**footnotetext: These authors contributed equally to this
work$\dagger$$\dagger$footnotetext: Corresponding author

# Optimizing Privacy, Utility, and Efficiency in Constrained Multi-Objective
Federated Learning

Yan Kang∗<EMAIL_ADDRESS>WeBankChina ,  Hanlin Gu∗<EMAIL_ADDRESS>WeBankChina ,  Xingxing Tang<EMAIL_ADDRESS>Hong Kong University of
Science and TechnologyChina ,  Yuanqin He<EMAIL_ADDRESS>WeBankChina ,
Yuzhu Zhang<EMAIL_ADDRESS>Shenzhen International Graduate
School, Tsinghua UniversityChina ,  Jinnan He<EMAIL_ADDRESS>Shenzhen International Graduate School, Tsinghua UniversityChina ,  Yuxing Han
<EMAIL_ADDRESS>Shenzhen International Graduate School, Tsinghua
UniversityChina ,  Lixin Fan<EMAIL_ADDRESS>WeBankChina ,  Kai Chen
<EMAIL_ADDRESS>Hong Kong University of Science and TechnologyChina and
Qiang Yang$\dagger$<EMAIL_ADDRESS>WeBank and Hong Kong University of
Science and TechnologyChina

###### Abstract.

Conventionally, federated learning aims to optimize a single objective,
typically the utility. However, for a federated learning system to be
trustworthy, it needs to simultaneously satisfy multiple/many objectives, such
as maximizing model performance, minimizing privacy leakage and training cost,
and being robust to malicious attacks. Multi-Objective Optimization (MOO)
aiming to optimize multiple conflicting objectives simultaneously is quite
suitable for solving the optimization problem of Trustworthy Federated
Learning (TFL). In this paper, we unify MOO and TFL by formulating the problem
of constrained multi-objective federated learning (CMOFL). Under this
formulation, existing MOO algorithms can be adapted to TFL straightforwardly.
Different from existing CMOFL works focusing on utility, efficiency, fairness,
and robustness, we consider optimizing privacy leakage along with utility loss
and training cost, the three primary objectives of a TFL system. We develop
two improved CMOFL algorithms based on NSGA-II and PSL, respectively, for
effectively and efficiently finding Pareto optimal solutions, and provide
theoretical analysis on their convergence. We design measurements of privacy
leakage, utility loss, and training cost for three privacy protection
mechanisms: Randomization, BatchCrypt (An efficient homomorphic encryption),
and Sparsification. Empirical experiments conducted under the three protection
mechanisms demonstrate the effectiveness of our proposed algorithms.

trustworthy federated learning, multi-objective optimization, privacy

††ccs: Computing methodologies Distributed computing methodologies††ccs:
Computing methodologies Machine learning††ccs: Security and privacy††ccs:
Applied computing

##  1\. Introduction

Due to the increasingly stricter legal and regulatory constraints (e.g.,
GDPR111GDPR is applicable as of May 25th, 2018 in all European member states
to harmonize data privacy laws across Europe. https://gdpr.eu/ and
HIPAA222HIPAA is a federal law of the USA created in 1996. It required the
creation of national standards to protect sensitive patient health information
from being disclosed without the patient’s consent or knowledge) enforced on
user privacy, private data from different users or organizations cannot be
directly merged to train machine learning models. In recent years, federated
learning (FL) has emerged as a practical privacy-preserving solution to tackle
data silo issues without sharing users’ private data. Initially, FL (McMahan
et al., 2017) was proposed to build models using data from millions of mobile
devices. It then extended to enterprise settings where the number of
participants might be much smaller, but privacy concerns are paramount (Yang
et al., 2019b). For now, FL has been widely applied to various domains such as
finance (Kang et al., 2022; Long et al., 2020), healthcare (Rieke et al.,
2020; Nguyen et al., 2022) and advertisement (Tan et al., 2020; Yang et al.,
2020).

Conventionally, an FL system (McMahan et al., 2016) aims to optimize a single
objective, typically the utility (i.e., model performance), while treating
other objectives as secondaries. However, if an FL system aims to optimize
only a single objective, it likely fails to meet the requirements of other
crucial objectives. For example, when a differential privacy-protected FedAvg
algorithm (Wei et al., 2020) wants to maximize the model performance solely,
it has to reduce the noise added to protect data privacy, thereby increasing
the risk of leaking privacy. For an FL system to be trusted by people (e.g.,
FL participants, users, and regulators), it must simultaneously fulfill
multiple objectives, such as maximizing model performance, minimizing privacy
leakage and training costs, and being robust to malicious attacks. We call an
FL system a trustworthy federated learning system if it optimizes the tradeoff
among at least privacy, utility, and efficiency.

Figure 1. Formulating the problem of constrained multi-objective federated
learning to unify the multi-objective optimization and trustworthy federated
learning (see Sec. 4.2 for detail).

In this paper, we propose to apply multi-objective optimization (MOO) to
optimize multiple objectives of trustworthy federated learning (TFL). To this
end, we unify MOO and TFL by formulating the problem of constrained multi-
objective federated learning (CMOFL), as illustrated in Figure 1. This unified
formulation allows us to adapt MOO algorithms to find Pareto optimal solutions
for TFL. While TFL can involve an arbitrary number of objectives, we focus on
privacy, utility, and efficiency, which are primary pillars of trustworthy
federated learning. The benefits of finding Pareto optimal solutions and front
that optimize the three objectives include:

  * •

Pareto optimal solutions with different optimal trade-offs among conflicting
objectives can support participants’ flexible requirements.

  * •

Solving the Pareto front for practical problems helps define the applicable
boundaries of privacy protection mechanisms. For example, when DP is applied,
the Pareto front can tell us that the privacy leakage is deteriorating
noticeably as the protection strength reduces for maintaining utility (see
Figure 5 (b) and (e)). Therefore, DP is unsuitable for applications in which
utility and privacy are critical.

  * •

Pareto front can be considered as a comprehensive evaluation of the privacy-
preserving capability of a protection mechanism concerning privacy, utility,
and efficiency, and thus can guide the standard-setting for privacy levels.

Existing efforts (Zhu and Jin, 2020; Zhong et al., 2022; Morell et al., 2022;
Chai et al., 04; Yin et al., 2022) have been devoted to leveraging multi-
objective optimization algorithms to find Pareto optimal solutions that
optimize utility, efficiency, robustness, and fairness. In this paper, we
develop two improved constrained multi-objective federated learning algorithms
based on NSGA-II (Deb et al., 2002) and PSL (Lin et al., 2022), respectively,
to effectively and efficiently find Pareto optimal solutions that minimize
privacy leakage, utility loss, and training cost.

In sum, our main contributions mainly include:

  * •

We formulate the problem of constrained multi-objective federated learning
(CMOFL), which unifies multi-objective optimization and trustworthy federated
learning. The formulation involves an average-case CMOFL and a worst-case
CMOFL (see Def. 1 and Def. 2). The former aims to minimize the objectives of
the FL system, while the latter aims to minimize the objectives of individual
participants.

  * •

We aim to minimize privacy leakage, along with utility loss and training cost,
which are the three primary concerns of trustworthy federated learning. This
is one of the first attempts in CMOFL to consider privacy an objective to
optimize.

  * •

We develop two improved constrained multi-objective federated learning (CMOFL)
algorithms based on NSGA-II (Deb et al., 2002) and PSL (Lin et al., 2022),
respectively (Sec. 5), which can find better Pareto optimal solutions than
their baseline counterparts. The two CMOFL algorithms leverage the regret
function to penalize solutions that violate privacy leakage or training cost
constraint during optimization. We provide the convergence analysis of the two
improved algorithms and show that the two algorithms can converge to Pareto
optimal solutions with sufficient generations or population size.

  * •

We design measurements of privacy leakage, utility loss, and training cost for
Randomization, BatchCrypt (an efficient version of homomorphic encryption)
(Zhang et al., 2020a), and Sparsification, respectively. Empirical experiments
on each of the three protection mechanisms demonstrate the efficacy of our
algorithms.

##  2\. Related Work

We briefly review works related to our study of constrained multi-objective
federated learning.

###  2.1. Privacy Attacking and Protection Mechanisms in FL

Federated learning protects data privacy by keeping participants’ private data
locally and sharing only model information (parameters and gradients).
However, recent research on Deep Leakage from Gradients (DLG) (Zhu et al.,
2019) and its follow-up works (Geiping et al., 2020; Zhao et al., 2020; Yin et
al., 2021) demonstrated that adversaries could reconstruct private data by
solving a gradient-match optimization problem based on the shared model
information.

