PaperlayerView exact revision on arXiv

Source-linked AI summary

Projection-Based Federated Learning on Compact Submanifolds with Geometry-Independent Differential Privacy

Thibault Pautrel, Florent Bouchard, Guillaume Ginolhac, Ammar Mian, Aurélien Bellet

arXiv:2610.33712v1stat.MLcs.LG

TL;DR

Record privacy and aggregation are challenging when federated model parameters lie on manifolds, where existing methods depend on geometry-specific noise and maps. DP-RFedProj combines closed-form projection-based aggregation with fixed-ambient gradient privatisation. Its experiments report better EEG performance than a Euclidean baseline at every tested privacy budget, while requiring five to six times less noise than the closest prior method for the same budget.

  • Problem

    Manifold-valued federated learning must protect record-dependent updates while handling aggregation that may require geometry-specific maps, which can lack closed forms.

    Source: §1.1 · p. 2

  • Method

    DP-RFedProj uses closed-form projections for aggregation and privatises gradients in a fixed ambient geometry, with a record-level guarantee independent of the manifold and local optimiser.

    Source: §4.2 · p. 15, §8 · p. 26

  • Results

    SPDNet outperforms EEGNet at every privacy budget, and the accounting requires five to six times less noise than the closest prior method for the same budget.

    Source: §8 · p. 27

  • Takeaways & Limitations

    The leading privacy term in the convergence rate scales with the manifold’s intrinsic dimension rather than its ambient dimension.

    Source: §5.3 · p. 19

    Convergence guarantees are established for ProjAvg and RLAvg, not for KFAvg or RetAvg.

    Source: §3.5 · p. 13

Abstract

from arXiv · show

Federated learning trains a shared model across clients without exchanging their data, yet the updates they transmit still leak information about individual records. Enforcing differential privacy is harder still when the model parameters lie on a Riemannian manifold. Existing methods rebuild the noise added for privacy in the geometry of each new iterate, aggregate through intrinsic maps that often lack a closed form, and prove convergence only in restricted regimes. We introduce DP-RFedProj, a record-level differentially private federated learning method for compact submanifolds that aggregates through closed-form projections and privatises gradients in a fixed ambient geometry. Each client may run any stochastic first-order optimiser, take several local steps, and participate only intermittently. An explicit record-level $f$-DP guarantee holds for the entire training transcript, independently of the manifold, the aggregation scheme and the local optimiser. We establish convergence of DP-RFedProj when each client runs Riemannian SGD locally and the server aggregates by projected averaging, and show that privacy enters the rate through a term scaling with the manifold's intrinsic dimension rather than the ambient one. Synthetic experiments on federated PCA over the Grassmann manifold corroborate these findings. On EEG motor-imagery classification with SPDNet, whose weights lie on the Stiefel manifold, the method outperforms a Euclidean baseline at every privacy budget considered. In both experimental settings, our accounting requires five to six times less noise than that of the closest prior method for the same budget, which translates into higher utility.

1 Introduction

Manifold-valued federated learning makes both privacy and aggregation more difficult: updates can leak records, while Euclidean averaging may leave the manifold and intrinsic maps may lack closed forms. The paper positions DP-RFedProj as a projection-based, record-private approach addressing gaps in prior guarantees and convergence analyses.

1.1 Setting and motivation

  • On manifolds, Euclidean averaging may leave the parameter space, while the Fréchet mean often requires geometric maps without closed forms.Existing Riemannian FL methods also lack convergence analyses combining multiple local steps with partial participation, and their manifold maps may require iterative solves on Stiefel.Source: §1.1 · p. 2, §1.2 · p. 3

1.2 Related work

  • Existing Riemannian privacy methods rely on geometry-dependent noise and per-round accounting, with convergence established only in restricted participation and local-step regimes.Projection-based methods support multiple local epochs but use client control variates, coupling aggregation to the optimiser and restricting analyses to full participation.Source: §1.2 · p. 3

