# Privacy-Preserving Federated Singular Value Decomposition
## 6 Empirical Comparison  
In order to compare our proposed schemes with FedPower, we implement the schemes in Python [36]. As we only encrypt 0 and 1 in Section 4, we optimize the performance and take advantage of the utilized Paillier cryptosystem. More specifically, we re-randomize the corresponding ciphertexts to obtain new ciphertexts. In addition, we also exploit the homomorphic property, and instead of decrypting each value (\(d\times r\times|number\ of\ node\ devices\) times), we first calculate the product of all the ciphertexts (elementary matrix multiplication) and then perform the decryption on a signal matrix. In this way, we obtain the sum of all Gaussian noises more efficiently. The decryption result is the sum of noise which will be canceled in Algorithm 2. Furthermore, we prepare the \(\mathbb{M}_{i}^{t}=\frac{1}{s_{i}}\mathbb{M}_{i}^{T}\mathbb{M}_{i}\), \(\mathbb{Z}_{0}^{(i)}\) and all keys of SA offline for each node device \(i\). **Metric. ** We use Euclidean distance to represent the similarity of two \(m\times n\) matrix \(\mathbb{A}=(a_{ij})\) and \(\mathbb{B}=(b_{ij})\), i.e., \(dist(\mathbb{A},\mathbb{B})=\sqrt{\sum_{i=1}^{n}\sum_{j=1}^{n}\left(a_{ij}-b_{ ij}\right)^{2}}\). Let \(\mathbb{Z}\) denote the true eigenspace computed without any noise, let \(\mathbb{Z}_{g}(\sigma,\sigma^{\prime})\) denote the eigenspace generated with Algorithm 1, let \(\mathbb{Z}_{u}(\sigma)\) denote the eigenspace generated with Algorithm 2, and let \(\mathbb{Z}_{p}(\sigma)\) denote the eigenspace generated with Algorithm 3. **Setup. ** For our experiments, we used the well-known NETFLIX rating dataset [37], and we pre-process it similarly to [38] (instead of 10, we removed users and movies with less than 50 ratings). It consists of 96.310.835 ratings corresponding to 17.711 movies from 324.468 users. We split them horizontally into 100 random blocks to simulate node devices. Moreover, we set the security parameter to 128; thus, we adopt 3072 bits for \(N\) in Paillier cryptosystem (this is equivalent to RSA-3072, which provides a 128-bit security level [39]). The number of iteration rank and top eigenvectors is set to \(r=k=10\), and we keep the same synchronous trigger \(p=4\) as [18]. To compare FedPower with our enhanced solutions, we set the noise size for these algorithms as \(\sigma=\sigma^{\prime}=0.1\). Moreover, for Algorithm 3 we bounded \(\mathbb{M}_{i}^{\prime}\) with 0.05 and \(\mathbb{Z}_{t}^{(i)}\) with 0.2 for all possible \(i\) and \(t\). Using Theorem 2, we can calculate that a single round corresponds to privacy budget \(\epsilon=30.6\) with \(\delta=10^{-5}\). In order to determine the number of global rounds \(T\), we set up a small experiment. We built a data matrix \(\mathbb{M}\) of size \(3000\times 100\) filled with integers in \([0,5]\), and randomly divided it for 100 node devices (each has at least 10 rows). We executed Algorithm 1 for 200 rounds and compared the distance between the aggregation result \(\mathbb{Z}\) and the real singular values of \(\mathbb{M}\). From the result in Figure 2, we can see that convergence occurs around the round 92, since the subsequent results vary only slightly (\(<\)1%). Thus, we set \(T=92\) for our experiments. The experiment is implemented in a Docker container of 40-core Intel(R) Xeon(R) Silver 4210 CPU @ 2.20 GHz and 755G RAM. We run our experiments 10-fold and take the average execution time. **Results. ** Firstly, we compare the efficiency of our enhanced schemes and the original algorithm. The computation times are presented in Table 3. Compared with FedPower, the overall computation burden of the devices increased by a factor of \(\times 39.68\) for the utility-enhanced solution in Section 4 and only \(\times 1.74\) and the privacy-enhanced solution in Section 5. Concerning the server, the increase is \(\times 6.97\) and \(\times 1.17\), respectively.