The literature has proposed various protection mechanisms to prevent private
data from being inferred by adversaries. The widely used ones are Homomorphic
Encryption (HE) (Gentry, 2009; Zhang et al., 2020b; Kang et al., 2022),
Differential Privacy (Geyer et al., 2017; Truex et al., 2020; Abadi et al.,
2016), Secret Sharing (Shamir, 1979; Blakley, 1979; Bonawitz et al., 2017) and
Sparsification (Nori et al., 2021). Recently, several works integrated split
learning into FL (Gu et al., 2021; Thapa et al., 2022; Wu et al., 2022) to
protect privacy by splitting the local model of each party into private and
public models and sharing only the public one with the server. Essentially,
these works are special cases of sparsification. Another line of privacy
protection works (Zhang et al., 2018; Huang et al., 2020) is instance
encoding, which transforms original training data to encoded ones such that
the machine learning models are trained using encoded data, thereby preventing
private data from being inferred by adversaries.

###  2.2. Multi-Objective Optimization

Multi-objective optimization (MOO) optimizes multiple conflicting objectives
simultaneously and outputs a set of Pareto optimal solutions instead of a
single one (Deb and Deb, 2014). A Pareto optimal solution represents a trade-
off between different objectives, each of which can not be further enhanced
without deteriorating others. MOO approaches can be gradient-free and
gradient-based.

Gradient-free MOO approaches do not require knowledge about the problem and
thus can solve black-box optimization problems. A large volume of existing MOO
works focuses on designing gradient-free MOO methods. These methods are
typically based on evolutionary algorithms and Bayesian optimization. Multi-
Objective Evolutionary Algorithms (MOEA), such as NSGA-II (Deb et al., 2002),
NSGA-III (Deb and Jain, 2014), SPEA2 (Zitzler et al., 2001; Kim et al., 2004)
and MOEA/D (Zhang and Li, 2007), converge fast and can find diverse Pareto
solutions. However, MOEA is computationally expensive, especially when the
black-box objective functions are expensive to evaluate.

To reduce the cost of expensive objective functions, a Multi-Objective
Bayesian Optimization (MOBO) (Laumanns and Ocenasek, 2002; Biswas et al.,
2021; Yang et al., 2019a; Daulton et al., 2022) algorithm approximates a
surrogate model to each black-box objective function and leverages an
acquisition method to search for Pareto optimal solutions. MOBO can find
Pareto optimal solutions with a small objective function evaluation budget.
However, the quality of the Pareto optimal solutions depends on the
performance of surrogate models.

With gradient information, gradient-based MOO approaches (Désidéri, 2012b;
Mahapatra and Rajan, 2020; Liu and Vicente, 2021) can be applied to large-
scale optimization problems, such as learning neural networks. These methods
mainly leverage multiple gradient descent algorithm (MSGA) (Désidéri, 2012b,
a) to find Pareto optimal solution. The core idea of MSGA is to find the
gradient with the direction that can decrease all objectives simultaneously.

###  2.3. Multi-Objective Federated Learning

In a multi-objective federated learning problem (MOFL), participants aim to
optimize multiple competing objectives (e.g., privacy leakage, utility loss,
learning cost, and fairness). MOFL typically leverages multi-objective
optimization approaches to find Pareto solutions for these objectives.
Existing research on MOFL mainly has two lines of direction. Table 1
summarizes these works.

Table 1. Existing multi-objective federated learning works. Work | Objective Scope | Specific Objectives | Type of Algorithm
---|---|---|---
(Ju et al., 2023; Cui et al., 2021; Mehrabi et al., 2022; Yin et al., 2022) | Worst-case | Fairness, Utility | Gradient-based
(Zhu and Jin, 2020; Zhong et al., 2022; Morell et al., 2022; Chai et al., 04; Yin et al., 2022) | Average-case |  Efficiency, Fairness, Robustness, Utility | Gradient-free

The first line of MOFL works (Ju et al., 2023; Cui et al., 2021; Hu et al.,
2022; Mehrabi et al., 2022) treats each client’s local model utility as an
objective and typically aims to achieve fairness among clients by optimizing
model parameters. (Hu et al., 2022; Cui et al., 2021) leveraged Multi-Gradient
Descent Algorithm (MGDA) to find a common descent direction for all
objectives. (Mehrabi et al., 2022) achieves fairness by enabling the server to
assign each client a score based on a validation dataset. This gives the
server the control to reward cooperative parties and punish uncooperative
parties. (Ju et al., 2023) proposed adaptive federated Adam as the server
optimizer to accelerate fair federated learning with bias.

The second line of MOFL works (Zhu and Jin, 2020; Zhong et al., 2022; Morell
et al., 2022; Chai et al., 04; Yin et al., 2022) aims to find Pareto solutions
that minimize system objectives, such as communication cost and resource
consumed for performing FL training and test error of the global model. A
solution represents variables that impact these system objectives. These
variables can be the model structure (e.g., number of layers, number of
neurons in each layer, and size of filters), training hyperparameters (e.g.,
learning rate, batch size, and local epoch), and communication-reduction
schemes (e.g., ratio or portion of model parameters to be shared with the
server and quantization bits). (Zhu and Jin, 2020; Zhong et al., 2022; Chai et
al., 04) leveraged NSGA-II, NSGA-III and MOEA/D, respectively, to minimize
communication cost and global model test error by optimizing the model
structure and training hyperparameters. (Morell et al., 2022) also tries to
minimize communication cost and global model test error but by optimizing the
communication-reduction scheme.

These two lines of research apply multi-objective optimization algorithms to
minimize objectives decided by federated learning parties (individually or as
a whole). Another relevant but different research direction (Xu et al., 2021b,
a; Liu et al., 2022) aims to leverage federated learning to train a global
surrogate model and an acquisition function using data dispersed among
multiple parties.

##  3\. Background

We review the concepts of multi-objective optimization and trustworthy
federated learning.

###  3.1. Multi-Objective Optimization

A multi-objective optimization problem is typically formulated as follows:

(2)
$\displaystyle\begin{array}[]{l@{\quad}l@{}l@{\quad}l}\min\limits_{{x}\in\mathcal{X}}(f_{1}({x}),f_{2}({x}),\ldots,f_{m}({x})),\end{array}$

where $x$ is a solution in the decision space $\mathcal{X}$ and
$\\{f_{i}\\}_{i=1}^{m}$ are the $m$ objectives.

No single solution can simultaneously optimize all objectives for a non-
trivial multi-objective optimization problem with conflicting objectives.
Therefore, decision-makers are often interested in Pareto optimal solutions
for supporting their flexible requirements. We have the following definitions
of Pareto dominance, Pareto optimal solutions, Pareto set, and Pareto front.

###### Definition 0 (Pareto Dominance).

Let $x_{a},x_{b}\in\mathcal{X}$, $x_{a}$ is said to dominate $x_{b}$, denoted
as $x_{a}\prec x_{b}$, if and only if $f_{i}(x_{a})\leq f_{i}(x_{b}),\forall
i\in\\{1,\ldots,m\\}$ and $f_{j}(x_{a})<f_{j}(x_{b}),\exists
j\in\\{1,\ldots,m\\}$.

###### Definition 0 (Pareto Optimal Solution).

A solution $x^{*}\in\mathcal{X}$ is called a Pareto optimal solution if there
does not exist a solution $\hat{x}\in\mathcal{X}$ such that $\hat{x}\prec
x^{*}$.

Intuitively, a Pareto optimal solution represents a trade-off between
conflicting objectives, each of which can not be further enhanced without
negatively affecting others. All Pareto optimal solutions form a Pareto set,
and their corresponding objectives form the Pareto front. The Pareto set and
Pareto front are formally defined as follows.

###### Definition 0 (Pareto Set and Front).

The set of all Pareto optimal solutions is called the Pareto set, and its
image in the objective space is called the Pareto front.

In order to compare Pareto fronts achieved by different MOFL algorithms, we
need to quantify the quality of a Pareto front. To this end, we adopt the
hypervolume (HV) indicator (Zitzler and Künzli, 2004) as the metric to
evaluate Pareto fronts. Definition 4 formally defines the hypervolume.

###### Definition 0 (Hypervolume Indicator).

Let $z=\\{z_{1},\cdots,z_{m}\\}$ be a reference point that is an upper bound
of the objectives $Y=\\{y_{1},\ldots,y_{m}\\}$, such that $y_{i}\leq z_{i}$,
$\forall i\in[m]$. the hypervolume indicator $\text{HV}_{z}(Y)$ measures the
region between $Y$ and $z$ and is formulated as:

(3)
$\text{HV}_{z}(Y)=\Lambda\left(\left\\{q\in\mathbb{R}^{m}\big{|}q\in\prod_{i=1}^{m}[y_{i},z_{i}]\right\\}\right)$

where $\Lambda(\cdot)$ refers to the Lebesgue measure.

