Title: FedAvP: Augment Local Data via Shared Policy in Federated Learning
Venue: NeurIPS 2024
Accepted: yes
Keywords: federated learning

data augmentation
Abstract: Federated Learning (FL) allows multiple clients to collaboratively train models without directly sharing their private data. While various data augmentation techniques have been actively studied in the FL environment, most of these methods share input-level or feature-level data information over communication, posing potential privacy leakage. In response to this challenge, we introduce a federated data augmentation algorithm named FedAvP that shares only the augmentation policies, not the data-related information. 
For data security and efficient policy search, we interpret the policy loss as a meta update loss in standard FL algorithms and utilize the first-order gradient information to further enhance privacy and reduce communication costs. Moreover, we propose a meta-learning method to search for adaptive personalized policies tailored to heterogeneous clients. Our approach outperforms existing best performing augmentation policy search methods and federated data augmentation methods, in the benchmarks for heterogeneous FL.

FedAvP: Augment Local Data via Shared Policy in Federated Learning

Abstract

Federated Learning (FL) allows multiple clients to collaboratively train models without directly sharing their private data. While various data augmentation techniques have been actively studied in the FL environment, most of these methods share input-level or feature-level data information over communication, posing potential privacy leakage. In response to this challenge, we introduce a federated data augmentation algorithm named FedAvP that shares only the augmentation policies, not the data-related information. For data security and efficient policy search, we interpret the policy loss as a meta update loss in standard FL algorithms and utilize the first-order gradient information to further enhance privacy and reduce communication costs. Moreover, we propose a meta-learning method to search for adaptive personalized policies tailored to heterogeneous clients. Our approach outperforms existing best performing augmentation policy search methods and federated data augmentation methods, in the benchmarks for heterogeneous FL.

1 Introduction

Federated Learning (FL) is a collaborative learning approach that allows multiple clients to learn without sharing their private information [1-6]. A central server coordinates the training process across multiple devices and aggregates the locally trained models into a global one; thus reducing the communication cost of exchanging raw data and mitigating the risk of privacy leakage associated with data sharing [7].

However, the limited accessibility of data in FL still poses many challenges, such as insufficient training data and local data bias. To address these challenges, there has been a growing interest in federated data augmentation techniques [8-12]. They aim to increase the diversity and volume of data available at each client, thereby improving the overall robustness and performance of the federated models. For example, FedMix [8] improves performance and privacy by averaging multiple images to facilitate data mixup among clients. Similarly, FedFA [11] utilizes feature statistics to mitigate local data biases, to improve model generalization. Despite their benefits, these methods often apply the sharing of input-level [8, 10, 12] or feature-level [13, 11] information. Such information sharing poses additional privacy concerns since malicious attackers could potentially reconstruct original data by applying gradient matching loss [14] on the additional input and feature information.

We propose a novel federated data augmentation algorithm named FedAvP ( A ugmet Local Data v ia Shared P olicy in Federated Learning), which shares only the augmentation policies during training. Thus, each client does not need to share its own data or data-related information directly but obtains collective knowledge on how to augment the dataset at local learning. Previously, AutoAugment [15] utilizes reinforcement learning (RL) to automatically find the optimal data augmentation policy for a target dataset. While AutoAugment requires extensive GPU resources, more efficient and faster policy search has been studied [16-20]. However, these methods are not designed for FL environments but

they perform policy search for public batch datasets. The data scarcity and heterogeneity in FL could fail these standard policy search frameworks.

To improve the robustness and generalization of model training in the heterogeneous FL setting, we first introduce a Federated Meta-Policy Loss (FMPL) specifically designed to compute a gradient of augmentation policy that updates a shared data augmentation policy for each client's unique environment. Our approach guides the policy gradient to account for the effects of data augmentation on the unseen local data. The policy gradient utilizes higher-order information; the impact of the data augmentation is estimated by its effect on the validation loss observed after a few gradient descent steps with the initial augmented data. However, computing the direct meta-policy gradient in FL requires an additional communication step between the server and clients. To bypass this, we also develop an alternative meta-policy search method that utilizes a first-order approximation. We further demonstrate that the adaptive policy search technique can adapt to heterogeneous data distributions among clients in the FL environment.

In the experiments, our FedAvP demonstrates superior performance on CIFAR-10/100 [21], SVHN [22], and FEMNIST [23] datasets within an FL context, compared to existing federated learning algorithms, including FedAvg [2], FedProx [4], FedDyn [5], FedExP [6], and federated data augmentation algorithms, including FedGen [9], FedMix [8], and FedFA [11]. Moreover, to further leverage the potential performance of these algorithms, we also conducted experiments applying data augmentation techniques such as RandAugment [17] and TrivialAugment [24] to these algorithms for comparison. We also evaluate our algorithm in environments where data is non-i.i.d. with heterogeneous clients [25]. We further compare the effectiveness of the utility of sharing this policy across clients for searching, in contrast to conducting a local policy search.

Our primary contributions are as follows.

We propose FedAvP(Augment Local Data via Shared Policy in Federated Learning) as the first algorithm in federated learning that facilitates shared augmentation policies among clients for federated policy search, to the best of our knowledge.

We introduce the federated meta-policy loss for effective policy search, and further propose a first-order approximation to this loss to enhance privacy and reduce communication costs.

Enabling meta-learning, our algorithm allows for rapid adaptation of a personalized policy by each client, addressing the challenge of highly heterogeneous data distributions among clients in the FL environment.

2 Related Work

Automated Data Augmentation . AutoAugment [15] utilizes RL to find an optimal data augmentation policy for a target dataset automatically. FastAA [16] proposes a more efficient search strategy by training small NNs in parallel without iterative training, using the density matching method. RandAugment [17] suggests a simplified search method composed of two hyper-parameters, which find the augmentation policy without a separate search process. TrivialAugment [24] further simplifies the algorithm and applies a single augmentation to each image as a parameter-free method. MetaAugment [19] proposes a sample-aware augmentation policy network to capture the variability of training samples more accurately than previous dataset-based search methods. Deep AutoAugment [18] proposes a fully automated search method that builds a multi-layer data augmentation pipeline from scratch by stacking augmentation layers. All of these recent data augmentation methods were developed under the assumption that all training data is accessible on a server. This assumption is invalid in FL since data privacy is a significant concern and it is challenging to tune these algorithms for each of the numerous heterogeneous local datasets. Therefore, our study aims to develop a new data augmentation policy search algorithm that takes into account the distributed FL process while preserving data security. RandAugment [17] and TrivialAugment [24] can be applied simultaneously to many clients in a federated learning environment, so we compared these methods in our experiments.

Federated Data Augmentation . The standard Federated Learning (FL) framework, such as FedAvg [2], typically performs iterative local model updates at each client and a global update at a server. Since the clients and server only communicate through the model parameters instead of raw data, it enables secured and decentralized learning [1, 3]. Despite its benefits, FL still has challenges

such as convergence degradation and model overfitting due to heterogeneity and sparsity among the data caused by the differences in client's actions and preferences [25]. To address these challenges, federated data augmentation (FDA) employs a data augmentation approach instead of a model-centric approach. FedMix [8] applies Mixup [26] to FL, augmenting data by linear interpolation of two random training examples and their labels. For privacy reasons, FedMix transfers mixup data to the server by averaging multiple images from the local device. In FedGen [9], the server learns a lightweight generator to ensemble user information, which is then broadcasted to users to regulate local training using the learned knowledge. FedFA [11] assumes that the data distribution of the clients can be summarized by the statistics of the latent features ( i.e ., mean and standard deviation). This allows learning local models by regularizing the gradients of the latent representations, weighted by the variances of the feature statistics estimated from the entire client federation. StatMix [13] sends the mean and standard deviation information of local client images to the server and makes it available for learning for each client. These methods use input-level data (image) averaging or feature-level statistics to prevent direct data transfer. Unlike previous methods, our methodology focuses on transmitting only the policy information optimized for local datasets from each client. ATSPriavacy [27] has demonstrated that searching for transformation policies can also protect against reconstruction attacks in Federated Learning (FL), while preserving performance. We compare our algorithm with this approach in terms of both vulnerability to reconstruction attacks and performance in the experimental section

3 Approach: FedAvP

Weintroduce FedAvP (Augment Local Data via Shared Policy in Federated Learning), which performs data augmentation search by sharing policies among clients in a federated learning (FL) environment. Starting from the problem formulation (§3.1), we address the challenges of heterogeneous clients with a proposal for adaptive policy search (§3.2). Finally, we extend its applicability through integration with the FedAvg algorithm [1] and joint learning (§3.3).