1.3 Contributions

  • DP-RFedProj uses closed-form projections for local updates and aggregation, while fixed-ambient gradient privatisation yields a record-level guarantee independent of the manifold and optimiser.Clients may use stochastic first-order optimisers; the guarantee uses record-level subsampling amplification and, in the reported experiments, certifies the same budget with five to six times less noise than the closest prior accounting.Source: §1.3 · p. 4
  • With Riemannian SGD, the convergence analysis covers multiple local steps, partial participation, and heterogeneous clients together, with the leading privacy term scaling with intrinsic dimension.The analysis includes clipping bias explicitly and also gives a guarantee when privacy noise is set to zero.Source: §1.3 · p. 4
  • On federated Grassmann PCA, privacy cost scales with intrinsic dimension and inversely with clients per round; on EEG tasks, SPDNet outperforms EEGNet at every privacy budget.Projection-based aggregation matches retraction-based accuracy while running an order of magnitude faster.Source: §1.3 · p. 4

2 Background

The background establishes the embedded-manifold setting, the federated protocol and its record-level privacy target, then describes PriRFed’s intrinsic privacy and aggregation pipeline and its limitations.

2.1 Riemannian Geometry

  • A compact submanifold is embedded in an ambient Euclidean space, with tangent spaces and a point-dependent Riemannian metric; in the induced metric, the Riemannian gradient is the tangent projection of the ambient gradient.Projection-based retractions map tangent displacements back to the manifold.Source: §2.1 · p. 5

2.2 Federated Learning and Differential Privacy

  • Each round selects clients, sends them the current model for local gradient steps, and aggregates their submissions into the next iterate.The honest-but-curious server follows the protocol but observes the exchanged messages; the target is record-level protection of the full transcript.Source: §2.2 · p. 6
  • Record-level protection randomises gradients before the optimiser receives them, since client submissions accumulate record-dependent gradients across local steps.Datasets are assumed pairwise disjoint for the stated record-level adjacency.Source: §2.2 · p. 6

2.3.1 Local private optimisation

  • PriRFed clips gradients and adds Gaussian noise in the tangent space at each iterate, tying both operations to the manifold’s changing geometry.Noise is sampled in the current tangent geometry or transported there from a fixed reference point.Source: §2.3.1 · pp. 7–8

2.3.2 Server aggregation on Riemannian manifolds

  • Riemannian aggregation replaces the Euclidean mean with a Fréchet mean, commonly approximated using logarithmic and exponential maps that may lack closed forms.Retraction-based substitutions ease but do not eliminate these difficulties.Source: §2.3.2 · p. 8

2.4 Limitations of the intrinsic pipeline

  • The intrinsic pipeline has limited accounting, requiring hidden client sampling for its client-level amplification and using composition steps that can be loose.On Stiefel, no retraction provides both forward and inverse maps in closed form, so an iterative solve is paid per submission; existing convergence results do not combine multiple local steps with multiple participating clients and assume identical client data for multi-step results.Source: §2.4 · p. 9

3 Projection-Based Private Federated Learning on Compact Submanifolds

DP-RFedProj combines ambient-space gradient privatisation with projection-based local updates and aggregation on compact submanifolds. Its privacy mechanism is decoupled from the geometry, while convergence is established for selected aggregators and manifolds under stated structural conditions.

3.1 Structural properties

  • Compactness supplies the projection Π, while the Euclidean-induced metric lets clipping and noise use iterate-independent ambient quantities; together these properties replace several geometry-dependent constructions.The projection also replaces retraction and inverse-retraction operations, and proximal smoothness and tube stability control its aggregation error when analysing multiple local steps, multiple clients, and heterogeneity.Source: §3.1 · p. 9

3.2 Privatised local optimisation

  • Clients may use any stochastic first-order optimiser that accesses their data only through privatised minibatch gradients, with ambient clipping and projected ambient Gaussian noise.The optimiser may use earlier privatised gradients, including for momentum or adaptive estimates; methods requiring another data access, such as RSVRG’s periodic full gradient, fall outside this per-step accounting unless charged separately.Source: §3.2 · pp. 10–11

