# Personalized Privacy-Preserving Framework
for Cross-Silo Federated Learning

Van-Tuan Tran, Huy-Hieu Pham, Member, IEEE and Kok-Seng Wong*, Member, IEEE
*Corresponding author: Kok-Seng Wong<EMAIL_ADDRESS>Hieu H. Pham and
Kok-Seng Wong are with the College of Engineering and Computer Science (CECS),
VinUniversity, Hanoi, Vietnam. Van-Tuan Tran, Hieu H. Pham, and Kok-Seng Wong
are with the VinUni-Illinois Smart Health Center (VISHC), VinUniversity,
Hanoi, Vietnam.

###### Abstract

Federated learning (FL) is recently surging as a promising decentralized deep
learning (DL) framework that enables DL-based approaches trained
collaboratively across clients without sharing private data. However, in the
context of the central party being active and dishonest, the data of
individual clients might be perfectly reconstructed, leading to the high
possibility of sensitive information being leaked. Moreover, FL also suffers
from the nonindependent and identically distributed (non-IID) data among
clients, resulting in the degradation in the inference performance on local
clients’ data. In this paper, we propose a novel framework, namely
Personalized Privacy-Preserving Federated Learning (PPPFL), with a
concentration on cross-silo FL to overcome these challenges. Specifically, we
introduce a stabilized variant of the Model-Agnostic Meta-Learning (MAML)
algorithm to collaboratively train a global initialization from clients’
synthetic data generated by Differential Private Generative Adversarial
Networks (DP-GANs). After reaching convergence, the global initialization will
be locally adapted by the clients to their private data. Through extensive
experiments, we empirically show that our proposed framework outperforms
multiple FL baselines on different datasets, including MNIST, Fashion-MNIST,
CIFAR-10, and CIFAR-100. The source code for this project is available at
https://github.com/vinuni-vishc/PPPF-Cross-Silo-FL.

###### Index Terms:

Cross-Silo Federated Learning, Differential Privacy, Generative Adversarial
Networks, Personalized Federated Learning.

##  1 Introduction

Although deep learning (DL) approaches have achieved significant
accomplishments in a wide range of applications [1, 2, 3], there exists
several fundamental challenges [4] that yet need to be addressed in order to
enable its complete power. Due to data sovereignty and data privacy concerns,
one major problem is the difficulty in the centralization of the local data
from multiple clients to one central server. In order to guarantee the
privacy-preserving in training schemes, federated learning (FL) framework [5]
is proposed to allow multiple entities (e.g., individuals, or organizations)
collaboratively train a DL model under the coordination of a central server.
Specifically, each client’s data is trained and stored locally, and only
updated gradients are transferred to the server for aggregation purposes. By
keeping the training data locally and in a decentralized fashion, FL
approaches can alleviate many of the systemic privacy risks of traditional
centralized DL methods [6].

However, under FL’s naive implementation, there are several key challenges
[7], including private information leakage, verifiable computation, expensive
communication costs, and statistical heterogeneity. In the scope of this
research, we focus on the problem of private information being divulged in FL
settings. Generally, despite the local training without data exchange between
the server and clients, private information can still be leaked to some extent
from the local gradients through inversion attacks [8, 9, 10, 11, 12]. More
seriously, as the central server holds full control of observing and modifying
the shared global model, sensitive information can also be eavesdropped on by
the server. For instance, Boenisch et al. [13] identified that an active-and-
dishonest server can set up trap weights for recovering the clients’ data with
zero reconstruction loss.

With the aim of limiting information disclosure about private data, a state-
of-the-art privacy-preserving technique was proposed by Dwork et al. [14],
known as differential privacy (DP). The central principle of this technique is
to add curated noises to the computational steps to perturb the sensitive
information. In general, there are two approaches to incorporating DP into FL
settings: global DP [15] and local DP [16]. Under global DP, clients are
assumed to trust the centralized server, and noises are added by the server;
while under local DP, each client perturbs its information locally prior to
sharing it with the server without requiring trust in a server [17]. Despite
the addition of noises, global DP approaches cannot ensure privacy
preservation in the case of the server being dishonest. Therefore, in this
research, we concentrate on the local DP scenario to enhance the privacy
protection of the clients against gradient leakage and parameter modification.

Another issue in FL is the non-independent and identically distributed (non-
IID) [18, 19], caused by the heterogeneity in local data distributions among
clients. In particular, in non-IID scenarios, different clients train models
from different data distributions, which leads to the performance degradation
of the aggregated model. This problem was especially taken into consideration
in the cases of cross-silo FL where clients are large entities (e.g.,
companies, institutions, and hospitals), and their private data may be greatly
different in size and partitioning [20]. There are plenty of approaches
introduced for handling non-IID problems, such as sharing data with the server
[21], fine-tuning the local models after obtaining the aggregated model [22,
23], adding personalized layers in local models [24], and transferring
knowledge from the server to a certain client [25, 26]. While those methods
mitigate the non-IID data distribution in FL in some cases, they inevitably
increase the risk of privacy leakage and a large number of hyperparameters
[18].

###  1.1 Our Contributions

In this work, to mitigate the above challenging FL problems, we propose a
Personalized Privacy-Preserving Federated Learning (PPPFL) framework for
cross-silo FL, a novel framework that allows local clients simultaneously
protect their own initial data at the instance-level and achieve a
personalized model. To the best of our knowledge, this study is the first to
marry two lines of research in FL on privacy-preserving and non-IID data, to
achieve both differential privacy guarantees and better convergence
performance. This framework consists of two computational stages: server-side
computations and client-side computations. In terms of the former stage,
building on meta-learning methods, the primary goal is to find an initial
global model shared between all clients which performs well after each client
updates it with respect to its own generated artificial data (Section 4.2.3).
In this way, the final model implemented by each local client can achieve
stronger generalization guarantees and more personalized adaptation. Regarding
the latter stage, each local client generates synthetic data by training a
differentially private data generative model (Section 4.2.4). Those data are
then utilized for collaboration purposes in the Federated training phase,
therefore preventing sharing of the raw data (Section 4.2.2). Moreover, we
also focus on cross-silo FL as attention put on applying FL to multiple large
organizations has greatly grown [27, 28]. Therefore, it is sufficient for our
proposed GANs-based framework to guarantee the DP in cross-silo FL.

We summarize our contributions as follows:

  * •

We propose a PPPFL, a novel framework that not only prevents information
leakage but also tackles the non-IID issue. To the best of our knowledge, we
are the first to introduce a new approach to provide the instance-level
privacy-preserving and address data heterogeneity in FL.

  * •

We first consolidate several advantages of DataLens into a single FL framework
to provide instance-level DP, helping to minimize the risks of sensitive
information leakage.

  * •

We introduce a new variant of FedMeta in terms of personalization and
convergence by incorporating the clients’ privacy budgets and gradient
stabilization techniques into the optimization process.

  * •

We conduct thorough experiments and ablation studies to demonstrate the
effectiveness of the proposed approach on different datasets.

The rest of this paper is organized as follows. Related works on privacy-
preserving FL and non-IID challenges in FL are reviewed in Section 2. In
section 3, we introduce backgrounds on threat models, differential privacy,
data generative models, and optimization-based meta-learning methods. Section
4 first presents our problem formulation and details of the proposed method,
then performs a rigorous analysis of its privacy guarantee and convergence.
Section 5 provides extensive experiments on multiple benchmark datasets.
Finally, section 6 discusses the experimental results, some key findings, and
limitations of this work and concludes the paper.

##  2 Related Works

Privacy-preserving FL. Because of the Active-and-dishonest threat server, in
this work, we mainly focus on local DP in which noise addition is conducted by
each local client to prevent perfect extractability of individually private
information. Many DP approaches based on the SGD algorithm have been proposed
to protect the privacy of clients. Sun et al. [29] used the adaptive range of
clients’ weights to achieve better-aggregated model performance, especially in
deeper models, and leveraged parameter shuffling as an extra layer of privacy
protection. Meanwhile, [30] allowed the individual clients to define their own
local privacy setting by developing a local training approach and a parameter
update sharing method, based on Condensed Local Differential Privacy with
Exponential Mechanism [31]. In order to minimize the tradeoff between the
privacy budget and the convergence performance, Wei et al. [32] proposed a DP-
SGD-based communication rounds discounting method.

Another approach to mitigating the privacy concern for data sharing is to
utilize generative models. The key idea of this approach is consolidating
generative models to locally synthesize data, and then these generated data
would be sent to the server by clients for collaboration. Chen et al. [33]
first leveraged the power of autoencoder in FL that allows clients to generate
their own artificial data by independently feeding their private data into the
autoencoder. Under the FL framework and DP thinking, [34] introduced FedDPGAN
for COVID-19 pneumonia detection without compromising patients’ sensitive
information. In this method, each medical institution adds Gaussian noise in
training gradients, and then parameters are sent to the server for training
COVID-19 diagnostic models collaboratively.

However, those approaches have not taken non-IID data into consideration which
inevitably causes a deterioration in the accuracy of FL. In this research, we
not only handle privacy concerns but also focus on non-IID problems. Moreover,
in real-world industrial environments which is referred to as the cross-silo
setting, [35] utilized RAPPOR [36] and optimized unary encoding that can
efficiently control the privacy budgets and address the massive data
distribution in many industrial applications (e.g., healthcare, smart cities).
Inspired by this work, we also provide a framework for privacy-preserving FL
to be utilized under cross-silo settings, potentially with untrusted parties.

