Paper: Certifiably Byzantine-Robust Federated Conformal Prediction (ICLR-2024)

Reviewer comment (Theory):
It seems the results are derived based on either knowing the number of truthful agents or being able to consistently estimate this quantity. This could be a relatively strong assumption in reality.

Author response:
We thank you for the valuable comment. If the number of benign clients is overestimated, then there must be a portion of malicious clients in the output set of RobFCP $\mathcal{B}$. Those malicious clients will participate in the conformal calibration and distort the computed quantile value. In Theorem 6 in Appendix F, we added the analysis of this scenario. The theoretical results show that (1) compared to the bound with the correct number $K\_b$, the overestimate $K’\_b$ asymptotically looses the bound by a factor $1-K\_b/K’\_b$, and (2) a larger overestimate $K’\_b$ leads to worse coverage guarantees. If the number of benign clients is underestimated, we can always find a benign client not in the set $\mathcal{B}$, which makes the original proof smooth. Therefore, Theorem 1 and Corollary 1 still hold by plugging a smaller $K’\_b$ into the bound, but the coverage guarantee also becomes worse due the monotonicity regarding the number of benign clients $K\_b$.

Reviewer comment (Theory):
The assumption on bounded distribution disparity could be relatively strong. There would be the cases where the underlying distributions of different group of agents are not the same. In that case, this assumption can be easily violated.

Author response:
We thank you for your valuable comments and suggestions. We added clarifications and improvements of Rob-FCP for the non-IID setting from both the theoretical perspective and the evaluation perspective. 

From the perspective of theoretical analysis, we provide the coverage guarantees of Rob-FCP in the non-IID setting in Corollary 1 based on the assumption of bounded disparity among benign clients in Assumption 3.1. We added clarifications that the assumption is quite standard, typical, and not simplified across the literature of non-IID federated learning analysis [1] and Byzantine analysis [2,3]. Concretely, Li et al. [1] quantify the non-iid degree (i.e., disparity) of local loss of clients with $\Gamma$ in Section 3.1 of [1] and accordingly provide the convergence guarantee of federated optimization in Theorem 1 of [1], which is a function of the disparity $\Gamma$. Park et al. [2] assume a bounded difference $\rho_1$ between the local loss of benign clients and global loss in Assumption 2 of [2] and provide the convergence analysis in federated Byzantine optimization in Theorem 1 of [2] as a function of $\rho_1$. Data et al. [3] have an assumption of bounded gradient dissimilarity $\kappa$ in Assumption 2 of [3] and prove a convergence guarantee in Theorem 1 of [3] regarding $\kappa$. Similarly, in our paper, we assume a bounded disparity of score statistics quantified with $\sigma$ in Assumption 3.1 and accordingly provide the coverage guarantees of Rob-FCP in the non-IID setting in Corollary 1 as a function of $\sigma$. As we can see, the type of assumption is quite standard in the analysis setup of the line of non-IID analysis and Byzantine analysis. The assumption is also essential since without a quantity to restrict the disparity in local behavior, the local behavior can vary arbitrarily, and we can not control global performance quantitatively. From the results in Corollary 1, we can also see that as long as the disparity bound $\sigma$ is finite, the coverage bound in the non-IID setting is asymptotically valid and tight with sufficiently large benign sample sizes $n_b$. We added these clarifications and details in Section 3.3 in the revised manuscript.

Reviewer comment (Theory):
Could the authors establish some theoretical guarantees where the number of truthful agents is not correctly estimated? What will happen if they are underestimated or overestimated?

Author response:
We thank you for the valuable comment. If the number of benign clients is overestimated, then there must be a portion of malicious clients in the output set of RobFCP $\mathcal{B}$. Those malicious clients will participate in the conformal calibration and distort the computed quantile value. In Theorem 6 in Appendix F, we added the analysis of this scenario. The theoretical results show that (1) compared to the bound with the correct number $K\_b$, the overestimate $K’\_b$ asymptotically looses the bound by a factor $1-K\_b/K’\_b$, and (2) a larger overestimate $K’\_b$ leads to worse coverage guarantees. If the number of benign clients is underestimated, we can always find a benign client not in the set $\mathcal{B}$, which makes the original proof smooth. Therefore, Theorem 1 and Corollary 1 still hold by plugging a smaller $K’\_b$ into the bound, but the coverage guarantee also becomes worse due the monotonicity regarding the number of benign clients $K\_b$.