3.1 Problem Formulation

Our approach is based on the idea of centralized FL [7]; it is not possible to share personal data neither between the server and clients nor among clients. This is different from traditional automated policy search algorithms, which find the optimal policy in a single batch dataset [15, 16, 20, 19, 18].

Objective . We begin with the standard FL algorithm, FedAvg [1], aiming to find augmentation policies that minimize a given objective function as follows:

K is the number of clients used to train the global model w , and D k is the local data of client k . The transformation policy p θ is used to augment the data denoted by t p θ ( D train k ) with coefficients α k satisfying ∑ α k = 1 and α k ≥ 0 . Assuming client k has n k data samples, α k is defined as α k = n k n where n = ∑ k n k . Under a global policy assumption, all clients share the same p θ . Alternatively, if we assume that each client has its own transformation policy p local θ k , we represent p local θ = { p local θ 1 , p local θ 2 , . . . , p local θ K } .

Search Space . We use the augmentation space having a sequence of two operations, following the search space from previous studies on automated policy search [17, 19]. We examine a set of 17 operations in total, including { Identity, ShearX/Y, TranslateX/Y, Rotate, AutoContrast, Equalize, Solarize, Posterize, Contrast, Color, Brightness, Sharpness, RandFlip, RandCutout, RandCrop } . Each operation includes a random magnitude, rescaled and uniformly sampled from the normalized interval [0 , 1] . Assuming each of the K clients has individual policy, the entire search space consists of K joint distributions, each having a size of 17 × 17 . For a global policy, we learn a single 17 × 17 dimensional joint distribution corresponding to the two operations. Specifically, p θ has a value in [0 , 1] using the sigmoid function on θ . For augmentation sampling, we normalize the policy parameter vector p θ whose sum to be one, and sample from a joint distribution with a regularization term ϵ . Operation pairs ( op 1 , op 2) are drawn from a mixed distribution:

𝜽

𝒈

𝒓"𝟏

= 𝜽

𝒈

+𝜼%

𝒌

𝜶

𝒌

(𝜽

∗

𝒌

-𝜽

𝒈

𝒓

)

Server

Global parameters

𝒘

𝒈

𝒓

Trans

.

RotateShear

𝜽

𝒈

𝒓

Model aggregation

𝒘

𝒈

𝒓"𝟏

= $

𝒌

𝜶

𝒌

𝒘

∗

𝒌

Policy aggregation

Trans

.

RotateShear

Clients

Local model update

𝒘

𝒈

𝒓

𝒘

∗

𝒌

𝒕

𝒑

𝜽 𝒈 𝒓

(𝑫

𝒌

𝒕𝒓𝒂𝒊𝒏

)

Local policy update

𝝏𝒍

𝑫

𝒌

(𝒘

𝒈

𝒓"𝟏

)

𝝏𝜽

𝒈

𝒓

Trans

.

RotateShear

𝜽

𝒈

𝒓

Trans.RotateShear

𝜽

∗

𝒌

𝒘

𝒈

𝒓"𝟏

𝒘

𝒈

𝒓

,

𝜽

𝒈

𝒓

𝒘

∗

𝒌

𝜽

∗

𝒌

𝜽

𝒈

𝒓"𝟏

= 𝜽

𝒈

+𝜼%

𝒌

𝜶

𝒌

(𝜽

∗

𝒌

-𝜽

𝒈

𝒓

)

Server

Global parameters

𝒘

𝒈

𝒓

Trans

.

Rotate Shear

𝜽

𝒈

𝒓

Model & Policy

aggregation

𝒘

𝒈

𝒓"𝟏

= $

𝒌

𝜶

𝒌

𝒘

∗

𝒌

Trans. Rotate Shear

Clients

Local model & policy update

𝒘

𝒈

𝒓

𝒘

∗

𝒌

𝒕

𝒑

𝜽 𝒈 𝒓

(𝑫

𝒌

𝒕𝒓𝒂𝒊𝒏

)

𝝏𝒍

𝑫

𝒌

𝑭𝑴𝑷𝑳

(𝜽

𝒈

𝒓

)

𝝏𝜽

𝒈

𝒓

Trans

.

RotateShear

𝜽

𝒈

𝒓

Trans

.

RotateShear

𝜽

∗

𝒌

𝒘

𝒈

𝒓

,

𝜽

𝒈

𝒓

𝒘

∗

𝒌

,

𝜽

∗

𝒌

This sampling strategy utilizes a uniform probability across all operation pairs for a balanced exploration and exploitation, as adopted in previous work [19].

3.2 Policy Optimization

To search the policy in a differentiable manner, we adopt the concept from meta-learning [28], where a model is trained on training data n times by SGD algorithm ( n inner steps), followed by validation of one outer step. In our context, training is performed on augmented data, followed by evaluation on validation data [29, 19]. However, directly applying this concept of inner and outer steps to FL is quite challenging due to the added complexity of FL, which involves training local models and aggregating them to update the global model.

Since our goal is to optimize the global augmentation policy, we redefine the inner and outer steps from the FL perspective. In a standard FL setting, the server sends a global model to the clients for each round, which is trained with their local training data. Afterward, the aggregation process occurs on the server to update the global model. We can regard one round of local training and aggregation as one inner step . After r rounds, where the global model is updated r times, validating the final updated model on each client can be considered one outer step . We set r = 1 , meaning validation occurs after each round.

Federated Meta-Policy Loss . In a single round of client updates, we first perform local training on each client and aggregate the local models to update the global weights, which are then redistributed to the clients for computing the validation loss. Figure 1 (a) illustrates this process. In each round, the initial weight for a client k , denoted w k 0 , is set to the global weight w g r . The local training consists of N iterations, with a batch size B of the training data D train k,n at each iteration n . A transformation according to the policy p θ k n is applied to each data sample. The local loss at iteration n for client k is calculated as

where P i θ k n is the unnormalized probability p θ k n ( op 1 , op 2) for the i -th transformation, when the sampled transformation t i p θ k n is the operations ( op 1 , op 2) . This reweighting strategy is inspired by recent sample reweighting [29, 19]. Following the local updates with the augmentation policy p θ k , we aggregate the results to obtain the new global weights w g r +1 , which are redistributed to the clients for validation loss assessment. At the start of round r , after distributing the global weights w g r to

each participating client, the procedure for the federated meta-policy loss can be summarized as follows:

Each client k performs local updates by optimizing their local weights w k n using the augmented data with the local loss in Eq. (3). The updated local weights are then aggregated according to w g r +1 = ∑ k α k w k N .

The aggregated global weights w g r +1 are then sent back to the same clients.

The Federated Meta-Policy Loss (FMPL) is computed on each client's validation set.

For this loss, the gradient with respect to the augmentation policy p θ is computed using backpropagation. Nonetheless, this approach presents two significant challenges. Firstly, it necessitates access to validation gradient information of other clients, which poses privacy concerns. Secondly, it requires revisiting the same clients for additional updates, thereby doubling the communication overhead.

First-order Approximation . To ensure security by preventing access to other clients' gradients and to reduce communication costs, we derive an approximation for the policy gradient with respect to θ k n -1 at the local step n of the client k by a Taylor expansion, as in the following proposition. See Appendix B for more details.

Proposition 1. Consider the federated meta-policy loss derived from the updated weight w k n for client k at step n using a first-order Taylor expansion:

When computing the policy gradient of the loss with respect to θ k n -1 , the first-order gradient approximation is

where w k n = w g r -lr · g aug w k 0 -. . . -lr · g aug w k n -1 and α k is a coefficient proportional to the client's data size.

In Proposition 1, g aug w k n = ∇ ℓ t p θ k n ( D train k,n ) ( w k n ) is the gradient obtained from the local loss in Eq. (3) at step n for client k . We calculate the gradient within the same client to prevent gradient leakage across clients. We optimize a policy that maximizes the inner product of the gradient obtained from sampling the validation data and the gradient obtained through augmentation using p θ k n -1 . The validation data are not used separately; instead, they are replaced by sampling the next batch, inspired by Reptile [30]. Proposition 1 also indicates that policy gradients can be computed concurrently with local updates. We utilize this approach to joint training (§3.3), which enables simultaneous model and policy training.

