On Privacy and Personalization in Cross-Silo Federated Learning
Abstract
While the application of differential privacy (DP) has been well-studied in crossdevice federated learning (FL), there is a lack of work considering DP and its implications for cross-silo FL, a setting characterized by a limited number of clients each containing many data subjects.
In cross-silo FL, usual notions of client-level DP are less suitable as real-world privacy regulations typically concern the in-silo data subjects rather than the silos themselves.
In this work, we instead consider an alternative notion of silo-speciﬁc sample-level DP, where silos set their own privacy targets for their local examples.
Under this setting, we reconsider the roles of personalization in federated learning.
In particular, we show that meanregularized multi-task learning ( MR-MTL ), a simple personalization framework, is a strong baseline for cross-silo FL: under stronger privacy requirements, silos are incentivized to federate more with each other to mitigate DP noise, resulting in consistent improvements relative to standard baseline methods.
We provide an empirical study of competing methods as well as a theoretical characterization of MR-MTL for mean estimation, highlighting the interplay between privacy and cross-silo data heterogeneity.
Our work serves to establish baselines for private cross-silo FL as well as identify key directions of future work in this area.
Introduction
Recent advances in machine learning often rely on large, centralized datasets [84, 23, 65], but curating such data may not always be viable, particularly when the data contains private information and must remain siloed across clients (e g. mobile devices or hospitals).
Recently, federated learning (FL) [71, 50] has emerged as a paradigm for learning from such distributed data but it has been shown that its data minimization principle alone may not provide adequate privacy protection for participants [101, 102].
To obtain formal privacy guarantees, there has thus been extensive work applying differential privacy (DP) [27, 28] to various parts of the FL pipeline (e.g. [32, 73, 41, 48, 4, 63, 44, 83, 34]).
Existing approaches for differentially private FL are typically designed for client-level DP in that they protect the federated clients, such as mobile devices (“user-level”), tasks in multi-task learning (“task-level”), or data silos like institutions (“silo-level”), and DP is achieved by clipping and noising the client model updates.
While client-level DP is considered a strong privacy notion as all data of a single client is protected, it may not be suitable for cross-silo FL, where there are fewer clients but each hold many data subjects that require protection.
For example, when hospitals/banks/schools wish to federate patient/customer/student records, it is the people owning those records rather than the participating silos that should be protected.
In fact, laws and regulations may mandate such participation in FL be disclosed publicly [96], compromising the privacy of the federating clients.
In this work, we instead consider a more natural model of silo-speciﬁc sample-level privacy (Fig. 1, with variants appearing in [41, 66, 109, 51, 63]): the k -th silo may set its own ( ε k , δ k ) sample-level
DP target for any learning algorithm with respect to its local dataset.
With this formulation in mind, we reconsider we explore existing baselines for FL (mostly developed in cross-device settings) across private cross-silo benchmarks, and we ﬁnd that the simple baseline of mean-regularized MTL ( MR-MTL )
[Figure]
has many advantages for this setting relative to other more common (and possibly more complex) methods.
We then further analyze the performance of MR-MTL under varying levels of heterogeneity and privacy, both in theory and in practice.
In addition to establishing baselines, we also identify interesting future directions in this area (§7 and Appendix G).
We summarize our contributions below:
• We consider the notion of silo-speciﬁc sample-level differential privacy (DP) as a more realistic privacy model for cross-silo federated learning (FL).
We analyze its implications on existing FL algorithms and, in particular, how it interfaces with data heterogeneity across silos.
• We empirically show that mean-regularized multi-task learning ( MR-MTL ), a simple form of model personalization, is a remarkably strong baseline under silo-speciﬁc sample-level DP.
Core to its effectiveness is its ability to (roughly) interpolate on the model personalization spectrum between local training and FedAvg with minimal privacy overhead.
• We provide a theoretical analysis of MR-MTL under mean estimation and characterize how MR-MTL navigates the tension between privacy and cross-silo data heterogeneity.
Finally, we examine the complications of deploying an optimal MR-MTL instance that stem from the privacy cost of hyperparameter tuning .
Our reasoning also applies to other personalization methods whose advantage over local training and/or FedAvg
hinges on selecting the best hyperparameter(s).
This raises important questions around the practicality of leveraging personalization to balance the emerging tradeoffs under silo-speciﬁc sample-level DP.
Preliminaries
Federated Learning (FL) [71, 58, 50] is a distributed learning paradigm with an emphasis on data protection: in every training round, each client (participant) downloads the current global model from a central server, trains it with the local dataset, and uploads the model changes (instead of the data) back to the server, which then aggregates the changes into a new global model.
A basic instantiation of FL is FedAvg [71], where clients are stateless and the server performs a simple (weighted) average.
Cross-device FL refers to settings with many clients each with limited data, bandwidth, availability, etc.
(e.g. mobile devices).
In contrast, cross-silo FL typically involves less clients (e.g. banks, schools, hospitals) but each with more resources.
Two distinguishing characteristics of cross-silo FL relevant to our work are that (1) silos may have sufﬁcient data to ﬁt a reasonable local model without FL, and (2) each data point in a silo tends to map to a data subject (a person) requiring privacy protection.
Differential Privacy (DP).
Despite its ability to mitigate systemic privacy risks, FL by itself does not provide formal privacy guarantees for participants’ data [50, 102, 101], and differential privacy is often used in conjunction with FL to ensure that an algorithm does not leak the privacy of its inputs.
Deﬁnition 2.1 (Differential Privacy [27, 28]) .
A randomized algorithm M : X n → Y , where X n is the set of datasets with n samples and Y is the set of outputs, is ( ε, δ ) -DP
if for any subset S ⊆ Y and any neighboring x, x (cid:48) differing in only one sample (by replacement), we have
[Equation]
To apply DP to a dataset query, one commonly used method is the Gaussian mechanism [28], which involves bounding the contribution ( (cid:96) 2 -norm) of each sample in the dataset followed by adding
Gaussian noise proportional to that bound onto the aggregate.
To apply DP in FL, one needs to deﬁne the “dataset” to protect; typically, as in client-level DP, this is the set of FL participants and thus the model updates from each participant in every round should be bounded and noised.
In learning settings, we need to repeatedly query a dataset and the privacy guarantee composes.
We use
DP-SGD [92, 11, 1] for ensuring sample-level DP for model training, and we use Rényi DP [77] and zCDP [15] for tight privacy composition.
In certain FL algorithms, clients also perform additional
[Figure]
work such as cluster selection [69, 33] that incurs privacy overhead with respect to its local dataset that must be accounted for independently from DP-SGD.
See Appendix A for additional background.
Personalized FL.
Model personalization is a key technique for improving utility under data heterogeneity across silos.
2 Past work has examined the roles of local adaptation [99, 104, 19], multi-task learning [91, 89], clustering [33, 22, 69, 89], public data [108, 69], meta learning [46, 56, 31] or other forms of model mixtures [61, 57, 69, 38, 24, 3].
Notably, many methods leverage extra computation to some extent (e g. extra iterations [61, 57, 19] or cluster selection [33, 69]), which will result in privacy overhead under silo-speciﬁc sample-level DP as discussed in the following section.
Of particular interest is the family of mean-regularized multi-task learning ( MR-MTL ) methods [30, 94, 38, 37] (see Algorithm A1 for a typical instantiation).
We ﬁnd that MR-MTL , while extremely simple, is a strong baseline for private cross-silo FL.
Revisiting the Privacy Model for Cross-Silo Federated Learning
To date, the prevalent privacy model for federated learning has been to protect the participating clients, i.e. client-level DP.
For cross-silo FL, however, several factors render client-level DP less appropriate.
First, cross-silo FL often involves a small number of clients and it can be utility-wise more costly to attain the same privacy targets.
For example, privacy ampliﬁcation via sampling [1, 78] may not apply on the client level since all silos typically participate in every round.
Second, many existing methods focus on enforcing client-level DP in a non-local model and thus deﬁnes a shared privacy guarantee for all participants, but in real-world cross-silo settings, participants under different jurisdictions (e.g. states) may have varying privacy requirements and thus opt for different privacy-utility tradeoffs.
Third, while silo-level protection implies sample-level protection, it may be too stringent in practice as silos often have large local datasets.
These unique properties for private cross-silo learning motivate us to consider silo-speciﬁc sample-level DP as an alternative privacy model (Fig. 1):
Deﬁnition 3.1 (Silo-speciﬁc sample-level DP) .
A cross-silo FL algorithm with K clients (silos) satisfy { ( ε k , δ k ) } k ∈
[ K ] -“ silo-speciﬁc sample-level DP ” if the local (personalized) model M k of every silo k ∈ [ K ] satisﬁes ( ε k , δ k )
-DP w.r.t.
the silo’s local dataset of training examples.
Characteristics of silo-speciﬁc sample-level privacy.
Importantly, silo-speciﬁc sample-level DP is deﬁned over the disjoint datasets of the individual silos, rather than the combined dataset of all silos.
3 To instantiate this setup in FL, each silo can simply run DP-SGD [92, 11, 1] with a noise scale calibrated to gradually spend its privacy budget over T training rounds, and return the noisy model update at each round.
This privacy notion has several important implications on the dynamics of FL:
Silos incur privacy costs with queries to their data, but not with participation in FL.
This follows from DP’s robustness to post-processing: the silos’ model updates in each round already satisfy their own sample-level DP targets, and participation by itself does not involve extra dataset
queries (e.g. DP-SGD steps).
In contrast, local training without communication can be kept noise-free under client-level DP, but participation in FL requires privatization.
Two immediate consequences of the above are that (1) local training and FedAvg now have identical privacy costs, and (2) local ﬁnetuning for model personalization may no longer work as expected (Fig. 2).
Less reliance on a trusted server.
As a corollary of the above, all model updates of silo k satisfy (at least) ( ε k , δ k ) -DP against external adversaries, including all other silos and the orchestrating server [28, 109].
In contrast, client-level DP under a non-local model necessitates some trust on the server, even for distributed DP methods (e.g. [29, 21, 48, 4, 20, 18]).
Tradeoff emerges between costs from privacy and heterogeneity.
As privacy-perserving noises are added independently on each silo, they are reﬂected in silos’ model updates and can thus be mitigated when the model updates are aggregated (e.g. via FedAvg), leading to a smaller utility drop due to DP for the shared model.
On the other hand, federation also means that the shared model may suffer from client heterogeneity (non-iid data across silos).
This intuition is observed in
Fig.
2: while local training may outperform FedAvg without privacy (as a result of heterogeneity), the opposite can be true when privacy is added (as a result of noise variance reduction).
The ﬁrst and last in the above are of particular interest because they suggest that model personalization can play a key and distinct role in our privacy setting.
Speciﬁcally, local training (no FL participation) and FedAvg (full FL participation) can be viewed as two ends of a personalization spectrum with identical privacy costs; if local training minimizes the effect of data heterogeneity but enjoys no DP noise reduction, and contrarily for FedAvg, it is then natural to ask whether there exist personalization methods that lie in between and achieve better utility, and, if so, what methods would work best.
Related privacy settings.
Past work on differentially private FL has concentrated on client-level
DP and cross-device FL (e.g. [32, 74, 44, 34, 49, 48, 6]), and the application of DP in cross-silo FL, particularly where each silo deﬁnes its own DP targets for records of its own dataset, is relatively underexplored.
Privacy notions closest to ours ﬁrst appeared in [95, 56, 41, 109, 66, 51, 63].
In [95], each client adds its own one-shot noise onto its outgoing update, but in learning scenarios this provides client-level protection.
