From: ICLR.cc/2021/Conference/Program_Chairs
title: Final Decision
decision: Reject
comment: This paper studies differentially private, communication-efficient training methods for federated learning. While the problem studied in this paper is well-motivated and interesting, the reviewers raised several concerns about the paper. Despite the authors' reconstruction protection explanation, the concern over large values of epsilon at the scale of 400 persists. There is not too much technical novelty since the main technique is given by prior work.

From: ICLR.cc/2021/Conference/Paper1773/Authors
title: Response
comment: We thank the reviewer for your comments. Below we address your specific points:

On choosing large epsilons: We provide a detailed introduction to the reconstruction attack and protection guarantees in the revision, and discussed the choice in the experimental section.

Structures and writing: We've adjusted according to your suggestions in the revision.

From: ICLR.cc/2021/Conference/Paper1773/Authors
title: Response
comment: We thank the reviewer for illuminating comments. Below we address your specific points:

On baseline comparisons: We've added the comparison with vqSGD. As there're relatively few works on distributed/federated learning under both privacy and communication constraints, it's hard to say whether our proposed baselines are state-of-art or not. So far as we've noticed, this is the only work that is able to train large neural models successfully under the FL setting with privacy and communication constraints. 

On privacy model: We've added a self-contained introduction of reconstruction attacks from Bhowmick et al, 2018. The granularity of privacy is indeed a very interesting point. In our paper, the protection is at the client level, but note that this implies protection at the individual data level under certain assumptions on the adversary. We take cross-silo FL for an example, protection at the client level implies that (under the local model) a strong adversary is not able to infer the precise value of the silo-aggregated gradients. This automatically provides protection against inference attack targeting individuals inside the silo, as long as the silo is a trusted aggregator for all the individuals that belong to it. In this case, the scenario is close to a silo-level central differential privacy model. Large epsilons are also applicable because of the amplification by subsampling phenomenon in central DP. We checked out the multi-central DP paper and it is a very interesting and promising work. However, it appears to us that the multiple-aggregator setup in the paper, where each individual may send its data to multiple aggregators, is somewhat too stringent under the FL setup, for which only one aggregator is needed for each client. 

On model performances: Currently, all results produced by private and communication-limited training methods have significant gaps with their non-private counterparts. It is possible to reduce this gap by adopting a more carefully designed training procedure, for example, we may shrink the gradient norm bound adaptively during training using some extra private communications, and apply more sophisticated selection procedure like the peeling procedure (Su et al, 2016), due to time limits, we will provide studies of these techniques in future versions of this paper. For the performance on FMNIST, we currently understand this as an implication of the baseline procedures high variances in high-dimension setups as ResNet110 is of a much larger dimension than LeNet5

Reference:
[1] Dwork et al, Differential private false discovery rate control, 2016

From: ICLR.cc/2021/Conference/Paper1773/Authors
title: Response
comment: We thank the reviewer for providing comments. It appears that you misunderstood our privacy model. We provide clarifications below:

On choosing high epsilons: we've added a detailed introduction of reconstruction protection schemes and showed that picking high epsilons provides decent protection against reconstruction attack, which requires a much weaker adversary as that of inference attacks assumed in local privacy models. 

On the intuition of PrivQuant: the algorithm provides a solution to locally private mean estimation problems use controllable communication levels. Previous works have proposed very efficient estimation procedures like vqSGD, but they work poorly on high-dimensional problems, this is partly because the high communication efficiency trades off accuracy too much in high dimensions. PrivQuant allows a better balance between communication and accuracy, which is important for the success of FL training with large models.

On the privacy cost of gradient subsampling: since we use uniformly random sampling, there're no additional costs for privacy (in terms of privacy budgets). Gradient subsampling strategy avoids adding too much noise to the almost-zero entries thereby improves overall accuracy, and this holds regardless of whether non-zero gradient dimensions are accrued locally.

From: ICLR.cc/2021/Conference/Paper1773/Authors
title: Response
comment: We thank the reviewer for providing comments. Below we address your specific points:

On the design of sqSGD: the motivation of sqSGD is to provide communication-efficient solutions that scale properly to high-dimensional models. Existent solutions like PM or vqSGD provides sound solutions for low-dimensional setups but performs poorly for high-dimensional setups. PrivQuant is an extension that allows controllable communication levels so that we could improve accuracy with a slight increase in communication cost. However, good distributed private mean estimation algorithms not necessarily offer good performance on high-dimensional distributed learning due to the large amount of noise injected results in too many perturbations for gradients with many almost-zero entries. Gradient sampling is a technique that exploits this fact and it turns out to be beneficial for a private distributed learning algorithm to scale to large-models. The combination of these techniques is key to the success of training large models with both private and communication constraints.