Gradient Clipping . From the policy gradient of Eq. (6), it becomes evident that policy search aims to maximize the dot product of the gradients derived from both augmentation and validation data. This approach, however, can introduce a bias toward augmentations with larger gradient magnitudes due to the nature of the dot product. Inspired by [31, 18], we mitigate the influence of gradient magnitude by gradient clipping [32, 33]. We apply gradient clipping to the gradients from both validation and augmentation data in Eq. (6) using a regularizer hyperparameter c .

Adaptive Policy Search . Our first-order approximation computes policy gradients at each local update step n without aggregation. These gradients are then averaged across all steps for each client to update the policy after a single communication round. However, this method can slow the policy search, since it only permits one gradient descent update per communication round. Drawing inspiration from meta-learning [28, 30, 34], which quickly adapts to various tasks using neural network training, we propose an adaptive policy search. The augmentation policy is represented as a vector parameter p θ = sigmoid ([ θ 1 , θ 2 , . . . , θ 289 ]) , where [ θ 1 , θ 2 , . . . , θ 289 ] denotes an 17 × 17 joint distribution. We use a neural network comprising the following dense layers: one dummy embedding layer, two 100-dim hidden layers, and an output layer shaped to the 17 × 17 distribution

Algorithm 1 FedAvP: Joint Training

Input: # of communication round R , # of client N , server policy learning rate η , client model learning rate γ , client policy learning rate λ , local steps E , gradient clipping threshold c , regularization term ϵ .

Initialize the global model parameter w g r and the global policy parameter θ g r

procedure LOCALUPDATE( w , θ )

size. We update our policy as done in Reptile [30, 35]. That is, the local policy updates on each client correspond to the inner steps in the Reptile, while the global policy updates on the server are analogous to the outer steps, as detailed in Algorithm 1. We train the policy neural network by increasing the dot-product between policy gradients on each client as follows:

where L k,j = ℓ FMPL D val k,j ( θ k 0 ) is the federated meta-policy loss in Eq. (4) computed on the client k 's j -th validation data batch using the global policy parameters θ k 0 . ⟨∇ L k,j · ∇ L k,s ⟩ is the dot-product between policy gradients on the client k . See Appendix C for more details. This process enables the policy neural network to learn in a direction that enhances the dot-product between the policy gradients of each client, thereby facilitating efficient policy search and enabling personalized policy search. We incorporate this strategy in the joint training in §3.3. An experiment result regarding this will be conducted in §4.

3.3 Joint Training

As done in AutoAugment, one could employ a pretrained network to perform policy search [16, 18]. However, such methods require a separate training phase and present complications in FL environments, since training a pretrained network beforehand is cumbersome, and the separate phase is disadvantageous for parallel training. Note that we previously adopt an adaptive policy search that can simultaneously train the model and policy search. At each local update step n , the weights w k n +1 and gradients concurrently update the model and policy by comparing the gradient on validation data at w k n +1 .

Algorithm 1 illustrates this joint training of our FedAvP. It begins by initializing the global model parameter w g r and the policy parameter θ g r , which are then sent to the clients from the server. Each client generates augmented data t p θn ( D train k,n ) using the policy parameter p θ n at every step n and updates the model accordingly. Subsequently, the gradient ∇ ℓ D val k,n ( w k n +1 ) is computed using the newly updated w k n +1 . Following Proposition 1, the policy parameter θ k n is updated to maximize the gradient on both validation and augmentation data ∇ ℓ t p θ n ( D train k,n ) ( w k n ) . This process of model and policy updates is repeated in every local update. Afterwards, the model and policy parameters from each client are aggregated at the server using α k .

Fast Update One limitation of joint learning is that it requires backpropagation for the policy gradient at every step. To reduce the computation load on local clients, the policy can be updated periodically instead of at every local step n , specifically when n mod τ == 0 . In all our experiments, we set τ = 5 . See the variant of the algorithm in Appendix A.3. We also reduced the hidden size of the policy neural network to two 25-dimensional hidden layers. In our experiments in §4, we will compare the performance of the Fast Update.

4 Experiments

4.1 Experimental setup

Environments . Previous FL studies have demonstrated that the standard algorithms are effective and converged when the data is i.i.d. [36-38]. To evaluate robust performance in non-i.i.d. data, we set up our experimental environment by distributing the CIFAR-10/100 [21] and SVHN [22] datasets with different levels of data heterogeneity among clients. We assign the data to 130 clients based on a Dirichlet distribution with different hyperparameters of α = [5 . 0 , 0 . 1] , as done in pFLBench [25]. The smaller α is, the higher the degree of heterogeneity is. Among these clients, only 100 randomly selected clients participate in the training, while the remaining 30 are nominated as out-of-distribution (OOD) clients. In each communication round, only 10 clients are sampled. We employed a standard CNN model, consistent with those in previous studies [39-41], for the global model. Experiments involving the larger model and OOD clients are provided in Appendix A.2. For the FEMNIST dataset [23], we introduced variability in data size by distributing data based on the writers [8, 11]. Further environments details are provided in Appendix A. Our code is available at https://github.com/alsdml/FedAvP.

Baselines . For a comprehensive evaluation, we compared our method with state-of-the-art federated learning algorithms such as FedAvg [2], FedProx [4], FedDyn [5], FedExP [6], and federated data augmentation algorithms including FedGen [9], FedMix [8], and FedFA [11]. To further explore the potential performance of these algorithms, we conducted experiments applying data augmentation techniques such as RandAugment [17] and TrivialAugment [24]. We also compared the results with those using default augmentations (random crops and horizontal flipping). Additionally, for comparison with our proposed model, we included FedAvP (W/ Local Policy), which trains each

(a) CIFAR-100,

α

= 5

.

0

(b) CIFAR-100,

α

= 0

.

1

(c) SVHN,

α

= 0

.

1

(d) FEMNIST

dentity

identity

dertity

dentity

ShearX

ShearXx

Shearx

ShearX

ShearY

LRaS

ShearY

Tanslatex

TranslateK

Translatex

TrarslateY:

TranslateY

TrarslateY

TranslateY

Rotate

Rotabe

Rotate

AutoContrast

AutoCantrast

AutoContrast

AutoContrast:

Equelize

Equalize

Equalize

Equalize

Solarize

Solarize

Solarize

Posterize

Poiterize

Posterize

Contrast

Contrast

Contrast

Contrast.

Coler

Color

Color

Celor

Brightness

Brightness

Brightness

Brightness

ssaudaeus

Sharpness

Sharpness

Sharpness

RandFlip

RandFip

Randrlip

RandCutout

RandCutout

RandCutout

RandOutout:

RandCrop

RanoCrop

RandCrop

RandCrop

local client without policy aggregation, and FedAvP (Fast Update) which reduces computation load on local clients (Algorithm 2). Further details of baselines are provided in Appendix A.

4.2 Performance on Non-i.i.d. Settings

Settings. Table 1 reports the test accuracy , which measures the accuracy on the test dataset of the 100 participating clients. The test accuracy is calculated as the weighted average of each client's accuracy by the number of data points they have. We compared each baseline with three data augmentations: +Default (random crops and horizontal flipping), +RandAugment, and +TrivialAugment. For FedAvP (W/ Local Policy), each client has its own transformation policy and policy aggregation is removed from our algorithm (Algorithm 1). For FedAvP (Fast Update), we used periodic local updates (Algorithm 2). For FedAvP, we used full local updates (Algorithm 1).

Results. The application of automated data augmentation algorithms such as RandAugment and TrivialAugment within a federated learning framework does not consistently enhance performance across all cases. In contrast, our algorithm learned distinct augmentations for each dataset, as depicted in Figure 2. When compared to FedAvP (W/ Local Policy) and FedAvP, notable performance improvements were observed in highly non-i.i.d. scenarios such as α = 0 . 1 in CIFAR-100 and SVHN. For instance, the standard deviation of local dataset sizes in CIFAR-100 with α = 5 . 0 was relatively small at 19.43, while it was significantly higher at 118.00 for CIFAR-100 and 533.60 for SVHN with α = 0 . 1 , indicating that imbalanced datasets in non-i.i.d. settings pose challenges for training local policies with smaller local datasets. Although FedAvP (Fast Update) experienced some performance declines compared to FedAvP, it generally achieved higher performance than baseline methods across most datasets.

