Title: Convergent Differential Privacy Analysis for General Federated Learning
Venue: NeurIPS 2025
Accepted: no
Keywords: Federated learning

differential privacy
Abstract: The powerful cooperation of federated learning (FL) and differential privacy (DP) provides a promising paradigm for the large-scale private clients. However, existing analyses in FL-DP mostly rely on the composition theorem and cannot tightly quantify the privacy leakage challenges, which is tight for a few communication rounds but yields an arbitrarily loose and divergent bound eventually. This also implies a counterintuitive judgment, suggesting that FL-DP may not provide adequate privacy support during long-term training under constant-level noisy perturbations, yielding discrepancy between the theoretical and experimental results. To further investigate the convergent privacy and reliability of the FL-DP framework, in this paper, we comprehensively evaluate the worst privacy of two classical methods under the non-convex and smooth objectives based on the $f$-DP analysis. With the aid of the shifted interpolation technique, we successfully prove that privacy in {\ttfamily Noisy-FedAvg} has a tight convergent bound. Moreover, with the regularization of the proxy term, privacy in {\ttfamily Noisy-FedProx} has a stable constant lower bound. Our analysis further demonstrates a solid theoretical foundation for the reliability of privacy in FL-DP. Meanwhile, our conclusions can also be losslessly converted to other classical DP analytical frameworks, e.g. $(\epsilon,\delta)$-DP and R$\acute{\text{e}}$nyi-DP~(RDP), to provide more fine-grained understandings for the FL-DP frameworks.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nTo narrow the gap between the theoretical privacy guarantee and the empirical privacy guarantee of FL-DP framework, this paper established sharper privacy bounds for two federated learning algorithms i.e., noise-FedAvg and noise-FedProx, under non-convex and smooth losses based on the $f$-DP. Inspired by the shifted interpolation technique used in the f-DP analysis for centralized noise gradient descent and its variants, this paper extends this technique to federated learning and proves that the noise-FedAvg and noise-FedProx enjoy a tight convergent lower bound and a constant lower bound, respectively. The theoretical analyses and results are also verified on a series of experiments.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths: \n\nThis paper established sharper privacy bounds for two FL-DP algorithms, resolving an important open problem on the privacy guarantee of FL-DP framework. I believe this makes significant contributions to the federated learning community. \n\nWeaknesses.  \n\nThere is a lack of analysis on the convergence rate to a stationary point for the noise-FedAvg and noise-FedProx algorithms. It is known that there is a trade-off between the privacy and utility in differential privacy algorithms. Although this paper established sharper privacy bounds on the noise-FedAvg and noise-FedProx algorithms, it is unclear what the convergence rates to a stationary point are for the two algorithms. For example, in Theorem 3, this paper gives various privacy lower bound by tuning the learning rates of noise-FedAvg. However, there is a lack of convergence rates under various learning rates.\n\nQUESTIONS:\nThere are many federated learning algorithms that have been proved to converge faster than FedAvg, such as SCAFFOLD [1], FedAdam, FedAdagrad [2]. FedProx is a personalized federated learning algorithm, thereby being significantly different from standard federated learning algorithms, such as FedAvg, SCAFFOLD. Why did this paper select noise-FedAvg and noise-FedProx as examples, rather than noise-SCAFFOLD or noise-FedAdam? Can the current privacy analysis be extended to the other noised federated learning algorithms? In my opinion, it would be better to prove that there exists a noise-SCAFFOLD, or a noise-FedAdam that attains a strong privacy guarantee.\n\nReferences\n\n[1]Karimireddy et al. SCAFFOLD: Stochastic Controlled Averaging for Federated Learning. ICML, 2020.\n\n[2]Reddi et al. Adaptive Federated Optimization. ICLR, 2021.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-15"}

comments: SUMMARY:
The paper provides a theoretical analysis for differential privacy in federated learning. Based on f-DP analysis, the paper evaluates the worst privacy of DP-FedAvg and DP-FedProx. Specifically, the paper adopts the shifted interpolation sequence to enable a privacy amplification analysis and analyze the global sensitivity. Compared with other studies, the paper is the first to provide a convergent DP analysis for non-convex functions in DP federated learning.