The works of [56, 66, 109, 41, 63] study analogous privacy notions, though they respectively focus on boosting utility [56], analyzing statistical rates [66], adapting FL to f -DP [109, 25], applying security primitives [41], and learning a better global model; the aspects of heterogeneity, DP noise reduction, the personalization spectrum, and their interplay (e.g. Figs.and 5) were unexplored.
The work of [51] also considers a similar privacy notion, but the authors study a disparate trust assumption where DP noise is not added to local training/ﬁnetuning such that the ﬁnal personalized models lack privacy guarantees.
We note that the trust model most suitable for private cross-silo FL may be application-speciﬁc; in this work, we focus on the setting where the outputs of the FL procedure (the personalized models) must remain differentially private.
Baselines for Private Cross-Silo Federated Learning
With the characteristics from §3 in mind, we now explore various methods on cross-silo benchmarks.
We defer additional details as well as results on more settings and datasets to the appendix.
Datasets.
We consider four cross-silo datasets that span regression/classiﬁcation and convex/nonconvex tasks: Vehicle [26], School [35], Google Glass (GLEAM) [82], and CIFAR-10 [53].
The ﬁrst three datasets have real-world cross-silo characteristics:
Vehicle contains measurements of road segments for classifying the type of passing vehicles, School contains student attributes for predicting exam scores, and GLEAM contains motion tracking data to classify wearers’ activities.
CIFARhas heterogeneous client splits following [94, 90].
See Appendix C.1 for more details and datasets.
Benchmark methods.
We consider several representative methods in the personalized FL literature beyond local training and FedAvg [71]: local ﬁnetuning [99, 104, 19] (a simple but strong baseline for model personalization), Ditto [57] (state-of-the-art personalization method), Mocha [91] (personalization with task relationship learning), IFCA/HypCluster [33, 69] (state-of-the-art hard clustering method for client models), and the mean-regularized multi-task learning ( MR-MTL ) methods [30, 94, 38, 37] (which we analyze in §5).
For fair comparison under silo-speciﬁc sample-level
DP, we align all benchmark methods on the total privacy budget by ﬁrst restricting the total number of iterations over the local datasets and then account for any privacy overheads (in the form of necessary extra steps [57] or cluster selection for IFCA/HypCluster [33, 69]).
Importantly, many other personalization methods can either be reduced to one of the above under convex settings (e.g.
[46, 61]) or are unsuitable due to large privacy overheads (e.g. large factor of extra steps for [31]).
[Figure] [Figure]
Training setup.
For all methods, we use minibatch DP-SGD in each silo to satisfy silo-speciﬁc sample-level privacy; while certain methods may have more efﬁcient solvers (e.g. dual form for [91]), we want compatibility with DP-SGD as well as privacy ampliﬁcation via sampling on the example level for tight accounting.
For all experiments, silos train for 1 local epoch in every round (except for [57] which runs ≥ 2 epochs).
Hyperparameter tuning is done via grid search for all methods.
Importantly, when comparing the benchmark methods, we do not account for the privacy cost of hyperparameter tuning in order to focus on their inherent privacyutility tradeoff; we revisit this issue in §7.
For simplicity, we use the same privacy budget for all silos, i.e. ( ε i , δ i )
= ( ε j , δ j ) for all i, j ∈ [ K ] ; note that this is not a restrictive assumption since the effect of having varying DP noise scales from different budgets can be attained by varying local dataset sizes.
Results.
Fig.
3 shows the privacy-utility tradeoffs across four datasets.
We observe that MR-MTL consistently outperforms a suite of baseline methods, and that it performs at least as good as local training and FedAvg (endpoints of the personalization spectrum), except at high-privacy regimes (possibly different for each dataset).
In particular, there exists a range of ε values where MR-MTL can give signiﬁcantly better utility over local training and FedAvg under the same privacy budgets ( ε ≈ 0 .
5 , 6 , 1 . 5 for Fig.
3 (a, b, c) respectively); this is our key regime of interest.
Effects of silo-speciﬁc sample-level privacy.
In Fig.
2 we saw that local ﬁnetuning may not improve utility as expected, motivating us to reconsider the roles of federation and personalization (§5 below).
In Fig.
4, we consider the implication of silo-speciﬁc sample-level DP from the effects of privacy overhead due to additional dataset queries: (1) If IFCA [33, 69] performs cluster selection at every round (default behavior), then the extra privacy cost can be prohibitive; (2) Despite its similarity to
MR-MTL , Ditto [57]’s privacy overhead makes it less competitive (see also Fig. 5).
On the Effectiveness of Mean-Regularized MTL for Private Cross-Silo FL
Following the observations in §4, we now examine the desirable properties of a good algorithm under silo-speciﬁc sample-level privacy and understand why MR-MTL may be an attractive candidate.
Federation as noise reduction.
A key message from §3 and Fig.
2 is that the utility cost from DP can be signiﬁcantly smaller for FedAvg compared to local training even when the latter spends an identical privacy budget.
This implies that FedAvg may have inherent beneﬁts for DP noise reduction, despite the noise are added in the gradient space rather than the parameter space (as in client-level DP).
Consider a simple setting of DP gradient descent: the update rule w ( t +1) k
= w ( t ) k − ηn k (cid:16)
z ( t )
+ (cid:80) n k
i
=1 g ( t ) k,i (cid:17) for silo k recursively expands to w ( T ) k
[Equation]
ηn k
[Equation]
−
[Equation]
=
[Equation]
n k i
=1 g ( t ) k,i over T steps, where g ( t ) k,i is the clipped gradient of the i -th local example at step t (with norm bound c ) out of a total of n k examples, and z ( t ) ∼ N (0 , σ 2 I ) is the Gaussian noise added to the gradient sum at step t that targets for an overall privacy budget of ( ε k , δ k ) over T steps with σ 2 =
O (cid:0) c 2 T ln(1 /δ k ) /ε
2 k (cid:1) [1].
The cumulative noise term
[Equation]
indeed implies that each silo’s model update has an independent Gaussian random walk component [88, 7, 100] whose variance can be reduced by averaging with other silos’ updates, as in FedAvg.
A similar reasoning applies to SGD cases since the additive DP noises are i.i.d.
across the minibatches.
Model personalization for privacy-heterogeneity cost tradeoff.
A major downside of FedAvg is that it may underperform simple local training due to data heterogeneity (e.g. [104] and Fig. 2), particularly given that clients in cross-silo FL often have sufﬁcient data to ﬁt reasonable local models.
This suggests an emerging role for model personalization on top of its beneﬁts in terms of utility [99], robustness [104], or fairness [57] under heterogeneity: our privacy model allows local training and FedAvg to be viewed as two endpoints of personalization spectrum that respectively mitigate the utility costs of heterogeneity and privacy noise with identical privacy budgets (§3), meaning that personalization methods may be viewed as interpolating between these endpoints, and various methods essentially do so in different ways.
However, our empirical observations motivate the following key properties for a good personalization algorithm:
Noise reduction : The effect of noise reduction is present throughout training so that the utility costs from DP can be consistently mitigated.
Local ﬁnetuning is a counter-example (Fig. 2).
Minimal privacy overhead : There are little to no additional local dataset queries to prevent extra noise for DP-SGD under a ﬁxed privacy budget.
In effect, such privacy overhead can shift the utility tradeoff curve downwards, and Ditto [57] may be viewed as a counter-example (Fig. 4).
Smooth interpolation along the personalization spectrum : The interpolation between local training and FedAvg should be ﬁne-grained (if not continuous) such that an optimal tradeoff should be attainable.
Clustering [33, 69] may be viewed as a counter-example.
These properties are rather restrictive and they render many promising algorithms less attractive.
For example, model mixture [61, 13, 24] and local adaptation [104, 19] methods can incur linear overhead in dataset iterations, and so can multi-task learning [57, 91, 89] methods that beneﬁt from additional training.
Clustering methods [33, 22, 69, 89] can also incur overhead with cluster selection [33, 69], distillation [22], or training restarts [89], and they discretize the personalization spectrum in a way that depends on external parameters (e.g., the number of clients, clusters, or top-down partitions).
The case for mean-regularization.
These considerations point to mean-regularized multi-task learning ( MR-MTL ) as one of the simplest yet particularly suitable forms of personalization.
MRMTL has manifested in various forms in the literature [30, 105, 94, 38, 19, 44] with the key idea that a personalized model w k for each silo k should be close to the mean of all personalized models ¯ w via a regularization penalty λ / 2 (cid:107) w k − ¯ w (cid:107)
(see Algorithm A1 for a typical instantiation).
The hyperparameter λ serves as a smooth knob between local training and FedAvg, with λ
=recovering local training and a larger λ forces the personalized models w k to be closer to each other (“federate more”).
However, it is an imperfect knob as λ → ∞ may not recover FedAvg under a typical optimization setup as the regularization term may dominate the gradient step w ( t +1) k
= w ( t )
k − η (cid:16) g t + λ (cid:16) w ( t ) k − ¯ w ( t ) (cid:17)(cid:17) where g t is the noisy clipped gradient, and MR-MTL may thus underperform FedAvg in high-privacy regimes that necessitate a large λ to mitigate DP noise (Fig. 3).
MR-MTL has the attractive properties that: (1) noise reduction is achieved throughout training via a soft constraint that personalized models are close to an averaged model; (2) for ﬁxed λ it has zero additional privacy cost compared to local training/FedAvg as it does not involve extra queries; and (3) λ provides a smooth interpolation along the personalization spectrum.
Moreover, compared to other regularization-based MTL methods, it adds only one hyperparameter λ (cf.
[45, 110, 36]); this has important practical implications as will be discussed in §7.
It also has fast convergence [106] and easily extends to deep learning with good empirical performance in the primal [94, 44] (cf.
It is also sufﬁcently extensible to handle structured heterogeneity (discussed below).
We argue through the following empirical analyses that these properties make MR-MTL a strong baseline under silo-speciﬁc sample-level DP.
[Figure]
Navigating the emerging privacy-heterogeneity cost tradeoff.
In Fig.
5 we study the effect of the regularization strength λ on the model utility directly.
There are several notable observations: (1) In both private and non-private settings, λ serves to roughly interpolate between local training and FedAvg.
The utility at the best λ ∗ may outperform both endpoints.
This is signiﬁcant for the private setting since MR-MTL achieves an identical privacy guarantee as the endpoints.
(3) Moreover, the advantage of MR-MTL over the best of the endpoints are also larger under privacy.
The value of λ ∗ also increases under privacy, indicating that the personalized silo models are closer to each other (i.e. silos are encouraged to “federate more”) for noise reduction.
We will characterize these behaviors in §6.
We also consider Ditto [57] in Fig.
5, a state-of-the-art personalization method that resembles MR-MTL and exhibits similar behaviors, to illustrate the effect of privacy overhead from its extra local training iterations.
MR-MTL under structured heterogeneity.
We further study (1) the extensibility of MR-MTL as a strong baseline method to handle clustering structures of silo data distributions and (2) its ﬂexibility to handle varying heterogeneity levels, by manually introducing two layers of heterogeneity to the
MNIST dataset [54].
The ﬁrst layer is 4-way rotations: train/test images are evenly split intogroups of 10 silos, with each group applying { 0 ◦ , 90 ◦ , 180 ◦ , 270 ◦ } of rotation to their images.
The second layer is silo-speciﬁc masking: each silo generates and applies its unique random mask of 2 × 2 white patches to its images, with varying masking probability.
Together, the 1st layer createswell-deﬁned silo clusters, and the 2nd layer (gradually) adds intra-cluster heterogeneity (see examples in Appendix C).
Importantly, our goal is not to contrive a utility advantage of MR-MTL (in fact, the added heterogeneity is disadvantageous to mean-regularization), but to examine its extensibility and ﬂexibility as a strong baseline method to match the best methods by construction.