Reviewer comment (Experiments):
Could the authors also provide some numerical results to illustrate the sensitivity if the number of truthful agents is not correctly identified?

Author response:
We thank you for the valuable suggestion. In the following Table 3, we provided evaluations of Rob-FCP with incorrect numbers of malicious clients. The results show that either underestimated numbers or overestimated numbers would harm the performance to different extents. Specifically, an underestimate of the number of malicious clients will definitely lead to the inclusion of malicious clients in the identified set $\mathcal{B}$ and downgrade the quality of conformal prediction. On the other hand, an overestimated number will lead to the exclusion of some benign clients. The neglect of non-conformity scores of those clients will lead to a distribution shift from the true data distribution in the calibration process, breaking the data exchangeability assumption of conformal prediction, and a downgraded performance. Therefore, correctly estimating the number of malicious clients is of significance, and this is why we propose the malicious client number estimator, which is sound both theoretically and empirically to achieve the goal.

Table 3. Marginal coverage / average set size under different Coverage attack with underestimated and overestimated numbers of malicious clients on TinyImageNet. The true ratio of malicious clients is $40\%~(K_m/K=25\%)$, while we evaluate Rob-FCP with different ratios of malicious clients $K’_m/K$ ranging from $5\%$ to $45\%$. The desired marginal coverage is $0.9$. 

| | $K’_m/K=5\\%$ | $K’_m/K=10\\%$ | $K’_m/K=15\\%$ | $K’_m/K=20\\%$ | $K’_m/K=25\\%$ |  $K’_m/K=30\\%$ | $K’_m/K=35\\%$ | $K’_m/K=40\\%$ | $K’_m/K=45\\%$ |
| - | - | - | - | - | - | - | - | - | - |
| Marginal coverage / average set size | 0.8682 / 35.8754 | 0.8756 / 37.1307 | 0.8812 / 38.3729 | 0.8884 / 40.6433 | 0.9078 / 44.5781 | 0.8936 / 42.1735 | 0.8921 / 42.0232 | 0.8834 / 38.3463 | 0.8803 / 38.0232 |

Reviewer comment (Theory):
Again, as I mentioned in the weakness part, if the distributions of underlying agents are no-i.i.d., it is very likely that assumption 3.1 will be violated, even if the agents report the true non-conformity score. It seems the current algorithm may not handle this point very well.

Author response:
We thank you for the interesting question. We can actually think about the effectiveness of Rob-FCP in the non-IID setting from two perspectives. (1) If the malicious clients attempt to disturb the quantile value of conformity scores to a large extent, they need to report a score vector far away from the cluster of score vectors of benign clients. Although the benign score vectors have some heterogeneity, the malicious score vector in this case is still distinguishable in the vector space and effectively excluded during the calibration. (2) If the malicious clients report score vectors close to the cluster of benign score vectors, then even if the Rob-FCP algorithm does not identify malicious clients exactly, the malicious score vectors can also characterize the structure of the benign score cluster, and thus, the computed quantile value would not deviate much. The two situations are exactly the important intuitions in the proof of Theorem 1 and Corollary 1, which rigorously formulates the coverage guarantee of Rob-FCP as a function of the non-IID degree $\sigma$.

Reviewer comment (Experiments):
The main reason why the algorithm in the paper works seems to be due to the homogeneity of the non-malicious agents. Even in the experiments, the clients are partitioned randomly and hence their distributions will be pretty similar. However, as discussed even in the intro of the paper, there can be many settings where there is quite a bit of heterogeneity among the agents not due to their Byzantine and malicious behaviors but the underlying distributions are just inherently different. In fact, this heterogeneity seemed to me the motivation to studying this problem — i.e. the bolded sentences in the second paragraph of the intro. But the paper seems to study cases when there isn’t much heterogeneity?

Author response:
We thank you for your valuable comments and suggestions. We added clarifications and improvements of Rob-FCP for the non-IID setting from both the theoretical perspective and the evaluation perspective. 