Intuitively, the $\text{HV}(Y)$ can be described as the size of the space
covered by $Y$. The larger the HV value, the better the $Y$.

###  3.2. Trustworthy Federated Learning

The motivation for adopting federated learning (FL) is that FL enables
multiple participants to train a machine learning model that performs much
better than the model trained by a single participant by leveraging the
private data of all participants but without sharing them. As the research on
FL goes deeper and broader, FL has encountered many new challenges. For
example, FL algorithms without any protection mechanism applied are vulnerable
to gradient-based privacy attacks (Lyu et al., 2022), such as the deep leakage
from gradients (DLG). To address these challenges and build a trustworthy FL
system, various aspects beyond utility should be considered. The literature
has offered several proposals for what aspects a trustworthy Artificial
Intelligence (AI) system (Thiebes et al., 2020; Li et al., 2023; Liu et al.,
2022; Chen et al., 2023b) in general and a trustworthy FL system (Zhang et
al., 2023b, a; Yang et al., 2023; Chen et al., 2023a) in particular should
satisfy. We call an FL system a trustworthy federated learning system if it
optimizes the tradeoff among at least the following three factors: privacy,
utility, and efficiency.

  * •

Privacy. the private data of participants should be protected to prevent them
from being inferred by adversaries. Privacy is of paramount importance to
trustworthy federated learning.

  * •

Utility. The performance of the FL model should be maximized on the test data.
A protection mechanism may lead to utility loss. Thus, there may have a
tradeoff between privacy leakage and utility loss.

  * •

Efficiency. The FL models should be trained or make inferences within an
acceptable or controllable computation and communication cost. A protection
mechanism may result in decreased efficiency. Thus, there may have a tradeoff
between privacy leakage and efficiency.

###### Remark 1.

We consider efficiency as an essential aspect of trustworthy FL because
privacy protection mechanisms are often time-consuming operations, which makes
them impractical to apply if efficiency is not optimized.

Other aspects that are also crucial to trustworthy federated learning include:

  * •

Robustness. The FL system should tolerate extreme conditions, such as being
attacked by malicious adversaries.

  * •

Fairness. Fairness largely impacts participants’ willingness to join federated
learning. We consider fairness from two perspectives: (1) the performance of
FL model(s) should be maximized on each participant’s test data; (2) the
payoff should be fairly distributed to each participant according to their
contributions to the federation (Lim et al., 2020; Yu et al., 2020).

  * •

IP-right security. Private models’ intellectual property (IP) should be
protected, traced, and audited to prevent valuable model assets from being
stolen or breached.

  * •

Explainability. The decisions made by FL models should be understood by both
technical FL participants and non-technical users and regulators.

##  4\. A Constrained Multi–Objective Federated Learning Framework

In this section, we formulate the constrained multi-objective federated
learning problem, and define privacy leakage, learning cost, and utility loss,
the three objectives we consider in this work.

Table 2. Table of Notation Notation | Meaning
---|---
$X$ and $Y$ | Solutions and objective values of multi-objective optimization
$\epsilon_{p}$, $\epsilon_{u}$, and $\epsilon_{c}$ | Privacy leakage, utility loss, and training cost
$W^{\mathcal{O}}_{k}$ |  Unprotected model parameters of client $k$
$W^{\mathcal{D}}_{k}$ |  Protected model parameters of client $k$
$W_{\text{fed}}^{\mathcal{D}}$ | Protected global model parameters
$P^{\mathcal{O}}_{k}$ |  Distribution of $W^{\mathcal{O}}_{k}$
$P^{\mathcal{D}}_{k}$ |  Distribution of $W^{\mathcal{D}}_{k}$

###  4.1. General Setup

FL setting and Treat Model. We focus on horizontal federated learning (HFL),
which involves $K$ participating parties that each holds a private dataset
$D_{k},k\in[K]$. The server is semi-honest, and it may launch privacy attacks
on exchanged information to infer participants’ private data. To mitigate
privacy leakage, each participant applies a protection mechanism to the model
information that will be shared with the server. Table 2 summarizes frequently
used notations in this paper.

The training procedure of trustworthy federated learning with $K$ clients
involves at least following four steps (also see Figure 2 (a)):

  1. 1

With the global model downloaded from the server, each client $k$ trains its
local model using its private data set $D_{k}$, and obtains the local model
$W_{k}^{\mathcal{O}}$.

  2. 2

In order to prevent semi-honest adversaries from inferring other clients’
private information $D_{k}$ based on shared model $W_{k}^{\mathcal{O}}$, each
client $k$ adopts a protection mechanism $\mathcal{M}$ (e.g., DP and HE) to
convert model $W_{k}^{\mathcal{O}}$ to protected model $W_{k}^{\mathcal{D}}$,
and sends $W_{k}^{\mathcal{D}}$ to the server.

  3. 3

The server aggregates $W_{k}^{\mathcal{D}},k=1,\cdots,K$ to generate a new
global model $W_{\text{fed}}^{\mathcal{D}}$.

  4. 4

Each client $k$ downloads the global model $W_{\text{fed}}^{\mathcal{D}}$ and
trains its local model based on $W_{\text{fed}}^{\mathcal{D}}$. (note that if
the protection mechanism is HE, each client need to decrypt
$W_{k}^{\mathcal{D}}$ before local training).

The steps  1- 4 iterate until the algorithm reaches the termination condition.

###  4.2. Problem Formulation

Conventionally, the $K$ participants of FL aim to collaboratively minimize a
single objective, typically the test error of global model $W_{\text{fed}}$.
This federated optimization problem is formulated as (McMahan et al., 2016):

(4) $\min_{W_{\text{fed}}}f(W_{\text{fed}})\qquad\text{where}\qquad
f(W_{\text{fed}})=\frac{n_{k}}{n}\sum_{k=1}^{K}F_{k}(W_{\text{fed}}),$

where $n_{k}$ denotes the size of the dataset $D_{k}$,
$n=\sum_{k=1}^{K}n_{k}$, and
$F_{k}(W_{\text{fed}})=\frac{1}{|D_{k}|}\sum_{i\in
D_{k}}\ell(W_{\text{fed}},D_{k,i})$ is the loss of predictions made by the
model parameter $W_{\text{fed}}$ on dataset $D_{k}$, in which $D_{k,i}$
denotes the $i$-th data-label pair of client $k$.

However, the formulation in Eq (4) does not satisfy the demand of trustworthy
federated learning (TFL), which may involve multiple/many objectives, such as
utility loss, privacy leakage, training cost, and robustness. These objectives
are typically conflicting with each other and cannot be minimized to optimal
simultaneously. In addition, TFL participants typically have constraints on
objectives for the final solutions to be practical or feasible in real-world
federated learning applications. For example, participants may require the
leaked privacy to be within an acceptable threshold or the training time
within a reasonable amount of time. Multi-objective optimization is used to
optimize multiple objectives at the same time while considering constraints.
Thus, it is perfectly suitable to solve the optimization problem of
trustworthy federated learning. We unify MOO and TFL, and formulate the
constrained multi-objective federated learning problem as follows.

###### Definition 0 (Average-case Constrained Multi-Objective Federated
Learning).

We formalize the average-case Constrained Multi-Objective Federated Learning
(CMOFL) problem as follows:

(5)
$\begin{split}&\min\limits_{x\in\mathcal{X}}(f_{1}(x),f_{2}(x),\ldots,f_{m}(x))\text{,
where }f_{i}(x)=\sum_{k=1}^{K}p_{i,k}F_{i,k}(x)\text{ for $1\leq i\leq m$},\\\
&\text{ subject to }\,\,f_{j}(x)\leq\phi_{j},\forall
j\in\\{1,\cdots,m\\}\end{split}$

where $x\in\mathbb{R}^{d}$ is a solution in the decision space $\mathcal{X}$,
$\\{f_{i}\\}_{i=1}^{m}$ are the $m$ objectives to minimize, $F_{i,k}$ is the
local objective of client $k$ corresponds to the $i$th objective $f_{i}$,
$p_{i,k}$ is the coefficient of $F_{i,k}$ satisfying
$\sum_{k=1}^{K}p_{i,k}=1$, and $\phi_{i}$ is the upper constraint of $f_{i}$.

###### Remark 2.

A solution $x$ in this paper refers to a set of hyperparameters, e.g., the
learning rate, batch size, and protection strength parameters. Each
hyperparameter set corresponds to specific privacy leakage, utility loss, and
training cost values. We look for Pareto optimal solutions of hyperparameters
that simultaneously minimize privacy leakage, utility loss, and training cost.

Definition 1 considers objectives that each is a weighted average of
participants’ local objectives. The average-case objectives can be considered
as the objectives of the whole FL system. In Definition 2, we also define
CMOFL that optimizes the objectives of individual participants.