Under the 1st layer of heterogeneity, clustered FL methods [33, 69] should be optimal if the correct clusters are formed since there is no intra-cluster heterogeneity; with increasing silo-speciﬁc heterogeneity in the 2nd layer, local training should be increasingly more attractive.
We propose a simple heuristic to precondition or “warm-start” MR-MTL with a small number of training rounds by running private clustering (with IFCA [33, 69]) followed by mean-regularized training within each formed cluster .
We ﬁnd that this simple heuristic, with convergence properties carried forward from its components [33, 30, 106], enables MR-MTL to excel at all levels of heterogeneity: in Fig.
6 (a), the preconditioning allows MR-MTL to match IFCA (optimal by construction) while local training (full personalization) does not beneﬁt from the same preconditioning; in Fig.
6 (b, c, d), MR-MTL remains optimal across different levels of silo-speciﬁc heterogeneity (the 2nd layer) while the gains from warm-start gradually drop.
We argue that extensibility and ﬂexibility are good properties that make MR-MTL a strong baseline, as heterogeneity in practical settings is likely less adversarial than what we presented.
Analysis
In this section we provide a theoretical analysis of MR-MTL under mean estimation as a simpliﬁed proxy for (single-round)
FL using a Bayesian framework extending on [57].
We provide expressions for the Bayes optimal estimator MR-MTL ( λ ∗ ) and describe how MR-MTL behaves with varying λ in relation to the personalization spectrum to characterize our observations from Fig.
Proofs and extensions are deferred to Appendix E.
Setup.
We start with a total of K silos where the k -th silo holds n training points X k (cid:44) { x k,i ∈ R } i ∈ [ n ] , each normally distributed around a hidden center w k with variance σ 2 ; i.e. x k,i = w k + z k,i with z k,i ∼ N (0 , σ 2 ) .
To quantify heterogeneity, the silo centers { w k } k ∈
[ K ] are also normally
[Figure] [Figure]
± = 10 °
A v g S il o T e s t
A cc
[Figure] [Figure]
[Figure]
A v g S il o T e s t
A cc
[Figure] [Figure]
[Figure]
A v g S il o T e s t
A
[Figure] [Figure]
A v g S il o T e s t
A
[Figure]
distributed around some unknown ﬁxed meta-center θ with variance τ 2 ; i.e. w k = θ
+ z with z ∼ N (0 , τ 2 ) .
A large τ means that the silo centers are distant from each other and thus their local objectives are heterogeneous, and contrarily for a small τ .
Our goal is for each silo k to compute a sample-level private estimate of w k that minimizes the generalization error (i.e. on unseen points from the same local distribution).
Each silo targets ( ε, δ ) sample-level DP and runs the Gaussian mechanism with noise scale σ DP = c (cid:112) 2 ln(1 .
25 /δ ) /ε
and clipping bound c .
5 Under this setting, the MR-MTL objective for the k -th silo is
[Equation]
Here, ˜ F k ( w ) (cid:44) 12 ( w − 1 n ( ξ k + (cid:80) ni
=1 x k,i · min(1 , c/ (cid:107) x k,i (cid:107) 2 ))) 2 is the local objective to privately estimate the mean of the local data points with privacy noise ξ k ∼ N (0 , σ 2DP ) .
Since the data are (sub-)Gaussian, we assume one can choose c such that no clipping error is introduced w.h.p.
, so ˆ w k (cid:44) argmin ˜ F k ( w ) = 1 n ( ξ k + (cid:80) i x k,i ) is the best local estimator.
¯ w = 1 K (cid:80) k
ˆ w k is the average estimator across silos, which is the same as the FedAvg estimator under mean estimation.
We also consider the external average local estimators for silo k , deﬁned as ˆ w \ k (cid:44) 1 K − 1 (cid:80) j (cid:54) =
k ˆ w j .
The following lemma gives the best MR-MTL estimator ˆ w k ( λ ) as a function of λ .
Lemma 6.1.
Let λ ≥ 0 and α = K
+
λ
(1+ λ ) K ∈ (1 /K, 1] .
The minimizer of h k ( w ) is given by
[Equation]
Note that the best λ is always 0 for training error (i.e. estimating the empirical mean of the local data { x k,i } ); our hope is that with some λ > 0 , ˆ w k ( λ ) yields a better generalization error.
We now present the main takeaways.
At a high level, the basis of our analysis relies on expressing the true center w k in terms of ˆ w k and ˆ w \ k conditioned on the local datasets { X k } k ∈ [ K ] .
Let
[Equation]
denote the “local variance” of ˆ w k around w k due to both data sampling and privacy noise.
Behavior of MR-MTL at optimal λ ∗ .
We ﬁrst derive the following lemma using Lemma 11 of [68].
Lemma 6.2.
Given ˆ w k , ˆ w \ k , and { X k } k ∈ [ K ] , we can express w k = µ k + ζ k , where ζ k ∼ N (0 , σ 2 w ) ,
[Equation]
Lemma 6.2 expresses the unobserved true silo centers w k in terms of the (private) empirical estimators ˆ w k and ˆ w \ k .
This expression requires conditioning on the datasets X k as they form the Markov blankets of ˆ w k .
Combining Lemma 6.1 and Lemma 6.2 gives the optimal λ .
Theorem 6.3 (Optimal MR-MTL estimate) .
The best λ ∗ for the generalization error is given by
[Equation]
Theorem 6.3 suggests that there indeed exists an optimal point ˆ w ( λ ∗ ) on the personalization spectrum.
Moreover, λ ∗ grows smoothly with stronger privacy ( σ 2DP → ∞ ) to encourage silos to “federate more” with others.
This was empirically observed in Fig.
We now characterize the utility of ˆ w ( λ ∗ ) .
Corollary 6.4 (Optimal error with ˆ w ( λ ∗ ) ) .
The MSE of the optimal estimator ˆ w ( λ ∗ ) is given by
[Equation]
Note also that ˆ w ( λ ∗ ) is the MMSE estimator of w k .
Corollary 6.4 allows us to compare ˆ w k ( λ ∗ ) against the endpoints of the personalization spectrum (local training and FedAvg) with the following propositions.
Proposition 6.5 (Optimal error gap to local training) .
Let E loc (cid:44) E (cid:2) ( w k −
[Equation]
w k
[Equation]
2 | X
[Equation]
= σ 2loc be the error of the local estimate.
Then, compared to the optimal estimator ˆ w ( λ ∗ ) (Corollary 6.4), the local estimator incurs an additional error of
[Equation]
Proposition 6.6 (Optimal error gap to FedAvg) .
Let E fed
[Equation]
E (cid:2) ( w k − ¯ w ) 2 | { X k } k ∈
[ K ] (cid:3) be the error under FedAvg.
Then, compared to the optimal estimator ˆ w ( λ ∗ ) (Corollary 6.4), the FedAvg estimator incurs an additional error of
[Equation]
Together, Propositions 6.5 and 6.6 suggest that the effects of stronger privacy ( σ 2DP , σ 2loc → ∞ ) on how MR-MTL compares against the personalization endpoints are opposite , with the beneﬁt of
MR-MTL increases against local training and diminishes against FedAvg.
They also suggest that
MR-MTL has an optimal utility advantage over both the endpoints when σ 2loc ≈ τ 2 and local training performs on par with FedAvg; the utility “bump” under privacy in Fig.
5 can be viewed as a result of this balance.
It is worth noting that since the data variance σ 2 and heterogeneity τ 2 are often ﬁxed in practice, the freedom for silos to vary their privacy targets ( ε and σ 2DP ) makes the utility advantage of
MR-MTL more ﬂexible compared to non-private settings.
Behavior of MR-MTL as a function of λ .
The above captures how MR-MTL behaves at its optimum, but in Fig.
5 we also observed that MR-MTL has the desirable property that the utility cost from DP shrinks smoothly with larger λ (§5).
Lemma 6.7 and Theorem 6.8 below provides a characterization.
Lemma 6.7 (Error of ˆ w k ( λ ) ) .
Let E ( λ ) (cid:44) E (cid:2) ( w k − ˆ w k ( λ ))
2 | ˆ w k , ˆ w \ k , { X k } k ∈ [ K ] (cid:3) be the error of MR-MTL as a function of λ .
Then, E ( λ ) =
(cid:0) 1 − 1 K (cid:1)
[Equation]
+
[Equation]
2loc K .
Using Lemma 6.7 we can now characterize how λ affects the utility cost from DP (recall from Figs.and 5 that federation helps with noise reduction).
As a side note, Lemma 6.7 also suggests that
MR-MTL ’s utility as a function of λ would have a quasi-concave shape, as was empirically observed in Fig.
This could potentially help make heuristic or automated search over λ easier.
Theorem 6.8 (Private utility gap) .
Let ˆ w k ( λ ) and ˆ w DP k ( λ ) be the non-private and private estimate of w k with σ 2loc ←
σ 2 /n and σ 2loc ← σ 2 /n + σ 2DP /n 2 , respectively.
Let E ( λ ) and E DP ( λ ) be the error of ˆ w k ( λ ) and ˆ w DP k ( λ ) respectively as in Lemma 6.7.
Let ∆ DP ( λ ) (cid:44) E DP ( λ ) − E ( λ ) be the utility cost due to privacy as a function of λ .
Then, ∆ DP ( λ ) = (cid:0) 1 − 1 K (cid:1)
[Equation]
Theorem 6.8 suggests that with a larger λ , the utility cost from privacy can be smoothly mitigated by up to a factor of K , matching the empirical observation in Fig.
Discussions
In previous sections, we empirically and theoretically studied the beneﬁts of the best personalization hyperparameter λ ∗ for MR-MTL , but it remains open as to how such λ ∗ can be obtained.
In this section, we take an honest look at the complications of deploying MR-MTL through the lens of the privacy cost of ﬁnding λ ∗ .
There are in general several approaches: (1) a non-adaptive search (e.g. grid/random search [12]); (2) an adaptive search (e.g. grad student descent); or (3) an online estimation during training (e.g. [97, 8, 80]).
Here, we focus on approach (1) since it is generic to all personalization methods and is a setting for which we have the best privacy accounting tools [62, 79] to our knowledge.
We defer technical details and further discussions to Appendix F. Note that while we focus on MR-MTL , our reasoning in principle extends to all personalization methods whose advantage depends on having the best hyperparameter(s).
[Figure]
Recall that for a typical tuning procedure
[Figure]
a baseline algorithm M is executed h times with different hyperparameters and the best result is recorded.
The work of [62, 79] shows that, with a constant h , there exists M that satisﬁes ( ε, δ = 0)
-DP where the output of tuning is not (˜ ε, 0)
-DP for any ˜ ε < hε , with analogous negative results for Rényi DP (thus also for δ > 0 ).
This implies that naive tuning (as done in practice) can incur a prohibitive privacy overhead and obliterates the utility advantage of
MR-MTL ( λ ∗ ) over local training/FedAvg.
Instead, by making h random , we can make ˜ ε constant w.r.t.
h or at most ˜ ε ≤ O (log E
[ h ]) [62, 79].
However, using the simpliﬁed setting of mean estimation (§6), we ﬁnd that even with this improved randomized protocol, there exist scenarios (Fig. 7) where the realistic cost of trying a moderate E [ h ] = 10 values of λ may signiﬁcantly diminish, or even outweigh , the utility advantage of λ ∗ over local training and FedAvg—that is, we might be better off by not privately tuning λ at all .
The above has several important implications.
On the negative side, it suggests that the true efﬁcacy of MR-MTL can be smaller in practice.