On baseline choice: the paper considers privacy protection in a "local" sense. cpSGD is a communication-efficient distributed learning algorithm that follows the central model of differential privacy, under which a trusted aggregator is assumed for the learning process which we do not require in our paper. Note that for reconstruction attacks, algorithms with central-DP guarantee do not necessarily satisfy the requirement. Hence cpSGD is not a proper comparison to sqSGD. We provide extra comparisons against vqSGD in the revision, which allows local model and serves as a reasonable baseline.

From: ICLR.cc/2021/Conference/Paper1773/Authors
title: Revision
comment: We'd like to thank all the reviewers for providing helpful comments. We've made the following updates to our paper based on your feedback:

- Reconstruction attacks and usage of high epsilons: we provide a self-contained introduction of reconstruction attack originated in Bhowmick et al, 2018 to address the misunderstandings of our experimental setup. We also add a paragraph on why epsilons are chosen as O(\sqrt{d}). Theorem 1 is also modified to state protection guarantees against both inference attack and reconstruction attack.
- Insufficient baselines: we enrich the baseline methods by vqSGD (Gandikota et al, 2019), a communication-optimal algorithm for distributed mean estimation. We match the communication level of vqSGD with sqSGD in all our experiments with a much higher effective privacy budget for vqSGD, and results showed that sqSGD outperforms vqSGD significantly in high-dimension setups.
- Structure and notations: we move the related works section upwards (section 2). We modify notations in algorithm 2 with respect to the local residuals so as not to be confused with sampling ratios. Section 2.4 in the original submission was removed since the problem was not clearly answered.

From: ICLR.cc/2021/Conference/Paper1773/AnonReviewer5
title: A new algorithm for differentially private federated learning
review: The paper proposed a differentially private training algorithm for federated learning. The target is to achieve communication reduction while keeping differential privacy during training. The proposed algorithm adds a few new components to SGD, including a privacy mechanism, a random rotation to reduce quantization error, a gradient coordinate selection mechanism to reduce communication/computation. Experiments with high \epsilon local differentially privacy guarantees are conducted. The proposed algorithm outperforms a baseline algorithm.

Overall the paper is well-organized and easy to follow. My main concern is that the paper seems incremental and the comparison with existing works is not sufficient. 

1. Out of the three components added to SGD, the random rotation scheme is from existing works and it is not the contribution of this paper. The gradient coordinate selection mechanism is just uniformly picking coordinates which quite straightforward. The main contribution seems to be the privacy mechanism which is an extension of the mechanism in Bhowmick et al., 2018 and it is not technically difficult to extend it. 

2. The experiments only compared with one baseline algorithm in literature. However, there are quite a few works on communication-efficient privacy-preserving distributed training. For example, cpSGD in Agarwal et al., 2018 is a closely related algorithm but it is not compared in experiments. If a comparison is not applicable, it is better to add more discussion on comparison with existing works to highlight the difference and contribution of this work.






rating: 5: Marginally below acceptance threshold
confidence: 4: The reviewer is confident but not absolutely certain that the evaluation is correct

From: ICLR.cc/2021/Conference/Paper1773/AnonReviewer4
title: Federated learning with local differential privacy
review: Federated learning is a distributed learning paradigm where models are learned from decentralized data sources. The paper proposes to train machine learning models with communication-efficient differentially private approaches.
I have several concerns about the work including the experimental setup.

Experimental setup:
Experiments use a privacy budget of epsilon = 400 for LeNet Models and 2000 for ResNet models. Note that differential privacy algorithms ensure that the probabilities differ by at most e^{epsilon} with high probability. This means that the probabilities can be off by  e^{400} ~ 10^170, which is higher than the number of particles in the observed universe.
The paper is very hard to accept with the current set of experimental results.

Other:
a. R_s is not defined in Section 1.2.
b. PrivQuant seems to be a very interesting algorithm, however very little intuition is provided. It would be good to describe why this algorithm is preferred over others. 
c. In Section 2.2, authors argue that one can get better results if the gradients are sparse. However note that for this to work, even the non-zero coordinates have to be relayed with differential privacy, which can add to the total privacy cost.
d. Step 14 in the algorithm: the role of r is not clear and needs to be explained more.
rating: 3: Clear rejection
confidence: 4: The reviewer is confident but not absolutely certain that the evaluation is correct

From: ICLR.cc/2021/Conference/Paper1773/AnonReviewer3
title: Improvement on low communication algorithm for private SGD.
review: ==== Overview====

This paper studies a low communication algorithm for multivariate mean estimation in the federated learning setting with differentially private communication. The algorithm uses quantization and dimension subsampling (only reporting some coordinates of the vector) to lower communication and randomized rotation (essentially applying a random orthogonal matrix) to reduce quantization error. They then apply this algorithm to ERM, using it as a subroutine in SGD. They experimentally explore the behavior of their algorithm on a number of benchmark datasets. They consider how the performance changes as they vary epsilon, the discretization parameter and the number of epochs (in SGD). 