From the perspective of theoretical analysis, we provide the coverage guarantees of Rob-FCP in the non-IID setting in Corollary 1 based on the assumption of bounded disparity among benign clients in Assumption 3.1. We added clarifications that the assumption is quite standard, typical, and not simplified across the literature of non-IID federated learning analysis [1] and Byzantine analysis [2,3]. Concretely, Li et al. [1] quantify the non-iid degree (i.e., disparity) of local loss of clients with $\Gamma$ in Section 3.1 of [1] and accordingly provide the convergence guarantee of federated optimization in Theorem 1 of [1], which is a function of the disparity $\Gamma$. Park et al. [2] assume a bounded difference $\rho_1$ between the local loss of benign clients and global loss in Assumption 2 of [2] and provide the convergence analysis in federated Byzantine optimization in Theorem 1 of [2] as a function of $\rho_1$. Data et al. [3] have an assumption of bounded gradient dissimilarity $\kappa$ in Assumption 2 of [3] and prove a convergence guarantee in Theorem 1 of [3] regarding $\kappa$. Similarly, in our paper, we assume a bounded disparity of score statistics quantified with $\sigma$ in Assumption 3.1 and accordingly provide the coverage guarantees of Rob-FCP in the non-IID setting in Corollary 1 as a function of $\sigma$. As we can see, the type of assumption is quite standard in the analysis setup of the line of non-IID analysis and Byzantine analysis. The assumption is also essential since without a quantity to restrict the disparity in local behavior, the local behavior can vary arbitrarily, and we can not control global performance quantitatively. From the results in Corollary 1, we can also see that as long as the disparity bound $\sigma$ is finite, the coverage bound in the non-IID setting is asymptotically valid and tight with sufficiently large benign sample sizes $n_b$. We added these clarifications and details in Section 3.3 in the revised manuscript.

From the evaluation perspective, we added more clarifications and illustrations on how we construct non-IID data of different levels and also added more evaluations on various approaches to non-IID data construction. We first added clarifications that we followed the standard evaluation setup of non-IID federated learning by sampling different label ratios for different clients from the Dirichlet distribution as the literature [4,5,6,7]. Concretely, we sample $p_{c,j} \sim \text{Dir}(\beta)$ and allocate a $p_{c,j}$ proportion of the instances with class $c$ to the client $j$. Here $\text{Dir}(·)$ denotes the Dirichlet distribution and $\beta$ is a concentration parameter ($\beta$ > 0). Dirichlet distribution is commonly used as the prior distribution in Bayesian statistics and is an appropriate
choice to simulate real-world data distribution. An advantage of this approach is that we can flexibly change the imbalance level by varying the concentration parameter $\beta$. If $\beta$
is set to a smaller value, then the partition is more unbalanced. We fixed the imbalance level $\beta$ as $0.5$ in the evaluations before the rebuttal period. Following the suggestion, we added evaluations with different imbalance levels $\beta$ to show the effectiveness of Rob-FCP under different non-IID settings. The results in the following Table 1 demonstrate that under multiple degrees of data imbalance in non-IID federated conformal prediction, Rob-FCP consistently outperforms FCP in achieving a nominal marginal coverage level in the existence of Byzantine clients. We also consider alternative approaches to construct non-IID data with demographic differences in federated learning. Concretely, we split the SHHS dataset by sorting five different attributes: wake time, N1, N2, N3, REM. For example, we first sort the instances according to the wake time of patients and then assign them to 100 clients in sequence. Therefore, some clients are assigned patients with an early wake time, and some are assigned instances with late wake time. The results in Table 2 show that in this type of non-IID partition, Rob-FCP still demonstrates robustness and effectiveness compared to FCP.

Reviewer comment (Theory):
It’s not clear to me what is exactly meant by the non-iid setting. Is it just that the agents’s non-conformal scores don’t come from the same distribution? However, the assumption that the v^(k) values (the histogram values) aren’t too different across agents in the non-iid setting essentially gives you an iid setting, right? I’m a little confused on the difference so it would be helpful to compare exactly the iid setting and the non-iid setting (along with other assumptions made for each setting) and how exactly they are really different.

Author response:
We consider the standard IID and non-IID settings in federated learning literature. Specifically, the data of local clients are sampled from the same data distribution in the IID setting, while the data of clients are sampled from different data distributions in the non-IID setting. In the context of federated conformal prediction, IID data samples among clients can imply the IID non-conformity scores of clients, which implies that the characterization vectors of scores are sampled from the same multinomial distribution. Similarly, non-IID data samples among clients can also imply the non-IID non-conformity scores of clients, which implies that the characterization vectors are sampled from different multinomial distributions. In Assumption 3.1, we quantify the maximum disparity of different multinomial distributions with $\sigma>0$, and a larger $\sigma$ can induce a larger non-IID degree. Note that $\sigma=0$ is equivalent to the IID setting because $\sigma=0$ implies that the parameters of multinomial distributions are the same: $\overline{\rm{v}}^{(k\_1)} = \overline{\rm{v}}^{(k\_2)}, \forall k\_1,k\_2$. To conclude, $\sigma=0$ in Assumption 3.1 formally defines the IID setting in the context of federated conformal prediction, while Assumption 3.1 with $\sigma>0$ defines the non-IID setting with non-IID degree $\sigma$.