4.3 Policy Adaptation on Clients

In our FedAvP, at the beginning of each round, the participating clients receive a global policy from the server, which is then optimized into a local policy using each client's local data. That is, this optimization adapts the global policy into a personalized policy on the local data of each client. The clients use the personalized policy to train their local model to achieve high performance and to aggregate well with other local models in the server. Figure 3 shows the statistics on the Euclidean distances between

0

200

400

600

800

1000

Round

0.0

0.1

0.2

0.3

0.4

0.5

0.6

5.0

0.1

the personalized policies of clients participating in each round and the global policy for that round. With α = 5 . 0 in CIFAR-100, the data is sufficiently i.i.d., and thus the personalized policies of clients tend not to deviate from the global policy. On the other hand, with α = 0 . 1 , the deviation from the global policy is initially high but decreases as training progresses, particularly after about 100 rounds. The variance of the Euclidean distances also follows this pattern.

4.4 Reconstruction Attack

Settings. In collaborative learning systems, it has been reported that gradient leakage attacks can occur [14, 42, 43], leveraging gradients to reconstruct the original training data. We conducted these reconstruction attack [14] experiments to evaluate whether our algorithm, which shares policies in a federated learning setting, provides enhanced privacy compared to FedGen, FedMix, and FedFA. Specifically, FedGen shares information at the generator and label distribution levels, FedMix shares at the input level, and FedFA shares at the feature level.

We included a defense algorithm in the performance comparison, ATSPrivacy [27]. Our experiments were conducted on CIFAR-100 with α = 0 . 1 , involving two clients: Client(L), which had the most training data (895 data points), and Client(S), with the least (156 data points). For ATSPrivacy, we used policies from [27] that showed the highest accuracy performance. Further experimental details are provided in Appendix A.1.

Results. The experimental results for the Reconstruction Attack are summarized in Table 2. Lower PSNR values indicate that the reconstructed images are less similar to the original data, thereby reflecting better privacy preservation. Fed-

Gen+label+generator utilizes the label distribution of local data and the generative model. FedMix+input and FedFA+feature represent the results of attacks utilizing input level and feature level information, respectively. FedAvP+policy gradients denotes the results of attacks using the policy gradient of our algorithm. ATSPrivacy recorded the lowest PSNR values, indicating that it makes reconstruction difficult. However, this was coupled with a decline in accuracy performance. Despite increases in PSNR for FedGen, FedMix and FedFA, our algorithm's use of policy gradients did not elevate PSNR values.

4.5 Computation and Communication Cost

Method

FedAvg

FedMix

FedAvP (Fast Update)

FedAvP

CIFAR-100 dataset

Before(MB) Per round(MB)

0

.

00

15

.

35

1

0

0

0

.

27

.

00

.

00

.

00

15

.

35

15

.

38

15

.

73

17

.

47

For computational comparison, we measured the time taken to reach a target accuracy of 35% on the CIFAR-100 dataset with α = 0 . 1 . Regarding communication comparison in FedMix, the method involves sending an average image to the server prior to training, which is detailed in the 'Before' section of the table. For FedAvP (Fast Update) using small neural networks, although it is higher than these baselines, the increase of 0.38MB from the cost of FedAvg is about 2.48 % compared to the gradient transmission cost of the model. See Appendix A.4 for additional results.

5 Conclusion

We proposed a novel federated data augmentation method named FedAvP (Augment Local Data via Shared Policy in Federated Learning). It shares the augmentation policies during training rather than preprocessed or encoded data such as the average of data or statistics of features. Direct exposure of personal information was constrained, yet clients still benefited from the policies learned and shared

across the clients to augment their local data. We also proposed Federated Meta-Policy Loss (FMPL) and used the first-order gradient information to enhance privacy with reduced communication costs. A potential limitation of our algorithm is the introduction of Joint Training. This approach requires consideration when applying our federated data augmentation method to existing federated learning algorithms. Also, our algorithm assumed the use of FedAvg, which does not account for model personalization [44, 45] in the computation of FMPL. Investigating a policy loss that aligns with model personalization algorithms would be interesting.

Acknowledgment

This work was partially supported by Institute of Information & communications Technology Planning &Evaluation (IITP) grant funded by the Korea government (MSIT) (No. RS-2021-II211343, Artificial Intelligence Graduate School Program (Seoul National University)), by Samsung Advanced Institute of Technology, and Center for Applied Research in Artificial Intelligence(CARAI) grant funded by Defense Acquisition Program Administration(DAPA) and Agency for Defense Development(ADD) (UD230017TD)

References

Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication-efficient learning of deep networks from decentralized data. In AISTATS , pages 1273-1282. PMLR, 2017.

Jakub Koneˇ cn` y, H Brendan McMahan, Daniel Ramage, and Peter Richtárik. Federated optimization: Distributed machine learning for on-device intelligence. arXiv preprint arXiv:1610.02527 , 2016.

Viraaji Mothukuri, Reza M Parizi, Seyedamin Pouriyeh, Yan Huang, Ali Dehghantanha, and Gautam Srivastava. A survey on security and privacy of federated learning. Future Gener. Comput. Syst. , 115:619640, 2021.

Tian Li, Anit Kumar Sahu, Manzil Zaheer, Maziar Sanjabi, Ameet Talwalkar, and Virginia Smith. Federated optimization in heterogeneous networks. Proceedings of Machine learning and systems , 2:429-450, 2020.

Durmus Alp Emre Acar, Yue Zhao, Ramon Matas, Matthew Mattina, Paul Whatmough, and Venkatesh Saligrama. Federated learning based on dynamic regularization. In International Conference on Learning Representations , 2020.

Divyansh Jhunjhunwala, Shiqiang Wang, and Gauri Joshi. Fedexp: Speeding up federated averaging via extrapolation. In The Eleventh International Conference on Learning Representations , 2022.

Sawsan AbdulRahman, Hanine Tout, Hakima Ould-Slimane, Azzam Mourad, Chamseddine Talhi, and Mohsen Guizani. A survey on federated learning: The journey from centralized to distributed on-site learning and beyond. IEEE Internet Things J. , 8(7):5476-5497, 2020.

Tehrim Yoon, Sumin Shin, Sung Ju Hwang, and Eunho Yang. Fedmix: Approximation of mixup under mean augmented federated learning. In ICLR , 2020.

Zhuangdi Zhu, Junyuan Hong, and Jiayu Zhou. Data-free knowledge distillation for heterogeneous federated learning. In International conference on machine learning , pages 12878-12889. PMLR, 2021.

MyungJae Shin, Chihoon Hwang, Joongheon Kim, Jihong Park, Mehdi Bennis, and Seong-Lyun Kim. Xor mixup: Privacy-preserving data augmentation for one-shot federated learning. arXiv preprint arXiv:2006.05148 , 2020.

Tianfei Zhou and Ender Konukoglu. Fedfa: Federated feature augmentation. In ICLR , 2022.

Mohammad Rasouli, Tao Sun, and Ram Rajagopal. Fedgan: Federated generative adversarial networks for distributed data. arXiv preprint arXiv:2006.07228 , 2020.

Dominik Lewy, Jacek Ma´ ndziuk, Maria Ganzha, and Marcin Paprzycki. Statmix: Data augmentation method that relies on image statistics in federated learning. In ICONIP , pages 574-585. Springer, 2022.

Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. Advances in neural information processing systems , 32, 2019.

Ekin D Cubuk, Barret Zoph, Dandelion Mane, Vijay Vasudevan, and Quoc V Le. Autoaugment: Learning augmentation policies from data. arXiv preprint arXiv:1805.09501 , 2018.

Sungbin Lim, Ildoo Kim, Taesup Kim, Chiheon Kim, and Sungwoong Kim. Fast autoaugment. Advances in neural information processing systems , 32, 2019.

Ekin D Cubuk, Barret Zoph, Jonathon Shlens, and Quoc V Le. Randaugment: Practical automated data augmentation with a reduced search space. In CVPRW , pages 702-703, 2020.

Yu Zheng, Zhi Zhang, Shen Yan, and Mi Zhang. Deep autoaugment. arXiv preprint arXiv:2203.06172 , 2022.

Fengwei Zhou, Jiawei Li, Chuanlong Xie, Fei Chen, Lanqing Hong, Rui Sun, and Zhenguo Li. Metaaugment: Sample-aware data augmentation policy learning. In AAAI , volume 35, pages 11097-11105, 2021.