3.3 Server-side aggregation

  • ProjAvg projects the ambient mean of client iterates onto the manifold, while RLAvg retracts the average of tangent-projected displacements at the current iterate.Both use the tangent projector and manifold projection, and ProjAvg is the closed-form retracted-lifted barycenter for the projection-based retraction and tangent-projector lifting map.Source: §3.3 · p. 11

3.4 Algorithm

  • Algorithm 1 combines τ private local steps with a single client submission and a server update, and its aggregation interface also accommodates KFAvg and RetAvg.The aggregation-level unification does not make the local privatisation schemes identical: DP-RFedProj uses extrinsic gradients, whereas PriRFed uses iterate-dependent intrinsic privatisation.Source: §3.4 · p. 12, Table 2 · p. 12

3.5 Scope of the privacy and convergence guarantees

  • The transcript privacy guarantee covers all four aggregation schemes and any manifold on which the algorithm runs, but convergence is established only for ProjAvg and RLAvg with RSGD.The algorithm requires Π; P1 aligns clipping and noise with the manifold metric, while privacy still holds under another metric with ambient-geometry clipping and noise. The affine-invariant metric on S++^n lacks both required properties, so the algorithm cannot run there.Source: §3.5 · p. 13, Table 3 · p. 13

4 Privacy Analysis

The privacy analysis asks whether a record can be inferred from the full transcript observed by an honest-but-curious server. It applies f-DP accounting to privatised local gradients and derives a transcript-level guarantee whose budget is independent of the manifold, optimiser, aggregator, and number of participating clients.

4 Privacy Analysis

  • The analysis adapts the DP-SGD privacy argument to certify record-level privacy for the whole training run against an honest-but-curious server observing the transcript.The f-DP trade-off-function calculus measures distinguishability and composes releases; its guarantee is equivalent to a family of (ε, δ)-DP guarantees.Source: §4 · pp. 13–14, §4.1 · p. 14

4.1 Privacy accounting in the f-DP calculus

  • The accounting uses subsampling amplification for unreleased minibatches and adaptive composition across releases; it does not amplify privacy through the server-visible client participation schedule.For a uniform minibatch of size B from a client dataset of size mi, the amplification rate is qi = B/mi.Source: §4.1 · p. 14

4.2 Record-level guarantee

  • For T rounds and τ local steps, the transcript is Cq(Gµ0)⊗Tτ-DP, with q = B/m⋆ and µ0 = 2C/(Bσdp), independent of k, the manifold, optimiser, and listed aggregator.The per-step record-substitution guarantee is Cqi(Gµ0)-DP, where qi = B/mi; the transcript bound covers ProjAvg, RLAvg, KFAvg, and RetAvg.Source: §4.2 · pp. 15–16

4.3 Interpreting the guarantee

  • At fixed Tτ, the leading-order privacy level is driven by the clipping threshold relative to noise and is damped by the smallest client dataset size; batch size cancels at leading order.The reported µtot-GDP summary is for interpretation, while experiments calibrate noise with a numerical accountant certifying an upper bound for Theorem 10.Source: §4.3 · p. 16

5 Convergence Analysis

The analysis establishes convergence for projected aggregation with Riemannian SGD across multiple local steps, partial participation, and heterogeneous clients. Its stationarity bound separates decaying optimization and privacy terms from a persistent clipping-bias floor, with leading privacy cost governed by intrinsic dimension.