###### Definition 0 (Worst-case Constrained Multi-Objective Federated
Learning).

We formalize the worst-case Constrained Multi-Objective Federated Learning
problem as follows:

(6)
$\begin{split}&\min\limits_{x\in\mathcal{X}}(f_{1}(x),f_{2}(x),\ldots,f_{m}(x))\text{,
where }f_{i}(x)=\max_{1\leq k\leq K}F_{i,k}(x)\text{ for $1\leq i\leq m$},\\\
&\text{ subject to }\,\,f_{j}(x)\leq\phi_{j},\forall
j\in\\{1,\cdots,m\\}\end{split}$

where $x\in\mathbb{R}^{d}$ is a solution in the decision space $\mathcal{X}$,
$\\{f_{i}\\}_{i=1}^{m}$ are the $m$ objectives to minimize and the $i$th
objective $f_{i},i\in[m]$ is the maximum (i.e., worst-case) of participants’
$i$th local objectives $\\{F_{i,k}\\}_{k=1}^{K}$, and $\phi_{i}$ is the upper
bound of $f_{i}$.

In this work, we focus on the average-case constrained multi-objective
federated learning, and we are particularly interested in minimizing privacy
leakage, utility loss, and training cost, the three primary concerns of
trustworthy federated learning.

###  4.3. Privacy Leakage, Utility Loss and Learning Cost

To mitigate privacy leakage, each participant applies a protection mechanism
to transform original model parameters $W_{k}^{\mathcal{O}}$ to a distorted
(i.e., protected) ones $W_{k}^{\mathcal{D}}$ and sends $W_{k}^{\mathcal{D}}$
to the server for further training. This implies that a protection mechanism
impacts not only privacy leakage but also utility loss and training cost. In
this section, we provide protection-mechanism-agnostic definitions of privacy
leakage $\epsilon_{p}$, utility loss $\epsilon_{u}$, and training cost
$\epsilon_{c}$. Based on these definitions, we will provide specific
measurements of $\epsilon_{p}$, $\epsilon_{u}$, and $\epsilon_{c}$ for
Randomization, BatchCrypt, and Sparsification in Sec. 6.1 for experiments.

Privacy Leakage. Following (du Pin Calmon and Fawaz, 2012; Rassouli and
Gündüz, 2019), the distortion (i.e., protection) extent is defined as the
distance between the distribution $P_{k}^{\mathcal{O}}$ of original model
parameters $W_{k}^{\mathcal{O}}$ (i.e., $W_{k}^{\mathcal{O}}\sim
P_{k}^{\mathcal{O}}$) and the distribution $P_{k}^{\mathcal{D}}$ of protected
model parameters $W_{k}^{\mathcal{D}}$ (i.e., $W_{k}^{\mathcal{D}}\sim
P_{k}^{\mathcal{D}}$). In this work, we leverage the distortion extent to
formulate the privacy leakage:

(7) $\displaystyle\epsilon_{p}=\frac{1}{K}\sum_{k=1}^{K}\epsilon_{p,k}\text{,
where }\epsilon_{p,k}=1-\text{TV}(P_{k}^{\mathcal{O}}||P_{k}^{\mathcal{D}}),$

where $\text{TV}(\cdot||\cdot)$ denotes the Total Variation distance between
two distributions. A larger distortion applied to the original model
parameters leads to larger
$\text{TV}(P_{k}^{\mathcal{O}}||P_{k}^{\mathcal{D}})$, thereby less privacy
leakage.

###### Remark 3.

We employ the TV distance (in the range of [0, 1]) to measure the distortion
extent following (Duchi et al., 2013). Zhang et al. (Zhang et al., 2022)
defined a Bayesian privacy leakage by measuring the information on the private
data that a semi-honest adversary may infer when observing protected model
information. They demonstrated that the proposed $\epsilon_{p}$ in Eq. (7)
serves as a lower bound for Bayesian privacy leakage (Theorem 4.1 in (Zhang et
al., 2022)).

The privacy leakage defined in Eq. (7) shows that a larger distortion leads to
less privacy leakage. On the other hand, a larger distortion may result in
larger utility loss and training cost. We define the utility loss and training
cost as follows.

Utility Loss. The utility loss $\epsilon_{u}$ of a federated learning system
is defined as follows:

(8)
$\epsilon_{u}=\text{U}({W_{\text{fed}}^{\mathcal{O}}})-\text{U}(W_{\text{fed}}^{\mathcal{D}}),$

where $\text{U}(W_{\text{fed}}^{\mathcal{D}})$ and
$\text{U}(W_{\text{fed}}^{\mathcal{O}})$ measure the utility of protected
global model $W_{\text{fed}}^{\mathcal{D}}$ and unprotected global model
$W_{\text{fed}}^{\mathcal{O}}$, respectively.

Training Cost The training cost $\epsilon_{c}$ of a federated learning system
can be divided into computation cost and communication cost, and we define it
as follows:

$\displaystyle\epsilon_{c}=\frac{1}{K}\sum_{k=1}^{K}(Q_{\text{comp}}+Q_{\text{comm}}),$

where $Q_{\text{comp}}$ measures computation cost, while $Q_{\text{comm}}$
measures communication cost.

##  5\. Constrained Multi-Objective Federated Learning Algorithms

In this section, we provide an overview of a gradient-free multi-objective
federated learning (MOFL) workflow and propose two improved MOFL algorithms
for finding the Pareto optimal solutions that minimize privacy leakage,
utility loss, and training cost.

Figure 2. The Constrained Multi-Objective Federated Learning Workflow. The
left panel illustrates a typical federated learning training procedure. The
right panel gives the general constrained multi-objective optimization
procedure involving five sub-procedures: train surrogate models, generate
solutions, evaluate solutions, select solutions, and constraint handling. The
select solutions sub-procedure and the evaluate solutions sub-procedure may
call the federated learning procedure to obtain utility loss $\epsilon_{u}$,
privacy leakage $\epsilon_{p}$, and training cost $\epsilon_{c}$ by evaluating
a given solution $x\in\mathcal{X}$.

Figure 2 illustrates the workflow of the general CMOFL, which consists of (i)
a federated learning procedure that evaluates solutions and (ii) a multi-
objective optimization (MOO) procedure that finds Pareto optimal solutions
under constraints based on objective values.

  * •

The federated learning procedure, serving as an evaluation function, evaluates
given solutions to measure their corresponding objective values for privacy
leakage, utility loss, and training cost. Algorithm 1 describes the detailed
FL procedure in MOFL. It follows the conventional secure FL (Zhang et al.,
2022) training procedure but with additional steps of measuring privacy
leakage, utility loss, and training cost. More specifically, each client
measures privacy leakage and training cost after local training and uploads
them to the server (line 10-11 in Algo. 1), which in turn aggregates uploaded
information (line 14 in Algo. 1). Upon the completion of training, the server
measures the final privacy leakage, training cost, and utility loss, and then
sends them to the MOO procedure (line 16-17 in Algo. 1).

  * •

The MOO procedure typically involves five sub-procedures: train surrogate
models, generate candidate solutions, evaluate solutions, select solutions,
and constraint handling. Different MOFL algorithms implement the five sub-
procedures differently and may call them in different orders. Surrogate models
are involved in surrogate-based MOO algorithms such as multi-objective
Bayesian optimization. They enhance optimization efficiency by assigning
solutions with surrogate objective values instead of calling expensive
objective functions. Evaluate solutions or select solutions subprocedure may
need to call the federated learning procedure to obtain the real values of FL
objectives. Constraint handling subprocedure eliminates solutions that violate
constraints.

Algorithm 1 Federated Learning Optimization (FLO)

1:Input: Dataset $D_{k}$ owned by client $k\in[K]$, solutions $X$, protection
mechanism $\mathcal{M}$.

2:Output: objective values $Y$ for $X$

3:for each solution $x$ $\in$ $X$ do

4: set global model structure and hyperparameters according to $x$;

5: initialize global model parameters $W_{\text{fed}}$;

6: for each communication round $i\in I$ do

7: $\triangleright$ Clients perform:

8: for client $k\in[K]$ do

9: decode $W_{\text{fed},i}\leftarrow W_{\text{fed},i}^{\mathcal{D}}$
(optionally) and set $W_{k,i}\leftarrow W_{\text{fed},i}$;

10: Local Update $W_{k,i}\leftarrow W_{k,i}-\eta\nabla\mathcal{L}_{k,i}$ based
on $D_{k}$;

11: Apply protection mechanism to obtain
$W_{k,i}^{\mathcal{D}}\leftarrow\mathcal{M}(W_{k,i})$;

12: Measure objectives of privacy leakage $\epsilon_{p,k,i}$ and learning cost
$\epsilon_{e,k,i}$;

13: Upload the $W_{k,i}^{\mathcal{D}}$, $\epsilon_{p,k,i}$ and
$\epsilon_{e,k,i}$ to the server;

14: $\triangleright$ Server perform:

15: $W_{\text{fed},i+1}^{\mathcal{D}}$
$\leftarrow\frac{1}{K}\sum_{k=1}^{k,i}W_{k,i}^{\mathcal{D}}$;

16: $\epsilon_{p,i}$ $\leftarrow$
Aggregate($\epsilon_{p,k,i},k\in[K]$);$\epsilon_{c,i}$ $\leftarrow$
Aggregate($\epsilon_{c,k,i},k\in[K]$)

17: Distribute the $W_{\text{fed},i+1}^{\mathcal{D}}$ to all clients.