Xinyu Zhang, Qiang Wang, Jian Zhang, and Zhao Zhong. Adversarial autoaugment. arXiv preprint arXiv:1912.11188 , 2019.

Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.

Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y. Ng. Reading Digits in Natural Images with Unsupervised Feature Learning. NIPSW , 2011.

Sebastian Caldas, Sai Meher Karthik Duddu, Peter Wu, Tian Li, Jakub Konecny, H. Brendan McMahan, Virginia Smith, and Ameet Talwalkar. LEAF: A Benchmark for Federated Settings. arXiv preprint arXiv:1812.01097 , 2019.

Samuel G Müller and Frank Hutter. Trivialaugment: Tuning-free yet state-of-the-art data augmentation. In ICCV , pages 774-782, 2021.

Daoyuan Chen, Dawei Gao, Weirui Kuang, Yaliang Li, and Bolin Ding. pfl-bench: A comprehensive benchmark for personalized federated learning. Advances in neural information processing systems , 35:9344-9360, 2022.

Hongyi Zhang, Moustapha Cisse, Yann N Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization. In ICLR , 2018.

Wei Gao, Shangwei Guo, Tianwei Zhang, Han Qiu, Yonggang Wen, and Yang Liu. Privacy-preserving collaborative learning with automatic transformation search. In CVPR , pages 114-123, 2021.

Chelsea Finn, Pieter Abbeel, and Sergey Levine. Model-agnostic meta-learning for fast adaptation of deep networks. In ICML , pages 1126-1135. PMLR, 2017.

Jun Shu, Qi Xie, Lixuan Yi, Qian Zhao, Sanping Zhou, Zongben Xu, and Deyu Meng. Meta-weight-net: Learning an explicit mapping for sample weighting. Advances in neural information processing systems , 32, 2019.

Alex Nichol and John Schulman. Reptile: a scalable metalearning algorithm. arXiv preprint arXiv:1803.02999 , 2(3):4, 2018.

Xinyi Wang, Hieu Pham, Paul Michel, Antonios Anastasopoulos, Jaime Carbonell, and Graham Neubig. Optimizing data usage via differentiable rewards. In ICML , pages 9983-9995. PMLR, 2020.

Razvan Pascanu, Tomas Mikolov, and Yoshua Bengio. On the difficulty of training recurrent neural networks. In ICML , pages 1310-1318. Pmlr, 2013.

Tomas Mikolov, Anoop Deoras, Stefan Kombrink, Lukas Burget, and Jan Cernock` y. Empirical evaluation and combination of advanced language modeling techniques. In Interspeech , number s 1, pages 605-608, 2011.

Zhenguo Li, Fengwei Zhou, Fei Chen, and Hang Li. Meta-sgd: Learning to learn quickly for few-shot learning. arXiv preprint arXiv:1707.09835 , 2017.

Yihan Jiang, Jakub Koneˇ cn` y, Keith Rush, and Sreeram Kannan. Improving federated learning personalization via model agnostic meta learning. arXiv preprint arXiv:1909.12488 , 2019.

Xiang Li, Kaixuan Huang, Wenhao Yang, Shusen Wang, and Zhihua Zhang. On the convergence of FedAvg on Non-IID data. arXiv preprint arXiv:1907.02189 , 2019.

Peter Kairouz, H Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, et al. Advances and open problems in federated learning. Found. Trends Mach. Learn. , 14(1-2):1-210, 2021.

Mohammed Aledhari, Rehma Razzak, Reza M Parizi, and Fahad Saeed. Federated learning: A survey on enabling technologies, protocols, and applications. IEEE Access , 8:140699-140725, 2020.

Aviv Shamsian, Aviv Navon, Ethan Fetaya, and Gal Chechik. Personalized federated learning using hypernetworks. In International Conference on Machine Learning , pages 9489-9502. PMLR, 2021.

Paul Pu Liang, Terrance Liu, Liu Ziyin, Nicholas B Allen, Randy P Auerbach, David Brent, Ruslan Salakhutdinov, and Louis-Philippe Morency. Think locally, act globally: Federated learning with local and global representations. arXiv preprint arXiv:2001.01523 , 2020.

Jaehoon Oh, Sangmook Kim, and Se-Young Yun. Fedbabu: Towards enhanced representation for federated image classification. arXiv preprint arXiv:2106.06042 , 2021.

Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller. Inverting gradients-how easy is it to break privacy in federated learning? Advances in neural information processing systems , 33:16937-16947, 2020.

Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. idlg: Improved deep leakage from gradients. arXiv preprint arXiv:2001.02610 , 2020.

Viraj Kulkarni, Milind Kulkarni, and Aniruddha Pant. Survey of personalization techniques for federated learning. In WorldS4 , pages 794-797. IEEE, 2020.

Alysa Ziying Tan, Han Yu, Lizhen Cui, and Qiang Yang. Towards personalized federated learning. IEEE Trans Neural Netw Learn Syst , 2022.

Takuya Akiba, Shotaro Sano, Toshihiko Yanase, Takeru Ohta, and Masanori Koyama. Optuna: A next-generation hyperparameter optimization framework. In Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining , pages 2623-2631, 2019.

Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. Pytorch: An imperative style, high-performance deep learning library. Advances in neural information processing systems , 32, 2019.

Terrance DeVries and Graham W Taylor. Improved regularization of convolutional neural networks with cutout. arXiv preprint arXiv:1708.04552 , 2017.

Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980 , 2014.

Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556 , 2014.

Felix Sattler, Simon Wiedemann, Klaus-Robert Müller, and Wojciech Samek. Robust and communicationefficient federated learning from non-iid data. IEEE transactions on neural networks and learning systems , 31(9):3400-3413, 2019.

Alexey Dosovitskiy. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929 , 2020.

Liangqiong Qu, Yuyin Zhou, Paul Pu Liang, Yingda Xia, Feifei Wang, Ehsan Adeli, Li Fei-Fei, and Daniel Rubin. Rethinking architecture design for tackling data heterogeneity in federated learning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 10061-10071, 2022.

Jianyu Wang, Qinghua Liu, Hao Liang, Gauri Joshi, and H Vincent Poor. Tackling the objective inconsistency problem in heterogeneous federated optimization. Advances in neural information processing systems , 33:7611-7623, 2020.

Sai Praneeth Karimireddy, Satyen Kale, Mehryar Mohri, Sashank Reddi, Sebastian Stich, and Ananda Theertha Suresh. Scaffold: Stochastic controlled averaging for federated learning. In International conference on machine learning , pages 5132-5143. PMLR, 2020.

Qinbin Li, Yiqun Diao, Quan Chen, and Bingsheng He. Federated learning on non-iid data silos: An experimental study. In 2022 IEEE 38th international conference on data engineering (ICDE) , pages 965-978. IEEE, 2022.

Alex Nichol, Joshua Achiam, and John Schulman. On first-order meta-learning algorithms. arXiv preprint arXiv:1803.02999 , 2018.

A Implementation Details

Model Consistent with prior studies, we employed a standard CNN model for all experiments as referenced in [39-41]. The global model consists of three convolutional layers with 64 filters and 3x3 kernels, followed by three fully-connected layers of 256, 128, and the final classification layer. All experiments are run on a cluster of 32 NVIDIA GTX 1080 GPUs.

Datasets To evaluate robust performance in non-i.i.d. data, we set up our experimental environment by distributing the CIFAR-10/100 [21] and SVHN [22] datasets with varying levels of data heterogeneity among clients. We allocated the data to 130 clients based on a Dirichlet distribution with different hyperparameters of α = [5 . 0 , 0 . 1] , following the procedure in pFL-Bench [25]. The lower the α , the higher the degree of heterogeneity. Among these clients, only 100 were randomly selected to participate in the training, while the remaining 30 were designated as out-of-distribution (OOD) clients. For the CIFAR10/100, the number of training rounds R was set to 1000. For the FEMNIST, the number of training rounds R was set to 500. For the SVHN, the number of training rounds R was set to 100, 300, and 500, as reported in Table 5. The results reported in the main paper, Table 1, are for the 500 round. In each communication round, only 10 clients are sampled, and the remaining 30 clients serve as out-of-distribution (OOD) clients.