5.1 Assumptions

  • The assumptions include proximal smoothness, uniformly bounded per-sample gradients, and uniform ambient-gradient smoothness over the data space.The per-sample smoothness requirement is stronger than smoothness of the averaged objective alone.Source: §5.1 · p. 17

5.2 Per-round noise control

  • A per-round high-probability noise-control event keeps projection inputs within the tube; its failure probability is at most kτe^(-c0/2), and larger c0 trades fewer failures for a larger effective gradient bound.On failure, projection still returns a manifold point, and the objective rises by at most δF for that round.Source: §5.2 · pp. 18–19

5.3 Main results

  • Under Assumptions 1–5 and a stepsize constraint, Theorem 13 gives a finite-horizon stationarity bound whose optimization term decays as O(1/√T), while clipping can leave a T-independent floor.The floor vanishes when C ≥ G; the bound also covers the clipped algorithm for any threshold.Source: §5.3 · pp. 19–20
  • The convergence guarantee covers any number of local steps τ and participating clients k ≤ n simultaneously, with clipping bias represented explicitly.The analysis applies to Riemannian SGD with ProjAvg or RLAvg aggregation.Source: §5 · p. 17, §5.3 · p. 19
  • The leading DP-noise term scales with intrinsic dimension dM, while ambient dimension D appears only in the remainder and stepsize ceiling.Tangent projection discards the normal component of ambient noise.Source: §5.3 · p. 19, §5.4 · p. 21

5.4 Outline of the proof of Theorem 13

  • Nearest-point projection linearizes each local displacement as a tangent-projected update plus O(α²), letting client displacements be averaged in the ambient space without a τ-dependent penalty.ProjAvg and RLAvg yield the same server update to first order; the descent argument avoids exponential, logarithmic, and inverse-retraction maps.Source: §5.4 · pp. 20–21

6 Synthetic experiments

The synthetic experiments test DP-RFedProj on federated PCA over the Grassmann manifold, where the optimum is known in closed form. They examine how privacy cost varies with manifold dimension, client participation, and privacy accounting.

6.1 Problem setting

  • The testbed is federated PCA on Gr(d, p), where each client’s records are projected onto a shared p-dimensional subspace that preserves variance.The known closed-form optimum is the projector onto the top-p eigenvectors; the reported metric is the last iterate’s optimality gap, with privacy cost measured against a same-run non-private gap.Source: §6 · p. 21, §6.1 · p. 21, §6.2 · p. 22

6.3 Analysis

  • Privacy cost grows with manifold dimension dM but stays flat as ambient dimension D grows; ProjAvg and RLAvg costs differ by at most 2%.The observed pattern matches the bound’s dependence on dM rather than D.Source: §6.3 · p. 22
  • Privacy cost falls with the bound’s 1/k dependence, dropping by about 53 times from k = 1 to full participation, k = 50.This holds for both aggregation schemes.Source: §6.3 · p. 22
  • At ε = 1, PriRFed’s accounting sets σdp = 0.131 versus 0.024 for DP-RFedProj, and its optimality gap is about 10 to 27 times larger under RetAvg.With DP-RFedProj’s accounting, all three aggregation schemes reach optimality gaps within 4% of one another.Source: §6.3 · p. 22

7 EEG experiments

The EEG experiments compare private federated SPDNet with Euclidean EEGNet across three motor-imagery datasets. SPDNet leads EEGNet in every dataset and privacy-budget cell, while projection-based aggregation matches alternatives at lower computational cost.

7.1 Datasets and preprocessing

  • The experiments use three MOABB motor-imagery datasets, with signals filtered to 8–32 Hz, resampled to 128 Hz, and normalized per trial.Clients hold trials from fixed subject groups, with comparable data amounts.Source: §7.1 · p. 23

7.2 Model architectures

  • EEGNet operates on raw trials, while SPDNet processes covariance matrices with a Stiefel-manifold BiMap layer followed by ReEig, LogEig, and a softmax classifier.EEGNet’s training-mode batch normalization is removed because it is incompatible with record-level privacy; SPDNet is configured to have fewer parameters than EEGNet.Source: §7.2 · p. 24

7.3 Centralized non-private baselines

  • In pooled runs trained under Table 11 settings, SPDNet leads on two of the three datasets, while EEGNet leads on Cho2017.These runs upper-bound what the federated and private runs can reach.Source: §7.3 · p. 24

7.4 Federated protocol

  • Federated runs use one local epoch per round, compare full and half client participation, and evaluate non-private training plus ε ∈ {20, 10, 5} at δ = 10^-5.For SPDNet, the BiMap weight uses ProjAvg, RLAvg, or RetAvg; EEGNet uses arithmetic averaging.Source: §7.4 · pp. 24–25