18: $\epsilon_{p}$ $\leftarrow$ Aggregate($\epsilon_{p,i},i\in[I]$);
$\epsilon_{c}$ $\leftarrow$ Aggregate($\epsilon_{c,i},i\in[I]$)

19: Evaluate test accuracy of $W_{\text{fed}}^{\mathcal{D}}$ on the test
dataset and calculate utility loss $\epsilon_{u}$.

20: $Y\leftarrow Y+(\epsilon_{p},\epsilon_{c}.\epsilon_{u})$

21:return $Y$;

Built upon the general MOFL workflow, we propose two constrained multiple-
objective federated learning (CMOFL) algorithms to find better Pareto optimal
solutions that satisfy constraints. To this end, both algorithms leverage a
regret function to penalize solutions that violate constraints on privacy or
training cost during optimization. The first CMOFL algorithm is based on NSGA-
II (Deb et al., 2002), and thus we name it CMOFL-NSGA-II. The second one is
based on PSL (Pareto Set Learning) (Lin et al., 2022), a multi-objective
Bayesian optimization algorithm, and we name it CMOFL-PSL.

###  5.1. CMOFL-NSGA-II

Non-dominated Sorting Genetic Algorithm II (NSGA-II) is a well-known multi-
objective evolutionary algorithm proposed by (Deb et al., 2002). NSGA-II
follows the general procedure of the genetic algorithm and is characterized by
a fast non-dominated sorting approach and diversity preservation heuristics
based on crowding distance. The fast non-dominated sorting approach sorts a
population into different non-dominated levels, and the crowding distance
measures the closeness among individuals (i.e., solutions) at the same
dominance level. Individuals with a higher non-dominated level and larger
crowding distance are more likely to be selected to enter the next generation.

Algorithm 2 CMOFL-NSGA-II

1:Input: generations $T$, datasets $\\{D_{k}\\}_{k=1}^{K}$ owned by $K$
clients; constraints $\phi_{u},\phi_{p},\phi_{c}$; penalty coefficients
$\alpha_{u},\alpha_{p},\alpha_{c}$.

2:Output: Pareto optimal solutions and Pareto front $\\{X_{T},Y_{T}\\}$

3:Initialize solutions $\\{X_{0}\\}$.

4:for each generation $t$ $=1,2,\cdots,T$ do

5: Crossover and mutate parent solutions $X_{t-1}$ to produce offspring
solutions $P$;

6: $R$ $\leftarrow$ Merge $X_{t-1}$ and $P$;

7: $Y$ $\leftarrow$ FLO$(R,\\{D_{k}\\}_{k=1}^{K})$ $\triangleright$ use FL to
obtain objective values

8: for each tuple ($\epsilon_{u},\epsilon_{p},\epsilon_{c}$) in $Y$ do
$\triangleright$ penalize objectives that violate constraints (9)
$\epsilon_{i}=\epsilon_{i}\text{ +
}\alpha_{i}\max\\{0,\epsilon_{i}-\phi_{i}\\},i\in\\{u,p,c\\}$

9: $R^{S}\leftarrow$ Non-dominated sorting and crowding distance sorting $R$
based on $Y$;

10: $X_{t}$ $\leftarrow$ Select $N$ high-ranking solutions from $R^{S}$;

11:return $\\{X_{T},Y_{T}\\}$

The FL version of NSGA-II was proposed in the work (Zhu and Jin, 2020). Our
algorithm CMOFL-NSGA-II improves it by applying constraints to objectives for
finding better and more practical Pareto optimal solutions.

Algo. 2 describes the training process of CMOFL-NSGA-II. The first generation
starts from initial solutions $X_{0}$. In each generation, offspring solutions
$P$ are generated by crossover and mutation on parent solutions. Then, parent
solutions and their offspring solutions are merged to form current solutions
$R$, the objective values $Y$ of which are obtained by calling federated
learning optimization procedure (Line 5 in Algo 2). We loop over objective
values in $Y$ and add penalties to those violating prespecified constraints
(Line 6 in Algo 2). Next, non-dominated sorting and crowding distance sorting
are performed on $R$ based on $Y$, resulting in $R^{S}$. Last, $N$ solutions
with the highest ranking in $R^{S}$ are selected to enter the next generation.
Upon completing $T$ generations of evolution, the algorithm returns Pareto
optimal solutions and their corresponding Pareto Front.

We provide the convergence analysis for Algo. 2 as follows:

###### Lemma 0.

The work (Zheng et al., 2022) considers the following LOTZ and ONEMINMAX
benchmarks in two multi-objective problems. Let $d$ be the dimension of the
solution space.

  * •

LOTZ: If the population size $N$ is at least $5(d+1)$, then the expected
runtime is $O(d^{2})$ iterations and $O(Nd^{2})$ fitness evaluations.

  * •

ONEMINMAX: if the population size $N$ is at least $4(d+1)$, then the expected
runtime is $O(d\text{log}d)$ iterations and $O(Nd\text{log}d)$ fitness
evaluations.

Lemma 1 demonstrates the NSGA-II algorithm could obtain almost Pareto optimal
solutions (i.e., within a small $\epsilon$ error) for LOTZ and ONEMINMAX
benchmarks with sufficiently large population size $N$. Further, we provide
the convergence analysis of Algo. 2 when the objective values obtained by
Algo. 2 approaches the finite Pareto optimal objective values within
$\epsilon$ error from the perspective of hypervolume.

###### Theorem 2.

Let $Y^{*}$ be the finite Pareto optimal objective values w.r.t $m$
objectives. If for any $y^{*}\in Y^{*},\exists y^{T}\in Y_{T}$ obtained by
Algo. 2, s.t. $\|y^{T}-y^{*}\|\leq\epsilon$, then we have:

(10) $\text{HV}_{z}(Y^{*})-\text{HV}_{z}(Y_{T})\leq Cm\epsilon,$

where $\text{HV}_{z}(\cdot)$ represents the hypervolume with reference point
$z$, $m$ is the number of objectives and $C$ is a constant. See proof in
Appendix B.1.

###  5.2. CMOFL-PSL

Pareto Set Learning (or PSL) (Lin et al., 2022) is a multi-objective Bayesian
optimization (MOBO) algorithm. It learns a Pareto set model to map any valid
preference to corresponding solutions and builds independent Gaussian process
models to approximate each expensive objective function. Based on the Pareto
set model and Gaussian process model, surrogate objectives are scalarized
using the weighted Tchebycheff approach. Solving the Tchebycheff scalarized
subproblem with specific trade-off preferences is equivalent to finding Pareto
optimal solutions.

Algorithm 3 CMOFL-PSL

1:Input: generations $T$, datasets $\\{D_{k}\\}_{k=1}^{K}$ owned by $K$
clients; constraints $\phi_{u},\phi_{p},\phi_{c}$; penalty coefficients
$\alpha_{u},\alpha_{p},\alpha_{c}$.

2:Output: Pareto front $\\{X_{T},Y_{T}\\}$

3:Initialize solutions $\\{X_{0},Y_{0}\\}$.