Hyperparameters For the FedAvP algorithm, the hyperparameters include the server policy learning rate η , client policy learning rate λ , gradient clipping threshold c , and a regularization term ϵ . In our experimentation, we tuned η within [0 . 4 , 0 . 9] , λ within [0 . 1 ∼ 0 . 9] , c within [0 . 4 ∼ 1 . 0] , and ϵ within [0 . 0 ∼ 0 . 5] . The validation batch size was also explored within [64 , 128 , 192] . A common hyperparameter across all methods was local epoch set to 5, and local batch is set to 64. The client model learning rate γ was searched within the range of [0 . 1 ∼ 0 . 3] . This comprehensive parameter optimization was conducted using an optimization tool known as Optuna 1 [46]. We utilized both the Tree-structured Parzen Estimator algorithm and Random Sampler as hyperparameter samplers within Optuna. The Adaptive Policy Network was consistently implemented in all experiments with FedAvP, comprising the following dense layers: an embedding layer, two hidden layers with 100 neurons each, and an output layer shaped to the 17 × 17 distribution size. With FedAvP (Fast Update), it comprised the following dense layers: an embedding layer, two hidden layers with 25 neurons each, and an output layer shaped to the 17 × 17 distribution size.

Baselines In all baseline experiments, Random Crop and HorizontalFlip were applied as default augmentations. For the baseline algorithms' hyperparameter settings, specifically for RandAugment (RA) [17], we leveraged a PyTorch implementation [47]. Hyperparameter values were determined in alignment with the procedures described by the authors. For the CIFAR-100 dataset, the hyperparameter M was investigated within the range of [2 , 6 , 10 , 14] and N within [1 , 2] . For CIFAR-10, the hyperparameter M was investigated within [4 , 5 , 7 , 9 , 11] and N within [2 , 3] . For FEMNIST, the hyperparameter M was investigated within [4 , 5 , 7 , 9 , 11] and N within [1 , 2 , 3] . For SVHN, the hyperparameter M was investigated within [5 , 7 , 9 , 11] and N within [3] . For TrivialAugment (TA) [24], we utilized the PyTorch library's built-in algorithm [47]. For RandAugment and TrivialAugment, Random Crop and HorizontalFlip were applied first, followed by RandCutout [48]. As for FedMix [8], the hyperparameter λ was investigated within [0 . 01 ∼ 0 . 1] . The client model learning rate γ was searched within the range of [0 . 005 ∼ 0 . 3] . The hyperparameter M used "All", meaning the average image of all images of each client was used. In the case of FedFA [11], we searched the hyperparameters p and α , each within the range of [0 . 0 ∼ 1 . 0] . The client model learning rate γ was searched within the range of [0 . 005 ∼ 0 . 3] .

A.1 Reconstruction Attack Details

We performed experiments using reconstruction attacks [14] to assess if our policy-sharing algorithm offers better privacy in a federated learning context, in comparison to FedMix [8] and FedFA [11], which share data at the input and feature levels respectively. Additionally, we conducted experiments to compare our algorithm with FedGen [9], which shares the label distribution of the client's training data and a generative model that produces a latent from learned latent feature space over the clients' local training data. Despite our algorithm not being specifically designed as a defense against reconstruction attacks, we included ATSPrivacy [27] in our performance evaluation for comparison. ATSPrivacy aims to identify the best policy to counter reconstruction attacks by conducting a policy search. Although ATSPrivacy's primary goal isn't to enhance performance through policy sharing in collaborative learning environments, we chose it as a baseline because it also involves policy search in the context of collaborative learning. We have described below the attack algorithms that utilize input-level, feature-level, and policy gradient information.

A.1.1 Reconstruction Attack using Additional Information

It has been reported that in Collaborative learning systems, Gradient leakage attacks are feasible [14, 42, 43]. These attacks use gradients to reconstruct the training data. We consider a scenario with a central server and clients where learning occurs through the exchange of gradients. Assume we have a given gradient ∇ W ( x, y ) , then we can optimize for a dummy data and label pair ( x ′ , y ′ ) by minimizing the following objective:

where || · || denotes a norm distance measure, ∇ W ( x, y ) is the given gradient, ( x, y ) is the client's sample data and label, and ( x ′ , y ′ ) are the targets of optimization. Following [42], we utilize cosine similarity as a cost function instead of norm distance, like in the case of

where ℓ ( x, y ) = ⟨ x, y ⟩ / ( ∥ x ∥ · ∥ y ∥ ) .

Here, we assume that input-level information is available, specifically the mean image of the client's data x mean in the FedMix [8]. The method for reconstruction attack utilizing input-level information is as follows:

where α input is a hyperparameter for the additional term, it is fixed at 0 . 1 in experiments where input-level information is available and set to 0 in scenarios without input-level information. x mean represents the mean image of the client's data. Cosine similarity was utilized to measure gradient distance, as described in [42]. Similarly, in cases where the client provides feature-level information to the server, as in the FedFA [11], this information can also be used to help with reconstruction. The method for reconstruction attack utilizing feature-level information is as follows:

where ¯ µ k and ¯ σ k are the momentum updated feature statistics of layer k in the client model, µ k ′ and σ k ′ are the feature statistics of layer k with regard to x ′ , α feat and β feat are hyperparameters for the additional terms fixed at 0.1 and 0.0, respectively.

In the FedGen algorithm, clients transmit the label distribution of their local training data and the generative model. This information allows us to improve the cost function for reconstruction, which is formulated as follows:

where G is a generative model to generate the latent distribution, W p refers to the final layer in the client model that takes a latent as an input and outputs prediction logits, c is the label distribution of the client's local training data, α gen and β gen are hyperparameters for the additional terms fixed at 0.0001 and 0.0001, respectively. Also, we can initialize y ′ with c .

A.1.2 Reconstruction Attack using Policy Gradient Information

For the FedAvP algorithm, clients send the policy gradient information. Such policy gradient information can also be utilized as a term of cost function for reconstruction in the following manner:

where α policy is a hyperparameter for the additional term fixed at 0.1.

When additional information, such as input-level or feature-level, is available in addition to gradient information, it can be utilized, potentially posing a security risk. On the other hand, we have confirmed that even when utilizing the policy gradient information additionally, the reconstruction risk does not increase. The results of the experiments regarding this are summarized in Table 2.

A.1.3 Experimental details

Our reconstruction attack experiments were conducted on CIFAR-100 with α = 0 . 1 , featuring heterogeneous data distribution. Specifically, after 1000 rounds of training, we selected clients for the reconstruction attack. The selection criteria were the client with the most training data (895 data points), Client(L), and the one with the least (156 data points), Client(S). For both clients, we randomly sampled 150 training data points to perform the reconstruction attack. In all experiments, the batch size and reconstruction step for the reconstruction attack were set to 1 and 2400, respectively. We used the Adam optimizer [49]. Gradients obtained from 1 round after 1000 rounds of training were used for the reconstruction attack.

For ATSPrivacy, we trained the 6 policies with FedAvg used in the CIFAR-100 dataset of the author's paper [27], namely 3-1-7, 43-18-18, (3-1-7, 43-18-18), 21-13-3, 7-4-15, and (21-13-3, 7-4-15), in the CIFAR-100 with ( α = 0 . 1 ) environment. We performed the reconstruction attack on the policies (7-4-15) and (21-13-3, 7-4-15), which showed the best accuracy performance. The (21-13-3, 7-4-15) policy is a hybrid policy described in the author's paper [27], and we applied it by randomly sampling one of the two policies.

A.2 Additional Results with a Larger Model

We conducted experiments on a model with more parameters than those used in the main experiments. The model used in these experiments is a simplified version of VGG11 [50, 51], where all dropout and batch normalization layers are removed, and the filters and the size of all fully-connected layers are reduced by a factor of 2. This model contains about three times more network parameters than the networks used in the main paper. We verify the performance of our model on non-IID datasets, specifically SVHN-10 ( α = 0 . 1 ), with different communication rounds.

Table 5: Classification accuracies with the different communication rounds of R = [100 , 300 , 500] in SVHN dataset with α = 0 . 1 using the VGG11s model.

A.3 Fast Update Algorithm

To reduce computation for local clients from joint learning, we perform periodic policy updates, specifically when n mod τ == 0 . In all our experiments, we set τ = 5 and reduced the hidden size of the policy neural network to two 25-dimensional hidden layers with FedAvP (Fast Update) algorithm.

Algorithm 2 FedAvP (Fast Update) : Joint Training

Input: # of communication round R , # of client N , server policy learning rate η , client model learning rate γ , client policy learning rate λ , local steps E , gradient clipping threshold c , regularization term ϵ .