Solving the non-IID problem in FL. Due to the heterogeneity in participants’
data distributions, possessing a global model that can fit all the models
among the parties is difficult [20]. To handle this issue, personalization
approaches have received much attention recently. The early work [37] cast the
personalization problem as a multi-task learning problem, which generates
separated but associated models for each client. Meanwhile, [24, 38] allowed
each client to have personalized layers followed by base layers, and only the
base layers are shared with the parameter server. This approach is able not
only to boost the learning performance of FL on unknown heterogeneous data but
also to reduce the communication costs since clients are not necessarily to
share the whole model with the server. Knowledge distillation is also a
promising approach for personalized FL with the main idea of transferring
knowledge from the server or other clients to a particular client to enhance
its performance on non-IID data. Transfer learning is utilized by [25, 26], in
which Liu et al. incorporated additively homomorphic encryption (HE) and
secret sharing while Lin et al. leveraged an ensemble distillation strategy
respectively, to allow knowledge to be shared without compromising user
privacy. Another important chart of knowledge distillation is federated domain
adaptation which aims at eliminating the differences between data shards
between clients [39, 40]. The most effective and powerful personalization
method is to incorporate meta-learning within FL. MAML [41] has been leveraged
in [42], where authors proposed Personalized FedAvg to seek a proper
initialization model for the clients that can be easily updated with the local
data of each client after the training phase.

Motivated by meta-learning approaches, we also take advantage of MAML to
provide personalized models for clients with non-IID data but introduce a
stabilized version of MAML that is more easily convergent compared to that in
[42]. Similar to studies [43, 44], our work also emphasizes on cross-silo FL
to address challenges in real-world settings, such as high coordination and
operational cost [20].

##  3 Preliminaries

In this section, we provide the details of threat models in privacy when it
comes to the existence of an active-and-dishonest server. Next, we provide
some background knowledge on DP and the local DP guarantees in FL. Finally, we
briefly discuss Optimization-based Meta-learning through the MAML [41]
framework. We also summarize the crucial notations used in this paper in Table
I.

TABLE I: Main notations used in the paper.

$\theta$ | Global model’s parameters
---|---
$\theta_{i}$ | Local model’s parameters in client $i$
$D_{i}$ | Secret (private) dataset in client $i$
$\mathcal{G}_{i}$ | Local DP data generator of client $i$ trained from $D$
${D^{*}}_{i}$ | Synthetic dataset of client $i$ generated by $\mathcal{G}_{i}$
$\epsilon_{i}$ | Privacy budget chosen by client $i$ when training $\mathcal{G}_{i}$
$\alpha^{*}$ | Inner learning rate when training local model $\theta$ using synthetic data ${D^{*}}$
$\beta^{*}$ | Outer learning rate when server aggregate local models $\theta$

###  3.1 Threat models

Semi-honest server. In this type of server, all participated parties follow
the protocol specification to perform the computation task but they may try to
infer the data of other parties from the received intermediate computation
results [45].

Geiping et al. indicated that through data recovery attacks [46], the
gradients of any fully connected (FC) layers followed by a ReLU activation
function $\mathbf{y}=\textsc{ReLU}(W\mathbf{x}+\mathbf{b})$ contain the
training data point $\mathbf{x}$ that may result in the possibility of the
original data being reconstructed from the knowledge of the parameter
gradients. Formally, when the $i^{th}$ neuron of a FC layer is fired (i.e.,
$\mathbf{w}_{i}^{T}\mathbf{x}+b_{i}>0$), the data point $\mathbf{x}$ can be
reconstructed by computing
$\mathbf{x}^{T}=\left(\frac{\partial\mathcal{L}}{\partial
b_{i}}\right)^{-1}.\left(\frac{\partial\mathcal{L}}{\partial\mathbf{w}_{i}^{T}}\right)$,
where $\mathbf{w}_{i}^{T}$ be the $i^{th}$ row in the weight matrix and
$b_{i}$ be the $i^{th}$ component in the bias vector. Consequently, a passive
attacker (e.g., semi-honest server) can extract roughly 20% of arbitrary data
points from a batch size $B=100$ for 1000 neurons on ImageNet [46].

Active-and-dishonest server. Due to the existence of the data leakage through
gradients of the FC layer, Boenisch et al. has raised high privacy-related
concerns in FL settings as the central party holds full control of observing
and modifying the shared gradients. Although the addition of the calibrated
noise into the users’ data or shared parameters can prevent the data
reconstruction attack [47, 48, 49], these implementations provide virtually no
protection against a non-honest server since the additional step is performed
by the server but not the clients themselves. Therefore, it is evident that
for the active-but-dishonest server, no privacy guarantees can be provided to
the clients. In this paper, our goal is to design a differentially private
framework, which ensures that the synthetic data instead of the sent
parameters are differentially private. By this setting, clients only send the
model’s parameters trained with DPGAN-by generated data to the server for
collaboration; thus differential privacy can be guaranteed even in cases of a
non-honest central party.

###  3.2 Differential Privacy

$(\epsilon-\delta)$ Differential Privacy proposed by Dwork et al.[14] is
currently a strong criterion for privacy preservation of distributed data
processing systems. It provides a guarantee that adversaries cannot infer
sensitive information about individuals based on the algorithm outputs. Some
formal definitions and concepts of types of DP in general and in FL are as
follows.

######  Definition 1.

$(\epsilon-\delta)$ Differential Privacy

Given a randomized mechanism $M$ and adjacent datasets $D$ and $D^{\prime}$,
$M$ satisfies $(\epsilon,\delta)$-differential privacy, if for all outputs $O$
of $M$ and for all possible sets $S$ of outputs

$\begin{array}[]{rl}Pr[M(D)\in S]&\leq\exp(\epsilon)*Pr[M(D^{\prime})\in
S]+\delta.\end{array}$

This definition captures the idea that the probability of any particular
output should not be significantly affected by the presence or absence of any
individual’s data in the general dataset. The parameters $\epsilon$ and
$\delta$ control the strength of the privacy guarantee, with smaller values of
$\epsilon$ and $\delta$ indicating a higher degree of privacy preservation.

######  Definition 2.

$(\lambda,\alpha)$-Renyi Differential Privacy

A randomized mechanism ${M}$ guarantees $(\lambda,\alpha)$-RDP with
$\lambda>1$, if for any neighboring datasets $D$ and $D^{\prime}$

$D_{\lambda}\left({M}(D)|{M}\left(D^{\prime}\right)\right)=\frac{1}{\lambda-1}\log\mathbb{E}_{x\sim{M}(D)}\left[\left(\frac{\operatorname{Pr}[{M}(D)=x]}{\operatorname{Pr}\left[{M}\left(D^{\prime}\right)=x\right]}\right)^{\lambda-1}\right]\leq\alpha.$

######  Theorem 1.

(From RDP to DP [50])

If a mechanism $\mathcal{M}$ guarantees $(\lambda,\alpha)$-RDP, then it also
guarantees $\left(\alpha+\frac{\log
1/\delta}{\lambda-1},\delta\right)$-differential privacy for any
$\delta\in(0,1)$.

Local DP and Global DP. In FL, global differential privacy (global DP) refers
to a privacy-preserving technique in which a trusted aggregator adds noise to
multiple users’ data or parameter updates to protect their privacy. The noise
is added using a DP mechanism, which is designed to ensure that the noise is
sufficient to prevent the identification of any individual user’s data, even
when the aggregator has access to the data of all users. However, when the
central server, or aggregator, is active and dishonest, it could identify the
data of individual users. Hence, local DP adds noise to the data locally
before it is sent to the central server or transmitted over an insecure
network.

User-level DP and instance-level DP in FL. User-level DP is a variant of local
DP used when the data consists of a smaller number of samples associated with
specific users, and the focus is on protecting the privacy of the users rather
than the privacy of the individual data points.

On the other hand, instance-level differential privacy is generally more
robust than user-level DP because it provides stronger privacy guarantees for
individual data samples. Particularly, instance-level DP ensures that the
probability of an adversary learning sensitive information about a specific
data point is bounded by a small privacy budget. Moreover, instance-level DP
is easier to implement and apply in practice than user-level DP, as it does
not require tracking or identifying specific users or user groups in the
dataset, thus making it more flexible and easier to use, especially in the
context of cross-silo FL [51, 32, 52].

###  3.3 Differentially Private Data Generation

Generative Adversarial Networks (GANs) are generative models that consist of a
generator and a discriminator, which are trained to play a minimax game to
generate synthetic data that is similar to a given dataset. More formally, the
generator $\mathcal{G}$ maps from a noise variable $z\sim p_{z}(z)$ to a fake
sample $\mathcal{G}(z)$ and to trick the discriminator $\mathcal{D}$ from
classifying fake sample against real sample $x\sim p_{r}(x)$. The loss
function can be formulated as

$\begin{split}\min_{\mathcal{G}}\max_{\mathcal{D}}L(\mathcal{D},\mathcal{G})&=\mathbb{E}_{x\sim
p_{r}(x)}[\log\mathcal{D}(x)]\\\ &\quad+\mathbb{E}_{z\sim
p_{z}(z)}[\log(1-\mathcal{D}(\mathcal{G}(z)))].\end{split}$

GANs are successfully utilized in plenty of applications [53], such as image
in-painting, image super-resolution, image-to-image translation, language, and
speech synthesis. Due to the high expressiveness of deep neural networks in
modeling the data distribution, DL-based generative models can output high-
fidelity samples. However, similar to other DL-based architectures, GAN models
are also vulnerable to several privacy violation attacks [33] that might
extract massive sensitive information from generated data. In order to provide
rigorous privacy guarantees to synthetic data, many approaches adopted DP in
GANs in hopes of enabling high learning efficacy without disclosing much
sensitive information about individuals within the training set. DP-GAN [54]
and DP-CGAN [55] are two earlier approaches introduced to adapt DP-SGD [56] to
GAN. The principle of this method is to add calibrated Gaussian noise to the
discriminator gradients during the training step. Later, in order to address a
major limitation of prior studies related to privacy budget explosion,
Papernot et al. [58] integrated the off-the-shelf Private Aggregation of
Teacher Ensembles (PATE) framework [57] into GAN to provide better privacy
budget usage while mitigating the sensitive data disclosure. Specifically,
PATE-GAN first learns a set of teacher discriminators on a disjoint subset of
training data and then aggregates the output of these teacher models to train
a student discriminator. Another variant, G-PATE [59] improved PATE-GAN by
directly training scalable differentially private student generators to
preserve high generated data utility. Nevertheless, those still cannot
generate differentially private high dimensional data with strong privacy
guarantees. By combining the PATE framework with a $top-k$-based proposed
noisy gradient compression and aggregation strategy TopAgg, DataLens [60]
demonstrated the capability of generating high-dimensional data with limited
privacy budgets and communication-efficient distributed learning,
outperforming PATE-GAN and G-PATE. Taking inspiration from DP-GAN, especially
DataLens, we can enjoy the benefits of them to synthesize high-utility data
while protecting individual training information. We provide a detailed
description in Section 4.2.2 and 4.2.3.

