Paper: Privacy-Preserving Data Quality Evaluation in Federated Learning Using Influence Approximation (ICLR-2024)

Reviewer comment (Theory):
Theoretical analysis, or some kind of high level intuition for the proposed method is highly appreciated. For instance, why can the proposed method work in non-IID settings? What type of data can be filtered out by the proposed method? Currently it is not clear to me why or when the proposed method can work.

Author response:
The high-level intuition behind why our proposed method works in a Non-IID setting is that based on the votes two clusters will form, one cluster with a lower average (the corrupted data) and the other with a higher average of votes. Empirically we have shown that this is the case.

Reviewer comment (Experiments):
Data collection is very challenging for federated learning. In the proposed method, data is further split into training data and validation data. Will this hurt the performance of the model? For instance, if we just use all the data for training, will this be a much stronger baseline? In the current setting 1/3 data is used for validation. More justification is appreciated for this setup.

Author response:
The training and validation data don't have to be mutually exclusive. We just require some kind of baseline to evaluate model updates provided by other devices.

Reviewer comment (Theory):
Scalability seems to be a question. Say there are $n$ parties. Compared to standard federated algorithm like FedAvg, each party needs to conduct $n$ times more validation computation. And the overall communication seems to scale in $O(n^2)$ since essentially every pair of parties need to communicate with each other.

Author response:
We solve the scalability issue by proposing a few solutions:
    a) Take a subset of devices k reducing the complexity to O(nk),
    b) Only run the algorithm to verify devices once when they want to join the federation,
    c) Only run the algorithm when the model performance stops improving or degrades.

Reviewer comment (Novelty):
Sign SGD [1] seems to be a related reference and needs to be cited.

Author response:
We would like to thank the reviewer for their suggestion

Reviewer comment (Experiments):
Is the overall distribution of training data and test data identical? If not, then it is not clear why validation data can be helpful for filtering training data.

Author response:
The overall distribution of the test and training data is only identical in the IID setting. When considering a Non-IID setting each device has its own training distribution, while the test data used to evaluate the global model is uniform from all classes.

Reviewer comment (Experiments):
It is not clear whether the baselines in the experiments are also privatized or not.

Author response:
The baselines are not privatized. The only privatization applied in this paper is for the lazy influence evaluation scheme.

Reviewer comment (Theory):
The output of the validation being private is said to prevent other users from tailoring their updates to the validation data, but from adaptive data analysis we know such protection only holds for a limited number of interactions. It is unclear how many rounds of interactions/validation this approach can tolerate given, for example, \( n \) validation examples. This is important because the number of interactions with each user's hold-out validation data seems to scale with the total number of users, which could be much larger than the amount of validation data a single user has.

Author response:
This is a good question, if we were to run our proposed method every iteration this would become a problem. We have not analyzed this scenario yet and would like to thank you for pointing this out.

Reviewer comment (Theory):
Other work in this area may eliminate "minority" distributions due to their large distance relative to other model updates, but it is unclear why this would not also occur in the presented setting. For instance, if a user’s data comes from a minority distribution, the majority-distribution users might vote negatively for its update, leading to its omission.

Author response:
This is correct if the device has no other devices that share any similarity in distributions. Given a more realistic scenario where there is a small minority instead of a single device, the algorithm can potentially differentiate them from uninformative data. However, more experiments need to be conducted in this scenario to say for certain.

Reviewer comment (Theory):
The text mentions that LDP is a generalization of DP, but it is unclear if “generalization” is the correct term to describe this relationship.

Author response:
You are completely right, we will correct the wording.

Reviewer comment (Writing):
In the challenges section, the Koh & Liang (2017) result is said to require \( O(p) \) operations, but \( p \) is not defined anywhere.

Author response:
We apologize for forgetting to include what p is, it represents the number of parameters of the model.

Reviewer comment (Theory):
In the paragraph after Figure 2, it is mentioned that even under really strict privacy guarantees, the aggregated influence signs will match the true value in expectation. The reviewer is unsure how to interpret this sentence. The reviewer interprets it as \(\sum_i \mathbb{E}[v_i'] = \sum_i v_i\), which is not correct; rather, \(\sum_i \mathbb{E}[v_i'] = (1-p) \sum_i v_i\).

Author response:
To clarify, we meant with that statement that the sign of the aggregated influence signs will match the sign of true value in expectation.

Reviewer comment (Presentation):
In Figure 3, the meaning of "communication rounds" is unclear. For example, does it mean that for 25 rounds all users have sent their proposed updates to the server?

Author response:
The communication rounds are standard FL communication rounds, which have been performed with a subset of agents. This subset of agents consists of agents who have successfully passed the filtration.

Reviewer comment (Theory):
McMahan et al. 2017 proposed User-level DP and RAPPOR provides local differential privacy. Therefore, in the proposed method, what is the level of privacy that you are providing?

Author response:
We provide 2 levels of privacy:
      a) User-level DP for the transmitted gradient update which is used to evaluate the device quality.
      b) RAPPOR to make the client votes differentially private.

Reviewer comment (Experiments):
Since using the proposed method from McMahan et al. 2017, the gradients are clipped which will clip out the information induce from local data. Therefore, the data filtering process might filter out important data points. What is the impact of the clipping bound toward the data filtering process?

Author response:
The effect of the clipping in our proposed method is the loss of quality evaluation accuracy. To combat this we require a larger amount of devices to maintain the same level of filtering accuracy, as can be seen in Figure 4.