4:for each generation $t$ $=1,2,\cdots,T$ do

5: Train Pareto Set model $h_{\theta}$ and Gaussian process model $g$ using
$\\{X_{t-1},Y_{t-1}\\}$;

6: $R$ $\leftarrow$ Generate $m$ candidate solutions using $h_{\theta}$

7: Compute surrogate objective values for candidate solutions $R$: $\hat{Y}$
$\leftarrow$ $g(R)$;

8: for each tuple ($\epsilon_{u},\epsilon_{p},\epsilon_{c}$) in $\hat{Y}$ do
$\triangleright$ penalize objectives that violate constraints (11)
$\epsilon_{i}=\epsilon_{i}+\alpha_{i}\max\\{0,\epsilon_{i}-\phi_{i}\\},i\in\\{u,p,c\\}$

9: $X$ $\leftarrow$ Select $N$ solutions from $R$ with the highest hypervolume
improvement based on $\hat{Y}$;

10: $Y\leftarrow$ FLO$(X,\\{D_{k}\\}_{k=1}^{K})$ $\triangleright$ use FL to
obtain real objective values

11: $\\{X_{t},Y_{t}\\}$ $\leftarrow$ $\\{X_{t-1},Y_{t-1}\\}$ \+ $\\{X,Y\\}$;

12:return $\\{X_{T},Y_{T}\\}$

We implement our FL version of PSL based on work (Lin et al., 2022) and name
it CMOFL-PSL. Algo. 3 describes the training process of CMOFL-PSL: In each
generation, a Pareto Set model $h_{\theta}$ and the Gaussian process model $g$
are first trained with the accumulated Pareto optimal solutions and front
$\\{X_{t-1},Y_{t-1}\\}$ (Line 3 in Algo. 3. We refer readers to work (Lin et
al., 2022) for detail). Then, $m$ ($m\gg N$) candidate solutions $R$ are
generated by $h_{\theta}$, and their surrogate objective values $\hat{Y}$ are
derived by the Gaussian process $g$. We loop over objective values in
$\hat{Y}$ and add penalties to the ones that violate prespecified constraints
(Line 6 in Algo. 3). After that, a greedy batch selection process is applied
to $R$ for selecting top $N$ solutions $X$ that have the biggest hypervolume
improvement based on $\hat{Y}$. Next, the selected solutions $X$ are evaluated
by calling the federated learning optimization procedure to obtain their real
objective values $Y$ (Line 8 in Algo. 3). Last, $X$ and $Y$ are appended to
accumulated Pareto optimal solutions and front $\\{X_{t-1},Y_{t-1}\\}$,
resulting in $\\{X_{t},Y_{t}\\}$. Upon completing $T$ generations, the
algorithm returns Pareto optimal solutions and their corresponding Pareto
Front.

We analyze the convergence of Algo. 3 as follows:

###### Theorem 3.

(Zhang and Golovin, 2020) If the type of scalarizations method is hypervolume
scalarization, the hypervolume regret after $T$ observations (i.e.,
generations) is upper bounded by:

(12)
$\sum_{t=1}^{T}\big{(}\text{HV}_{z}(Y^{*})-\text{HV}_{z}(Y_{t})\big{)}\leq
O(m^{2}d^{1/2}[\gamma_{T}ln(T)T]^{1/2}),$

where $Y_{t}$ is obtained by Algo. 3 and $\gamma_{T}$ is a kernel-dependent
quantity known as the maximum information gain. For example,
$\gamma_{T}=O(\text{poly }ln(T))$ for the squared exponential kernel.
Furthermore, $\text{HV}_{z}(Y^{*})-\text{HV}_{z}(Y_{T})\leq
O(m^{2}d^{1/2}[\gamma_{T}ln(T)/T]^{1/2})$.

Theorem 3 demonstrates the convergence of Algo. 3 according to the
hypervolume. Specifically, the convergence bound increases with the increment
of the number of objectives $m$ or the dimension $d$ of a solution and
decreases with the increment of $T$. The multi-objective Bayesian optimization
in Algo. 3 (CMOFL-PSL) (Lin et al., 2022) leverages the Tchebyshev
scalarizations, whose relation to Hypervolume scalarizations is presented in
Appendix B.2.

##  6\. Experiment

In this section, we elaborate on the empirical experiments to verify our
proposed algorithms.

###  6.1. Experimental Setups

This section details the experimental setups, including the datasets and
models we adopt to run experiments, federated learning setup, multi-objective
optimization algorithm setup, and experimental settings in which we conduct
our experiments.

####  6.1.1. Datasets and Models

We conduct experiments on two datasets: Fashion-MNIST (Xiao et al., 2017) and
CIFAR10 (Krizhevsky et al., 2014). Fashion-MNIST has 60000 training data and
10000 test data, while CIFAR10 has 50000 training data and 10000 test data.
Both datasets have 10 classes. We adopt MLP (Multilayer Perceptrons) for
conducting experiments on Fashion-MNIST and a modified LeNet (LeCun et al.,
1998) on CIFAR10.

The MLP consists of 2 hidden layers and a softmax layer. Each hidden layer has
256 neurons, and the softmax layer has 10 neurons. The modified LeNet consists
of 2 convolutional layers, 2 hidden layers, and a softmax layer. Each
convolutional layer has 32 channels and a kernel size of $5\times 5$, each
hidden layer has 128 neurons, and the last softmax layer has 10 neurons. All
activation functions are ReLU. Table 3 summarizes the structures of the two
models.

Table 3. Datasets and models for experiments. $ks$ is kernel size, $fm$ is the number of feature maps. Dataset | Model | Convolutional layers | Fully-connected layers
---|---|---|---
Fashion-MNIST | MLP | — | $256\rightarrow 256\rightarrow 10$
CIFAR10 | LeNet | ($ks:5\times 5,fm:32$) $\rightarrow$ ($ks:5\times 5,fm:32$) | $128\rightarrow 128\rightarrow 10$

We also consider the neural network structure as a dimension to optimize for
trading off privacy leakage, utility loss, and training cost. The detail is
covered in Sec. 6.1.5.

####  6.1.2. Federated Learning Setup

We conduct federated learning with 5 clients and focus on IID (independent and
identically distributed) data setting. We assign each client 12000 training
data for Fashion-MNIST and 10000 training data for CIFAR10 to train their
local models and use 10000 test data to validate the aggregated global model.
The federated optimization is performed with 10 global communication rounds
among clients and 5 local epochs with a batch size of 64 on each client. All
clients use the SGD optimizer to train their local models. We simulate
federated learning in standalone mode.

####  6.1.3. Baseline

We consider the FL version of NSGA-II (Deb et al., 2002) and PSL (Lin et al.,
2022) as our baselines. We name them MOFL-NSGA-II and MOFL-PSL, respectively.
NSGA-II is a well-known multi-objective evolutionary algorithm, while PSL is a
novel multi-objective Bayesian optimization algorithm. We implement their FL
version based on works (Zhu and Jin, 2020; Lin et al., 2022). MOFL-NSGA-II and
MOFL-PSL do not handle constraints. For a fair comparison, we report the
Pareto optimal solutions satisfying constraints generated from MOFL-NSGA-II
and MOFL-PSL.

####  6.1.4. Multi-Objective Optimization algorithm Setup

For all CMOFL methods compared in this work, we set the total number of
generations (i.e., iterations) to 20 and the population size to 20 unless
otherwise specified.

NSGA-II Setup. We follow literature (Zhu and Jin, 2020) to set NSGA-II
parameters. For binary chromosome, we apply a single-point crossover with a
probability of 0.9 and a bit-flip mutation with a probability of 0.1. For
real-valued chromosome, we apply a simulated binary crossover (SBX) (Deb and
Kumar, 1995) with a probability of 0.9 and $n_{c}$ = 2, and a polynomial
mutation with a probability of 0.1 and $n_{m}$ = 20, where $n_{c}$ and $n_{m}$
denote spread factor distribution indices for crossover and mutation,
respectively.

PSL Setup. We follow literature (Lin et al., 2022) to set PSL parameters. At
each iteration, we train the Pareto set model $h_{\theta}$ with 1000 update
steps using Adam optimizer with a learning rate of 1e-5 and no weight decay.
At each iteration, we generate 1000 candidate solutions using $h_{\theta}$ and
select the population size of solutions from the 1000 candidates.

####  6.1.5. Experimental settings

We use three experimental settings to investigate the effectiveness of our
proposed algorithms: (1) use Randomization (RD) to protect data privacy and
minimize utility loss and privacy leakage; (2) use BatchCrypt (BC) to protect
data privacy and minimize utility loss and training cost; (3) use
Sparsification (SF) to protect data privacy and minimize utility loss, privacy
leakage, and training cost. Table 4 summarizes the three experimental settings
and following elaborates on the setup of each setting.