Moreover, it raises the broader open question of whether the emerging privacy-heterogeneity cost tradeoff is best balanced by model personalization, as many existing methods including MR-MTL inherently require at least one hyperparameter to specify “how much” to personalize for general utility improvements over local training and FedAvg.
Alternatively, the hyperparameter(s) may be estimated during training (approach (3) above), though such procedures may not be general and/or scalable and may need to be tailored to the speciﬁc personalization method.
On the positive side, it is unclear whether the choice of λ can meaningfully leak privacy in practice.
MR-MTL may also be viewed favorably as a strong baseline since it only needs one hyperparameter to attain its beneﬁts, while other existing methods that require more tuning will incur even larger privacy costs from hyperparameter tuning.
Concluding remarks
In this work, we revisit the application of differential privacy in cross-silo FL.
We examine silospeciﬁc sample-level DP as a more appropriate privacy notion for cross-silo FL, and we point out several meaningful ways in which it differs from client-level DP commonly studied under the cross-device setting, particularly when analyzing tensions between privacy, utility, and heterogeneity.
We explore and establish baselines under this privacy setting and identify desirable properties for a personalization method for balancing an emerging tradeoff between utility costs from privacy and heterogeneity.
We then analyze a simple, promising method ( MR-MTL ) and discuss key open questions for the area at large.
Some future directions include (1) extending the privacy model to cases where data subjects have multiple records across silos, (2) extending our theoretical characterization to deep learning cases or performing a large-scale empirical study, and (3) developing auto-tuning algorithms for personalization hyperparameters with minimal privacy overhead.
Acknowledgements.
We thank Sebastian Caldas, Tian Li, Yash Savani, Amrith Setlur, and Peter
Kairouz for helpful discussions and feedback.
We thank Thomas Steinke for guidance on implementing privacy accounting for hyperparameter tuning [79].
Appendix A Additional Background
B Additional
Discussions
B.1 Limitations . .
B.2 Potential Negative Societal Impact . . . . . . . . . . . . . . . . . . . . . . . . . . .
C
Additional
Experimental Details
C.1 Datasets and Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
C.2 License/Usage Information for Datasets . . . . . . . . . . . . . . . . . . . . . . .
C.3 Benchmark Methods and Implementation . . . . . . . . . . . . . . . . . . . . . .
C.4 Training Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
C.5 Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
C.6 Code . .
D Additional Algorithmic Details
D
.1 Mean-Regularized Multi-Task Learning ( MR-MTL
D
.2 IFCA Preconditioning / Warm-Starting
E Additional Analysis Details
E.1 Notations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
E.2 MR-MTL Formulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
E.3 Assumptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
E.4 Omitted Details and Proofs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
E.
The Case of Heterogeneous Privacy Requirements . . . . . . . . . . . . . . . . . .
F Additional Details for Private Hyperparameter Tuning (§7)
F.
Additional Background on Privacy Costs of Hyperparameter Tuning . . . . . . . .
F.
Interpretation of Fig.
F
. Implementing
Hyperparameter Tuning under Silo-Speciﬁc Sample-Level DP . . .
G Future Directions for Auto-tuning / Online Estimation of λ
H Additional Experimental Results
H.1 Local Finetuning (Extension of Fig. 2) . . . . . . . . . . . . . . . . . . . . . . . .
H.2 Utility of MR-MTL as a Function of λ (Extension of Fig. 5) . . . . . . . . . . . . .
H.3 Subsampled ADNI Dataset . .
H.4 Additional Discussions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
A Additional Background
Rényi Differential Privacy (RDP).
In this work, we make use of a relaxation of different privacy known as Rényi Differential Privacy [77] for tight privacy accounting.
Deﬁnition A.1 (Rényi Differential Privacy (RDP) [77]) .
A randomized algorithm M : X n → Y is ( α, ε ) -RDP with order α > 1 if for any adjacent datasets x, x (cid:48)
[Equation]
where D α ( P (cid:107) Q ) is the Rényi divergence 6 between distributions P and Q :
[Equation]
Under Rényi DP, the privacy composition is simple: if every step of an algorithm satisﬁes ( α, ε ) -RDP, then over T steps the algorithm satisﬁes ( α, Tε ) -RDP.
The following lemma from [15, 17] provides a conversion from RDP to standard ( ε, δ ) -DP guarantees.
Lemma A.2 (Conversion from Rényi DP to approximate DP [15, 17]) .
If a mechanism M satisﬁes ( α, ε ( α )) -RDP, then for any δ > 0 , it also satisﬁes ( ε ( δ ) , δ ) -DP where
[Equation]
Zero-Concentrated Differential Privacy (zCDP).
A closely related privacy notion is zeroconcentrated DP (zCDP [15]), where ρ -zCDP is equivalent to satisfying ( α, ρα ) -Rényi DP simultaneously for all orders α .
Thus, algorithms that satisfy zCDP
guarantees are compatible with standard
RDP accounting routines implemented in open-source libraries (e.g. TensorFlow Privacy [72]).
In our work, we make use of zCDP and a related result for the Exponential Mechanism [87] for tight privacy composition when implementing private cluster selection for IFCA [33, 69] (see below and
Appendix C.3).
Exponential Mechanism for Private Selection.
The Exponential Mechanism (EM) is a standard algorithm for making private selection from a set of candidates based on their scores [75].
Speciﬁcally, there is a dataset x ∈ X n requiring DP protection, and a scoring function s : X n × [ G ] → R that evaluates a set of candidates g ∈
[ G ] .
We want to pick the candidate with the highest score (i.e. argmax g ∈ [ G ] s ( x, g ) ) subject to ( ε, 0) -DP for neighboring datasets x, x (cid:48) .
The mechanism M is deﬁned by setting the probability of choosing any g ∈
[ G ] as
[Equation]
(14) where ∆ is the sensitivity of the scoring function.
EM also satisﬁes 18 ε 2 -zCDP [87] and thus ( α, α 8 ε 2 ) -RDP for all α .
A variant of EM is the Permute-and-Flip mechanism [70].
The Exponential Mechanism can be implemented as “Report Noisy Max” with Gumbel noise: we can add independent noises drawn from the Gumbel distribution with scale 2∆ ε to the candidate scores s ( x, g ) for all g ∈
[ G ] and simply report the max noisy score.
If the score function is a loss metric (where we want the minimum instead of the maximum), we can similarly implement “Report Noisy
Min” by subtracting the Gumbel noises from the scores and report the minimum.
The latter is used in our implementation for private cluster selection, where clients select clusters with lowest loss or error rate (i.e. 1 − accuracy); see Appendix C.3 for more details.
Privacy Budgeting.
A typical accounting workﬂow, as used in our experiments, thus involves (1) composing the RDP guarantees of all private operations in the algorithm and (2) trying a list of α values that give the lowest ε for a target δ when converting back to ( ε, δ ) -DP that captures the overall privacy cost.
For SGD training, we also use existing results on privacy ampliﬁcation via subsampling [78, 1]: if a gradient step is ( ε, δ ) w.r.t.
the dataset without ampliﬁcation and the gradient is computed with a minibatch (assumed to be a random sample) of batch size b
= q/n where q is the sampling ratio and n is the size of the dataset, then the privacy of the gradient step is ampliﬁed to ( O ( qε ) , δ ) -DP.
In a silo-speciﬁc sample-level DP setup, the size of the dataset n k at each silo thus
[Equation]
determines the extent of the ampliﬁcation, and thus even if silos target for the same ( ε, δ ) sample-level
DP, they may end up adding different amounts of noise when running DP-SGD (mentioned in the
Training Setup paragraph of §4).
For this reason our experiments primarily focus on having the same privacy target for all silos.
Heterogeneous DP.
A related privacy notion is heterogeneous DP [5, 47], where each item within a dataset to be protected by DP may opt for a different ( ε, δ ) target.
Our setting primarily focuses on different ( ε, δ ) values for disjoint datasets, and all items within a speciﬁc dataset share the same DP target.
See also Appendix F for additional background relating to Section §7 (private hyperparameter tuning).
B Additional Discussions B.1 Limitations
We discuss below the limitations of this work in addition to Section §7.
When multiple records map to the same entity.
In this paper we studied the application of silospeciﬁc sample-level differential privacy in cross-silo federated learning.
While this is an important initial step towards a more suitable privacy model for cross-silo FL (in contrast to the commonly studied client-level DP model), we assume that each entity that requires privacy protection has at most one record (training example) across silos (e.g. a single patient has one medical record at a hospital).
There are two characteristic cases where this assumption does not hold for all items in a silo:
• Multiple records within a silo map to the same entity.
One example would be a student reenrolling at the same school for multiple degree programs, thus creating multiple student records at the same silo.
In such cases, the silo curator may need to carefully apply group privacy or other methods for ensuring entity-level privacy [55] to protect the
entity rather
than its records.
• Multiple records across silos map to the same entity.
One example would be a person having multiple credit cards at different banks.
This case is more intricate as it is harder to precisely account for the DP guarantee for this entity without knowing (1) the silos in which this entity has appeared and (2) the speciﬁc
privacy targets for each of those silos.
In this case, the silos may cooperate to run private set intersection (e.g. as considered in [67]) to privately identify this scenario, but this would by itself come at a privacy cost.
These cases are interesting avenues for future research on private cross-silo learning.
Extending the analysis to deep learning cases.
In Section §6 we use federated mean estimation as a simpliﬁed setting for analyzing the behavior of MR-MTL under silo-speciﬁc sample-level privacy.
While the analysis provides adequate insights into the empirical phenomena in Fig.
5, it is a simple model that does not consider the dynamic aspects of the learning settings, including (1) the Gaussian random walk component of the model updates due to DP noise applied over many training rounds, (2) the effect of communication frequency on the effect of noise reduction, (3) the concept of “client drifts” (as considered in [52]) as a result of heterogeneity and how it interfaces with the DP noises, and (4) how overparameterization may affect all of the above.
Caveats of cross-silo learning with very large local datasets.
In contrast to cross-device federated learning, cross-silo federated learning is typically characterized by having a limited number of clients, each with a large local dataset.
The term “large” is relative because it describes the sufﬁciency of the datasets for ﬁtting good local models of a speciﬁc class ; for example, 500 examples are likely sufﬁcient to ﬁt linear regression of 10 parameters, but very likely insufﬁcient to learn a transformer [98].
In this sense, many FL problems in practice – such as large commercial banks running regression on tabular data – will in fact have local training to be the optimal strategy, as long as there are sufﬁcient local data and the data from other silos are not of the same local distribution.
In these cases, one should expect MR-MTL to opt for λ ∗ ≈ 0 as federated learning is not needed at all, and thus its advantages under privacy will also be minimal.
B.2 Potential Negative Societal Impact
Our work studies the empirical behaviors that arise when applying an alternative model of differential privacy to cross-silo federated learning, and we provide a strong baseline method ( MR-MTL ) that fares well in this setting.
In this sense, our work sheds light on and facilitates the development of a previously underexplored area of differentially private federated learning.
However, because
MR-MTL requires selecting a good regularization stength λ , one potential negative impact is that users may excessively tune λ on a private dataset and inadvertently leak privacy via the choice of λ (perhaps qualitatively rather than quantitatively); for example, if a silo chose a large λ for better performance, then in principle its data would look somewhat more similar to the “average” of the silo datasets.
Moreover, our privacy model requires that silos add their own independent noises for their own DP targets, and this requirement may not be followed correctly (either deliberately or inadvertently) to provide vacuous DP guarantees for people’s data
[Table]
C Additional Experimental Details C.1 Datasets and Models
Table A1 summarizes the datasets, tasks, and models considered in our experiments.
In the following, we provide details on each.