Reviewer comment (Theory):
How’s the final (1-alpha)-quantile being calculated after identifying the benign clients? Is it simply combining all the clients non-conformal scores altogether and then calculating the (1-alpha)-quantile? If that’s the case, I’m not understanding the federated nature of this problem except for the fact that some of the clients data are being ignored due to their apparent distributional difference to other clients? How can one tell if this distributional difference of some clients is due to their malicious behavior or truly inherent distributional difference?

Author response:
We added clarifications that we did not combine all the non-conformal scores of clients  $\\{s_j^{(k)}\\}~(k \in {1,2,..,K})$ because sending all the conformity scores to the server is expensive and leak much information about local data samples in the federated setting. Therefore, we characterize the scores $\\{s_j^{(k)}\\}$ with a histogram statistics vector $v^{(k)}$, which computes score frequency in $H$ equally partitioned subintervals. The characterization vector $v^{(k)}$ has a much smaller dimension than the universal scores $\\{s_j^{(k)}\\}$ ($H \ll n_k$) and thus leaks much less private information during the communication between the server and clients.
The characterization vector is an approximation of the universal scores and can induce an approximation error of federated calibration, quantified by $\epsilon$ in Section 2.2. We also consider the influence of $\epsilon$ on the coverage guarantee in the Byzantine setting in Theorem 1 and Corollary 1, indicating a tradeoff between the tightness of conformal guarantee bound and the private information leakage/communication costs in federated settings.

We thank you for the interesting question. We can actually think about the effectiveness of Rob-FCP in the non-IID setting from two perspectives. (1) If the malicious clients attempt to disturb the quantile value of conformity scores to a large extent, they need to report a score vector far away from the cluster of score vectors of benign clients. Although the benign score vectors have some heterogeneity, the malicious score vector in this case is still distinguishable in the vector space and effectively excluded during the calibration. (2) If the malicious clients report score vectors close to the cluster of benign score vectors, then even if the Rob-FCP algorithm does not identify malicious clients exactly, the malicious score vectors can still characterize the structure of the benign score cluster, and thus, the computed quantile value would not deviate much. The two situations are exactly the important intuitions in the proof of Theorem 1 and Corollary 1, which rigorously formulates the coverage guarantee of Rob-FCP as a function of the non-IID degree $\sigma$.

Reviewer comment (Reproducibility):
A major weakness is that to calculate the vector distance $d_{k_1, k_2}$ in step 8 of the algorithm ("Algorithm 1 Identifying the malicious client"), we need to send all the vectors $v^{(k)}$ to the server. It seems to me that this step is very problematic in a federated learning context.

Author response:
> Q1: More clarifications of sending all the characterization vectors $v^{(k)}$ to the server in the federated setting. Is it possible to compute the vector distance with a federated algorithm?

We added clarifications that the characterization vector $v^{(k)}$ is proposed exactly for the federated setting to reduce the privacy leakage of local scores and reduce communication costs. Concretely, in the federated conformal prediction context, each client $k$ computes the conformity scores of its $n_k$ local data samples $\{s_j^{(k)}\}$. However, sending all the conformity scores $\{s_j^{(k)}\}$ to the server is expensive and leaks much information about local data samples. Therefore, we characterize the scores $\{s_j^{(k)}\}$ with a histogram statistics vector $v^{(k)}$, which computes score frequency in $H$ equally partitioned subintervals. The characterization vector $v^{(k)}$ has a much smaller dimension than the universal scores $\{s_j^{(k)}\}$ ($H \ll n\_k$) and thus leaks much less private information during the communication between the server and clients.
Thus, the characterization vector distance computation on the server side also obeys the principle of federated learning for privacy-preserving and communication efficiency. 
The characterization vector is an approximation of the universal scores and can induce an approximation error of federated calibration quantified by $\epsilon$ in Section 2.2. We also consider the influence of $\epsilon$ on the coverage guarantee in the Byzantine setting in Theorem 1 and Corollary 1, indicating a tradeoff between the tightness of conformal guarantee bound and the private information leakage/communication costs in federated settings.