STRENGTHS AND WEAKNESSES:
Strengths:
1. The paper provides the first convergent DP analysis in DP-FL methods with non-convex functions.
2. The analysis includes different kinds of learning rate decaying policies for DP-FedAvg.
3. The results can be converted to other DP analytical frameworks.


Weaknesses:
1. The analysis assumes the full-participation setting, while client sampling is usually adopted in federated learning.
2. The paper does not introduce any new techniques for DP analysis.
3. The challenges of analyzing DP-FL with f-DP is unclear.

QUESTIONS:
1. Could the proposed analysis be extended to the client sampling setting?
2. What are the main challenges when adopting f-DP and shifted interpolation technique to analyze DP-FL?
3. Is there any new insight for analyzing DP-FL?

LIMITATIONS:
The analysis assumes the full-participation setting in federated learning. However, client sampling is usually adopted.
TITLE: Official Review
CLARITY: 2
IMPACT: 3
ORIGINALITY: 2
DATE: 2025-06-28

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper tackles a long-standing open question in DPFL: whether a constant noise variance can still guarantee privacy when training runs for arbitrarily many communication rounds.\nUsing the shifted interpolation technique, the authors derive tight, convergent privacy lower bounds for two canonical algorithms: \n- Noisy-FedAvg: under four learning-rate schedules\n- Noisy-FedProx: showing the proximal term $\\alpha$ yields privacy that converges to a constant independent of the local-update interval $K$.\nThey also provide empirical studies on MNIST and CIFAR-10 that verify the bounded global sensitivity predicted by the theory.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths & Contributions\n\n\n- First stable privacy bound for non-convex FL\n- Splitting global sensitivity into data and model terms yields intuitive, tunable bounds\n- Experiments on MNIST/CIFAR-10 verify bounded global sensitivity and the effect of parameters. \n\n\nLimitations & Weaknesses\n\n- The condition $\\alpha>L$ (Theorem 4) seems a little strong. Can some comments address what would happen otherwise? Also, in the experiments, the optimality is taken at, for instance in Table 5, $\\alpha = 0.1$, which is a quite small value and seems impossible for $L$. \n- All runs use fewer than 100 clients and vision data. Moreover, the authors claim a theoretical relationship between privacy and client number $m$, but only reported $m\\in \\{50, 100\\}$ in experiments. More validation would be more convincing. \n- The analysis relies largely on an application of the shifted interpolation technique on the federated setting.\n\nQUESTIONS:\n- How big is the loss when you force $t_{0}=0$ in the $\\lambda_{t}$ optimisation? Does this gap fade as the ratio $T/t_{0}$ gets large?\n- If each client picks its own $\\alpha$, does the nice independent of $K$ privacy result still hold?\n- Can some comments be given about possibilities in incorporating adaptive per-round clipping into current sensitivity analysis?\n- Can more validation regarding $m$ be provided (more different values of $m$). See also the Weakness part. \n- Can some comments address what would happen if $\\alpha<L$ and possibilities to avoid the condition? See also the first point of Weakness. \n\n\nMinor points:\n- Line 263, a typo for $m=20$?\n\nLIMITATIONS:\nThis is a theoretical work with no obvious limitation.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-07-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper addresses a limitation in the analysis of privacy guarantees in Federated Learning with Differential Privacy (FL-DP). It challenges the common belief that privacy bounds necessarily diverge over time. By applying f-DP and a shifted interpolation technique, the authors analyze the privacy of Noisy-FedAvg and Noisy-FedProx under non-convex settings. The authors theoretically demonstrate that these methods can achieve convergent privacy bounds — a claim that prior composition-based analyses fail to provide. The authors support their theory with empirical evaluations of sensitivity and accuracy under different configurations.