[Table]
Vehicle Dataset [26].
The Vehicle Sensor dataset is a binary classiﬁcation dataset containing K =data silos.
Each silo (sensor) has acoustic and seismic measurements for a road segment, with each data point being a 100-dimensional feature vector describing the measurements when a vehicle passes through the road segment.
The goal is to predict between two predetermined types of vehicles.
We use a train/test split of 75%/25% following previous work [91], yielding 872 ≤ n train k ≤ 1933 training examples on each client.
We use simple linear SVMs for classiﬁcation following [91, 57].
It is a suitable dataset for cross-silo FL because the number of silos K is small while each silo has sufﬁcient data to ﬁt a good local model, as opposed to cross-device datasets such as FEMNIST [16] where
K is large but each silo has little data to learn a useful model.
Moreover, we can use tight privacy budgets due to reasonably large local datasets (in terms of sufﬁciency for ﬁtting a good local model) and SVMs (which are relatively noise-tolerant since decision boundaries only depend on support vectors).
The dataset is accessible from the original authors.
School Dataset [35, 9, 111].
The School dataset originated from the now-defunct Inner London
Education Authority.
9 It is a regression dataset for predicting the exam scores of 15,362 students distributed across 139 secondary schools.
Each school has records for between 22 and 251 students, and each student is described by a 28-dimensional feature vector capturing attributions such as the school ranking, student birth year, and whether the school provided free meals.
We perform 80%/20% train/test split in Fig.
3 (with 15 ≤ n train k ≤ 175 training examples in each silo), and additionally consider 50%/50% and 20%/80% train/test split in Fig.
A8.
We use simple linear regression models following previous work (e.g. [9, 111, 36]) to predict student scores.
Like the Vehicle dataset, the
School dataset is a natural cross-silo FL dataset with a limited number of clients K , each with roughly sufﬁcient data to ﬁt a reasonable local model.
The dataset is available from [111].
[Figure]
Google Glass Eating and Motion (GLEAM) Dataset [82].
We also benchmark on the GLEAM dataset, a real-world head motion tracking dataset for binary classiﬁcation.
The motion data is collected with Google Glass, and the task is to classify the activity of the wearer (eating or not).
There are in total K = 38 silos (wearers) and 27800 data points, with each silo containing 699 ≤ n k ≤data points.
Each data point is a 180-dimensional feature vector capturing head movement of the wearers.
Linear models yield reasonable utility on GLEAM and thus we use linear SVMs following previous work [91].
Like Vehicle and School, this is a suitable dataset for cross-silo FL given a small
K and relatively large local datasets.
Heterogeneous CIFAR-10 Dataset.
We additionally evaluate on CIFAR-10 [53], with heterogeneous client data split following previous work [94, 90] (based on the code provided by [90]).
The dataset has K = 30 clients (silos) in total, and data heterogeneity is generated with each client having a random number of samples from 5 randomly chosen classes out of the 10 classes.
Each client has 1515 ≤ n k ≤ 1839 training examples.
We use a simple convolutional network with the following layers: [Conv× 3 with 32 channels, ReLU, MaxPool 2 × 2 with stride 2, Conv 3 × 3 with 64 channels, ReLU, MaxPool× 2 stride 2, Linear].
No padding is used for convolutional layers.
Rotated & Masked MNIST Dataset.
We adapt the original MNIST dataset [54] to study the effect of structured heterogeneity on MR-MTL .
For the 60000/10000 train/test images, we ﬁrst perform a shufﬂe and then evenly separate them into K = 40 clients (silos), each with 1500/250 train/test images with roughly uniform distribution on the labels.
We then randomly separate the silos intogroups of 10, and apply rotations of { 0 ◦ , 90 ◦ , 180 ◦ , 270 ◦ } to each group respectively; silos within the same group have the same rotations applied to the images, thus forming 4 natural silo clusters.
To add intra-cluster heterogeneity, we then apply silo-speciﬁc random masks of 2 × 2 white patches; that is, all images in the same silo has the same mask, and no two silos have the same mask with very high probability.
The random masks are akin to those considered in [40].
The white patches of the random mask do not overlap, and the mask ratio is the probability of a patch being applied (so the speciﬁed percentage of masked area is an expectation).
Examples of generated images are shown in Fig.
A1.
These image transformations introduce two types of heterogeneity identiﬁed by [50]: “covariate shift” (skew of feature distributions) and “concept drift” (same label, different features).
The model architecture is the same as the one used for heterogeneous CIFAR-10.
Subsampled Alzheimer’s Disease Neuroimaging Initiative (ADNI) Dataset [2].
We additionally benchmark on the ADNI dataset, which is a real-world dataset containing brain PET scans of
Alzheimer’s disease patients, patients with mild cognitive impairment, and healthy people taken from multiple institutions [81].
It is a regression dataset for predicting the SUVR value (a scalar ranged roughly between 0.8 and 2) from the PET scan images of a brain.
We simpliﬁed the full dataset for faster training by subsampling the axial slices generated for each brain PET scan (96 slices for scan), turning them into a gray scale image, downsampling them to size 32 × 32 , and randomly splitting them into a 75%/25% train/test sets.
There are in total K = 9 silos containing a total of 11040 images; each silo corresponds to a different equipment that took the PET scans and contains 45 ≤ n train k ≤ 2685 training examples.
See Fig.
4 of [86] and Fig.
4 of [81] for sample images.
The model architecture is a simple convolutional network with the following layers:
[Conv 5 × 5 withchannels, ReLU, MaxPool 2 × 2 with stride 2, Conv 5 × 5 with 64 channels, ReLU, MaxPool 2 ×stride 2, Linear].
No padding is used for convolutional layers.
C.2 License/Usage Information for Datasets
Vehicle Dataset.
The Vehicle dataset was made publicly available by the original authors as a research dataset [26] and license information was unavailable.
It has been subsequently used in many work (e.g. [91]).
School Dataset.
The original entity that collected the School dataset [35] is defunct and license information was unavailable.
The dataset has been made publicly available [111] and used extensively in previous work (e.g. [111, 107]).
Google Glass (GLEAM) Dataset.
The GLEAM dataset was made publicly available by the original authors and can be used for any non-commercial purposes.
See this URL 10 for license and usage information.
Heterogeneous CIFAR-10 Dataset.
The original CIFAR-10 dataset is available under the MIT license.
Rotated & Masked MNIST Dataset.
The original MNIST dataset is available under the CC BY-SA 3.0 license.
Subsampled ADNI Dataset.
As per the Data Use Agreement of the ADNI dataset:
Data used in preparation of this manuscript were obtained from the Alzheimer’s
Disease Neuroimaging Initiative (ADNI) database (adni.loni.usc.edu).
As such, the investigators within the ADNI contributed to the design and implementation of ADNI and/or provided data but did not participate in analysis or writing of this manuscript.
A complete listing of ADNI investigators can be found at this URL.
The data sharing and publication policy of the ADNI dataset can be found at this URL.
13 Access to the dataset must be approved by ADNI.
C.3 Benchmark Methods and Implementation
We provide more details on our benchmark personalization methods below.
Local ﬁnetuning [99, 104, 19] is one of the simplest but most effective personalization methods: once clients obtain a shared model via federated training (e.g. FedAvg), they can personalize it with additional training steps over their local dataset.
This simple strategy has been shown to work very well empirically [99, 104, 19], with the work of [19] providing theoretical support that it can asymptotically achieve comparable performance to other more sophisticated methods.
Moreover, in contrast to other local adaptation methods like distillation [104], local ﬁnetuning’s privacy footprint under our privacy model can be easily controlled (by limiting the number of ﬁnetuning and total training steps) without qualitatives change in its behavior.
In our experiments, local ﬁnetuning is implemented as FedAvg followed by local training, each taking 50% of the total number of training rounds to ensure an identical privacy budget as other baseline methods.
Ditto [57] is the current state-of-the-art method for personalization with provable beneﬁts of robustness and fairness.
It is closely related to MR-MTL because it similarly trains personalized models while (cid:96) 2 -regularizing them towards a global model, but it differs from MR-MTL in that its global model can be obtained by a standalone solver.
In particular, when no privacy is added, Ditto’s modularity allows it to perfectly interpolate between local and FedAvg training with its regularization strength λ .
In our experiments, we implement Ditto with the FedAvg solver and use a minimal number of iterations over the local datasets to avoid excessive privacy overhead.
Mocha [91] is a multi-task learning framework tailored for federated settings.
During training, it simultaneously learns the personalized models as well as a client-relationship matrix which can model both positive and negative client relationships (in contrast, clustering methods only focus on positive relationships).
One disadvantage of Mocha is that it applies to convex problems only.
In particular, the original paper uses a dual formulation for efﬁcient training, but for fair comparison and compatibility with privacy primitives (especially DP-SGD [92, 11, 1]), we implemented Mocha in its primal form and trained it with SGD in our experiments.
Similarly, we align Mocha to other baselines in terms of the number of training steps to prevent privacy overhead.
IFCA [33] (and the conceptually similar HypCluster [69]) is a simple clustering framework proposed as an extension to FedAvg.
In every round of IFCA training, the server sends k models (cluster centroids) to all clients; each client locally evaluates them over its local training data and selects the one with the lowest loss.
Each client then locally trains on the selected model and returns updates only for this model, along with its index.
Clients that selected the same model indices can be viewed as belonging to the same cluster.
We use IFCA as the representative clustering method due to its performance, simplicity, and practicality.
The privacy overhead of IFCA comes in the form of private cluster selection : when each client evaluates the incoming models (cluster centroids) on the local datasets, this procedure must be privatized as the selection itself may leak information about the dataset.
Private selection can be implemented via the exponential mechanism [75] with sharp accounting via a bounded range analysis [87] (discussed in Appendix A), but one must decide (e.g. as a privacy budget ε select for the same δ ) how to share the selection cost with DP-SGD under a ﬁxed total privacy budget ε total .
Mitigating strategies for private cluster selection.
In our experiments, we observed that if private selection is implemented naively, it can incur a prohibitive privacy overhead and destroys the ﬁnal utility (e.g. Fig. 4).
There are two important reasons: (1) unlike DP-SGD, no privacy ampliﬁcation applies to private selection, and (2) the sensitivity of the training loss (which is used to select cluster centroids) is unbounded in general and must be clipped to a reasonable value (e.g. ≤ 1 ).
We propose two mitigation strategies:
Use accuracy instead of loss.
For the cluster selection metric (i.e. the score function s ( x, g ) where x is the local dataset and g is a particular cluster centroid), we use the error rate ( 1 − accuracy ) instead of the loss (which is used by the original authors [33, 69]).
The rationale is that accuracy is a low-sensitivity function, particularly in cross-
silo
settings
: one
can show that
by
enumerating
the
cases where
the
differing example between
the
neighboring datasets x and x (cid:48)
are correctly
/incorrectly classiﬁed under addition/removal/replacement notions of DP, the sensitivity ∆ acc of s is bounded as
[Equation]
where n is the size of the local dataset.
Since n can be large in cross-silo settings, the sensitivity can be orders of magnitude smaller than that of the loss function.
With small sensitivity, we heuristically set the per-round
selection privacy budget
to a very small ε select = 0 . 03 · ε total .
Despite this, however
, the cost of private selection
can
still
grow quickly over the entire training process and considerably eat into DP-SGD’s privacy budget.
Truncate the number of cluster selection rounds.
Our second strategy is to simply run less rounds of cluster selection (e.g. to 10% of total number of training
rounds
, as
in Fig. 3)
This follows from the
empirical
analysis
of [33]
as well as
our own experimental observation that clusters
tend to converge quickly, though in
some
cases, clusters may not fully converge within 10% of training rounds
Despite these strategies, however, the private selection cost can still lead to a steep utility hit.
