufficient statistics, A is the log- partition function, To, no are the effective prior parameters, and h, H are some suitable functions determined by the exponential family.
The local posterior given a vector x of n iid observations is in the same exponential family:
pl, To, no) exp ((To Σ ((a)) (no + A())),
so the changes parameters when updating from prior to posterior are
TO TO
T(x:
(A.25)
no - no +
(A.26)
Now partitioning the data into N shards, each with ne = N samples, together with the tempered (cold)
likelihood p(x(1)) results in a posterior
Pshava(n) to, no) exp((To + Σ NT(x)))" (no + Nnn)A(1)),
the updates for shard & are
To - To + Σ NT(xk)
(A.27)
k;
no - no + NNg-
(A.28)
Averaging over the posterior parameters corresponding to the N local data shards we have updates
To
To
NT(xk)))
(A.29)
N
k=1
ki
N
T(*k:)
(A.30)
=To
1=1
Ri
=To-
T(x,), and
(A.31)
1=1
N
70g
(no
+
NnR)
(A.32)
N
km
+
(A.33)
which match the expressions for the regular local posterior using full local data given in Equation A.25 and
Equation A.26
Figure 5 shows the effects of changing the number of local data shards using a logistic regression model with and without DP. As discussed in Section [4.2.]] when the assumptions of Theorem A.9 are not satisfied, we would expect that increasing the number of local data partitions can lead to slower convergence due increased estimator variance. This can be seen in Figure a). In contrast, under privacy constraints increasing the number of local partitions lead to improved performance, since adding local partitioning
29

---

Published in Transactions on Machine Learning Research (04/2023)
Log. regr. with balanced MIMIC-ilI, 10 clients, bai anced split
Log. regr. with balanced MIMIC-III,, 10 clients, balanced split
Accuracy
Accuracy
0.45
6:45
Number of local splits: 1
splits:
eps-inf, C- 1000
Number local splits: 100
eps-Int, C=1
Number splits: 200
e,5
1.
13
20
25
30
35
50
23
50
330
125
159
175
200
Communications
Number local splits
0.3
0.7
Number
Number local splits:
eps:inl inf, C=1000
Number local splits: 100
epswinf, C=1
Number splits: 200
eps-4.0,
-16
15
-10
125
150
Communications
Number local splRt
(a)
(b)
Figure Logistic regression, balancod MIMIC-III data with 10 clients: mean over 5 seeds with SEM, balanced split. a) Without DP, increasing the number of local partitions lead to slower convergence, b) non-DP with clipping norm C, and (4, 10 SDDDP-PP wihout privacy increasing the number of local partitions does not help (non-DP with clipping C 1000), or even hurts performance (non-DP with clipping C' 1), while with DP, increasing the number of local partitions mitigates the effect of DP noise.
can mitigate the DP noise effect, as seem Figure b). Note that increasing the number of local partitions can also increase the bias due clipping, especially with tight clipping bound. In this experiment, use same fixed hyperparameters in all runs: number of global updates or communication rounds number of local steps 50, learning rate 10-2, damping = .4.
Theorem A.10. Using local averaging with M clients and a shared number of local partitions N assume the cliends have access to brusted aggregalor. Then for any given privacy paramelers e, the noise standard deviation added by a single client can be scaled as O (x) while guaranteeing the same privacy level.
Proof. Let r 02 and denote by dg the noise standard deviation that locally guarantees the required DP level for every client with some known norm bound C (possibly due to clipping), and assign equal noise shares over clients. The message for synchronous global update is
M
M
N
A
(+)
Σ
( + nI)
(A.34)
N
1=1
J=1
k=
M
N
M1 (2 - x(0-1))
+
7) j=1
(A.35)
N
j=1
1=
30