Table 4. The three experimental settings that apply Randomization (RD), BatchCrypt (BC), and Sparsification (SF), respectively, to protect data privacy. FC: fully-connected layer. |  | Experimental Settings
---|---|---
|  | RD | BC | SF
Objectives to minimize |  utility loss privacy leakage |  utility loss training cost |  utility loss privacy leakage training cost
Constraint |  privacy leakage $\leq 0.8$ $\alpha_{p}=20$ |  training cost $\leq 500\text{s}$ $\alpha_{c}=20$ |  privacy leakage $\leq 0.8$ $\alpha_{p}=20$
Solution variables |  Protection parameter |  $\sigma_{\text{rd}}:$[0, 1] $c_{\text{clip}}:$[1, 4] | $bs:${100, 200, 400, 800} |  $\rho:$[0, 1]; $\xi:$[0, 0.99];
Learning rate | [0.01, 0.3] | [0.01, 0.3] | [0.01, 0.3]
for MLP: # of FC neurons | — | [1, 256] | [1, 256]
for LetNet: # of channels # of FC neurons | — |  $[1,32]$ $[1,128]$ |  $[1,32]$ $[1,128]$

All three settings measure utility loss $\epsilon_{u}$ using test error:

(13) $\epsilon_{u}=1-\text{Acc}(W_{\text{fed}}^{\mathcal{D}}),$

where $W_{\text{fed}}^{\mathcal{D}}$ is the protected global model and
$\text{Acc}(\cdot)$ evaluates the accuracy of $W_{\text{fed}}^{\mathcal{D}}$
using test data. This measurement uses 1.0 as the utility upper bound and is a
variant of Eq. (8).

Randomization setting. Randomization (RD) protects data privacy by adding
Gaussian noise to each client’s model parameters to be shared with the server.
In this setting, we leverage the measurement provided in Eq. (14) to measure
the privacy leakage $\epsilon_{p}$:

(14)
$\epsilon_{p}=1-\min\\{1,C_{1}\frac{\sigma_{\text{rd}}^{2}}{c_{\text{clip}}^{2}}\sqrt{d_{w}}\\},$

where $\sigma_{\text{rd}}$ denotes the standard deviation of the Gaussian
noise added to model parameters, $c_{\text{clip}}$ denotes the clip norm, and
$d_{w}$ denotes the dimension of model parameters, $C_{1}$ is a prespecified
constant and is set to 1 for Fashion-MNIST and CIFAR10. This measurement is
derived from Eq. (7). We refer readers to Appendix A for details.

In this setting, a solution contains the following variables to optimize:
learning rate, standard deviation $\sigma_{\text{rd}}$, and clip norm
$c_{\text{clip}}$ of Gaussian noise. We assume clients require that the
privacy leakage is constrained not to go beyond $0.8$. Note that the dimension
of model parameters $d_{w}$ serves as a constant and will not be optimized.

BatchCrypt setting. BatchCrypt (BC) (Zhang et al., 2020a) is a batch
encryption technique that aims to improve the efficiency of homomorphic
encryption. BatchCrypt quantizes model parameters into low-bit integer
representations, encodes quantized parameters into batches, and then encrypts
each batch in one go. Essentially, the BatchCrypt batch size $bs$ controls the
trade-off between training cost and utility loss. We measure the training cost
$\epsilon_{c}$ of BatchCrypt as follows:

(15)
$\epsilon_{c}=\frac{1}{K}\sum_{k=1}^{K}\left(Q_{\text{time}_{1}}(W^{O}_{k},bs)+Q_{\text{time}_{2}}(\\{W^{\mathcal{D}}_{k}\\}_{k=1}^{K})\right)$

where $Q_{\text{time}_{1}}$ measures the time spent on training and encrypting
a client model while $Q_{\text{time}_{2}}$ measures the time spent on
aggregating encrypted clients’ models.

In this setting, a solution contains the following variables to optimize:
learning rate, the number of neurons in each layer for the two hidden-layer
MLP (and the number of channels in each layer for LetNet), and BatchCrypt
batch size $bs$ chosen in the range of $[100,200,400,800]$. The training cost
is constrained not to go beyond $500$ seconds.

Sparsification setting. We follow the sparsification (SF) method proposed in
(Zhu and Jin, 2020). Intuitively, the SF can be considered as a privacy
protection mechanism that decomposes each client’s model into a public sub-
model and a private sub-model, then shares the public sub-model with the
server while retaining the private sub-model locally to protect privacy. The
size of the private sub-model is controlled by two hyperparameters: (1)
$\rho$, the probability of connection between every two neighboring hidden
layers; (2) $\xi$, the fraction of the model parameters with the smallest
update to be retained at local.

Let $\mu_{k}$ denote the mean of values of retained (or private) model
parameters of $k_{th}$ client. We use the measurements provided in Eq. (16) to
measure the privacy leakage $\epsilon_{p}$.

(16)
$\epsilon_{p}=\frac{1}{K}\sum_{k=1}^{K}\left(1-\sqrt{2}(1-\exp\\{-\frac{\mu_{k}}{C_{2}}\\})^{1/2}\right),$

where $C_{2}$ is a prespecified constant, it is set to 8 for Fashion-MNIST and
32 for CIFAR10. This measurement is derived from Eq. (7). We refer readers to
Appendix A for the proof.

We measure training cost using the following measurement (Zhu and Jin, 2019):

(17) $\epsilon_{c}=\frac{1}{K}\sum_{k}v_{k},$

where $v_{k}$ is the number of shared (or public) model parameters of $k_{th}$
client. A larger $v_{k}$ indicates more model parameters of client $k$ are
shared with the server, meaning a higher training cost.

In this setting, a solution contains the following variables to optimize:
learning rate, number of neurons in each layer for MLP (or number of channels
in each layer for LetNet), connection probability $\rho$ chosen in the range
of $[0,1]$ and $\xi$ chosen in the range of $[0,0.99]$. Similar to RD, we
assume that clients require the privacy leakage to be constrained not to go
beyond 0.8.

###  6.2. Main Experimental Results

We compare our proposed algorithms, CMOFL-NSGA-II and CMOFL-PSL, with their
corresponding baselines, MOFL-NSGA-II and MOFL-PSL, in terms of hypervolume
trends with respect to the number of generations for the three experimental
settings (RD, BC, and SF). For RD and SF settings, the privacy leakage is
constrained to be less than 0.8, while for SF, the training cost is
constrained to be less than 500 seconds.

(a) BC: CMOFL-NSGA-II vs MOFL-NSGA-II

(b) RD: CMOFL-NSGA-II vs MOFL-NSGA-II

(c) SF: CMOFL-NSGA-II vs MOFL-NSGA-II

(d) BC: CMOFL-PSL vs MOFL-PSL

(e) RD: CMOFL-PSL vs MOFL-PSL

(f) SF: CMOFL-PSL vs MOFL-PSL

Figure 3. Comparing hypervolume values of our proposed CMOFL algorithms with
those of baseline MOFL algorithms on the Fashion-MNIST dataset for BC, RD, and
SF, respectively. The first line compares CMOFL-NSGA-II and MOFL-NSGA-II for
the three protection mechanisms. The second line compares CMOFL-PSL and MOFL-
PSL for the three protection mechanisms.

(a) BC: CMOFL-NSGA-II vs MOFL-NSGA-II

(b) RD: CMOFL-NSGA-II vs MOFL-NSGA-II

(c) SF: CMOFL-NSGA-II vs MOFL-NSGA-II

(d) BC: CMOFL-PSL vs MOFL-PSL

(e) RD: CMOFL-PSL vs MOFL-PSL

(f) SF: CMOFL-PSL vs MOFL-PSL

Figure 4. Comparing hypervolume values of our proposed CMOFL algorithms with
those of baseline MOFL algorithms on the CIFAR10 dataset for BC, RD, and SF,
respectively. The first line compares CMOFL-NSGA-II and MOFL-NSGA-II for the
three protection mechanisms. The second line compares CMOFL-PSL and MOFL-PSL
for the three protection mechanisms.

Figures 3 and 4 illustrate the experimental results conducted on Fashion-MNIST
and CIFAR10, respectively. The results are averaged over 3 different random
seeds. They show that CMOFL-NSGA-II (red) and CMOFL-PSL (brown) achieve better
hypervolume (HV) values than their corresponding baselines, MOFL-NSGA-II
(blue) and MOFL-PSL (green), from the beginning to the 20th generation,
demonstrating that CMOFL-NSGA-II and CMOFL-PSL, leveraging constraints to
restrict the search for feasible solutions, can find better Pareto optimal
solutions more efficiently.

(a) BC: CMOFL-NSGA-II vs MOFL-NSGA-II

(b) RD: CMOFL-NSGA-II vs MOFL-NSGA-II

(c) SF: CMOFL-NSGA-II vs MOFL-NSGA-II

(d) BC: CMOFL-PSL vs MOFL-PSL

(e) RD: CMOFL-PSL vs MOFL-PSL

(f) SF: CMOFL-PSL vs MOFL-PSL

Figure 5. Comparing Pareto fronts (at the 20th generation) of our proposed
CMOFL algorithms and those of baseline MOFL algorithms on the Fashion-MNIST
dataset for BC, RD, and SF, respectively. The first line shows CMOFL-NSGA-II
(red) vs. MOFL-NSGA-II (blue) for each protection mechanism. The second line
shows CMOFL-PSL (brown) vs. MOFL-PSL (green) for each protection mechanism. A
better Pareto front curve should be more toward the bottom-left corner of each
sub-figure.