Note also that the new hyperparameter ε select can be tuned; for a ﬁxed total budget ε
[Equation]
, a small ε select means the budget for DP-SGD ε train is not affected by much, but the selected clusters would be very noisy and inaccurate; a large ε select leads to less noisy clusters (and thus smaller intra-cluster heterogeneity), but DP-SGD will correspondingly use larger noise and hurt optimization.
C.4 Training Settings
Optimizers.
For simplicity of hyperparameter tuning and experimental controls, we use minibatch
DP-SGD for client local training without local or server momentum for all experiments (in fact,
FedAvgM [43] and FedAdam [85] were not found to be helpful on Vehicle and School).
While there are more efﬁcient solvers for the Vehicle and School datasets since we are dealing with convex problems, we want compatibility with DP-SGD [92, 11, 1] as well as tight privacy accounting with privacy ampliﬁcation via subsampling (i.e. via minibatch training).
Hyperparameters.
For all datasets and all methods, we set silos to train for 1 local epoch in every round (except Ditto [57] which takes 2 local epochs).
For Vehicle, GLEAM, School, Heterogeneous
CIFAR-10, Rotated & Masked MNIST, and subsampled ADNI respectively, the local batch size across all silos are ﬁxed with B = 64 , 64 , 32 , 100 , 100 , 64 , and the clipping norm for per-example gradients are heuristically set to c = 6 , 6 , 1 , 8 , 1 , 0 . 5 .
Vehicle uses T = 400 rounds for most experiments (except Fig. 2 which trains for T = 200 rounds); School, Google Glass, Heterogeneous CIFAR-10, and Rotated & Masked MNIST use T = 200 ; and ADNI uses T = 500 .
For multi-task learning methods ( MR-MTL , Ditto [57], Mocha [91]), we sweep the regularization strength across a grid of λ ∈ [0 . 0001 , 0 .
3 , 1 , 3 , 10] to ﬁnd the best λ ∗ wherever applicable (e.g. Figs.
3, 5 and A8).
To compensate for the change in the gradient magnitude, we also sweep different client learning rates across a grid of η ∈ [0 . 001 , 0 . 003 , 0 . 01 , 0 .
3] ; for fair comparison, the same grid of η is swept for methods that do not involve λ (e.g. IFCA, local ﬁnetuning).
For Fig.
2 and Fig.
A2, the learning rate is ﬁxed to η = 0 .
For all datasets, the chosen privacy parameter δ satisfy δ < n − 1 .
1 k where n k is the local training dataset size.
Evaluation Protocol.
For all datasets, we evaluate methods by the average test metric (accuracy or
MSE) across the silos, weighted by their respective test sample counts.
Weighted averaging allows the ﬁnal test metric to reﬂect a method’s performance over the individual test samples of the combined dataset across silos, thus fairer and more aligned (compared to uniform averaging of silo test metrics) with our privacy model where each test sample represents an entity requiring protection.
C.5 Hardware
Experiments for Vehicle, School, and Google Glass are run on Intel Xeon Gold 6238 CPUs, and experiments for Rotated & Masked MNIST and ADNI are run on four NVIDIA A6000 GPUs.
C.6 Code
Our experiments are implemented in Python with NumPy [39], JAX [14] and Haiku [42].
For private training, JAX is used to vectorize DP-SGD over per-example gradients [93].
Code will be made available at https://github.com/kenziyuliu/private-cross-silo-fl .
D Additional Algorithmic Details D.1 Mean-Regularized Multi-Task Learning ( MR-MTL )
Algorithm A1 describes the canonical instantiation of MR-MTL [94].
Its key ingredient is the meanregularization (Line 6 of Algorithm A1) that forces the local personalized models w k to be close to their mean ¯ w .
Silo-speciﬁc sample-level privacy is added by privatizing the local gradients as in
DP-SGD [92, 11, 1].
Privacy of MR-MTL .
Since the iterates of ¯ w ( t ) are already differentially private (as they are the average of the private iterates w ( t ) k ), the additional regularization term λ 2 (cid:107) w ( t ) k − ¯ w ( t − 1)
k
(cid:107)
(and hence MR-MTL ) does not incur privacy overhead compared to local and FedAvg training.
Weighted vs Unweighted Model Updates.
It is customary to weigh the model updates from each client (silo) by its training example counts, as in the original FedAvg implementation [71].
However, note that under silo-speciﬁc sample-level privacy with addition/removal notions of DP, the example counts on each silo may itself leak sensitive information (e.g. when a silo only has one record).
This
[Table] [Table]
[Table] [Table]
[Table] [Table]
is less of an issue with the replacement notion of DP, since neighboring datasets would have the same example counts.
In our experiments we use weighted model updates and thus implicitly assume the replacement notion of DP.
Nevertheless, we did not observe signiﬁcant changes in performance when unweighted aggregation is used.
D.2 IFCA Preconditioning / Warm-Starting
In Section §5, we considered an extension to MR-MTL where training is “warm-started” by a small number of rounds of clustering (via IFCA [33, 69]), followed by MR-MTL training within each formed cluster.
Pseudocode for this procedure is shown in Algorithm A2.
Privacy of IFCA Preconditioning.
Observe that as with MR-MTL , the gradient steps satisfy silospeciﬁc sample-level DP regardless or whether the steps are made on the cluster models or the personalized models.
IFCA preconditioning introduces privacy overhead in the form of private cluster selection (Line 6 of Algorithm A2; discussed in Appendices A and C.3), which splits the total privacy budget with DP-SGD.
As a result the noise scale for DP-SGD would be increased and can be numerically determined.
1: Input: Initial client models { w (0) k } k ∈
[ K ] , number of clusters G , initial cluster models { ¯ w (0) g } g ∈ [ G ] , total number of rounds T , and the number of initial clustering rounds T cluster .
2: # IFCA preconditioning rounds 3: for IFCA training round t = 1 , ..., T cluster do 4:
Server sends cluster models { ¯ w ( t − 1) g } g ∈
[ G ] to every client.
5: for client k
= 1 , ..., K in parallel do 6:
Use Exponential Mechanism (Appendix A) to select best cluster ¯ w ( t − 1) g ∗ ( k ) from { ¯ w ( t − 1) g } with loss/error rate function s and local dataset ( X k , Y k ) .
Set model iterate: w ( t ) k ← ¯ w ( t − 1) g ∗ ( k ) .
For every batch ( x, y ) , client updates w ( t ) k using SGD or DP-SGD with batch loss (cid:96) ( w ( t ) k , x, y ) and gradient ∇ w ( t )
k (cid:96) (cid:16) w ( t ) k , x, y (cid:17) .
Return model update ∆ ( t ) k
= w ( t ) k − ¯ w ( t − 1) g ∗ ( k ) and selected cluster index g ∗ ( k ) .
10: for each cluster g ∈ [ G ] do 11:
Server applies (weighted) model updates to cluster g with the associated client indices: ¯
[Equation]
+
[Equation]
|
[Equation]
(cid:88) k
[Equation] [Equation]
) k , where K g ≡ { k ∈ [ K ] | g ∗ ( k ) = g } .
(16) 12: # MR-MTL rounds
13: for MR-MTL training round t =
T cluster + 1 , ..., T do 14:
Server sends cluster models { ¯ w ( t − 1) g } g ∈
[ G ] to every client.
15: for client k
= 1 , ..., K in parallel do 16:
Client retrieves the last selected cluster centroid ¯ w ( t − 1) g ∗ ( k ) .
Set model iterate: w ( t ) k ← w ( t
[Equation]
1) k ( using the personalized model from last round ).
For every batch ( x, y ) , client updates w ( t ) k using SGD or DP-SGD [92, 11, 1] with batch loss (cid:96) ( w ( t ) k , x, y ) and gradient
[Equation]
(cid:13)(cid:13)(cid:13)
[Equation]
Return model update ∆ ( t ) k
= w ( t ) k − ¯ w ( t − 1) g ∗ ( k ) and the cluster index g ∗ .
20: for each cluster g ∈ [ G ] do 21:
Server applies (weighted) model updates to cluster g with the associated client indices:
[Equation]
where K g ≡ { k ∈ [ K ] | g ∗ ( k ) = g } .
Output: Personalized models w ( T ) k for all i ∈
[ K ] .
E Additional Analysis Details
In this section we provide additional details for the analysis presented in Section §6.
We also extend the analysis to the case with varying n , σ , σ DP for each silo in Appendix E.5.
E.1 Notations
Unless otherwise speciﬁed, we used the following notations throughout the analysis:
• K denotes the total number of silos (clients) with indices k ∈
[ K ] ; • n denotes the number of examples on each silo; • w k denotes the true center of silo k ’s data distribution; • X k ≡ { x k,i } i ∈ [ n ] denotes the local dataset with n data points; • ˆ w k denotes the best local estimator of w k ; • ¯ w denotes the average of local estimators; • ˆ w \ k (cid:44)
1 K − 1 (cid:80) j (cid:54) =
k,j ∈
[ K ] ˆ w j denotes the external average estimators from the perspective of k ; • σ 2 denotes the sampling variance of the local data X k ; • τ 2 denotes the sampling variance of the local data centers w k (hence a measure of data heterogeneity across silos); and • σ 2DP denotes the DP noise variance on each silo to satisfy silo-speciﬁc sample-level privacy.
E.2 MR-MTL Formulation
The general formulation of the mean-regularized MTL objective may be expressed as
[Equation] [Equation]
where F k ( · ) is the local objective for client k , ¯ w (cid:44)
1 K
[Equation]
Kk =1 w k is the average model, and λ ≥is the regularization strength.
A larger λ enforces the models to be closer to each other, and λ =reduces the problem to local training.
In particular, unlike Ditto [57], MR-MTL may not recover
FedAvg [71] under SGD as λ → ∞ , since λ essentially changes the ratio between the local objective gradients and the regularization gradients.
For the purposes of our analysis, we assume F k is strongly convex for all k ∈
[ K ] .
E.3 Assumptions
Our characterization of MR-MTL on makes the following simplifying assumptions.
Assumption E.1.
All clients (silos) have the same number of data points n , data sampling variance σ 2 , and DP noise variance σ 2DP .
Assumption E.2.
A sufﬁciently large clipping c can be selected such that (cid:107) x k,i (cid:107) 2 ≤ c with high probability.
Note that Assumption E.1 primarily serves to make results cleaner and easily interpretable (see
Appendix E.5 for extensions).
Assumption E.2 is mild since Gaussians have strong tail decay.
E.4 Omitted Details and Proofs
Lemma 11 of [68].
Our analysis (particularly Lemma 6.2) makes use of the following lemma to determine the posterior of an unknown parameter given several independent Gaussian observations.
Lemma E.3 (Lemma 11 of [68]) .
Let θ ∈ R be a constant (non-informative prior).
Let { φ k (cid:44) θ
+ z k } k ∈ [ K ] with z k ∼ N (0 , σ 2 k ) be m independent noisy observations of θ with variances { σ 2 k } k ∈ [ K ] .
Then, conditioned on { φ k } k ∈ [ K ] , with σ 2 θ (cid:44) ( (cid:80) k ∈
[ K ] 1 /σ 2 k ) − 1 , we have
[Equation]
k ∈ [ K ] φ k σ 2 k
+ z, where z ∼ N (0 , σ 2 θ ) .
This lemma allows us to express the local true centers w k conditioned on the local empirical estimates ˆ w k , the external empirical estimates ˆ w \ k , and the local datasets { X k } k ∈ [ K ] .
Below we present omitted proofs for the main results presented in Section §6.