###  3.4 Optimization-based Meta-learning

The goal of meta-learning is to train a model that can quickly adapt to a new
task, based on only a few examples, through two phases: meta-learning and
adaptation. To achieve effectiveness, the meta-learning problem treats entire
tasks as training samples. Optimization-based approaches cast the adaption
part of the process as an optimization problem [41]. This aims at establishing
initial model parameters $\theta$ through learning from $T$ number of similar
tasks, which can perform well on a new task $T+1$. Formally, given a task
$\mathcal{T}$, and its associated training and validation dataset
$(\mathcal{D}^{tr},\mathcal{D}^{val})$, the optimal parameter $\theta^{*}$ for
$\mathcal{D}^{tr}$ is calculated by a gradient descent step

$\theta^{*}=\theta-\alpha\nabla_{\theta}\mathcal{L}(\theta,\mathcal{D}^{tr}),$

where $\mathcal{L}$ is the loss function, each $\mathcal{D}$ contains
observations $X$ and corresponding targets $y$, $\mathcal{D}=\\{X,y\\}$.
Different from transfer learning, we need to optimize the initial parameter
$\theta$ such that it would perform well on the validation set
$\mathcal{D}^{val}$. In meta-learning, this step is known as the meta-training
step

$\theta=\theta-\beta\nabla_{\theta}\mathcal{L}(\theta^{*},\mathcal{D}^{val}).$

For multiple tasks
$\mathcal{T}=\\{\mathcal{T}_{1},\mathcal{T}_{2},...,\mathcal{T}_{t}\\}$, the
optimal parameter $\theta^{*}$ for a task $\mathcal{T}_{i}$ is computed

$\theta^{*}_{i}=\theta-\alpha\nabla_{\theta}\mathcal{L}(\theta,\mathcal{D}^{tr}_{i}),$

with the corresponding updating rule

$\theta=\theta-\beta\nabla_{\theta}\sum_{i}{\mathcal{L}(\theta^{*}_{i},\mathcal{D}^{val}_{i})}.$

A task $t$ contains i.i.d. observations $X_{t}$ and their corresponding
targets $y_{t}$. Similarly, to evaluate a meta-learning algorithm, one usually
split each task’s data $(X_{t},y_{t})$ into the training (support) set
$(X_{t}^{tr},y_{t}^{tr})$ and validation (query) set
$(X_{t}^{val},y_{t}^{val})$. If we define
$\mathcal{L}_{t}:\mathbb{R}^{d}\rightarrow\mathbb{R}$ as the loss
corresponding to task $t$.

Meta-training is to learn a model that can adapt to new tasks quickly and
efficiently using only a small number of gradient descent steps, without the
need for extensive training data. Formally, the training objective function
can be formulated as follows

$L^{train}(\theta)=\frac{1}{T}\sum_{t=1}^{T}{\mathcal{L}\left[\left(\theta;X_{t}^{tr},y_{t}^{tr}\right);X_{t}^{val},y_{t}^{val}\right].}$

(1)

Meta-testing is the process of evaluating the performance of a model that has
been meta-trained on a set of new tasks. During meta-testing, the model is
presented with a novel task that is similar but has not been seen during meta-
training. The empirical risk on novel task $T+1$ can be formulated as follows

$\begin{split}L^{test}(\theta)&=\mathbb{E}_{(X_{T+1},y_{T+1},(x^{\prime},y^{\prime})\sim
p_{T+1})}\\\
&\quad\mathcal{L}\left[(\theta;X_{T+1},y_{T+1});x^{\prime},y^{\prime})\right].\end{split}$
(2)

Figure 1: The overall architecture of the PPPFL framework consisting three
consecutive stages. First, each participant locally synthesizes DP-guaranteed
dataset ${D^{*}}$ by training their own DP-data-generator $\mathcal{G}$ from
secret dataset $D$. Next, in the federated training process, the synthetic
data, which have been respectively separated into a training set
${D^{*}}^{tr}$ and held-out validation set ${D^{*}}^{val}$, will be used to
update the global model parameters $\theta$. Lastly, the clients get emerged
from the federated training rounds and perform updates to their local model
parameters $\theta^{*}$ based on their secret training data $D^{tr}$ and
evaluate their new locally adapted model with respect to the secret validation
set $D^{val}$.

##  4 Methodology

In this section, we present a formal problem formulation in which the goal is
to enhance privacy in personalized Federated Learning. We then proceed to
describe our proposed solution to this problem, the PPPFL framework, in
detail. This includes a step-by-step description of the process, beginning
with the training of local models on the client side and culminating in the
federated collaboration between the clients and the server. Finally, we
provide theoretical proof demonstrating the privacy and convergence guarantees
of the PPPFL framework.

###  4.1 Problem Formulation

Privacy-preserving FL. Given a set of $K$ clients $\\{c_{1},\dots,c_{K}\\}$
sampled from a client distribution $\mathcal{C}$ and an un-trusted server $S$.
Each $i^{th}$ client has its own private dataset $D_{i}$ and all clients’
datasets are non-IID. In this research, we mainly study the common non-IID
scenario where the local data distribution $\Pr(x_{i},y_{i})=\Pr(x_{i}\mid
y_{i})\Pr(y_{i})$ with the label distribution $\Pr(y_{i})$ is different among
clients. For the evaluation purpose, local private datasets $D_{i}$ are
divided into training $D_{i}^{tr}$ and testing $D_{i}^{val}$ sets, such that
$D_{i}=D_{i}^{tr}\cup D_{i}^{val}$. Due to the concern of the active-and-
dishonest server $S$, the private datasets will be kept locally and never be
used for the federated training phase. Instead, clients train their own
personalized synthetic data generator $\mathcal{G}_{i}$, and then use the
generated datasets ${D^{*}}_{i}^{tr}$ and ${D^{*}}_{i}^{val}$ with
${D^{*}}_{i}=\mathcal{G}_{i}(D_{i})$ for collaboration. The privacy budget
$\epsilon_{i}$ in each $\mathcal{G}_{i}$ is customized by the clients.

Personalized FL. The goal is to find an initial shared model that can perform
well after each client updates it with respect to its own gradients.
Specifically, the central party uses synthetic datasets ${D^{*}}_{i}$ to meta-
learn a generalized model parameterized by $\theta$ from the updates sent by
the clients. Therefore, this model can be later personalized by each client
with its own corresponding private data $D_{i}$. The support set
${D^{*}}_{i}^{tr}$ and a query set ${D^{*}}_{i}^{val}$, and the meta-model
will be locally adapted to the private data set $D_{i}^{tr}$ and evaluated on
$D_{i}^{test}$ by the clients.

Considering the meta-train tasks and meta-test tasks $t\sim\mathcal{T}$ are
now the clients $i\sim\mathcal{C}$ with the synthetic ${D^{*}}_{i}$ and
private data $D_{i}$, respectively. The meta-training objective function in
Eq. 1 can be re-written as

$L(\theta)=\mathbb{E}_{c\sim\mathcal{C}}\mathcal{L}\left[\left({\theta};{D^{*}}_{c}^{tr}\right);{D^{*}}_{i}^{val}\right].$
(3)

###  4.2 Our Proposed Framework

We first introduce the data flow in each client and the central server. Then,
we present our techniques to overcome the challenges of gradients instability
[61] when using MAML [41] as the optimization-based meta-learning algorithm,
and the computational steps of the DataLens [60] architecture.

Algorithm 1 Computational steps on the clients

1:client data $D$, client model $\theta$, fine-tuning steps $\gamma$

2:adapted model $\hat{\theta}$

3:// Before collaborative training

4:for each client $c\in\mathrm{C}$ do

5: $\mathcal{G}_{c}\leftarrow\textsc{DP-GAN Training}(D_{c}$) 4 // Training
the DP data generator

6: (i) $D_{c}\leftarrow D^{tr}_{c}\cup D^{val}_{c}$ // Locally data
partitioning

7: (ii)
${D^{*}}^{tr}_{c}\leftarrow\mathcal{G}_{c}(D^{tr}_{c}),{D^{*}}^{val}_{c}\leftarrow\mathcal{G}_{c}(D^{val}_{c})$
// Synthesizing DP data

8:end for

9:Federated Training 3 // After collaborative training

10:for each client $c\in Q$ do

11: (iii)
$\hat{\theta}_{c}\leftarrow\theta_{c}-\gamma\ast\nabla_{\theta_{c}}\mathcal{L}_{c}$
$\mathcal{L}_{D^{tr}_{c}}(\theta_{c})\leftarrow\frac{1}{\mid
D^{tr}_{c}\mid}\sum_{\left(x,y\right)\in
D^{tr}_{c}}{\ell(f_{\theta_{c}}\left(x\right),\ y)}$ // Locally fine-tuning

12:end for

####  4.2.1 Method Overview

We now briefly illustrate the proposed PPPFL framework, which includes 3 main
phases: local data generation, federated training, and local adaptation (as
depicted in Fig. 1). In our method, the DP gradient compression and
aggregation approach and the optimization-based meta-learning algorithm serve
as key components which help the PPPFL prevent individual information
disclosures and improve the consistency among local models.