---

Published in Transactions on Machine Learning Research (04/2023)
To match the target local noise standard deviation with the aggregated noise standard deviation need
2 0
(A.36)
j=1
0u VM
2
(A.37)
Setting to match the lower bound, we see that the total noise magnitude on the global approximation level in Equation A.35 does not change with M.
Looking at Theorem A.10, when the global noise level is constant, adding a client to the protocol will reduce the relative effect of the noise in Equation A.35 increases the non-noise part the sum. On the other hand, on global convergence we would have
M Σ 1=1
N
1 0,
1=1
update near a global optimum will be mostly noise.
When applying Theorem A.10 DP is guaranteed jointly the global model level, while the local approx- imations have less noise than required for the stated privacy level (although they might still have some valid DP guarantees). In contrast, when each client guarantees DP independently via Theorem A.6 the global model will be (fmaz: mmax)-DP w.r.t. any single training data sample by parallel composition with Emaz = max f dmaz = max }M), where cm, dm are the parameters used by client m. In all the experiments in this paper, we use common (c, budget shared by all the clients.
DP with virtual PVI clients
Theorem A.11. Assume the change in the model parameters [ 1 < CC = 1,... Nm for some known consland C, where Xmx is proposed solution to Equatioo 4-8 and ((s-1) is the vector of common initial values. Then releasing A is (e, 8D,,, with 5 E 1) s.t. 0(6, Isample = 1, 9,), when
A
(Niu (6-11) +7:
(A.38)
where NO0 I).
Proof. Almost the same as the proof of Theorem A.6
Corollary A.12. A composition of S global updates with virtual PVT clients using norm bound C for clipping is (s,6)-DP, with ô E 10 s.l. 6 066, qsampie = 1, S, ).)..
Proof. Since each global update is DP by Theorem A.ll when we enforce the norm bound by clipping, the result follows immediately by composing over the global updates.
Thcorem A.13. Assume there are real clients adding virtual clients, and access to a trusted aggregator.
Then for any given privacy porameters e, 6, the noise slandard deviation added by a single client can be scaled while guoranteeing the same privacy level.
as O VM
Proof. Similar to the proof for Theorem A.10 with obvious modifications.
As with local averaging, Theorem A.13 gives joint DP guarantees on the global model level. In contrast, when each client guarantees DP independently with Theorem A.11 the global model will be (Emaxs Smaz) ) DP w.r.t. any single training data sample by parallel composition with Cmas max manxfi,....... CM) 8mas 18, where cm, are the parameters used by client m. And again, all the experiments we common (c, 5) budget shared by all the clients.
31

---

Published in Transactions on Machine Learning Research (04/2023)
B Appendix: experimental details
This appendix contains details of the experimental settings omitted from Section 5
With Adult data, we first combine the training and lest sets, and then randomly split the whole data with 80% for training and 20% for validation. With MIMIC-III data, we first preprocessing the data for the in-hospital mortality prediction task as detailed by Harutyunyan al. (2019) Since the preprocessed data is very unbalanced and leaves little room for showing the differences between the methods (a constant prediction can reach close to 90% accuracy while non-DP prediction can do some percentage points better), we first re-balance the data by keeping only as many majority label samples as there are in the minority class. This leaves 5594 samples, which are then randomly split into training and validation sets, giving a total of 4475 samples of training data to be divided over all the clients.
We divide the data between M clients using the following schem half of the clients are small and the other half large, with data sizes given by
n (1 p)]:
Marrge = (1 + [1+,)],
n
Msmail
M
M
with p E [0. p -= 0 gives equal data sizes for everyone while 1 means that the small clients have no data. For creating unbalanced data distributions, denote the fraction of majority class samples by A. Then the target fraction of majority class samples for the small clients is paramcterized by k:
Mtrrge x (1-
where having x means small clients only have majority class labels, and = - - implies small clients have only minority class labels. For large clients the labels are divided randomly.
We use the following splits in the experiments:
p
K
Rsmall
Asmall
Atarge
balanced
0
0
2442
.76
2 .76
unbalanced 1
.75
.95
610
.99
2 .73
unbalanced 2
.7
-3
732
.03
2 .89
Table 2:
Adult data, 10 clients data split.
p
K
Ramall
Asmall
Atarge
balanced
0
0
122
.75
.7-.8
unbalanced
.75
.95
30
.97
.67-.78
unbalanced 2
.7
-3
36
.03
.85-933
Table 3:
Adult data, 200 clients data split.
P
nsmaal
Asmall
Atarge
balanced
0
0
447
.5
22 .5
unbalanced 1
.75
.95
111
.97
.41-.4
unbalanced 2
.7
-.5
134
.25
551.58
Table 4: Balanced MIMIC-IIT data, 10 clients data split.
We use Adam Kingma & Ba 2014 to optimise all objective functions. In general, depending e.g. on the
update schedule, even the non-DP DP PVT can diverge (see Ashman et al. 2022 We found that DP-PVT using
The code for preprocessing available from https::/t////.. http:///htttteeeeee/e//////aa///
8The data splitting scheme was originally introduced by Sharma el 2019) workshop paper that combines DP with earlier workshop version.
PVT. The current, paper otherwise completely novel and based on
32