\n\nSTRENGTHS AND WEAKNESSES:\nStrength – Quality & Rigor: The paper is technically solid and presents a rigorous theoretical analysis. It builds on state-of-the-art privacy tools — the f-DP framework and shifted interpolation method — which together provide a tight characterization of privacy loss. The proofs appear correct and are grounded in recent advances (e.g. using the exact composition in f-DP instead of loose $(\\epsilon,\\delta)$ composition). The authors carefully handle the complexities of federated settings (like multi-step local updates and heterogeneous data) that previously foiled direct analysis. The theoretical results are clearly stated (with theorems for each scenario and a helpful summary table) and are novel in that they cover non-convex objectives and realistic FL settings. The quality of writing and organization is good – the paper motivates the problem clearly in the introduction.\n\nStrength – Significance: This work addresses a previously unresolved question: Can federated learning with noise maintain privacy guarantees indefinitely? The findings may be meaningful to the FL and DP communities. By refuting the “divergent $\\epsilon$” issue, the paper instills confidence that deploying DP in federated training is viable for many rounds – bridging a gap between theory and the encouraging empirical evidence. It also provides practical insights: for instance, the result that adding a proximal term (FedProx) yields strictly better privacy at little cost is valuable for practitioners designing private FL algorithms. \n\nStrength – Clarity: The paper is generally well-written and structured. The authors articulate the privacy problem and their solution approach in a way that readers (familiar with DP) can follow. Mathematical notations (like trade-off functions $T(P;Q)$) are defined, and important assumptions (L-smoothness, clipping norm, noise variance) are stated clearly. The inclusion of multiple learning rate scenarios and discussion of each in the theorems improves clarity, as it shows how different training strategies affect privacy. \n\nWeakness – Originality: The main concern is that the methodological novelty is limited. The core analytical tools employed — f-DP (trade-off function approach) and the shifted interpolation technique — are not introduced by this paper but by prior works (Dong et al., 2022; Bok et al., 2024). Essentially, the authors apply these existing techniques to the federated learning setting, instead of developing a fundamentally new privacy analysis method. While doing so is non-trivial (due to new challenges like client heterogeneity and local steps) and the paper is the first to handle the FL case, one could view the contribution as an incremental extension of earlier analyses of DP-SGD. Indeed, recent research has already shown convergent privacy loss for centralized DP-SGD under various conditions: e.g., Altschuler & Talwar (2022) and Ye & Shokri (2022) proved convergent bounds for convex problems, and very recently Chien & Li (ICLR 2025) extended this to non-convex, non-smooth losses in the single-machine (non-federated) scenario (https://openreview.net/pdf?id=kjmLabjSE2#:~:text=with%20respect%20to%20the%20number,Our%20analysis%20relies%20on). Compared to those, this work focuses on the federated multi-client scenario. Thus, the novelty lies in tailoring known techniques to FL and examining FedProx’s effect, rather than inventing new theory from scratch. This is a modest advance in originality.\n\nWeakness – Empirical Evaluation: While the experiments support the theoretical claims, their scope is somewhat limited. The authors validate the key insights on vision datasets (MNIST, CIFAR-10) with relatively simple models, which is a good start, but the evaluation could be more comprehensive. For instance, all experiments fix a total of $T \\times K = 30000$ iterations; this ensures a baseline for comparison, but it would be interesting to see privacy/utility trade-offs for truly long training (very large $T$) explicitly, or on more complex tasks (e.g., NLP or large-scale federated benchmarks). Additionally, the paper does not report actual $(\\epsilon,\\delta)$ values or compare against classical composition bounds in the experiments. It would strengthen the work to empirically demonstrate how much tighter the new analysis is – e.g., by showing that for a given $\\delta$, the effective $\\epsilon$ under the new analysis is significantly lower than that predicted by a moments accountant or RDP composition after the same training duration. The current experiments focus on accuracy and sensitivity metrics, which are proxy indicators; including a direct comparison of privacy budgets would highlight the practical improvement. The absence of such evaluations leaves a slight gap in quantifying the benefit. Finally, the datasets used are IID or Dirichlet-split with relatively few clients (at most 100) – exploring more heterogeneous or larger-scale federated settings (as done in some FL-DP literature) could further convince readers of the broad applicability. These omissions, however, are not fundamental flaws but areas where the evaluation could be more exhaustive.