In the first stage, to limit sensitive information leakage, each client
generates its own artificial data through DataLens. DataLens [60] is a state-
of-the-art privacy-preserving data generative model, which is capable of
generating high-dimensional data without leaking private information.
Motivated by this novel DP-GAN model, our framework integrates it to enable
each client to add noises to their own data through a training approach
(Section 4.2.4). After this data generation step, the synthetic data
${D^{*}}_{i}$ of each $i^{th}$ client is used for the federated training,
which helps to protect the original data $D_{i}$ as $D_{i}$ is kept locally by
each client.

Algorithm 2 Aggregations On The Server

1:initial model $\theta_{0}$, outer learning rate $\beta^{*}$

2:aggregated model $\theta$

3:Initialize global model $\theta\leftarrow\theta_{0}$

4:for each communication round $t=1,2,\dots$ do

5: Sample a set $U_{t}$ of $m$ clients and distribute $\theta_{0}$ for the
sampled clients

6: for each client $c\in U_{t}$ in parallel do

7: $g_{i}\leftarrow\textsc{Federated Training}(\theta_{i})$ 3

8: $\theta\leftarrow\theta-\frac{\beta^{*}}{m}\sum_{c_{t}}g_{i}$

9: Update the global model

10: end for

11:end for

Next, during the Federated training phase (as shown in Algorithm 3), at the
beginning of each communication round between clients and the server, each
client downloads the weights of a global model. For every following
communication round, the clients perform gradient decent updates on the
synthetic training data ${D^{*}}^{tr}$. For the inference step, clients will
get feedback by calculating the gradients on the synthetic validation dataset
${D^{*}}^{val}$ with respect to their own local models, and then send those
feedback signals to the server for collaboration (as shown in Algorithm 1).
Based on those shared signals and clients’ models, the global model is updated
by the server (as shown in Algorithm 2).

After the collaboration rounds stop, the clients locally conduct the
adaptation phase by performing gradient descent updates on their latest model
downloaded from the server with respect to the local private datasets (as
shown in Algorithm 1) to get better inference performance.

Algorithm 3 Federated Training

1:client synthetic data ${D^{*}}_{i}^{tr},{D^{*}}_{i}^{val}$, initial model
$\theta_{0}$, inner learning rate $\alpha^{*}$

2:updated model $\theta^{*}$

3:Initialize the local model $\theta\leftarrow\theta_{0}$

4:for each communication round $t=1,2,\dots$ do

5: ClientUpdate($\theta_{i}$, ${D^{*}}_{i}^{tr}$)

6:
$\mathcal{L}_{D^{*}_{c}}^{val}(\theta_{c})\leftarrow\frac{1}{|D^{*val}_{c}|}\sum_{(x^{\prime},y^{\prime})\in
D^{*val}_{c}}{\ell(f_{\theta_{i}}(x^{\prime}),y^{\prime})}$

7: Compute the query loss

8:
$g_{i}\leftarrow\nabla_{\theta_{i}}\mathcal{L}_{{D^{*}}_{i}^{val}}\left(\theta_{i}\right)$

9: Uploading $g_{i}$ to the server

10:end for

11:function ClientUpdate($\theta_{i}$, ${D^{*}}_{i}^{tr}$)

12:
$\mathcal{L}_{{D^{*}}_{c}}^{tr}\left(\theta_{c}\right)\leftarrow\frac{1}{\left|{D^{*}}_{c}^{tr}\right|}\sum_{\left(x,y\right)\in{D^{*}}_{c}^{tr}}\ell\left(f_{\theta_{i}}\left(x\right),y\right)$

13:
$\theta_{i}\leftarrow\theta_{i}-\alpha^{*}*\nabla_{\theta_{i}}\mathcal{L}_{D^{*tr}_{i}}$

14:end function

####  4.2.2 Client-side computations

In this framework, besides the gradient sharing process with the server, the
clients need to compute two extra steps, which are described in Algorithm 1.
First, to ensure the instance-level DP for the framework, each client needs to
train a differentially private data generator to synthesize their own dataset
which is then used for collaboration. Under this setting, our framework can
provide stronger privacy guarantees for individual data samples, mitigating
information disclosure problems. The second additional step is that clients
are expected to perform a local adaptation step on their kept private data
after receiving the well-initialized parameters from the central party. This
step contributes to the generation of a generalized and personalized model for
each client. We assume two added steps are trivial as the clients are large
organizations with high computational power.

####  4.2.3 Server-side computations

Different from other FL settings [5], instead of naively aggregating
parameters sent by clients, the objective of the server in our setting is to
seek the best initialization which performs greatly after each client updates
with respect to its own local private dataset. To accomplish this goal, the
server aggregates shared parameters and feedback signals sent by clients
$(\theta,g)$, where $g$ is the feedback signals and $\theta$ are clients’
parameters. However, there always exists a trade-off between the privacy
budget and utility, in which higher $\epsilon$ implies higher utility but
lower privacy and vice versa. Moreover, as the $\epsilon$ value is controlled
by each client, this trade-off is amplified due to the difference in clients’
settings. Therefore, it would be more efficient if the server can integrate
clients’ privacy budget information into its optimization procedure. In other
words, the objective function in PPPFL when having multiple $\epsilon$ as

$L(\theta)=\mathbb{E}_{c\sim\mathcal{C}}\left[\frac{e^{\frac{\epsilon_{c}}{\rho}}}{\sum_{j=1}^{K}\frac{e^{\epsilon_{j}}}{\rho}}\mathcal{L}\left(\left({\theta};{D^{*}}_{c}^{tr}\right);{D^{*}}_{i}^{val}\right)\right],$
(4)

with $\rho$ is a hyperparameter that denotes the temperature of the softmax
smoothing function over the clients’ budgets.

Algorithm 4 DP-GANs Training

1:client private dataset $D_{i}$, $N$ discriminators
$\mathcal{D}_{1},\ldots,\mathcal{D}_{N}$

2:DP generator $\mathcal{G}$

3:Partitioning the sensitive dataset $D_{i}$ into non-overlapping subsets
$\mathrm{d}_{1},\mathrm{~{}d}_{2},\ldots,\mathrm{d}_{\mathrm{N}}$ an associate
a teacher discriminator $\mathcal{G}_{i}$ to each set.

4:Training the teachers: using the discrimination loss
$\mathcal{L}_{\mathcal{G}}=-\log\mathcal{G}(x)-\log(1-\mathcal{G}\left(\mathcal{D}^{\prime}(z)\right)$
with $\mathcal{D}$ denotes the student generator $\mathrm{x}$ is sampled from
the subsets $\mathrm{d}_{\mathrm{i}},z$ is the noise sample.

5:Gradients Compression: the teacher’s dense gradients vectors $g^{(i)}$ into
sparsified vectors $\tilde{g}^{(i)}$ with $\\{-1,0,1\\}$ values.

6:DP Aggregating and Thresholding: the aggregated teacher’s gradients vector
$\tilde{g}^{*}\leftarrow\sum_{i=1}^{N}\tilde{g}^{(i)}+\mathcal{N}\left(0,\sigma^{2}\right)$,
then be mapped to $\\{-1,0,1\\}$ values by comparing each gradient direction
with a threshold $\beta N$.

7:Training the student generator: with the generator loss
$\tilde{\mathcal{L}}_{\mathcal{G}}(z,\hat{x})=$
$\mathbb{E}\left[\mathcal{D}\left(z\right)-\hat{x}\right]^{2}$, where
$\hat{x}=\mathcal{D}\left(\mathrm{z}\right)+\gamma\bar{g}$ is the synthetic
data plus the aggregated DP teacher gradients vector and $\gamma$ denotes the
learning rate.

(a) The diverging learning curve.

(b) The stabilized learning curve.

Figure 2: The improvement on convergence (bottom) compared to the original
MAML (top) indicated by the total cross-entropy loss of the support set and
query set over communication rounds. The top figure indicates a diverging
learning curve when the gradients keep accumulating while the bottom figure
illustrates fast convergence after 10 communication rounds. The experiment is
conducted on the CIFAR-10 dataset.

####  4.2.4 DP-GAN training

In this paper, we consolidate the advantages of DataLens [60], which is a
current state-of-the-art DP data generative model, to enable clients to
generate their differential privacy dataset. Based on the PATE framework,
DataLens consists of multiple teacher discriminators
$\mathcal{D}_{1},\mathcal{D}_{2},\ldots,\mathcal{D}_{N}$ that produce gradient
vectors to guide the student generator $\mathcal{G}$ in updating its synthetic
samples. Meanwhile, the student generator sends updated synthetic ones to the
teacher for label querying. The curated Gaussian noise $\mathcal{N}(0,\sigma)$
is added into the computations during the teacher aggregation step, which is
described in Algorithm 4 and 4.3.

The detailed training procedure includes five main steps:

  * •

Step 1: Partitioning the sensitive dataset $D_{i}$ into non-overlapping
subsets. This technique ensures that the discriminators do not rely on the
specifics of a single sensitive training data point, hence protecting the
privacy of the training data [62].