Initialize the global model parameter w g r and the global policy parameter θ g r

A.4 Additional Results of Computation cost

For additional computational comparisons, we measured the time taken to reach a target accuracy of 40% on the CIFAR-100 dataset with α = 5 . 0 and the time taken to reach a target accuracy of 75% on the CIFAR-10 dataset with α = 5 . 0 . In the case of CIFAR-100 with α = 5 . 0 , FedAvP (Fast Update) achieved results more than 1 hour faster than FedAvg. Our method generally produced faster results compared to applying RandAugment and TrivialAugment which enhanced the performance of FedAvg in table 1.

A.5 Ablation Results of Hyperparameters ϵ

(a) FedAvg - Client(S)

(c) FedGen - Client(S)

(e) FedMix - Client(S)

(g) FedFA - Client(S)

(i) FedAvP - Client(S)

(k) FedGen+label+generator - Client(S)

(m) FedMix+input - Client(S)

(o) FedFA+featrue - Client(S)

(q) FedAvP+pg - Client(S)

14.63

14.80

15.28

15.29

15.38

15.47

15.57

16.23

16.34

16.45

8.95

96°8

668

9.12

85'6

10.30

11.05

11.46

11.72

12.53

13.84

13.97

14.29

14.46

14.50

14.84

14.95

15.12

15.34

15.51

13.89

14.18

14.44

14.73

14.87

15.63

15.78

16.80

17.21

19.14

10.69

11.32

11.34

11.67

11.90

12.06

12.11

12.75

13.28

13.89

10.82

10.82

11.03

11.31

11.53

11.64

11.83

12.37

12.41

12.91

14.92

14.96

15.14

15.14

15.42

15.63

15.71

16.04

16.83

17.84

15.41

15.53

15.69

15.84

15.89

16.09

16.33

16.60

16.62

19.44

7.98

8.19

8.52

8.70

8.74

9.21

9.60

9.95

9.96

10.60

(b) FedAvg - Client(L)

(d) FedGen - Client(L)

(f) FedMix - Client(L)

(h) FedFA - Client(L)

(j) FedAvP - Client(L)

(l) FedGen+label+generator - Client(L)

(n) FedMix+input - Client(L)

(p) FedFA+featrue - Client(L)

(r) FedAvP+pg - Client(L)

15.02

15.31

15.40

15.41

15.42

15.45

16.29

17.30

17.95

19.27

8.50

8.63

8.90

9.10

10.00

11.04

11.23

11.60

12.19

12.45

14.45

14.56

14.65

14.69

15.26

15.27

16.23

16.35

17.63

18.39

14.83

14.97

15.67

16.21

17.16

17.33

17.34

18.54

21.48

22.03

11.56

11.63

11.82

12.00

12.09

12.26

12.56

13.13

14.54

16.57

11.90

12.04

12.16

12.23

12.68

13.22

13.32

13.43

15.00

16.74

15.90

15.96

16.01

16.09

16.54

16.81

16.85

16.88

17.52

19.37

16.81

16.93

17.24

17.42

18.36

18.58

18.59

18.64

20.11

20.99

8.83

8.85

8.88

8.92

9.20

8E6

9.60

9.62

9.77

9.99

(a) CIFAR-100 with

α

= 5

.

0

(b) CIFAR-100 with

α

= 0

.

1

(c) CIFAR-10 with

α

= 5

.

0

(d) SVHN with

α

= 0

.

1

2

1.5

0.5

0

200

400

600

800

1,000

1.5

0.5

0

200

400

600

800

1,000

0.8

0.6

0.4

0.2

0

200

400

600

800

1,000

0.4

0.2

0

0

100

200

300

400

500

A.6 Additional Results of Non-i.i.d. Experiments

A.7 The Scalability of FedAvP

A.8 Additional Results with ViT-T

We present additional results using the ViT-T model[52, 53] on CIFAR-100 with different heterogeneity degrees.

A.8.1 Computation Time of ViT-T on CIFAR-100

A.9 Comparison with Other Classic Non-IID Methods

We conducted additional experiments with non-IID algorithms, including FedNova [54] and SCAFFOLD [55].

A.10 Additional Results of Non-i.i.d. Experiments with Equally-Weighted Metric

In the main paper, we followed the weighted accuracy metric as described in the pFL-Bench [25]. Here, we provide additional results for non-i.i.d. experiments using an equally-weighted metric on CIFAR-100.

A.11 Experiments on Extreme label-skew Settings

The table below presents the results across different datasets and partitioning strategies, specifically the quantity-based label skew settings described in [56]. Here, C is the number of different labels held by each client. In extreme label skew cases, such as C = 1 , where data labels are highly partitioned, our algorithm shows slightly lower performance on CIFAR-100 ( C = 1 ). However, in all other cases, our algorithm demonstrates improved performance.

Table 17: Test accuracy (%) on CIFAR-100 and SVHN datasets under quantity-based label skew settings. C denotes the number of different labels held by each client.

B Proof of Proposition 1

Consider the federated meta-policy loss derived from the updated weight w k n for client k at step n using a first-order Taylor expansion:

When calculating the policy gradient of this loss with respect to θ k n -1 for client k , the first-order gradient approximation is as follows:

Proof.

First, let's calculate starting from the left term in Eq. (19)

Next, we calculate the right term in Eq. (19)

∂

(

∇

ℓ

D

val

k

(

w

k

n

)

T

∂θ

(

k

n

w

-

g

1

-

w

k

n

))

r

+1

(treating ∇ ℓ D val k ( w k n ) as a constant for first-order)

(using the definition of w g r +1 in (18))

(using the definition of w k N in (16)) and treating g aug w k n as a constant for first-order) (28)

(using the definition of w k n in (16))

By combining Eq. (24) and Eq. (33),

C Proof of Adaptive Policy Search

where L k,j ≡ ℓ FMPL D val k,j ( θ k 0 ) represents the the federated meta-policy loss in computed on the client k 's j -th validation data batch using the global policy parameters θ k 0 received from the server. ⟨∇ L k,j · ∇ L k,s ⟩ represents the dot-product between policy gradients on the client k .

Proof. We refer to the proof of reptile [30, 57] and use the following definitions:

First, let's calculate g k n in Eq. (38) to O ( λ 2 ) as follows:

(48)

Then, we define the following in (36):

(using the definitions of (41) and (42) ) (50)

By combining Eq. (36) and Eq. (49) and taking the expectation over the clients and local updates,

NeurIPS Paper Checklist

Do not remove the checklist: The papers not including the checklist will be desk rejected.

1. Claims

Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?

Answer: [Yes]

Justification: We stated the paper's contributions and scope in Section 1.

Guidelines:

The answer NA means that the abstract and introduction do not include the claims made in the paper.

The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.

The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.

It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.

2. Limitations

Question: Does the paper discuss the limitations of the work performed by the authors?

Answer: [Yes]

Justification: We stated the paper's limitations in Section 5.

Guidelines:

The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.

The authors are encouraged to create a separate "Limitations" section in their paper.

The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.

The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.

The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.

The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.

If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.

While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.

3. Theory Assumptions and Proofs

Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?

Answer: [Yes]

Justification: We provided the paper's proof in appendix B and C .

Guidelines:

The answer NA means that the paper does not include theoretical results.

All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced.

All assumptions should be clearly stated or referenced in the statement of any theorems.

The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.

Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.

Theorems and Lemmas that the proof relies upon should be properly referenced.

4. Experimental Result Reproducibility

Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?

Answer: [Yes]

Justification: We provide algorithms including 1 and 2, and their experimental settings in Appendix A.

Guidelines:

The answer NA means that the paper does not include experiments.

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.

If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.

Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.

While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example

(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.

(b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.

(c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).

(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.

5. Open access to data and code

Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?

Answer: [Yes]

Justification: We provide the code for our paper and its instructions in a zip file.

Guidelines:

The answer NA means that paper does not include experiments requiring code.

Please see the NeurIPS code and data submission guidelines ( https://nips.cc/ public/guides/CodeSubmissionPolicy ) for more details.

While we encourage the release of code and data, we understand that this might not be possible, so 'No' is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).

The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines ( https: //nips.cc/public/guides/CodeSubmissionPolicy ) for more details.

The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.

The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).

Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.

6. Experimental Setting/Details

Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?