---

Published in Transactions on Machine Learning Research (04/2023)
any of our approaches is more prone to diverge than non-DP PVI, while DP optimisation is more stable than local averaging virtual PVT clients. To improve model stability, we use some damping in all the experiments. When damping with a factor E (0, 1], at global update the model parameters X are set to
- p) (--1) +p.
We use grid search to optimise all hyperparameters in terms of predictive accuracy and model log-likelihood using 1 random seed, and then run 5 independent random seeds using the best hyperparameters from the seed runs. The reported results with 5 random seeds are the best results in terms of log- oggllikeihood for each model. With BNNs using local averaging or virtual PVI clients some seeds diverged when using the hyperparameters optimised using a single seed. These seeds were rerun with the same hyperparameter settings to produce full runs. This might give the methods some extra advantage in the comparison, but since they still do not work too well, we surmise that the methods are not well suited for the task.
To approximate the posterior predictive distributions we use a Monte Carlo estimate with 100 samples:
100
p(y.
Fe. E.. v)
Σ
p( Osesch, Viwe ~ q()).
100
fMO=1
33


Reviews:
[{"review_id": "rUlEV1ayWc", "reviewer": "Reviewer_HTxx", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "## Strengths: \n\n- The paper introduces the reader to necessary background on (partitioned) variational inference and differential privacy. \n- Contributions are clearly and accurately stated and followed up on. \n\n## Weaknesses: \n\n- This paper combines a number of established ideas into one setting---variational Bayes + differential privacy + partitioned/distributed/federated learning. As a result, the algorithmic contributions are rather small, making minor changes to the existing PVI algorithm or using the DP-SGD optimiser as-is. Similarly, the theoretical properties stated about the algorithms follow largely from existing analysis, such as in the case of Virtual PVI for which \"the regular PVI properties ... hold immediately\" or the multiple proofs in the appendix with strong reliance on previous works. The DP guarantees also follow standard arguments using clipping and Gaussian noise. Comparatively, Theorems 7 and 8 seem more specific to the combined setting, but are not discussed much in the main paper. \n\n- The empirical evaluation only studies artificial splits of existing batch datasets. This is unfortunate, since one of the paper's main points is that there are problem settings in which we can't perform normal DP VI, but should work in a partitioner or distributed setting. It should be possible to use data with an inherent client notion, such as the eICU data set from the same source as MIMIC (a single-site data set). Moreover, the synthetic splits are all uniform which is highly unrealistic for real settings where different clients are much more likely to have different distributions over their samples (as in the application proposed by the authors)\n\n- There are parameters in the proposed algorithms which are not explored in the empirical study, such as the number of virtual clients/partitions or the privacy parameters. Is the former uninteresting in light of e.g., Theorem 7? What about the effects of a high/low \\epsilon? Could the naive parameter perturbation method not be used as a baseline in the experiments?", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper studies communication-efficient variational inference (VI) in a client-distributed setting under client privacy constraints. In this setting, a central model is updated based on the learning of several clients who do not share their data with each other, only privacy-preserving statistics thereof. The goal is to learn an accurate model in as few communication rounds as possible while maintaining privacy. The work builds on partitioned VI (PVI, Ashman et al., 2022) and differential privacy (DP) to produce three different methods toward this goal: DP optimisation, Local averaging, and Virtual PVI Clients. Each algorithm is guaranteed to satisfy DP by applying the so-called Gaussian mechanism to different stages of the learning procedure. Theoretical analyses describe how the magnitude of perturbations necessary to guarantee DP scales with the number of clients and other problem parameters. In an empirical evaluation comparing the accuracy of fitted models, the new methods compare favorably to a sound, yet pessimistic, baseline, but it is less clear which among the three contributions is preferable in which setting. \n\nClaimed contributions: \n- Three new algorithms for communication-efficient DP VI\n- The new algorithms are orders of magnitude more efficient than Global DP VI, without secure primitives. \n- A comparison of the proposed algorithms in terms of their dependence on local data, model class and access to a trusted aggregator", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "- Empirical evaluation of the algorithms on data that has inherent client structure. \n\n- Minor issue: The comments surrounding eq (2.2) are imprecise. \"However, since the minimisation in Equation 2.1 is still generally intractable, the actual optimisation is typically done by maximising the so-called evidence lower bound. ... It can be shown that the optimal solution λ∗V I also solves the original minimization problem in Equation 2.1.