  * •

Step 2: Training teacher discriminators. Each teacher discriminator
$\mathcal{D}_{i}$ is trained to differentiate between real samples and
synthetic samples generated by the student generator $\mathcal{G}$ by using
the loss function
$\mathcal{L}_{\mathcal{G}}=-\log\mathcal{G}(x)-\log(1-\mathcal{G}\left(\mathcal{D}^{\prime}(z)\right)$.

  * •

Step 3: Gradients Compression. The gradient vector of each teacher is filtered
by the ${top-k}$ values, then clipped, normalized, and lossy compressed with
stochastic sign gradient quantization to reduce communication cost and to
improve privacy and convergence guarantees.

  * •

Step 4: DP gradient aggregation and thresholding. The Gaussian noise is
calibrated by estimating $\ell_{2}$ sensitivity of the aggregated gradient
vector (as shown in 4.3). The

  * •

Step 5: Training the student generator. When gradient descent steps are
performed on the loss function of the student generator, the aggregated DP
gradient vectors from the teacher discriminators are backpropagated to the
student generator.

####  4.2.5 Stabilizing MAML algorithm

As previously noted by Antoniou et al. [61], the optimization process in
Model-Agnostic Meta-Learning (MAML) can be unstable due to the multiple times
that differentiation is performed through the model. This instability is
illustrated in Fig. 2(a), which shows that the original MAML model diverges
after just a few communication rounds. To address this issue, we propose a
modified version of MAML that employs Model Exponential Moving Average in the
inner loop, followed by Cosine Annealing Learning rate scheduling in the outer
loop. This approach is inspired by previous work on improving generalization
in DL over Stochastic Gradient Descent (SGD) in general [63, 64, 65] and
improving stability in MAML in specific [61]. Formally, the model parameters
$\theta_{t}$ of the clients at communication round $t$ are set to be an
Exponential Moving Average (EMA) of the previous round’s model parameters:
$\theta_{t}:=\zeta\theta_{t}+(1-\zeta)\theta_{t-1}$, where $\zeta$ is the
momentum hyperparameter. The learning rate $\beta^{*}$ for the outer
optimization loop is calculated as $\beta^{*}(t)=f(\bmod(t-1,\lceil
T/M\rceil))$, where $t$ is the current round of the total $T$ communication
rounds, $M$ is the number of cosine annealing cycles, and $f$ is a
monotonically decreasing function. By combining these techniques, the global
model is able to traverse multiple local optima while maintaining stability
during training.

####  4.2.6 Personalization

In our approach, we also take the customization and personalization of clients
into consideration since they may have different business-related requirements
for data sharing. Instead of giving the server full control on the level of
user privacy, we allow clients to adjust their own privacy level depending on
their actual demands. This enables clients to independently, and effectively
select their preferred privacy budgets $\epsilon$ and incorporate them
directly into the DP-GAN training procedure while still being able to control
the outcomes of the training process without having to wait for the
collaborative model to converge. Additionally, the information about the
client’s privacy budgets is used in our proposed framework to improve the
performance of the client’s models.

###  4.3 Privacy Analysis

In our chosen DP-generative algorithm [60], briefly described in Algorithm 4,
the gradients of the student generator are obtained by aggregating the
sparsified gradients of the teachers and voting. Specifically, the gradient
set $G=\\{g^{(1)},\ldots,g^{(\mathrm{N})}\\}$ of $N$ is quantized using
top-$k$-sparsification [66] to convert the real-valued gradient vector into a
sparse $\\{-1,1\\}$ vector $\tilde{g}^{(i)}$ with $k$ non-zero entries.

The Gaussian mechanism can be applied to the sum aggregation function defined
as
$f_{\text{sum}}(\tilde{\mathcal{G}})=\sum_{i=1}^{N}\tilde{\mathbf{g}}^{(i)}$
for a set of compressed teacher gradient vectors
$\tilde{G}=\left(\tilde{\mathbf{g}}^{(1)},\ldots,\tilde{\mathbf{g}}^{(N)}\right)$,
where $\tilde{\mathbf{g}}^{(i)}$ is the compressed gradient of the $i$-th
teacher. The resulting output is $\tilde{\mathbf{G}}\sigma
f{\text{sum}}(\tilde{\mathcal{G}})=f_{\text{sum}}(\tilde{\mathcal{G}})+\mathcal{N}\left(0,\sigma^{2}\right)=\sum_{\tilde{\mathbf{g}}\in\tilde{\mathcal{G}}}\tilde{\mathbf{g}}+\mathcal{N}\left(0,\sigma^{2}\right)$.
The Gaussian mechanism guarantees $(\lambda,\alpha)$-RDP 2 for any real-valued
function $f$.

######  Lemma 1.

For any neighboring top- $k$ gradient vector sets
$\tilde{\mathcal{G}},\tilde{\mathcal{G}}^{\prime}$ differing by the gradient
vector of one teacher, the $\ell_{2}$ sensitivity for $f_{\text{sum }}$ is
$2\sqrt{k}$.

According to Theorem 1, the Gaussian mechanism $\mathrm{G}\sigma f$ to a
function $f$ with $\ell_{2}$ sensitivity results in a
$(\lambda,s^{2}\lambda/(2\sigma^{2}))$-RDP guarantee. In order to determine
the RDP guarantee for the Gaussian mechanism applied to the sum aggregation
function $\tilde{\mathrm{G}}\sigma f_{\mathrm{sum}}(\tilde{\mathcal{G}})$, it
is necessary to calculate the $\ell_{2}$ sensitivity of this function.
According to Lemma 1, the $\ell_{2}$ sensitivity of $f_{\text{sum}}$ for any
neighboring top-$k$ gradient vector sets
$\tilde{\mathcal{G}},\tilde{\mathcal{G}}^{\prime}$ that differ by a single
gradient vector is equal to $2\sqrt{k}$. This value can be used to determine
the RDP guarantee for the Gaussian mechanism applied to the sum aggregation
function.

TABLE II: The average performance over the clients, trained on synthetic, fine-tuned and test on secret data. | MNIST | FMNIST | CIFAR-10 | CIFAR-100
---|---|---|---|---
Method | BMT-F1 | BMTA | BMT-F1 | BMTA | BMT-F1 | BMTA | BMT-F1 | BMTA
FedAvg [5] | 0.9223 | 0.9051 | 0.7267 | 0.7938 | 0.4898 | 0.6562 | 0.2142 | 0.3028
FedNova [67] | 0.8773 | 0.8996 | 0.6303 | 0.7607 | 0.3847 | 0.6627 | 0.2855 | 0.3374
FedProx [68] | 0.9006 | 0.9040 | 0.6994 | 0.7721 | 0.4856 | 0.6718 | 0.3014 | 0.3404
SCAFFOLD [69] | 0.8906 | 0.9024 | 0.6698 | 0.8061 | 0.3732 | 0.6614 | 0.2096 | 0.3333
FedMeta [70] | 0.9399 | 0.9616 | 0.8367 | 0.8800 | 0.6897 | 0.7466 | 0.2737 | 0.4133
PPPFL (ours) | 0.9420 | 0.9640 | 0.8622 | 0.9199 | 0.7163 | 0.8000 | 0.3526 | 0.4800

##  5 Evaluation

In this section, we illustrate the experimental evaluation of our proposed
framework for two problems: prevent sensitive information leakage and address
clients’ data heterogeneity issues. To demonstrate its effectiveness, we
conduct experiments on different benchmark datasets and compare them with six
baseline models.

Figure 3: Test accuracy and FID score with respect to different users’ privacy
budgets. The left vertical axis represents the BMTA in percentage, the right
vertical axis indicates the synthetic data quality in terms of FID score while
the categories in the horizontal axis are different ranges of clients’ privacy
budget $\epsilon$, specifically from $1$ to $5$, $6$ to $10$, and lastly inf.
represents synthetic data without any DP guarantees.

###  5.1 Experiment Setup

TABLE III: The BMTA of adapted models when using non-private GANs

Method | MNIST | FMNIST | CIFAR-10
---|---|---|---
FedAvg [5] | 0.9400 | 0.7893 | 0.5521
FedNova [67] | 0.8386 | 0.7782 | 0.5724
FedProx [68] | 0.9373 | 0.7981 | 0.5737
SCAFFOLD [69] | 0.9279 | 0.8061 | 0.5608
SDA-FL [43] | 0.9826 | 0.8687 | 0.6789
PPPFL (ours) | 0.9466 | 0.8666 | 0.7133

Datasets. We use four public benchmark datasets, including MNIST [71],
Fashion-MNIST [72], CIFAR-10 [73], and CIFAR-100, to evaluate our proposed
method. MNIST and Fashion-MNIST have $60000$ training examples and $10000$
testing examples, and all of them are grayscale images of $28\times 28$
dimensions. We also utilize two color-image datasets, CIFAR-10 and CIFAR-100,
to demonstrate the performance of the proposed method. Both datasets have
$50000$ in training images and $10000$ in testing images.

Baselines. We compare our proposed method with the most popular FL algorithm
FedAvg [5], and state-of-the-art FL algorithms under non-IID data, including
FedNova [67], FedProx [68], SCAFFOLD [69], FedMeta [70], and SDA-FL [43].

Federated Learning Settings. We simulate the FL scenario with $5$ clients and
$30$ communication rounds. In each communication round, all of the clients
participate in the protocol. The inner learning rate and outer learning rate
for the meta-training procedure are respectively set to $1e-4$ and $3e-4$, the
used optimizer is Adam [74] and batch size is $64$.

(a) Accuracy improvements of adapted federated models over local, trained-
from-scratch models.

(b) The correlation between local models’ performance with the performance
gain from protocol participation.