7.5 Privacy–utility trade-off

  • Under privacy, SPDNet leads EEGNet in every dataset and budget; with ProjAvg, it retains 10 to 61% of its non-private accuracy above chance, versus at most 18% for EEGNet.Table 7 reports full-participation test accuracy; Table 8 covers half participation.Source: §7.5 · p. 25, Table 7 · p. 26, Table 8 · p. 26
  • With half participation, SPDNet still leads EEGNet on every dataset and budget; participation costs SPDNet at most 2.4 accuracy points under privacy and 0.5 point without privacy.Changing the run length by halving or doubling T changes accuracy by at most 2 points for SPDNet and less than one point for EEGNet on BNCI2014_001 and Weibo2014.Source: §7.5 · p. 25

7.6 Riemannian aggregation rules

  • The three Riemannian aggregation rules land within 2.3 accuracy points in every cell, while RetAvg costs 9 to 18 times more per round than ProjAvg.The two projection-based rules differ by at most 0.6 point, below seed-to-seed standard deviation.Source: §7.6 · p. 25

7.7 Comparison with PriRFed

  • At the same privacy budget, PriRFed requires five to six times as much noise; with RetAvg and matched settings, SPDNet loses 12.7, 3.7, and 8.2 points on BNCI2014_001, Cho2017, and Weibo2014, respectively.At PriRFed’s noise level, SPDNet ends within 6 points of chance.Source: §7.7 · p. 26

8 Conclusion

DP-RFedProj combines record-level privacy for compact submanifolds with convergence analysis covering multiple local steps, partial participation, and heterogeneous clients. Experiments report stronger private SPDNet accuracy than EEGNet and lower noise than the closest prior method, alongside stated scope limitations and future directions.

8 Conclusion

  • DP-RFedProj provides record-level differential privacy for compact submanifolds, with privacy obtained by perturbing gradients in fixed ambient geometry.The guarantee holds independently of the manifold, aggregation scheme, and local optimiser.Source: §8 · p. 26
  • The convergence analysis covers multiple local steps, partial participation, and heterogeneous clients together, with federated PCA experiments matching the theory on intrinsic-dimension privacy cost.The PCA experiments also report that privacy cost decreases with the number of clients per round.Source: §8 · p. 26
  • SPDNet outperforms EEGNet at every privacy budget, even on the dataset where EEGNet leads without privacy.The conclusion also reports that projection-based aggregation reaches retraction-based aggregation's accuracy at a fraction of the cost.Source: §8 · p. 27
  • Five to six times less noise than the closest prior method is required, while projection-based aggregation reaches retraction-based aggregation's accuracy at a fraction of the cost.The comparison concerns the same privacy budget.Source: §8 · p. 27
  • The framework requires a compact submanifold with the Euclidean-induced metric, and its convergence rate is proved for constant-step-size Riemannian SGD.The stated boundary excludes metrics without an ambient projection, such as the affine-invariant SPD metric; EEG experiments use scheduled Adam.Source: §8 · p. 28
  • Future directions include subject-level EEG privacy, splitting privacy budgets for personalised models, and handling batch normalisation's effect on per-record sensitivity.The text suggests privatising batch-normalisation statistics or using compatible per-sample normalisations.Source: §8 · p. 28

Broader Impact Statement

This block states the work's privacy scope and reviews geometric properties of the Stiefel, Grassmann, and SPD manifolds. It highlights projection operations and metric distinctions relevant to the paper's settings.