\n\nQUESTIONS:\nQ1 - How do the contributions of this paper go beyond prior analyses of DP-SGD, and what is truly novel in the FL context? The paper leverages the f-DP framework and shifted interpolation technique introduced by others. Works like Ye & Shokri (2022) and Altschuler & Talwar (2022) already showed convergent privacy for (strongly) convex losses, and a recent result by Chien & Li (2025) proved a convergent RDP bound for non-convex DP-SGD without smoothness assumptions. The authors should clarify exactly what new challenges are solved here that were not in those works. For example, does the multi-client, multi-step setting require new lemmas or insights beyond a straightforward combination of known results? Is the FedProx analysis (with a constant lower bound on ε) entirely novel? A detailed discussion of how this work differs from and improves upon concurrent works (especially in handling client heterogeneity or proving Theorem 4 for FedProx) would strengthen the paper’s originality.\n\nQ2 - In Section 4.3, the analysis introduces an optimization problem to bound the trade-off function and then makes a relaxation (using $H_0$ in place of the intractable $H^*$) to obtain a solvable form. Could the authors clarify the impact of this relaxation on the final privacy bound? Is the resulting bound provably tight (i.e., matches the true worst-case privacy loss) or is there a gap? The paper claims the relaxed solution $H_0$ still achieves a convergent constant privacy loss, but it’s not clear if this is merely an existence proof or a tight characterization. For example, if one were to compute the exact privacy loss via another method, would it match the expressions in Table 1? Understanding this is important for trusting the results – if the relaxation introduces only negligible looseness, that’s fine, but if it’s significantly loose, the “tight convergent bound” claim might need nuance. A clear explanation (perhaps with theoretical or empirical evidence of tightness) would increase my confidence in the results. \n\nQ3 –The experimental results are encouraging, but I have suggestions to bolster them. (a) Can the authors provide a comparison to classical privacy accounting in the experiments? For instance, take one of the FL setups and compute the $(\\epsilon,\\delta)$ after T rounds using the Moments Accountant or RDP composition, and compare it to the $\\epsilon$ predicted by their f-DP analysis (converted to $(\\epsilon,\\delta)$). This would empirically demonstrate the improvement in the privacy bound (e.g., showing that naive composition might give $\\epsilon > 10$ while the new method gives a bounded $\\epsilon \\approx 2$ for large $T$, hypothetically). (b) Consider evaluating on a larger scale or different domain, if possible. The current experiments use at most 100 clients and relatively small models; would the privacy convergence hold in, say, a language modeling task with hundreds of clients, or an image classification with a deeper network? While I understand resource and space constraints, even a discussion of this (or simulated results) would be valuable. \n\nQ4 –The analysis reveals interesting trade-offs, particularly with the proximal coefficient α in FedProx. The experiments (Table 5 and Fig.2d) show that larger α drastically reduces sensitivity (hence improves privacy) but can hurt accuracy if α is too large. Could the authors comment on how to choose α optimally in practice? Is there a recommended range where we get most privacy benefit with minimal accuracy drop (e.g., α≈0.1 in their CIFAR-10 experiment improved privacy a lot with negligible accuracy loss)? This guidance would help practitioners balance the utility-privacy trade-off using FedProx. Similarly, for Noisy-FedAvg, do the results suggest an optimal clipping norm $V$ or number of local steps $K$ to use from a privacy perspective (since $V$ and $K$ affect the bounds)? Any intuition or recommendations here would enhance the practical relevance of the theory.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 4, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-07-02"}