Figure 4: The relationship between the enhancement of adapted federated models
and locally trained models. The Spearman’s correlation coefficient is $-0.90$
indicating a strong correlation between local models’ performance with the
performance gained by taking part in the protocol. TABLE IV: Additional
experiments on different training and testing setups1

Method | Train / test setup | MNIST | FMNIST | CIFAR-10 | CIFAR-100
---|---|---|---|---|---
BMT-F1 | BMTA | BMT-F1 | BMTA | BMT-F1 | BMTA | BMT-F1 | BMTA
Local | secret / secret | 0.8292 | 0.8412 | 0.6896 | 0.7136 | 0.5959 | 0.6130 | 0.2721 | 0.2998
synthetic / secret | 0.3021 | 0.3371 | 0.0716 | 0.0838 | 0.1450 | 0.1578 | 0.0067 | 0.0100
Collaborative | synthetic / secret | 0.2689 | 0.3157 | 0.0476 | 0.1231 | 0.0500 | 0.1417 | 0.0089 | 0.0100
synthetic - fine-tune / secret2 | 0.9223 | 0.9051 | 0.7267 | 0.7938 | 0.5510 | 0.7124 | 0.2142 | 0.3028
secret / secret | 0.9360 | 0.9645 | 0.8730 | 0.8972 | 0.7427 | 0.8083 | 0.4520 | 0.5416

  * 1

The ”Train/test setup” column in the table specifies the data used for
training and testing the models for each method. The format of the entries in
this column is ”train set/test set”, where the ”train set” is the data used to
train the model and the ”test set” is the data used to evaluate the model’s
performance.

  * 2

refers to a training and testing setup in which the model is first trained on
synthetic data, then fine-tuned on real, secret data, and finally evaluated on
a real, secret test set.

###  5.2 Performance on DP-synthetic data

DP data generation model. We follow the hyperparameter choices by [60].
Specifically, for the MNIST Handwritten Dataset, the DP GANs are trained using
privacy budget $\epsilon\in{1,\dots,10}$. The sensitivity $\delta$ is set to
$1e-5$, $top-k$ value equals to $300$. The noise parameter $\sigma=5000$ and
voting threshold $\beta=0.7$.
Non-IID simulation. We simulate the common non-IID scenario where the label
distribution is skewed. The label distribution $q\sim Dirichlet(\tau)$ with
$\tau=0.5$.
Metrics. We follow the work by Huang et al. [43] on employing Best Mean Test
Accuracy (BMTA) as the metric by averaging the testing accuracy on all clients
and selecting the best value across the training communication rounds. In
cases of the presence of non-IID data, we use the Best Mean Test F1-score
(BMT-F1) as an additional metric for better evaluation. Formally, at
communication round $t$, given the accuracy score $\nu_{i}^{t}$ and the
F1-score $\zeta_{i}^{t}$ of the $o^{th}$ client ($i\in[1,K]$), the BMTA and
BMT-F1 metrics are calculated as
$\text{BMTA}=\max_{{t}}\frac{1}{K}\sum_{i=1}^{K}\nu_{i}^{t}$ and
$\text{BMT-F1}=\max_{{t}}\frac{1}{K}\sum_{i=1}^{K}\zeta_{i}^{t}$.

Table II shows that our proposed framework PPPFL outperforms the baselines by
a significant margin. Specifically, we outperform the baselines by a
significant margin in multiple datasets, we also push the frontier of data
privacy and data utility by achieving good performance while maintaining DP
guarantees. In terms of accuracy, our proposed method outperforms previous
works in all four benchmarks, MNIST, FMNIST, CIFAR-10, and CIFAR-100, with the
corresponding figures: 0.9640, 0.9199, 0.80, and 0.480. Regarding BMT-F1, in
the CIFAR-10 dataset, our framework is also superior to the FedMeta algorithms
by more than 2.5%, while this figure achieves by nearly 8.0% regarding the
CIFAR-100 dataset.

###  5.3 Performance on non-private synthetic data.

Table III shows that when using only a single global model, in comparison with
the ensemble of multiple global models in SDA-FL [75], our proposed framework
can achieve comparable performances on MNIST and FMNIST datasets and obtain
higher accuracy on CIFAR-100 dataset, at 0.7133.

###  5.4 Performance on other data flows.

Table IV is divided into two main categories, including the first one is the
first two rows that show the results of models trained locally, and the second
one is the last three rows that illustrate collaboration results between these
models. The purpose of this experiment is to approximate the lower bounds and
upper bounds of the models’ performance when using different training and
testing data setups. Regarding the first group, the independent local training
scenario without FL is conducted to form a strong baseline. For the second
group, FL collaboration procedures with and without using private data as the
clients’ training sets are performed to demonstrate the necessity of local
adaptation.

###  5.5 Trade-off between Synthetic Data Privacy Levels and Model Performance

We evaluate our proposed framework under different users’ data privacy budget
$\epsilon$, from the low range $\epsilon\in[1\ldots 5]$ to a higher range
between $[6,\ldots,10]$, and lastly a scenario where the synthetic data is
generated by a generative model without having any added DP-noise. The quality
of those aforementioned synthetic data sets is evaluated using Inception Score
(IS) and Frechet Inception Distance (FID) [76]. The results shown in Table V
and Fig. 3 indicate that the higher DP-noise added in the synthetic data might
result in higher generalization error.

TABLE V: Test accuracy and Macro F1-score with respected to synthetic data quality. |  BMTA $\uparrow$ |  BMT-F1 $\uparrow$ |  IS $\uparrow$ |  FID $\downarrow$
---|---|---|---|---
$\epsilon\in[1\ldots 5]$ | 0.8133 | 0.7454 | 1.2242 | 407.5517
$\epsilon\in[6\ldots 10]$ | 0.8400 | 0.7940 | 1.8100 | 249.0475
$\epsilon=\infty$ | 0.8533 | 0.8199 | 2.9442 | 49.9617

##  6 Conclusions and Future Works

In this work, we show that our proposed Personalized Privacy-Preserving
Federated Learning (PPPFL) framework could not only minimize the risk of
sensitive information being leaked but also overcome the challenges of the
nonindependent and identically distributed (non-IID) data among clients. We
demonstrate the efficiency of the PPPFL framework as it outperforms many
existing baselines on both DP-synthetic and non-private synthetic data when
evaluating different datasets, including MNIST, Fashion-MNIST, CIFAR-10, and
CIFAR-100. We also indicate the existence of a trade-off between synthetic
data privacy levels and the model’s performance. Despite our framework’s
performance improvements, conducting experiments with other GANs architectures
is necessary.

User incentive to participate in the protocol. In this part of our work, we
focus on the incentives for users to participate in the PPPFL framework. In
cross-silo FL, organizations or companies usually have intentionally long-term
strategic focuses and development goals. This makes the long-term cooperation
relationship more possible, as long as we can design a proper incentive
mechanism. To this end, we demonstrate a strong correlation between the local
performance of a user’s model and the benefits that each client derives from
participating in the protocol. This correlation is shown in Fig. 4(b).
Particularly, if local models have lower performance, it is evident that they
would gain more from participating in the PPPFL protocol.

This phenomenon raises the possibility of fairness issues within the PPPFL
framework, which we plan to address in future work.

## Acknowledgments

This work was supported by VinUni-Illinois Smart Health Center (VISHC),
VinUniversity.