Broader Impact Statement

  • The stated aim is safer collaborative training on sensitive records, under an honest-but-curious-server threat model and record-level protection.The text says privacy costs accuracy and the budget should be chosen for the protection it affords.Source: Broader Impact Statement · p. 28

A.1 The Stiefel manifold

  • On the Stiefel manifold, the polar factor is the nearest-point projection and the aggregation rules use it, while QR provides a more numerically stable alternative.The polar projection is unique and smooth for full-column-rank inputs.Source: §A.1 · p. 32

A.2 The Grassmann manifold

  • On the Grassmann manifold, projection selects a top-p eigenspace and is unique when the pth eigenvalue exceeds the next one.Computing the projection requires one symmetric eigendecomposition.Source: §A.2 · p. 32

A.3 The manifold of SPD matrices

  • The SPD manifold is noncompact; its affine-invariant metric is invariant to general linear mixing, whereas the cheaper log-Euclidean metric is not.The log-Euclidean metric is invariant to orthogonal transformations and scaling.Source: §A.3 · p. 33

B Proofs for the convergence analysis

The proofs use regularity properties of compact, proximally smooth submanifolds and establish auxiliary bounds for clipped stochastic gradients and projected Gaussian noise. The probabilistic setting conditions on prior-round randomness while leaving current-round participation, minibatches, and noise random.

B.1 Geometric preliminaries

  • Proximal smoothness supplies a Lipschitz bound for projection near the manifold, while compactness makes the tangent-projector map Lipschitz.Clipping is a metric projection onto an ambient norm ball, and the clipped gradients remain tangent with bounded norm.Source: §B.1 · p. 33

B.2 Auxiliary lemmas

  • The auxiliary lemmas bound clipped stochastic-gradient minibatch variance and clipped-gradient heterogeneity under the stated assumptions.Sampling without replacement yields an unbiased minibatch estimator, with variance expressed using the finite-population variance.Source: §B.2 · pp. 33–34
  • For isotropic ambient Gaussian noise, projection onto a tangent space has expected squared norm d_M s^2, including under the stated norm truncation.Here d_M is the projector rank and s^2 is the ambient Gaussian variance.Source: §B.2 · p. 34

B.3 Probabilistic setting

  • The probabilistic setup fixes the current iterate using prior-round randomness while keeping current participation, minibatches, and noise random.Round randomness is generated for every client and used only for clients selected to participate.Source: §B.3 · p. 34

B.4 Proof of Lemma 12

The proof bounds the probability that any round's Gaussian perturbations exceed a prescribed norm threshold. It uses independent draws, Gaussian concentration, and a union bound.

B.4 Proof of Lemma 12

  • The round's Gaussian perturbations are independent and identically distributed, and the good event requires each draw's norm to stay below R.The probability of the good event is the single-draw probability raised to kτ.Source: §B.4 · p. 34
  • Gaussian concentration bounds the probability that one perturbation exceeds R by e^-c0/2.The threshold is chosen using the ambient dimension and c0.Source: §B.4 · p. 34
  • A union bound over kτ draws gives a failure-probability bound of π ≤ kτe^-c0/2.The resulting failure probability is independent of the participating-client set conditional on prior-round randomness.Source: §B.4 · p. 34

B.5 Proof of Theorem 13

The proof establishes one-round progress by controlling local and server projections, linearising local trajectories, and bounding the effects of sampling and noise. It then accounts for bad rounds and sums the descent bounds.

Step 1: tube stability

  • On Gt, the step-size condition keeps local and server pre-projection points within the projection tube, making each round’s projections single-valued.The stated condition is α ≤ γ/(4Geff), and the server pre-projection points lie within γ/2 of xt.Source: Step 1: tube stability · p. 35

Step 2: linearisation of the local trajectory

Step 3: server update and one-round descent

  • For both ProjAvg and RLAvg, the server-update analysis controls the expected update and its noise terms before deriving one-round descent.The analysis uses uniform client sampling and conditional zero-mean noise terms; the descent lemma requires α ≤ min{γ/(4Geff), 1/(4LM)}.Source: Step 3: server update and one-round… · pp. 36–37
  • The one-round bound combines a negative gradient contribution with clipping-bias, variance, and higher-order terms.The proof gives the gradient coefficient as −9/16 after combining terms.Source: Step 3: server update and one-round… · pp. 36–37

Bad rounds and summation

  • The proof handles the complement of Gt separately, sums the per-round bounds, and uses F(xT) ≥ F⋆ to obtain the stated result.Every iterate remains on M, including on bad rounds.Source: Bad rounds and summation · pp. 37–38

B.6 Proof of Corollary 14

The corollary’s rate follows by choosing a horizon-dependent stepsize and bounding bad-round and higher-order contributions. Ambient dimension enters through Geff only in the stepsize condition and subdominant remainder.