Reviewer comment (Theory):
Another important weakness is that the bounds of Theorem 1 and Corollary 1 are in $1/(\min n_i)$. Therefore, if a non-malicious agent has only one data point, the bound does not improve, even if the other agents have an increasing number of data. This may just be due to an artifact of the proof or maybe we really can't do any better. This has to be proven (or at least discussed).

Author response:
> Q2: More discussions of the factor of the minimal sample size of benign clients $1/\min n_i$.

We thank you for the valuable comment. The appearance of $1/\min n_i$ is indeed due to the artifact of the proof. In the derivation from Equation (36) to Equation (37) in the proof of Theorem 1, we lower bound the total sample sizes in $\mathcal{B}$ (benign client set identified by Rob-FCP) with the minimal benign sample size $\min_{k’ \in [K_b]} n_{k’}$. We can definitely replace $\min_{k’ \in [K_b]} n_{k’}$ with the total sample sizes of $K_b-K_m$ benign clients with the smallest sample sizes, which leads to a tighter bound in many scenarios. This will introduce more complex notations, but it is only meaningful for some extreme cases. In practice, if a benign client has an extremely small sample size, then the characterization vector is almost useless for malicious client identification, and the influence on the conformal calibrated quantile is also negligible as FCP performs a weighted calibration based on sample sizes of clients. Therefore, for the extreme case of some benign clients with extremely small sample sizes (e.g., less than 10), it is more meaningful to discard their scores and apply Rob-FCP to the remaining clients, which is more beneficial to malicious client detection and only leads to negligible error for conformal calibration. We added the discussions to the remark of Theorem 1, which is similarly applied to Corollary 1.

Reviewer comment (Theory):
"marginal prediction coverage: ..." the definition is with an "inclusion".

Author response:
> Q5: Notation errors.

We thank you for pointing out the notation issues. We fixed the notation error of marginal coverage, $\mathcal{Q}_\lambda$, and $N_m$ in the revised manuscript.

Reviewer comment (Writing):
Mixture coefficients in the definition of $Q_{\lambda}$ are missing.

Author response:
> Q5: Notation errors.

We thank you for pointing out the notation issues. We fixed the notation error of marginal coverage, $\mathcal{Q}_\lambda$, and $N_m$ in the revised manuscript.

Reviewer comment (Writing):
Problem in the definition of $N_m$.

Author response:
> Q5: Notation errors.

We thank you for pointing out the notation issues. We fixed the notation error of marginal coverage, $\mathcal{Q}_\lambda$, and $N_m$ in the revised manuscript.

Reviewer comment (Reproducibility):
Is it possible to compute the vector distance $d_{k_1, k_2}$ with a federated algorithm?

Author response:
> Q1: More clarifications of sending all the characterization vectors $v^{(k)}$ to the server in the federated setting. Is it possible to compute the vector distance with a federated algorithm?

We added clarifications that the characterization vector $v^{(k)}$ is proposed exactly for the federated setting to reduce the privacy leakage of local scores and reduce communication costs. Concretely, in the federated conformal prediction context, each client $k$ computes the conformity scores of its $n_k$ local data samples $\{s_j^{(k)}\}$. However, sending all the conformity scores $\{s_j^{(k)}\}$ to the server is expensive and leaks much information about local data samples. Therefore, we characterize the scores $\{s_j^{(k)}\}$ with a histogram statistics vector $v^{(k)}$, which computes score frequency in $H$ equally partitioned subintervals. The characterization vector $v^{(k)}$ has a much smaller dimension than the universal scores $\{s_j^{(k)}\}$ ($H \ll n\_k$) and thus leaks much less private information during the communication between the server and clients.
Thus, the characterization vector distance computation on the server side also obeys the principle of federated learning for privacy-preserving and communication efficiency. 
The characterization vector is an approximation of the universal scores and can induce an approximation error of federated calibration quantified by $\epsilon$ in Section 2.2. We also consider the influence of $\epsilon$ on the coverage guarantee in the Byzantine setting in Theorem 1 and Corollary 1, indicating a tradeoff between the tightness of conformal guarantee bound and the private information leakage/communication costs in federated settings.