## References

  * Suvorov et al. [2022] R. Suvorov, E. Logacheva, A. Mashikhin, A. Remizova, A. Ashukha, A. Silvestrov, N. Kong, H. Goka, K. Park, and V. Lempitsky, “Resolution-robust large mask inpainting with fourier convolutions,” in _Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision_ , 2022, pp. 2149–2159.
  * Saharia et al. [2022] C. Saharia, W. Chan, S. Saxena, L. Li, J. Whang, E. Denton, S. K. S. Ghasemipour, B. K. Ayan, S. S. Mahdavi, R. G. Lopes _et al._ , “Photorealistic text-to-image diffusion models with deep language understanding,” _arXiv preprint arXiv:2205.11487_ , 2022.
  * Schulman et al. [2022] J. Schulman, B. Zoph, C. Kim, J. Hilton, J. Menick, J. Weng, J. Uribe, L. Fedus, L. Metz, M. Pokorny _et al._ , “Chatgpt: Optimizing language models for dialogue,” 2022.
  * Dong et al. [2021] S. Dong, P. Wang, and K. Abbas, “A survey on deep learning and its applications,” _Computer Science Review_ , vol. 40, p. 100379, 2021.
  * McMahan et al. [2017] B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in _Artificial intelligence and statistics_. PMLR, 2017, pp. 1273–1282.
  * Zhang et al. [2021a] C. Zhang, Y. Xie, H. Bai, B. Yu, W. Li, and Y. Gao, “A survey on federated learning,” _Knowledge-Based Systems_ , vol. 216, p. 106775, 2021.
  * Yang et al. [2019] Q. Yang, Y. Liu, T. Chen, and Y. Tong, “Federated machine learning: Concept and applications,” _ACM Transactions on Intelligent Systems and Technology (TIST)_ , vol. 10, no. 2, pp. 1–19, 2019.
  * Geiping et al. [2020] J. Geiping, H. Bauermeister, H. Dröge, and M. Moeller, “Inverting gradients-how easy is it to break privacy in federated learning?” _Advances in Neural Information Processing Systems_ , vol. 33, pp. 16 937–16 947, 2020.
  * Wang et al. [2019a] Z. Wang, M. Song, Z. Zhang, Y. Song, Q. Wang, and H. Qi, “Beyond inferring class representatives: User-level privacy leakage from federated learning,” in _IEEE INFOCOM 2019-IEEE Conference on Computer Communications_. IEEE, 2019, pp. 2512–2520.
  * Yin et al. [2021] H. Yin, A. Mallya, A. Vahdat, J. M. Alvarez, J. Kautz, and P. Molchanov, “See through gradients: Image batch recovery via gradinversion,” in _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , 2021, pp. 16 337–16 346.
  * Zhao et al. [2020] B. Zhao, K. R. Mopuri, and H. Bilen, “idlg: Improved deep leakage from gradients,” _arXiv preprint arXiv:2001.02610_ , 2020.
  * Zhu et al. [2019] L. Zhu, Z. Liu, and S. Han, “Deep leakage from gradients,” _Advances in neural information processing systems_ , vol. 32, 2019.
  * Boenisch et al. [2021] F. Boenisch, A. Dziedzic, R. Schuster, A. S. Shamsabadi, I. Shumailov, and N. Papernot, “When the curious abandon honesty: Federated learning is not private,” _arXiv preprint arXiv:2112.02918_ , 2021.
  * Dwork et al. [2014] C. Dwork, A. Roth _et al._ , “The algorithmic foundations of differential privacy,” _Foundations and Trends® in Theoretical Computer Science_ , vol. 9, no. 3–4, pp. 211–407, 2014.
  * Dwork et al. [2006] C. Dwork, F. McSherry, K. Nissim, and A. Smith, “Calibrating noise to sensitivity in private data analysis,” in _Theory of cryptography conference_. Springer, 2006, pp. 265–284.
  * Duchi et al. [2013] J. C. Duchi, M. I. Jordan, and M. J. Wainwright, “Local privacy and statistical minimax rates,” in _2013 IEEE 54th Annual Symposium on Foundations of Computer Science_. IEEE, 2013, pp. 429–438.
  * Kasiviswanathan et al. [2011] S. P. Kasiviswanathan, H. K. Lee, K. Nissim, S. Raskhodnikova, and A. Smith, “What can we learn privately?” _SIAM Journal on Computing_ , vol. 40, no. 3, pp. 793–826, 2011.
  * Zhu et al. [2021] H. Zhu, J. Xu, S. Liu, and Y. Jin, “Federated learning on non-iid data: A survey,” _Neurocomputing_ , vol. 465, pp. 371–390, 2021.
  * Kulkarni et al. [2020] V. Kulkarni, M. Kulkarni, and A. Pant, “Survey of personalization techniques for federated learning,” in _2020 Fourth World Conference on Smart Trends in Systems, Security and Sustainability (WorldS4)_. IEEE, 2020, pp. 794–797.
  * Kairouz et al. [2021] P. Kairouz, H. B. McMahan, B. Avent, A. Bellet, M. Bennis, A. N. Bhagoji, K. Bonawitz, Z. Charles, G. Cormode, R. Cummings _et al._ , “Advances and open problems in federated learning,” _Foundations and Trends® in Machine Learning_ , vol. 14, no. 1–2, pp. 1–210, 2021\.
  * Tuor et al. [2021] T. Tuor, S. Wang, B. J. Ko, C. Liu, and K. K. Leung, “Overcoming noisy and irrelevant data in federated learning,” in _2020 25th International Conference on Pattern Recognition (ICPR)_. IEEE, 2021, pp. 5020–5027.
  * Wang et al. [2019b] K. Wang, R. Mathews, C. Kiddon, H. Eichner, F. Beaufays, and D. Ramage, “Federated evaluation of on-device personalization,” _arXiv preprint arXiv:1910.10252_ , 2019.
  * T Dinh et al. [2020] C. T Dinh, N. Tran, and J. Nguyen, “Personalized federated learning with moreau envelopes,” _Advances in Neural Information Processing Systems_ , vol. 33, pp. 21 394–21 405, 2020.
  * Arivazhagan et al. [2019] M. G. Arivazhagan, V. Aggarwal, A. K. Singh, and S. Choudhary, “Federated learning with personalization layers,” _arXiv preprint arXiv:1912.00818_ , 2019.
  * Liu et al. [2020a] Y. Liu, Y. Kang, C. Xing, T. Chen, and Q. Yang, “A secure federated transfer learning framework,” _IEEE Intelligent Systems_ , vol. 35, no. 4, pp. 70–82, 2020.
  * Lin et al. [2020] T. Lin, L. Kong, S. U. Stich, and M. Jaggi, “Ensemble distillation for robust model fusion in federated learning,” _Advances in Neural Information Processing Systems_ , vol. 33, pp. 2351–2363, 2020.
  * Cordis [2019] E. Cordis, “Machine learning ledger orchestration for drug discovery,” 2019.
  * Treleaven et al. [2022] P. Treleaven, M. Smietanka, and H. Pithadia, “Federated learning: The pioneering distributed machine learning and privacy-preserving data technology,” _Computer_ , vol. 55, no. 4, pp. 20–29, 2022.
  * Sun et al. [2020] L. Sun, J. Qian, and X. Chen, “Ldp-fl: Practical private aggregation in federated learning with local differential privacy,” _arXiv preprint arXiv:2007.15789_ , 2020.
  * Truex et al. [2020] S. Truex, L. Liu, K.-H. Chow, M. E. Gursoy, and W. Wei, “Ldp-fed: Federated learning with local differential privacy,” in _Proceedings of the Third ACM International Workshop on Edge Systems, Analytics and Networking_ , 2020, pp. 61–66.
  * Gursoy et al. [2019] M. E. Gursoy, A. Tamersoy, S. Truex, W. Wei, and L. Liu, “Secure and utility-aware data collection with condensed local differential privacy,” _IEEE Transactions on Dependable and Secure Computing_ , vol. 18, no. 5, pp. 2365–2378, 2019.
  * Wei et al. [2021] K. Wei, J. Li, M. Ding, C. Ma, H. Su, B. Zhang, and H. V. Poor, “User-level privacy-preserving federated learning: Analysis and performance optimization,” _IEEE Transactions on Mobile Computing_ , vol. 21, no. 9, pp. 3388–3401, 2021.
  * Chen et al. [2018a] Q. Chen, C. Xiang, M. Xue, B. Li, N. Borisov, D. Kaarfar, and H. Zhu, “Differentially private data generative models,” _arXiv preprint arXiv:1812.02274_ , 2018.
  * Zhang et al. [2021b] L. Zhang, B. Shen, A. Barnawi, S. Xi, N. Kumar, and Y. Wu, “Feddpgan: federated differentially private generative adversarial networks framework for the detection of covid-19 pneumonia,” _Information Systems Frontiers_ , vol. 23, no. 6, pp. 1403–1415, 2021.
  * Mahawaga Arachchige et al. [2022] P. C. Mahawaga Arachchige, D. Liu, S. Camtepe, S. Nepal, M. Grobler, P. Bertok, and I. Khalil, “Local differential privacy for federated learning,” in _European Symposium on Research in Computer Security_. Springer, 2022, pp. 195–216.
  * Erlingsson et al. [2014] Ú. Erlingsson, V. Pihur, and A. Korolova, “Rappor: Randomized aggregatable privacy-preserving ordinal response,” in _Proceedings of the 2014 ACM SIGSAC conference on computer and communications security_ , 2014, pp. 1054–1067.
  * Smith et al. [2017] V. Smith, C.-K. Chiang, M. Sanjabi, and A. S. Talwalkar, “Federated multi-task learning,” _Advances in neural information processing systems_ , vol. 30, 2017.
  * Liang et al. [2020] P. P. Liang, T. Liu, L. Ziyin, N. B. Allen, R. P. Auerbach, D. Brent, R. Salakhutdinov, and L.-P. Morency, “Think locally, act globally: Federated learning with local and global representations,” _arXiv preprint arXiv:2001.01523_ , 2020.
  * Li and Wang [2019] D. Li and J. Wang, “Fedmd: Heterogenous federated learning via model distillation,” _arXiv preprint arXiv:1910.03581_ , 2019.
  * Peng et al. [2019] X. Peng, Z. Huang, Y. Zhu, and K. Saenko, “Federated adversarial domain adaptation,” _arXiv preprint arXiv:1911.02054_ , 2019.
  * Finn et al. [2017] C. Finn, P. Abbeel, and S. Levine, “Model-agnostic meta-learning for fast adaptation of deep networks,” in _International conference on machine learning_. PMLR, 2017, pp. 1126–1135.
  * Fallah et al. [2020] A. Fallah, A. Mokhtari, and A. Ozdaglar, “Personalized federated learning with theoretical guarantees: A model-agnostic meta-learning approach,” _Advances in Neural Information Processing Systems_ , vol. 33, pp. 3557–3568, 2020.
  * Huang et al. [2021] Y. Huang, L. Chu, Z. Zhou, L. Wang, J. Liu, J. Pei, and Y. Zhang, “Personalized cross-silo federated learning on non-iid data.” in _AAAI_ , 2021, pp. 7865–7873.
  * Shamsian et al. [2021] A. Shamsian, A. Navon, E. Fetaya, and G. Chechik, “Personalized federated learning using hypernetworks,” in _International Conference on Machine Learning_. PMLR, 2021, pp. 9489–9502.
  * Li et al. [2021] B. Li, P. Qi, B. Liu, S. Di, J. Liu, J. Pei, J. Yi, and B. Zhou, “Trustworthy ai: From principles to practices,” _arXiv preprint arXiv:2110.01167_ , 2021\.
  * Shokri et al. [2017] R. Shokri, M. Stronati, C. Song, and V. Shmatikov, “Membership inference attacks against machine learning models,” in _2017 IEEE Symposium on Security and Privacy (SP)_ , 2017, pp. 3–18.
  * Wei et al. [2020] K. Wei, J. Li, M. Ding, C. Ma, H. H. Yang, F. Farokhi, S. Jin, T. Q. Quek, and H. V. Poor, “Federated learning with differential privacy: Algorithms and performance analysis,” _IEEE Transactions on Information Forensics and Security_ , vol. 15, pp. 3454–3469, 2020.
  * Adnan et al. [2022] M. Adnan, S. Kalra, J. C. Cresswell, G. W. Taylor, and H. R. Tizhoosh, “Federated learning and differential privacy for medical image analysis,” _Scientific reports_ , vol. 12, no. 1, p. 1953, 2022.
  * Ramaswamy et al. [2020] S. Ramaswamy, O. Thakkar, R. Mathews, G. Andrew, H. B. McMahan, and F. Beaufays, “Training production language models without memorizing user data,” _arXiv preprint arXiv:2009.10031_ , 2020.
  * Mironov [2017] I. Mironov, “Rényi differential privacy,” in _2017 IEEE 30th computer security foundations symposium (CSF)_. IEEE, 2017, pp. 263–275.
  * Liu et al. [2020b] Y. Liu, A. T. Suresh, F. X. X. Yu, S. Kumar, and M. Riley, “Learning discrete distributions: user vs item-level privacy,” _Advances in Neural Information Processing Systems_ , vol. 33, pp. 20 965–20 976, 2020.
  * Levy et al. [2021] D. Levy, Z. Sun, K. Amin, S. Kale, A. Kulesza, M. Mohri, and A. T. Suresh, “Learning with user-level privacy,” _Advances in Neural Information Processing Systems_ , vol. 34, pp. 12 466–12 479, 2021.
  * Wang et al. [2021a] Z. Wang, Q. She, and T. E. Ward, “Generative adversarial networks in computer vision: A survey and taxonomy,” _ACM Computing Surveys (CSUR)_ , vol. 54, no. 2, pp. 1–38, 2021.
  * Xie et al. [2018] L. Xie, K. Lin, S. Wang, F. Wang, and J. Zhou, “Differentially private generative adversarial network,” _arXiv preprint arXiv:1802.06739_ , 2018\.
  * Torkzadehmahani et al. [2019] R. Torkzadehmahani, P. Kairouz, and B. Paten, “Dp-cgan: Differentially private synthetic data and label generation,” in _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops_ , 2019, pp. 0–0.
  * Abadi et al. [2016] M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” in _Proceedings of the 2016 ACM SIGSAC conference on computer and communications security_ , 2016, pp. 308–318.
  * Papernot et al. [2018] N. Papernot, S. Song, I. Mironov, A. Raghunathan, K. Talwar, and Ú. Erlingsson, “Scalable private learning with pate,” _arXiv preprint arXiv:1802.08908_ , 2018.
  * Jordon et al. [2018] J. Jordon, J. Yoon, and M. Van Der Schaar, “Pate-gan: Generating synthetic data with differential privacy guarantees,” in _International conference on learning representations_ , 2018.
  * Long et al. [2019] Y. Long, S. Lin, Z. Yang, C. A. Gunter, and B. Li, “Scalable differentially private generative student model via pate,” _arXiv preprint arXiv:1906.09338_ , 2019.
  * Wang et al. [2021b] B. Wang, F. Wu, Y. Long, L. Rimanic, C. Zhang, and B. Li, “Datalens: Scalable privacy preserving training via gradient compression and aggregation,” in _Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security_ , 2021, pp. 2146–2168.
  * Antoniou et al. [2018] A. Antoniou, H. Edwards, and A. Storkey, “How to train your maml,” _arXiv preprint arXiv:1810.09502_ , 2018.
  * Papernot et al. [2016] N. Papernot, M. Abadi, U. Erlingsson, I. Goodfellow, and K. Talwar, “Semi-supervised knowledge transfer for deep learning from private training data,” _arXiv preprint arXiv:1610.05755_ , 2016.
  * Izmailov et al. [2018] P. Izmailov, D. Podoprikhin, T. Garipov, D. Vetrov, and A. G. Wilson, “Averaging weights leads to wider optima and better generalization,” _arXiv preprint arXiv:1803.05407_ , 2018.
  * Tarvainen and Valpola [2017] A. Tarvainen and H. Valpola, “Mean teachers are better role models: Weight-averaged consistency targets improve semi-supervised deep learning results,” _Advances in neural information processing systems_ , vol. 30, 2017\.
  * Huang et al. [2017] G. Huang, Y. Li, G. Pleiss, Z. Liu, J. E. Hopcroft, and K. Q. Weinberger, “Snapshot ensembles: Train 1, get m for free,” _arXiv preprint arXiv:1704.00109_ , 2017.
  * Shi et al. [2019] S. Shi, X. Chu, K. C. Cheung, and S. See, “Understanding top-k sparsification in distributed deep learning,” _arXiv preprint arXiv:1911.08772_ , 2019.
  * Wang et al. [2020] J. Wang, Q. Liu, H. Liang, G. Joshi, and H. V. Poor, “Tackling the objective inconsistency problem in heterogeneous federated optimization,” _Advances in neural information processing systems_ , vol. 33, pp. 7611–7623, 2020.
  * Li et al. [2020] T. Li, A. K. Sahu, M. Zaheer, M. Sanjabi, A. Talwalkar, and V. Smith, “Federated optimization in heterogeneous networks,” _Proceedings of Machine Learning and Systems_ , vol. 2, pp. 429–450, 2020.
  * Karimireddy et al. [2020] S. P. Karimireddy, S. Kale, M. Mohri, S. Reddi, S. Stich, and A. T. Suresh, “Scaffold: Stochastic controlled averaging for federated learning,” in _International Conference on Machine Learning_. PMLR, 2020, pp. 5132–5143.
  * Chen et al. [2018b] F. Chen, M. Luo, Z. Dong, Z. Li, and X. He, “Federated meta-learning with fast convergence and efficient communication,” _arXiv preprint arXiv:1802.07876_ , 2018.
  * Deng [2012] L. Deng, “The mnist database of handwritten digit images for machine learning research [best of the web],” _IEEE signal processing magazine_ , vol. 29, no. 6, pp. 141–142, 2012.
  * Xiao et al. [2017] H. Xiao, K. Rasul, and R. Vollgraf, “Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,” _arXiv preprint arXiv:1708.07747_ , 2017.
  * Krizhevsky and Hinton [2010] A. Krizhevsky and G. Hinton, “Convolutional deep belief networks on cifar-10,” _Unpublished manuscript_ , vol. 40, no. 7, pp. 1–9, 2010.
  * Kingma and Ba [2014] D. P. Kingma and J. Ba, “Adam: A method for stochastic optimization,” _arXiv preprint arXiv:1412.6980_ , 2014.
  * Li et al. [2022] Z. Li, J. Shao, Y. Mao, J. H. Wang, and J. Zhang, “Federated learning with gan-based data synthesis for non-iid clients,” _arXiv preprint arXiv:2206.05507_ , 2022.
  * Heusel et al. [2017] M. Heusel, H. Ramsauer, T. Unterthiner, B. Nessler, and S. Hochreiter, “Gans trained by a two time-scale update rule converge to a local nash equilibrium,” _Advances in neural information processing systems_ , vol. 30, 2017.