B.6 Proof of Corollary 14

  • With c0 = 4 log T + 2 log(kτ) and α = cα/T, the bad-round contribution is o(T^-1/2).The bound uses π ≤ T^-2.Source: §B.6 · p. 38
  • The term Aα² is O((log T)²/T), hence o(T^-1/2), while Geff = O(log T) for sufficiently large T.The stated threshold is all T beyond some T0.Source: §B.6 · p. 38
  • Ambient dimension D enters only through Geff in the stepsize condition and the subdominant remainder, not the leading rate.The remaining constants are independent of T.Source: §B.6 · p. 38

C Details of the synthetic experiments

The synthetic experiment uses federated PCA with a closed-form Grassmann-manifold solution and compares privacy costs across aggregation schemes. Its reported median privacy cost is a fraction of the corresponding noise-scale expression.

Closed-form solution

  • The rank-p PCA objective is minimised by projecting onto the top-p eigenvectors of the pooled covariance matrix.The passage identifies this solution using Ky Fan’s maximum principle.Source: C Details of the synthetic experiments · p. 38

Clip constant and stepsize

  • The methods use a clip constant chosen to make clipping inactive, and their learning rates are tuned on three runs separate from the ten reported runs.DP-RFedProj selects η = 0.2 across the reported privacy budgets and aggregation schemes.Source: C Details of the synthetic experiments · p. 38

Values

D Details of the EEG experiments

The EEG experiments describe model and privacy-accounting choices, including a batch-normalization constraint and tuned configurations. The horizon ablation reports limited accuracy changes for SPDNet, while the aggregation-time table reports timing summaries and a RetAvg-to-ProjAvg ratio.

D.2 The batch-normalization problem

  • Training-mode batch normalization makes each per-sample gradient depend on all B records, increasing sensitivity from 2C/B to 2C; EEGNet therefore omits it.The stated choice lets the guarantee cover all training records and matches SPDNet, which also has no batch normalization.Source: §D.2 · p. 39

D.3 Hyperparameter selection

  • Hyperparameters are selected using validation accuracy of the last iterate, with three tuning seeds disjoint from the ten reported seeds.The process tunes configurations centrally, federated without privacy, and then by privacy budget; RLAvg inherits ProjAvg settings.Source: §D.3 · p. 39
  • Figure 5 and Figure 6 show the EEGNet and SPDNet pipelines, respectively, with shapes annotated above each arrow.The captions identify B as batch size and T as time samples for EEGNet, and d as the post-BiMap dimension for SPDNet.Source: Figure 5 · p. 40, Figure 6 · p. 40

D.4 Learning curves and horizon

  • Doubling the horizon changes SPDNet accuracy by −0.9 to +1.4 points, while halving it changes accuracy by −2.0 to +0.8.The ablation recalibrates noise and uses the same learning rate and batch size at each budget.Source: §D.4 · p. 40, Table 14 · p. 42

D.6 Privacy accounting

  • Privacy accounting uses the smallest client’s subsampling rate and the largest client’s local-step count; PriRFed’s client-sampling amplification is not used because the server observes the selected set.The accounting calibrates σdp per seed; the comparison holds the mechanism fixed and changes the outer accounting.Source: §D.6 · p. 41

D.5 Aggregation cost

  • Table 15 reports per-round aggregation-time medians and interquartile ranges across ten non-private runs, plus the RetAvg-to-ProjAvg median ratio.The rule-to-rule ratios are comparable on the shared processor pool, but absolute times depend on hardware.Source: §D.5 · p. 40, Table 15 · p. 42

Related papers

Loading 2610.33712v1…