==== Comments ==

I thought PrivQuant was an interesting algorithm. I thought the use of randomized rounding was nice, although it was also used in Bhowmick et. al ’18. It wasn’t clear to me to what degree this algorithm was an extension of the algorithm in that paper, but I thought it was clever. The series of improvements made seem to all have individually appeared in the literature before (I wasn’t familiar with the random rotation but the authors indicate that this is not new to this work), but the combination of them for solving this problem seems to be unique.

The paper does a good job of placing itself in the context of prior work. I would have liked more explanation of how vqSGD compares?

The experiments are well designed. Hyper-parameter tuning is often an issue for algorithms like this and the authors clearly state how they tune hyper-parameters heuristically. They compare their algorithm to an algorithm from the literature, which has low communication via performing dimension subsampling, at a variety of epoch and privacy levels. They always outperform the other algorithm. It wasn’t clear to me if the algorithm they compare against was the current state of the art. 

The discussion of Bhowmick et. Al ’18 was bit confusing and didn’t seem very self-contained. The authors use this paper as justification for the large local epsilon values used in the experiments. They also say that they will develop algorithms that protect against inference and reconstruction attacks. This is fine, but I think the findings and caveats of Bhowmick ’18 should be discussed more explicitly if they are used to justify the statement that high local eps algorithms protect against reconstruction attacks.

This is mainly semantics but I occasionally found the granularity of the privacy confusing. PrivQuant seems to be a locally differentially private in that each data point is privatized before it is sent to a central server. However, sqSGD is not written as a purely local algorithm, instead each client holds several data points, which they aggregate into a gradient, which is then privatized. Since PrivQuant is DP, it seems like the privacy is at the client level, not the level of individual data points? Perhaps the language of multi-central DP (https://arxiv.org/pdf/2009.05401.pdf)
 would be more helpful than local DP in the cross-silo FL setting?

Just a question for the authors: do you have any intuition for what’s happening with FMNIST? It seems much more sensitive than MNIST or EMIST

==== Presentation =

It would have been nice to see the non-private performance on the Figures to compare. The non-private seems to approach around 90% in most cases, is this around the non-private error? The authors state in the “impact of communication constraints” section that their algorithm “yields competitive results”, competitive with what?

The statement of Theorem 1 was a bit confusing. Is condition (5) required for the privacy statement and the unbiased statement? Currently it reads as being required for the unbiasedness, and its not clear whether its required for privacy.

Small:
LDP is typically attributed to Dwork, McSherry, Nissim, Smith ’07 or https://arxiv.org/pdf/0803.0924.pdf.
It might have been more intuitive to just state the definition of M(v_1,v_2) in terms of the Hamming distance. 
It would be nice to have some intuition for the statement about the quantization error at the start of section 2.3 since that wasn’t obvious to me. 
At one point the authors refer to “raw perturbed gradients”, is this unquantized?
rating: 6: Marginally above acceptance threshold
confidence: 3: The reviewer is fairly confident that the evaluation is correct

From: ICLR.cc/2021/Conference/Paper1773/AnonReviewer2
title: Review
review: This paper studies FL under local differential privacy constraints. They identify two major concerns in designing practical privacy-preserving FL algorithms: communication efficiency and highdimensional compatibility, and develop a gradient-based learning algorithm sqSGD that addresses both concerns. They improve the base algorithm in two ways: First, apply a gradient subsampling strategy that offers simultaneously better training performance and smaller communication costs. Secondly, utilize randomized rotation as a preprocessing step to reduce quantization error. 

There are also some parts need to be improved. For example, putting the related work as Section 3 is not proper. For the experiments, the epsilon is too large for privacy protection as 400 and 2000,. For this level, the privacy is not well protected. For the baseline PM, which performs well when epsilon is small. But in this paper, the comparison is only about large epsilon.

They are some typos/errors here:
After Eq(1), it needs a space before ‘M’
Different fonts for “cross-silo”
The first sentence of the last paragraph on Page 2, capitalize the first letter.
Eq(4), it should be k^* rather than k
In Algorithm 1, parameter \tau is not introduced
rating: 5: Marginally below acceptance threshold
confidence: 2: The reviewer is willing to defend the evaluation, but it is quite likely that the reviewer did not understand central parts of the paper