Reviewer comment (Theory):
The $\min{n_i}$ in the bound of Theorem 1 and Corollary 1 cannot be improved or is it just an artifact of the proof?

Author response:
> Q1: Can we reply $1/\min n_i$ with $1/N_b$, where $N_b$ is the number of data of all the benign clients?

In the proof of Theorem 1, we bound $N_{\mathcal{B}}$ (number of data samples in the index set $\mathcal{B}$ output by Rob-FCP) with a lower bound of the minimal sample size of benign clients $\min_{k' \in [K_b]} n_{k'}$. Let $K_b$ be the number of benign clients and $K_m~(K_m<K_b)$ be the number of malicious clients. Since we have $|\mathcal{B}|=K_b$, there are at least $K_b-K_m$ benign clients in set $\mathcal{B}$. Therefore, we can only replace the quantity $\min_{k' \in [K_b]} n_{k'}$ with the total sample sizes of $K_b-K_m$ benign clients with the smallest $K_b-K_m$ sample sizes. It is not possible to replace it with a summation of data samples for all benign clients. We made it more clear in the revised version.

Reviewer comment (Theory):
In Theorem 1 and Corollary 1, $\varepsilon$ appears in the bound. Is it possible to control it?

Author response:
> Q6: In Theorem 1 and Corollary 1, $\epsilon$ appears in the bound. Is it possible to control it?

We follow FCP to introduce the notation $\epsilon$ to quantify the approximation error of the estimated quantile $\hat{q}\_\alpha$ by data sketching such that the rank of $\hat{q}\_\alpha$ is between $(1-\alpha-\epsilon)(N+K)$ and $(1-\alpha+\epsilon)(N+K)$. The approximation error $\epsilon$ affects the coverage bound of FCP as Equation (3) and accordingly affects the coverage bound in the Byzantine setting as Theorem 1. Since $\epsilon$ is a quantity dependent on the score distribution, we cannot explicitly formulate it without further assumptions. However, we can control the approximation error $\epsilon$ with the dimension of the characterization vector $H$. A large $H$ indicates a large number of subintervals for the histogram statistics and a fine-grained partition, which will lead to a more precise approximation and a low $\epsilon$. Therefore, we can empirically adjust $H$ to control the approximation error $\epsilon$. We included the discussions in the remarks of Theorem 1 in the revised manuscript.

*[1] Lu, Charles, et al. "Federated conformal predictors for distributed uncertainty quantification." ICML 2023.*

Reviewer comment (Experiments):
In addition to the previous question, in the experiment how much time it takes to compute the quantile? (and for which $\varepsilon$?)

Author response:
> Q7: In the experiment how much time does it take to compute the quantile? (and for which $\epsilon$?)

We follow the suggestion to add the runtime of quantile computation in Rob-FCP in the following Table 1, which indicates the efficiency of federated conformal prediction with our method.

Table 1. Runtime of RobFCP quantile computation with $40\%$ malicious clients.
| | MNIST | CIFAR-10 | Tiny-ImageNet | SHHS | PathMNIST |
| - | - | - | - | - | - |
| Runtime (seconds) | 0.5284 | 0.5169 | 0.5563 | 0.2227 | 0.3032 |

Reviewer comment (Theory):
Regarding my remark on privacy, is it possible/easy to extend Rob-FCP in order to have differential privacy guarantees?

Author response:
> Q8: Is it possible/easy to extend Rob-FCP in order to have differential privacy guarantees?

We thank you for the valuable question. To provide differential privacy guarantees of Rob-FCP, one practical approach is to add privacy-preserving noises to the characterization vectors before uploading them to the server. Essentially, we can view the characterization vector as the gradient in the setting of FL with differential privacy (DP) and add Gaussian noises to the characterization vector with differential privacy guarantees as a function of the scale of noises, which can be achieved by drawing analogy from the FL with DP setting [1,2,3]. Therefore, practically implementing the differential-private version of Rob-FCP is possible and straightforward.

*[1] Zheng, Qinqing, et al. "Federated f-differential privacy." AISTATS 2021.*

*[2] Andrew, Galen, et al. "Differentially private learning with adaptive clipping." NeurIPS 2021.*

*[3] Zhang, Xinwei, et al. "Understanding clipping for federated learning: Convergence and client-level differential privacy." ICML 2022.*