Paper:
Federated learning is a recent advance in privacy protection. In this context, a trusted curator aggregates parameters optimized in decentralized fashion by multiple clients. The resulting model is then distributed back to all clients, ultimately converging to a joint representative model without explicitly having to share the data. However, the protocol is vulnerable to differential attacks, which could originate from any party contributing during federated optimization. In such an attack, a client's contribution during training and information about their data set is revealed through analyzing the distributed model. We tackle this problem and propose an algorithm for client sided differential privacy preserving federated optimization. The aim is to hide clients' contributions during training, balancing the trade-off between privacy loss and model performance. Empirical studies suggest that given a sufficiently large number of participating clients, our proposed procedure can maintain client-level differential privacy at only a minor cost in model performance.

Review:
The main claim the authors make is that providing privacy in learning should go beyond just privacy for individual records to providing privacy for data contributors which could be an entire hospital. Adding privacy by design to the machine learning pipe-line is an important topic. Unfortunately, the presentation of this paper makes it hard to follow. 
Some of the issues in this paper are technical and easy to resolve, such as citation format (see below) or consistency of notation (see below). Another example is that although the method presented here is suitable only for gradient based learning this is not stated clearly. However, other issues are more fundamental:
1.	The main motivation for this work is providing privacy to a client which could be a hospital as opposed to providing privacy to a single record – why is that an important task? Moreover, there are standard ways to extend differential privacy from a single record to a set of r records (see dwork & Rote, 2014 Theorem 2.2), in what sense the method presented here different than these methods?
2.	Another issue with the hospitals motivation is that the results show that when the number of parties is 10,000 the accuracy is close to the baseline. However, there are only 5534 registered hospitals in the US in 2018 according to the American Hospital Association (AHA): https://www.aha.org/statistics/fast-facts-us-hospitals. Therefore, are the sizes used in the experiments reasonable?
3.	In the presentation of the methods, it is not clear what is novel and what was already done by Abadi et al., 2016
4.	The theoretical analysis of the algorithm is only implied and not stated clearly
5.	In reporting the experiment setup key pieces of information are missing which makes the experiment irreproducible. For example, what is the leaning algorithm used? If it is a neural network, what was its layout? What type of cross validation was used to tune parameters?
6.	In describing the experiment it says that “For K\in\{1000,10000} data points are repeated.” This could mean that a single client holds the same point multiple times or that multiple clients hold the same data point. Which one of them is correct? What are the implications of that on the results of the experiment?
7.	Since grid search is used to tune parameters, more information is leaking which is not compensated for by, for example, composition bounds
8.	The results of the experiments are not contrasted against prior art, for example the results of Abadi et al., 2016.
Additional comments
9.	The introduction is confusing since it uses the term “federated learning” as a privacy technology. However federated learning discusses the scenario where the data is distributed between several parties. It is not necessarily the case that there are also privacy concerns associated, in many cases the need for federated learning is due to performance constraints.
10.	In the abstract the term “differential attacks” is used – what does it mean?
11.	“An independent study McMahan et al. (2018), published at the same time”- since you refer to the work of McMahan et al before your paper was reviewed, it means that the work of McMahan et al came out earlier.
12.	In the section “Choosing $\sigma$ and $m$” it is stated that the higher \sigma and the lower m, the higher the privacy loss. Isn’t the privacy loss reduced when \sigma is larger? Moreover, since you divide the gradients by m_t then the sensitivity of each party is of the order of S/m and therefore it reduces as m gets larger, hence, the privacy loss is smaller when m is large. 
13.	At the bottom of page 4 and top of page 5 you introduce variance related terms that are never used in the algorithm or any analysis (they are presented in Figure 3). The variance between clients can be a function of how the data is split between them. If, for example, each client represents a different demography then the variance may be larger from the beginning.
14.	In the experiments (Table 1), what does it mean for \delta^\prime to be e-3, e-5 or e-6? Is it 10^{-3}, 10^{-5} and 10^{-6}?
15.	The methods presented here apply only for gradient descent learning algorithms, but this is not stated clearly. For example, would the methods presented here apply for learning tree based models?
16.	The citations are used incorrectly, for example “sometimes referred to as collaborative Shokri & Shmatikov (2015)” should be “sometimes referred to as collaborative (Shokri & Shmatikov, 2015)”. This can be achieved by using \citep in latex. This problem appears in many places in the paper, including, for example, “we make use of the moments accountant as proposed by Abadi et al. Abadi et al. (2016).” Which should be “we make use of the moments accountant as proposed by Abadi et al. (2016).” In which case you should use only \cite and not quote the name in the .tex file.
17.	“We use the same deﬁnition for differential privacy in randomized mechanisms as Abadi et al. (2016):” – the definition of differential privacy is due to Dwork, McSherry, Nissim & Smith, 2006
18.	Notation is followed loosely which makes it harder to follow at parts. For example, you use “m_t” for the number of participants in time t but in some cases,  you use only m as in “Choosing $\sigma$ and $m$”.
19.	In algorithm 1 the function ClientUpdate receives two parameters however the first parameter is never used in this function. 
20.	Figure 2: I think it would be easier to see the results if you use log-log plot
21.	Discussion: “For K=10000, the differrntially private model almost reaches accuracies of the non-differential private one.” – it is true that the model used in this experiment achieves an accuracy of 0.97 without DP and the reported number for K=10000 is 0.96 which is very close. However, the baseline accuracy of 0.97 is very low for MNIST.
22.	In the bibliography you have Brendan McMahan appearing both as Brendan McMahan and H. Brendan McMahan
It is possible that underneath that this work has some hidden jams, however, the presentation makes them hard to find.