\". If solving 2.2 solves 2.1, either 2.1 is not intractable or 2.2 must be intractable as well, in which case tractability can not be the reason to use it. ", "broader_impact_concerns": "None", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "rlqMrEJQ60", "reviewer": "Reviewer_gi6N", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strength:\n- Federated learning with DP guarantees is an important problem\n- Experimental results\n\nWeaknesses:\n- the writing could be significantly improved (starting from the introduction to motivate the problem)\n- formal definition of neighbouring is missing\n- notation keeps changing throughout the paper\n- threat model and guarantees are not clear to compare the three methods\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper considers adding differential privacy guarantees to the problem of Partitioned Variational Inference in the federated learning setting. They do so by adopting a very recent paper by Ashman et al. that proposed a framework in FL setting.\n\nThe contributions by the authors include when DP guarantees are applied: at the client or at the server and how it is added at the client (either through the update or through computing local models).\n\nThe paper also supplements its results with experiments on UCI adult dataset to compare the methods in data that may not have the original assumptions.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "No", "audience_explanation": "", "requested_changes": "\n- introduction of the paper does not motivate the problem and the result well. Which setting is the result important? What was challenging about it? How it is different from Ashman et al. 2022?\n- what does it mean for the work to be communication efficient? It seems it is an empirical results and not theoretical. this should be clearly stated.\n- the problem setting is undefined. What is the threat model (e.g., saying clients are honest is not sufficient, as it seems DP guarantees would change depending on which proposed method is used)? How can there be no trusted aggregator? what is meant by secure primitive?\n- Which dataset neighbouring definition is relevant for which section? is it user or sample DP? Seems it would change depending on the method being used?\n- Notation needs to be clearly stated, how many clients, what data they have, assumptions on the data. client m vs client j. How are sample, individual, party and client related across the paper? These are crucial to communicate which DP property is guaranteed (local vs global)\n- Table 1 and statements before Section 3.2. are quite vague. For example, what does it mean to benefit from trusted Aggregator? How did one arrive to this table, what should reader take from it?\n- theorem statements are not self-inclusive. Theorem 11 does not say what level of DP guarantee this would provide.\n", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "qAr4LLUaVD", "reviewer": "Reviewer_MNCv", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "As I see it, the main weakness of the paper is the technical soundness. I think the paper needs to be considerably reworked regarding the presentation of both the proposed solutions and the technical claims. As is, it is very difficult for me to assess the technical quality of the claims. I provide a list of some of my issues below to justify this concern.  \n\n- Throughout the paper, the elements of the problem ($\\theta$,$x$, $x_i$, $p$,$q$, $\\lambda, t_i$, etc.) are introduced in words but without describing their mathematical nature (scalars, vectors in $\\mathbb{R}^d$, distributions with support in a given vector space, mappings, etc.). To my point of view, the absence of a formal and clear problem statement in the beginning of the paper obfuscates the discourse as it introduces potential ambiguities that hinder the assessment of the technical soundness of the work.\n- Note also that the minimization/maximization problems suffer from the same ambiguity. One the one hand, the optimization problems are defined by taking $q \\in \\mathcal{Q}$, where $\\mathcal{Q}$ is a class of distributions. On the other hand, the selected argmax in (2.1) and throughout the paper is a variational parameter that I guess is a real-valued vector. This kind of typo is obviously not critical in general, but at this stage I think their accumulation also obfuscates the readability. I list below some more inconsistencies that I think should be fixed:\n  - $q$ should be defined in a consistent manner, either $q(. \\mid \\lambda)$ or $q(.)$. \n  - The Kullback-Leibler notation should be consistent.\n  - $\\Delta t_m^{(i)}$ and $q_m^*$ should be defined before being used in Algo 1 line 4.\n  - $q^*$ should be defined before being used in Algo 3 line 5. \n  - $\\eta$ is used to describe different elements (natural parameters in Theorem 7 and noise in Theorems 4 and 9).\n- The technical content, be it definitions or theorems does not seem to rest on solid ground. To me, this comes from the fact that the results and definitions are formulated in words and refer to concepts that have not been introduced in the paper. I list some examples below.