Answer: [Yes]

Justification: We provide detailed experimental settings in Appendix A.

Guidelines:

The answer NA means that the paper does not include experiments.

The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.

The full details can be provided either with the code, in appendix, or as supplemental material.

7. Experiment Statistical Significance

Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?

Answer: [Yes]

Justification: We provided our algorithm's accuracies with their variances in Table 1.

Guidelines:

The answer NA means that the paper does not include experiments.

The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)

The assumptions made should be given (e.g., Normally distributed errors).

It should be clear whether the error bar is the standard deviation or the standard error of the mean.

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.

For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).

If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.

8. Experiments Compute Resources

Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?

Answer: [Yes]

Justification: We provided computation time and communication cost in 4 and A. Guidelines:

The answer NA means that the paper does not include experiments.

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.

The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.

The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).

9. Code Of Ethics

Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines ?

Answer: [Yes]

Justification: Our research proposes a federated data augmentation method, is non-harmful, and complies with the Code of Ethics.

Guidelines:

The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.

If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.

The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).

10. Broader Impacts

Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?

Answer: [Yes]

Justification: Our research proposes a federated data augmentation method that does not have negative impacts on society.

Guidelines:

The answer NA means that there is no societal impact of the work performed.

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.

Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.

The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.

If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).

11. Safeguards

Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?

Answer: [NA]

Justification: Our research proposes a federated data augmentation method that does not have a high risk for misuse.

Guidelines:

The answer NA means that the paper poses no such risks.

Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.

We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.

12. Licenses for existing assets

Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?

Answer: [Yes]

Justification: We have cited all the assets used in the paper.

Guidelines:

The answer NA means that the paper does not use existing assets.

The authors should cite the original paper that produced the code package or dataset.

The authors should state which version of the asset is used and, if possible, include a URL.

The name of the license (e.g., CC-BY 4.0) should be included for each asset.

For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.

If this information is not available online, the authors are encouraged to reach out to the asset's creators.

13. New Assets

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?

Answer: [NA]

Justification: our paper does not release new assets.

Guidelines:

The answer NA means that the paper does not release new assets.

Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.

The paper should discuss whether and how consent was obtained from people whose asset is used.

At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.

14. Crowdsourcing and Research with Human Subjects

Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?

Answer: [NA]

Justification: our paper does not involve crowdsourcing nor research with human subjects.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.

According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.

15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?

Answer: [NA]

Justification: our paper does not involve crowdsourcing nor research with human subjects.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.

For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.

Peer reviews:
comments: SUMMARY:
This paper proposes FedAvP, a novel algorithm to perform data augmentation via shared policy in federated learning (FL). Extensive experiments verify the effectiveness of the proposed algorithm.

STRENGTHS:
S1: The proposed algorithm is novel with solid theoretical analysis.

S2: The experiments are comprehensive, with open-source code submitted.

WEAKNESSES:
W1: The authors can conduct more experiments on more comprehensive non-IID settings. For example, in a previous FL benchmark on non-IID data [1], the quantity-based label skew settings are challenging. The authors are suggested to experiment on such settings to further support the effectiveness of the proposed algorithm. 

[1] Li, Qinbin, et al. "Federated learning on non-iid data silos: An experimental study." 2022 IEEE 38th international conference on data engineering (ICDE). IEEE, 2022.

QUESTIONS:
Please see weaknesses. The authors are suggested to conduct more comprehensive experiments. I will adjust the score based on the author response.

LIMITATIONS:
Please see weaknesses.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2024-06-13

comments: SUMMARY:
This paper points out that the shared input-level and feature-level information poses potential privacy leakage. FedAvP only shares the augmentation policy which is not related to the data. This method leverages the first-order information as a replacement to reduce privacy leakage and communication costs. Comprehensive experiments demonstrate the efficacy and efficiency of FedAvp.

STRENGTHS:
- Empirical evidence shows that the proposed method is effective in enhancing model performance.
- This method avoids the privacy leakage of the information-sharing strategy.
- This method can be deployed on different methods.

WEAKNESSES:
- The writing of this paper should be improved to express ideas clearly.
- A deeper analysis is needed to reveal why different $\alpha$ learn different augmentation methods under the same data as depicted in Figure 1. There is also no in-depth insight about how the different augmentation influences the performance in different FL setting

QUESTIONS:
- As FedAvp is also a learning policy for augmentation strategy. So whats the performance of FedAvg+AutoAugment which is also an automation policy?
- What is the meaning of OOD client is not mentioned.
- This paper claims that the reported accuracy is calculated as the weighted average of each client’s accuracy by the number of data points they have. However, most of the methods report the accuracy of global model. How the test dataset is partitioned of each client?

LIMITATIONS:
See weakness.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 2
DATE: 2024-07-09

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper introduces a novel federated data augmentation algorithm, FedAvP, designed for data augmentation of the client-side without the need to share client data information. Specifically, the authors propose a meta-learning method that allows multiple clients to collaboratively learn data augmentation policies and design a Federated Meta-Policy Loss (FMPL) for the optimization of data augmentation policies. Moreover, to prevent the gradient updates of the data augmentation policies from leaking local data privacy, they propose using first-order approximation optimization to protect privacy and reduce communication costs. Finally, the authors conducted experiments in different data heterogeneity scenarios across multiple datasets to validate the effectiveness of the method.\n\nSTRENGTHS:\n1) The paper innovatively applies the method of automatic data augmentation using policy loss to the federated learning scenario, to mitigate the data heterogeneity issues faced by federated learning.\n2) The paper provides theoretical proof for the proposed method, and validates its effectiveness through performance experiments, privacy protection experiments, and cost experiments.\n3) The paper is logically coherent and well-organized.\n4) The method of multiple clients collaboratively learning automatic data augmentation policies may provide new research ideas for dealing with data heterogeneity issues in federated learning.\n\nWEAKNESSES:\n1) The augmentation policy search method in the paper only supports image data augmentation and includes only two types of augmentation methods. Moreover, as the number of augmentation methods increases, the search space will grow exponentially. The authors should analyze the scalability of FedAvP in this regard.\n2) The paper lacks comparisons with the latest federated data augmentation methods, and there are few non-iid scenarios involved in the performance experiments, with only one scenario on some datasets.\n\nQUESTIONS:\n1. Why were the performance experiments on the Cifar-10, SVHN, and FEMNIST datasets only conducted in one scenario?\n2. The gradient calculation of the policy loss introduces significant additional overhead. Could this be a hindrance to applying this method to larger visual pre-training models like ViT?\n\nLIMITATIONS:\nThe method proposed in the paper seems to be applicable only for federated training of small-scale visual models. Its performance on tasks involving text, speech, or multi-modalities and larger-scale models still needs to be further validated.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-12"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes FedAvP, which performs data augmentation search by sharing policies among clients in a federated learning (FL) environment. They introduce federated meta-policy loss and utilize the first-order gradient information to further enhance privacy and reduce communication costs. The proposed algorithm allows for rapid adaptation of a personalized policy by each client, relieving the challenge of non-iid.\n\nSTRENGTHS:\n1. This paper proposes a novel federated data augmentation algorithm that shares only the augmentation policies during training. It allows to augment the data without revealing data privacy. \n\n2. Although FedAvP will introduce some additional computation and communication costs, they introduce various techniques to overcome like first-order approximation and fast update.\n\n3. The experiments are well done, and there were experimental data for all possible judging criteria. My concern is that the number of datasets is somewhat limited.\n\n4. This paper is logically clear, and describes the possible problems and solutions one by one, which is easy to understand.\n\nWEAKNESSES:\n1. If the focus of this paper is on addressing non-iid using data augmentation, then the baselines used for comparisons are actually lacking. Classic methods for addressing non-iid, such as FedNova and Scaffold, have not been compared.\n2. Additionally, to address the non-iid problem, it would be helpful to have some more vivid and intuitive explanations of why the shared policy can alleviate the non-iid issue.\n3. One weakness affecting readability is that when the article references some inspired works to address certain issues, it opts for direct citations without more detailed explanations, such as gradient clipping and the reweighting in Eq. (3).\n\nQUESTIONS:\n1. Regarding W2, could you please add more intuitive explanations of the shared policy strategy?\n\n2. Regarding W3, could you please explain what is the advantage of the reweighting in Eq.(3)?\n\nLIMITATIONS:\nThe authors provide discussions on the limitations of the work in Sections 5.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-13"}