We reiterate the lemmas and theorems for convenience.
Lemma 6.1 .
The minimizer of the silo-speciﬁc objective h k ( w ) (see Eq.
(3), Eq.
(18)) is
[Equation]
where α (cid:44)
[Equation]
Proof of Lemma 6.1.
First note that ¯ w is independent of λ .
Since we assume F k is convex, h k is also convex, and the proof follows from taking the derivative of h k and setting it to 0:
[Equation]
Note here that in the non-private case, the local estimator is given by the empirical average: ˆ w k = 1 n (cid:80) ni
=1 x k,i .
In the private case, under Assumption E.2, the local estimator is ˆ w k =n ( ξ k + (cid:80) ni
=1 x k,i ) where ξ k ∼ N (0 , σ 2DP ) is the one-shot privacy noise, and we can similarly arrive at the same ˆ w k ( λ ) expression.
Lemma 6.2 .
Let σ 2loc (cid:44) σ 2 /n + σ 2DP /n 2 denote the local variance on each silo as a result of data sampling and DP noise.
Then, given ˆ w k and ˆ w \ k , w k can be expressed as
[Equation]
where ζ k ∼ N (0 , σ 2 w ) ,
[Equation]
24) with σ 2 w (cid:44)
[Equation]
σ 2loc
[Equation]
K
[Equation]
Kτ
[Equation]
σ 2loc
[Equation] [Equation]
25) and µ k
[Equation]
Proof of Lemma 6.2.
When given θ , we can express w k = θ
+ z k where z k ∼ N (0 , τ 2 ) , and by symmetry when given w k ,
[Equation]
where z k ∼
[Equation] [Equation]
[Equation]
Note also that when given the local dataset X k , ˆ w k is a noisy observation of w k with Gaussian noise from data sampling and added privacy:
[Equation]
where
[Equation] [Equation]
Moreover, when given the local datasets { X j } j ∈ [ K ] ,j (cid:54) =
k , ˆ w \ k can be viewed as a noisy observation of θ with Gaussian noise from the silo heterogeneity and the empirical mean of the local estimators:
[Equation]
where
[Equation] [Equation]
Combining (29) with (27) we have, when given w k and the local datasets { X j } j ∈ [ K ] ,j (cid:54) =
k , ˆ w \ k = w k + z \ k where z \ k ∼ N (cid:18) 0 , τ 2 + τ 2 + σ 2loc
[Equation]
Invoking Lemma E.3 on Eq.
(28) and Eq.
(30) we have the desired µ k and σ 2 w .
A key observation for this derivation is that the local datasets { X k } k ∈ [ K ] form the Markov blankets of ˆ w k and ˆ w \ k (as they are sampled after w k are sampled, and the estimators ˆ w k and ˆ w \ k are computed based on the datasets).
Thus, given { X k } k ∈ [ K ] , ˆ w k and ˆ w \ k can be viewed as independent observations of w k and Lemma E.3 applies.
Theorem 6.3 (Optimal MR-MTL estimate).
Let λ
∗
be the optimal λ that minimizes the generalization error.
Then,
[Equation]
Proof of Theorem 6.3.
The objective of ﬁnding λ ∗ equates to ﬁnding an expression for λ such that when w k is viewed as a noisy observation of ˆ w k ( λ ) (which is an interpolation of ˆ w k and ˆ w \ k from
Lemma 6.1), the coefﬁcients for ˆ w k and ˆ w \ k in ˆ w k ( λ ) matches those of w k (Lemma 6.2).
That is, we want λ ∗ such that
[Equation]
Simpifying gives λ ∗ =
σ 2loc /τ 2 .
Note that ˆ w k ( λ ∗ ) is the (conditional) MMSE estimator of w k .
Note that Eq.
(31) measures the generalization error because w k is the (unobserved) true center of the local data distribution around which testing data points would be drawn.
Proposition 6.5 (Optimal error gap to local training).
Denote the error of the local estimate as
[Equation]
and let ∆ loc (cid:44) E loc − E ∗ be its error gap to the optimal estimate.
Then,
[Equation]
Proposition 6.6 (Optimal error gap to FedAvg).
Denote the error of the global (FedAvg) estimate as
[Equation]
and let ∆ fed (cid:44) E fed − E ∗ be its error gap to the optimal estimate.
Then,
[Equation]
Proofs of Propositions 6.5 and 6.6.
From Corollary 6.4 we know that the error of the optimal estimator ˆ w k
( λ ∗ ) of w k is E ∗ =
σ 2 w = σ 2loc ( σ 2loc + Kτ 2 ) K
( σ 2loc + τ 2 ) .
For E loc , we know from earlier that the local estimator ˆ w k = ˆ w k (0) of w k has an MSE/variance of E loc =
σ 2loc .
For E fed , we can view ¯ w as a noisy observation of w k with MSE/variance E fed =
σ 2loc +( K − 1) τ 2 K .
The results of Propositions 6.
and 6.6 thus follow from re-arranging terms of E loc − E ∗ and E fed − E ∗ respectively.
Lemma 6.7 (Error of ˆ w k ( λ ) ).
Let E λ (cid:44) E (cid:2) (
w k − ˆ w k ( λ )) 2 | ˆ w k , ˆ w \ k , { X k } k ∈ [ K ] (cid:3) be the error of MR-MTL as a function of λ .
Then,
[Equation] [Equation]
Proof of Lemma 6.7.
The result follows from the variance of ˆ w k ( λ ) when viewed as a noisy observation of w k .
Speciﬁcally, from Lemma 6.1 we know that ˆ w k ( λ ) is an interpolation (parameterized by α (cid:44) K
+ λ (1+ λ ) K ) between ˆ w k and ˆ w \ k .
We thus have (with some rearrangement),
[Equation]
The proof of Theorem 6.8 follows directly from Lemma 6.7 by subtracting the common terms between private and non-private MR-MTL estimates.
E.5 The Case of Heterogeneous Privacy Requirements
In the main analysis, we assumed for simplicity that each silo has the same values of local dataset size n , local data sampling variance σ 2 , and DP noise variance σ 2DP .
In this section, we consider the case where each silo k has custom values for the above, denoted as n k , σ 2 k , and σ 2 k, DP , to arrive at a silo-speciﬁc “local variance” ˜ σ 2 k :
[Equation]
With a slight abuse of notation, let us use C + N ( µ, σ 2 ) to denote drawing an iid sample of Gaussian noise with mean µ and variance σ 2 and add it to some value C .
Then, following Lemma 6.2 and the same set of conditions, we can express the local model ˆ w k and the non-local model ˆ w \ k as:
[Equation]
and the true local center w k can be expressed in terms of ˆ w k and ˆ w \ k with silo-speciﬁc local variances:
Lemma E.4.
Given ˆ w k and ˆ w \ k , w k can be expressed as
[Equation]
with
[Equation]
Proof.
The proof follows similarly from Lemma 6.2: we apply Lemma E.3 to the expressions of ˆ w k and ˆ w \ k as noisy observations of w k .
From here we can derive the best λ ∗ k speciﬁc to each silo .
Theorem E.5 (Optimal λ for silo k ) .
The optimal choice of the MR-MTL regularization strength for silo k is given by
[Equation]
Proof.
The result follows from re-arranging and solving for λ ∗ k in the following equation, as in
Theorem 6.3:
[Equation]
where µ k is deﬁned in Lemma E.4.
Theorem E.5 suggests that if silos have varying local variance (as a result of varying local dataset sizes, inherent data variances, and silo-speciﬁc sample-level DP requirements), then it is optimal to have each silo choose its own λ ∗ k .
In particular, the term
[Equation]
k suggests that the optimal λ
[Equation]
k depends on how much of an “outlier” is silo k compared to the rest of silos: if it has a smaller local variance, then it beneﬁts from a smaller λ ∗ k since other silos are noisy; if it has a larger local variance, then λ ∗ k would be larger to encourage silo k to “conform”.
Note that under this simple analysis, one could have λ ∗ k < 0 (when ˜ σ 2 k > Kτ 2 + 1 K − 1 (cid:80) j
(cid:54) =
k ˜ σ 2 j ); this case stems from having a gradually larger ˜ σ 2 k and it sufﬁces to choose λ ∗ → ∞ (i.e. fall back to FedAvg training).
F Additional Details for Private Hyperparameter Tuning (§7)
In Section §7 we took an alternative view on the beneﬁts of personalization by examining the privacy cost of tuning the hyperparameter responsible for navigating the tradeoff between costs from heterogeneity and privacy.
In this section, we expand on the omitted details and provide more discussions.
F.1 Additional Background on Privacy Costs of Hyperparameter Tuning
We consider the typical hyperparameter tuning procedure (denoted as HPO) where a base algorithm
M , such as one run of a machine learning algorithm to produce a model, is executed h times with different hyperparameters and the best result is recorded.
The hyperparameters may be highdimensional; e.g. vector of learning rate and batch size.
Typically, h is a constant (e.g. we sweep a ﬁxed grid of learning rates and batch sizes).
On a high level, the works of Liu and Talwar [62] and Papernot and Steinke [79] show that, with a constant h , one can construct M where the privacy guarantee of the HPO output is (roughly) a factor of h weaker than the original privacy guarantee.
Speciﬁcally, [79] gives the following proposition that applies to both pure DP and Rényi DP (and thus related to approximate DP).
Proposition F.1 (Proposition 17 of [79]) .
For any ε > 0 and any α > 1 , there exist some algorithm
M that satisfy ( ε, 0) -DP and the corresponding HPO algorithm A that runs M for h times and returns only the best result, such that
A is not (˜ ε, 0) -DP
for any ˜ ε < hε , and 2.
A is not ( α, ˜ ε
( α ))
-Rényi DP for any ˜ ε ( α ) <
ˆ ε ( α ) where
[Equation]
Both the pure DP and RDP results suggest that running the typical HPO procedure with a ﬁxed h can be as bad as running M and h times and releasing all results.
The authors of [62] and [79] provided a mitigating strategy where one simply makes h (the number of tuning runs) a random variable.
The authors of [79] provide an improved analysis and considered two distributions for h in particular: the truncated negative binomial (TNB) distribution and the Poisson distribution.
Here, we focus on TNB as it provides a spectrum of results for privacy-utility tradeoff, allowing us to choose several points on this spectrum that offer small (but realistic) privacy overhead.
We combine it our analysis in Section §6 to motivate our discussions on the practical complications of deploying personalization methods.
Speciﬁcally, the probability mass function of the TNB distribution is given by
[Equation]
expected
[Equation]
η
[Equation] [Equation]
where η and γ are parameters of the TNB distribution.
The privacy of the HPO output using h sampled from the TNB distribution is given by the following theorem from [79].
Theorem F.2 (Theorem 2 of [79]) .
For any η > 1 , any γ ∈ (0 , 1) , and any algorithm M that satisfy both ( α 1 , ε ( α 1 ))
-RDP
and ( α 2 , ε ( α 2 ))
-RDP with α 1 > 1 and α 2 ≥ 1 , the HPO algorithm A that runs M for h times and returns only the best result with h ∼ TNB( η, γ ) satisﬁes ( α 1 , ˜ ε ) -RDP with ˜ ε
= ε ( α 1 ) + (1 + η ) (cid:18)
[Equation]
Theorem F.2 tells us that by drawing h from the TNB distribution, the privacy cost of the HPO procedure is a constant factor of the original cost of M for pure DP (when α 1 , α 2 → ∞ ), or up to a factor of log E [ h ] for approximate DP.
This substantially improves the default HPO procedure.
F.2 Interpretation of Fig.
In Fig.