\n  - In Definition 2, the accounting oracle is defined by referring to the ‘subsampled mechanism’ and a ‘subsampling ratio’ that have not been introduced in the paper. These concepts are used throughout the entire technical part of the paper without being ever defined. More importantly, the proposed solutions all build on the Gaussian mechanism (and DP-SGD for Theorem 3) that is not formalized either. While all these concepts are standard in the differential privacy literature, restating them with the paper’s formalism would raise a number of ambiguities.\n  - The theorems are not self-contained and assume some a priori knowledge from the reader. For examples, Theorem 4 and Theorem 9 (that are supposed to be treating different solutions) are stated in the exact same way, making them identical unless assuming a priori knowledge from the reader. I strongly believe that each solution should be formally presented (e.g., in a small algorithm or in a sequence of equations) and that each theorem should reference the solution it applies to.\n  - In paragraph ‘DP with local averaging’ and in Theorem 7, the paper mentions ‘exponential family factors/parameters’ that are not formally described. I think it should be clarified especially since exponential families have very versatile forms; hence it is primary to clearly define which form is being used.\n\nAnother important concern I have is on whether the paper advances the state of knowledge in terms of privacy-preserving distributed models. As I understand it, the main takeaway of the paper consists in saying that (i) applying differential privacy on a local optimizer is primarily interesting because it benefits from the size of the local datasets, and (ii) applying differential privacy when merging the local updates, can also benefit from having access to a trusted aggregator (e.g., a shuffler). As far as my understanding of the existing literature goes, I believe that these findings do not provide additional intuition to the community. Specifically, the importance of the size of the dataset (and thus of the mini-batches of data) when applying DP-SGD is already well documented in (Song et al., 2013; Bassily et al., 2014; Abadi et al., 2016)(*). Similarly, the importance of a shuffler in improving the performances of a differentially private federated learning scheme has been documented in e.g., (Cheu et al., 2019;  Erlingsson et al., 2019). To be clear, I am not saying that the paper does not provide any new intuition. My point is rather that, in the absence of a clear discussion with existing wisdom from the literature on differential privacy in (federated/distributed) machine learning, it is challenging for me to grasp the nature of this contribution.\n\n(*) These works are referenced in the paper\n\nCheu, A., Smith, A., Ullman, J., Zeber, D., Zhilyaev, M. (2019). Distributed Differential Privacy via Shuffling. EUROCRYPT 2019.\nErlingsson, A., Feldman V., Mironov I., Raghunathan A., Talwar K., and Thakurta, A. (2019). Amplification by Shuffling: From Local to Central Differential Privacy via Anonymity. SODA 2019.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper studies the problem of privacy preserving federated learning for probabilistic models. Essentially, the paper considers a setting where several users hold disjoint datasets and aim to collaboratively learn a probabilistic model while enforcing central differential privacy on their joint dataset. In short, the paper proposes three different solutions to solve this problem, all based on adapting a model called Partitioned Variational Inference (PVI) with a Gaussian mechanism (well known from the differential privacy community). The three methods are claimed to provide differential privacy and are compared empirically on two simple datasets with a logistic regression model and a Bayesian neural network. \n\nBefore starting the review, I just want to clearly state that I am not an expert in variational inference. I consider myself more knowledgeable in privacy-preserving distributed/federated learning, especially when considering differential privacy.  ", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "No", "audience_explanation": "", "requested_changes": "In view of the above remarks, I have two requests that are essential for me to recommend acceptance. \n\n1. Rework pages 2-9 to incorporate the above comments on formalism and improve the technical presentation of solutions and claims. \n\n2. Clearly present the main findings of the paper and how they differ from the existing literature. In doing so, I would recommend moving the related work section closer to the introduction, and comparing the contributions with the literature directly at the beginning of the paper. ", "broader_impact_concerns": "I have no broader impact concern", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The above evaluations describe the submission's relation to each of the acceptance criteria. Since both are passed, the paper should be accepted. One of the reviewers still had concerns related to the communications improvement, and so the authors should perform a minor revisions with this in mind.
Decision: Accept (poster)