|  Van-Tuan Tran got the Bachelor Degree of Engineering in Telecommunications
Engineering from Vietnam National University, Ho Chi Minh City. He was a
Research Intern at Smart Health Center, VinBigData JSC, and a Research
Assistant at VinUni-Illinois Smart Health Center, VinUniversity, Hanoi,
Vietnam. His research interests include Deep Learning Applications for
Computer Vision, Secure AI and Federated Learning.
---|---
|  Hieu H. Pham (Member, IEEE) received the Engineering degree in industrial
informatics from the Hanoi University of Science and Technology (HUST),
Vietnam, in 2016, and the Ph.D. degree in computer science from the Toulouse
Computer Science Research Institute (IRIT), University of Toulouse, France, in
2019. He is currently a Assistant Professor at the College of Engineering and
Computer Science (CECS), VinUniversity, and serves as an Associate Director at
the VinUni-Illinois Smart Health Center (VISHC). His research interests
include computer vision, machine learning, medical image analysis, and their
applications in smart healthcare. He is the author and coauthor of 30
scientific articles appeared in about 20 conferences and journals, such as
Scientific Data (Nature), Computer Vision and Image Understanding,
Neurocomputing, International Conference on Medical Image Computing and
Computer-Assisted Intervention (MICCAI), Medical Imaging with Deep Learning
(MIDL), IEEE International Conference on Image Processing (ICIP), and IEEE
International Conference on Computer Vision (ICCV). He is also currently
serving as Reviewer for MICCAI, ICCV, CVPR, IET Computer Vision Journal (IET-
CVI), IEEE Journal of Biomedical and Health Informatics (JBHI), and Scientific
Reports (Nature). Before joining VinUniversity, he worked at the Vingroup Big
Data Institute (VinBigData), as a Research Scientist and the Head of the
Fundamental Research Team. With this position, he led several research
projects on medical AI, including collecting various types of medical data,
managing and annotating data, and developing new AI solutions for medical
analysis.
---|---
|  Kok-Seng Wong (Member, IEEE) received his first degree in Computer Science
(Software Engineering) from the University of Malaya, Malaysia in 2002, and an
M.Sc. (Information Technology) degree from the Malaysia University of Science
and Technology (in collaboration with MIT) in 2004. He obtained his Ph.D. from
Soongsil University, South Korea, in 2012. He is currently an Associate
Professor in the College of Engineering and Computer Science, VinUniversity.
Before joining VinUniversity, he taught computer science subjects
(undergraduate and postgraduate) in Kazakhstan, Malaysian, and South Korean
universities for the past 17 years. Dr. Wong aims to bring principles and
techniques from cryptography to the design and implementation of secure and
privacy-protected systems. He has published 60 articles in journals and
conferences in his research field. To this end, he conducts research that
spans the areas of security, data privacy, and AI security while maintaining a
strong relevance to the privacy-preserving framework.
---|---