7, we considered 6 pairs of ( η, γ ) to arrive at the same E [ h ] = 10 (i.e. on average we want to try 10 values of λ when tuning MR-MTL ).
Intuitively, for a ﬁxed E [ h ] , we can expect a smaller η (and consequently a smaller γ ) to give a tighter privacy guarantee from Theorem F.2 (i.e. the privacy cost of hyperparameter tuning is smaller).
At the same time, however, the TNB distribution would be more concentrated around h = 1 with a smaller η , which means we may end up trying onlyhyperparameter even when E [ h ] is large.
( η, γ ) thus provides an implicit privacy-utility tradeoff.
In Fig.
7 we chose a list of η values that favors strong privacy while being realistic, since picking η → − 1 (or just η < − 0 . 5 ) would give a even smaller privacy overhead, but it will perform very poorly utility-wise and was not considered by [79].
We then applied Theorem F.2 with these ( η, γ ) values to the the expected error of MR-MTL as a function of λ under mean estimation, by computing and applying the extra noise needed to account for the privacy cost of tuning.
Here, the closed form of the expected error of MR-MTL is derived in Lemma 6.7, but in Fig.
7 we ran numerical simulations with 500 repetitions.
Fig.
7 (a) and (c) suggests that there are settings in which, after applying Theorem F.2, the best λ ∗ one could ﬁnd would already give an error that is larger than simply running FedAvg and local training without any tuning , respectively (the green curves).
Fig.
7 (b) suggests that in less extreme cases, the private hyperparameter tuning cost would signiﬁcantly diminish the utility improvement of MR-MTL .
F.3 Implementing Hyperparameter Tuning under Silo-Speciﬁc Sample-Level DP
Under silo-speciﬁc sample-level privacy, it can be intricate to implement the improved, randomized hyperparameter tuning protocol described above in Appendix F.1.
For silo k to satisfy its own ( ε k , δ k ) sample-level DP target, it must draw h independently to all other silos, and it must only return the best result of hyperparameter tuning at the end of training (instead of returning the best model iterate at every round).
Using MR-MTL as an example, the above has several implications:
Each silo should now maintain a list of personalized models, each corresponding to a choice of λ . 2.
Depending on the speciﬁc distribution of h , silos may or may not end up trying the same set of λ values.
During training rounds, silos must return model updates for – and consequently regularize their personalized models towards – a “pivot” model using some public ¯ λ .
The analysis in Appendix E.5 suggests that having silo-speciﬁc choices of λ (#2 above) should not have adverse effects, but the above adaptations in general may inﬂuence ﬁnal utility or convergence properties in iterative learning settings.
Other more sophisticated implementation (potentially tailored to the speciﬁc personalization method) may also be possible.
It would be an interesting future direction to study the best approaches for implementing private hyperparameter tuning under silo-speciﬁc sample-level privacy.
G Future Directions for Auto-tuning / Online Estimation of λ
Apart from tuning λ for MR-MTL (or other hyperparameters for other personalization methods) non-adaptively with grid search or random search, another approach is to leverage some form of online estimation as in [97, 8, 80] (mentioned in Section §7).
That is, λ is adjusted at every training round or iteration such that it gradually converges to a good λ ∗ (in expectation).
This line of approaches would be promising if their privacy overhead (if any) can be contained within a small factor of the original privacy guarantee—smaller than that offered by the randomized tuning procedure discussed above in Appendix F.1.
However, since the hyperparameters of interest are those that navigate the tradeoff between costs from heterogeneity and privacy (such as λ for MR-MTL ), there are several factors that make auto-tuning particularly challenging in our setting:
• A universal and practical measure of heterogeneity is generally unavailable .
For MR-MTL , our analysis in Section §6 suggests that the optimal λ ∗ depends on a measure of data heterogeneity across silos ( τ 2 ).
However, in practice, the level of heterogeneity is abstract and hard to quantify even with non-private oracle access to the silo datasets.
Past work has devised custom measures of heterogeneity such as the variance of client (silo) model or gradient updates [52, 59], or the difference between the true global loss and the aggregate of the true local losses, but these measures may not be consistent throughout training [52, 59] such that they cannot provide a useful estimate of the heterogeneity which should be invariant during training.
These metrics may also simply not be obtainable in practice [60].
The work of [91] considers the use of a client-relationship matrix, but such matrix may be too large ( K 2 elements) and too noisy under privacy as we may need to directly or implicitly noise every coordinate of the matrix.
Directly estimating the dataset statistics may also be challenging, since silos may apply custom dataset transformations (e.g. standardization or augmentation) that can drastically alter such statistics without affecting the learning dynamics.
• The estimated heterogeneity may have high variance.
In addition to the above, heterogeneity would generally be measured on the client distribution (as some form of “variance” across clients, as in [52]), but there is generally a limited number of clients in cross-silo settings, meaning that this estimated “variance” as a measure of heterogeneity may itself have high variance.
Moreoever, such measures must also be estimated privately, which means that it would have even higher variance from the additional noise.
This could be problematic since the best hyperparameter for personalization may depend on such heterogeneity measure (as is the case for MR-MTL in simpliﬁed settings), and the precision of a potential auto-tuning precedure may suffer as a result.
• Auto-tuning procedures may need to be developed speciﬁcally for each method.
For example, local ﬁnetuning may use the number of federated training rounds as the hyperparameter for determining “how much” to personalize, but such hyperparameter would likely be auto-tuned in a drastically different way compared to auto-tuning for λ for MR-MTL .
It is in general an open question as to whether method-speciﬁc auto-tuning procedures will always outperform the simple randomized procedure described in Appendix F.1, in terms of both precision and privacy overhead.
H Additional Experimental Results H.1 Local Finetuning (Extension of Fig. 2)
In Fig.
[Figure]
we made the observation that local ﬁnetuning [99, 104, 19] as a personalization strategy (warm-starting from a global model and continue training using local data) may not always improve utility as expected.
Extending on Fig.
[Figure]
we examine the behavior of local ﬁnetuning starting at different stages of training (under a ﬁxed total number of rounds) as well as under varying privacy budgets in Fig.
A2.
We observe that the phenomenon illustrated in Fig.
2 is indeed reﬂected across different settings: as soon as local ﬁnetuning begins, the DP utility gap can quickly widen
[Figure]
and the utility of ﬁnetuning under privacy can roughly reduce to the utility of local training.
Note, however
[Figure]
that these observations serve to give insights into an interesting behavior of local ﬁnetuning under silo-speciﬁc sample-level DP and do not preclude the possibility that local ﬁnetuning can still outperform both local training and FedAvg.
Indeed, local ﬁnetuning was observed to outperform local training in, e
[Figure]
g., Fig.
3 (d) and Fig.
A
[Figure]
s
[Figure]
H.2 Utility of MR-MTL as a Function of λ (Extension of Fig. 5)
We also extend on Fig.
5 to consider varying privacy budgets
[Figure]
and the results are shown in Fig.
A (Vehicle), Fig.
A4 (School)
[Figure]
and Fig.
A5 (Heterogeneous CIFAR-10).
Note that on School, the test metric is MSE thus lower is better.
There are several notable observations:
• λ ∗ decreases as ε grows (weaker privacy) : With weaker privacy (larger ε ), we have a smaller optimal λ ∗ (i.e. the location of the utility “bump” under DP gradually shifts to the left).
This behavior is characterized
by Theorem 6.3, where under stronger privacy, silos beneﬁt from more federation as a means to reduce the effect of privacy noise.
[Figure] [Figure]
• MR-MTL does not always outperform FedAvg (at high privacy regimes):
One minor caveat is that Proposition 6.6 says that the utility gap from MR-MTL to FedAvg is always nonnegative under federated mean estimation; however, as discussed in Sections §5 and §6, MR-MTL does not approach FedAvg with larger λ in general learning settings since the MR-MTL objective may become too hard to solve via (DP-)SGD.
Thus, despite its utility advantage over local training at λ ∗ , it may never reach the performance of FedAvg.
See, e
[Figure]
g., subplots of ε ∈ [0 . 1 , 0 . 2] in Fig.
A3.
• Utility advantage of MR-MTL ( λ ∗ ) over local/FedAvg changes with ε : Observe that with larger
ε , the utility advantage of MR-MTL ( λ ∗ ) is larger compared to FedAvg and is smaller compared to local training.
This behavior is characterized by Propositions 6.5 and 6.6.
Note also that for Heterogeneous CIFAR-10 (Fig. A5), Ditto [57] exhibits a slightly different interpolation behavior compared to MR-MTL (e.g. it has larger optimal λ ∗ under privacy), though at λ ∗ its utility underperforms that of MR-MTL under privacy.
H.3 Subsampled ADNI Dataset
We further evaluate the suite of personalization methods on the subsampled ADNI dataset, and the results are shown in Fig.
A6.
There are several notable observations:
MR-MTL is essentially recovering local training due to the high degree of heterogeneity present in this dataset, with λ ∗ ≈ 0 for most ε values except around ε ≈ 3 . 5 (annotated with arrows in Fig.
A6 (a, b)).
Unlike results on other datasets, the privacy regime of interest where MR-MTL outperforms both local/FedAvg (around ε ≈ 4 ) is extremely narrow, compared to ε ≈ 0 .
5 for Vehicle (Fig.
3 (a)), ε ≈ 6 for School (Fig.
3 (b)), and ε ≈ 1 . 5 for GLEAM (Fig. 3 (c)).
The utility advantage of MR-MTL is also insigniﬁcant.
[Figure]
The underlying heterogeneity structure of the dataset is rather pathological in that it is not ameanable to both mean-regularization and clustering.
First, observe from Fig.
A6 (a) that MRMTL still opts for a small λ ∗ in high-privacy regimes even when FedAvg performs better; one would expect MR-MTL to opt for a larger λ for lower DP noise (at a cost of higher heterogeneity).
Second, from Fig.
A6 (b, c), we observe that both clustering and cluster-preconditoning did not lead to signiﬁcant utility improvements, although the latter reduces the degree of heterogeneity and allows MR-MTL to opt for a larger λ ∗ in the privacy regime of interest.
In general, determining how to better model such heterogeneity (especially in high privacy regimes) is an interesting direction of future work.
H.4 Additional Discussions
Behavior on larger privacy budgets (Fig. A7).
We extend the results on Vehicle (Fig. 3 (a, b)) by considering larger privacy budgets, and the results are shown in Fig.
A7.
We note that as privacy requirement loosens, personalized learning (where each silo maintains its own model) tend to perform better than the case where models are shared across clients (FedAvg and IFCA).
This is expected as clients in cross-silo datasets tend to have sufﬁcient data for learning a good local model.
Moreover, this also means MR-MTL remains competitive as it can use a smaller λ .
Effect of dataset subsampling (Fig. A8).
Subsampling local datasets would in principle turn the cross-silo learning setting closer to a cross-device learning setting, in which local training becomes less attractive as due to insufﬁcient local data and may opt for federated training despite data heterogeneity.
In Fig.
A8, we examine this behavior on the School dataset by using different train/test split ratios of 80%/20%, 50%/50%, and 20%/80%.
We observe that with less local training data: (1) FedAvg performs better since silos beneﬁt from federation despite data heterogeneity; (2) the cross-over point between local training and FedAvg shifts to larger ε (or they may not be a cross-over point); and (3) MR-MTL may no longer provide an optimal point on the personalization spectrum, since small local datasets with silo-speciﬁc sample-level DP necessitate a larger λ (cf.
Theorem 6.3) but MR-MTL may not recover FedAvg under (DP-)SGD.
In these cases, client-level DP protection (as is commonly used for cross-device FL) may be more appropriate.
[Figure] [Figure]
[Figure] [Figure]
[Figure] [Figure]