We then compare the Pareto fronts (at the 20th generation) achieved by our
proposed CMOFL algorithms with those achieved by baselines on the Fashion-
MNIST dataset for BC, RD, and SF, respectively. Figure 5 illustrates the
results (A better Pareto front curve should be more toward the bottom-left
corner of each sub-figure.). It shows that our proposed CMOFL algorithms,
CMOFL-NSGA-II (red) and CMOFL-PSL (brown), yield better Pareto fronts than
baselines, MOFL-NSGA-II (blue) and MOFL-PSL (green), for all three protection
mechanisms.

###  6.3. Effectiveness of CMOFL with a Limited FL Evaluation Budget

CMOFL algorithms need to call the FL procedure to obtain real objective values
for each solution. Therefore, if a CMOFL algorithm requires a large number of
FL evaluations to find satisfactory Pareto optimal solutions, it is
impractical in many real-world applications.

To investigate the effectiveness of CMOFL-NSGA-II and CMOFL-PSL with limited
FL evaluation budgets, we run each algorithm with 5 initial solutions and 20
generations that each has a population size of 5 (there are totally 105 FL
evaluations, while experiments in Sec. 6.2 involve 420 evaluations). We
conduct experiments on the Fashion-MNIST dataset for BC, RD, and SF,
respectively. The reported results are averaged over 3 different random seeds.

(a) BC: CMOFL-PSL vs CMOFL-NSGA-II

(b) RD: CMOFL-PSL vs CMOFL-NSGA-II

(c) SF: CMOFL-PSL vs CMOFL-NSGA-II

Figure 6. Comparing hypervolume values of CMOFL-PSL (brown) and CMOFL-NSGA-II
(red) when each generation uses 5 federated learning evaluations. Comparisons
are conducted on the Fashion-MNIST dataset for BC, RD, and SF, respectively.

Figure 6 compares CMOFL-PSL (brown) and CMOFL-NSGA-II (red) in terms of their
hypervolume trends with each generation using 5 FL evaluations. It shows that
CMOFL-PSL noticeably outperforms CMOFL-NSGA-II from the beginning of the
optimization and converges to hypervolume values comparable to or better than
CMOFL-NSGA-II, demonstrating that CMOFL-PSL can find better Pareto optimal
solutions more efficiently than CMOFL-NSGA-II when the FL evaluation budget is
limited. These results are expected because, per generation, CMOFL-PSL selects
5 best solutions from a large set of candidate solutions (1000 in this work)
that are sampled from the Pareto set model and evaluated using a surrogate
model (i.e., Gaussian Process) of the FL. In this way, CMOFL-PSL can
efficiently explore broader solution space to find better Pareto optimal
solutions.

These experiments manifest that surrogate model-based MOO approaches, such as
MOBO, are promising to solve TFL optimization problems in real-world scenarios
where the FL evaluation budget is often limited.

###  6.4. Pareto Front as Guideline for Choosing Protection Mechanisms

The Pareto front represents different optimal trade-offs among privacy
leakage, utility loss, and training cost in this work. It helps define the
applicable boundaries of protection mechanisms and hence could guide FL
practitioners to choose the most appropriate protection mechanisms for
applications at hand. For example, when Randomization is applied (see Figure 5
(b) and (e)), the Pareto front tells us that a noticeable amount of privacy
leakage would be incurred as the test error decreases and vice versa.
Therefore, it is challenging to find Randomization hyperparameters
($\sigma_{\text{rd}}$ and $c_{\text{clip}}$) that meet the requirements for
applications in which both privacy and utility are critical (e.g.,
healthcare). Taking the BatchCrypt as another example (see Figure 5 (a) and
(d)), the training cost increases significantly on the Pareto front as the
utility loss approaches the optimal. This manifest that BatchCrypt is
unsuitable for applications where efficiency and utility are of utmost
importance (e.g., advertisement).

##  7\. Conclusion, Impact and Future Work

In this paper, we formulate the problem of constrained multi-objective
federated learning (CMOFL), which unifies multi-objective optimization and
trustworthy federated learning. For one of the first attempts, we consider
privacy leakage as an objective to minimize in CMOFL. We develop two improved
CMOFL algorithms based on NSGA-II and PSL, respectively, for effectively and
efficiently finding Pareto optimal solutions. Each algorithm leverages a
regret function to penalize objectives that violate prespecified constraints.
We design specific measurements of privacy leakage, utility loss, and training
cost for three privacy protection mechanisms: differential privacy,
BatchCrypt, and sparsification. Empirical experiments conducted under each of
the three protection mechanisms demonstrate the efficacy of our proposed
algorithms.

The benefits of finding Pareto optimal solutions (and front) for trustworthy
federated learning (TFL) problems include: (1) Pareto optimal solutions can
flexibly support participants’ requirements. (2) Pareto front helps define
applicable boundaries of privacy protection mechanisms. (3) Pareto front can
serve as a tool to guide the standard-setting for privacy levels.

At least three research directions are worth exploring: (1) Designing CMOFL
algorithms that can find Pareto optimal solutions using a small amount of
federated learning evaluation budget. In CMOFL, the evaluation of each
solution is performed by federated learning, which is a time-consuming
procedure. Therefore, a large number of federated learning evaluations is
infeasible. (2) Applying CMOFL to vertical or hybrid FL settings. For example,
we can leverage CMOFL to find Pareto optimal hyperparameters (e.g., tree
number, tree depth, learning rate, leaf purity, and the number of aligned
samples) that simultaneously optimize privacy, efficiency, and utility of
SecureBoost (Cheng et al., 2021; Chen et al., 2021), which is a widely used
algorithm in vertical FL applications. (3) Investigating objectives to
optimize beyond privacy, utility, and efficiency.

##  Appendix A Privacy Leakage Measurements for Protection Mechanisms

In this section, we prove the correctness of privacy leakage measurements
provided in Eq. (14) (for Randomization) and provided in Eq. (16) (for
Sparsification).

###  A.1. Privacy Leakage

Following (du Pin Calmon and Fawaz, 2012; Rassouli and Gündüz, 2019), the
distortion (i.e., protection) extent is defined as the distance between the
distribution $P_{k}^{\mathcal{O}}$ of original model parameters
$W_{k}^{\mathcal{O}}$ (i.e., $W_{k}^{\mathcal{O}}\sim P_{k}^{\mathcal{O}}$)
and the distribution $P_{k}^{\mathcal{D}}$ of protected model parameters
$W_{k}^{\mathcal{D}}$ (i.e., $W_{k}^{\mathcal{D}}\sim P_{k}^{\mathcal{D}}$).
In this work, we leverage the distortion extent to formulate the privacy
leakage:

(1) $\displaystyle\epsilon_{p}=\frac{1}{K}\sum_{k=1}^{K}\epsilon_{p,k}\text{,
where }\epsilon_{p,k}=1-\text{TV}(P_{k}^{\mathcal{O}}||P_{k}^{\mathcal{D}}),$

where $\text{TV}(\cdot||\cdot)$ denotes the Total Variation distance between
two distributions. A larger distortion applied to the original model
parameters leads to larger
$\text{TV}(P_{k}^{\mathcal{O}}||P_{k}^{\mathcal{D}})$, thereby less privacy
leakage.

In this paper, suppose $W_{k}^{\mathcal{O}}$ to be the parameters sampled from
the Multivariate Gaussian distribution
$P_{k}^{\mathcal{O}}=\mathcal{N}(\mu_{0},\Sigma_{0})$, where
$\mu_{0}=(\mu_{u},\mu_{o}),\mu_{u}\in\mathbb{R}^{q},\mu_{o}\in\mathbb{R}^{n-q}$
and $\Sigma_{0}=\text{diag}(\Sigma_{u}^{q\times
q},\Sigma_{o}^{(n-q)\times(n-q)})$ is a diagonal matrix. Before we provide the
proof for Proposition 1, we first introduce the following two lemmas on
estimating the total variation distance between two Gaussian distributions.

###### Lemma 0.

(Total variation distance between Gaussians with the same mean (Devroye et
al., 2018)). Let $\mu\in R^{n}$, $\Sigma_{1},\Sigma_{2}$ be diagonal matrix,
and let $\lambda_{1},\dots,\lambda_{n}$ denote the eigenvalues of
$\Sigma_{1}^{-1}\Sigma_{2}-I_{n}$. Then,

(2)
$\frac{1}{100}\leq\frac{{\text{TV}}(\mathcal{N}(\mu,\Sigma_{1}),\mathcal{N}(\mu,\Sigma_{2}))}{\min\\{1,\sqrt{\sum_{i=1}^{n}\lambda_{i}^{2}}\\}}\leq\frac{3}{2}.$

###### Lemma 0.

(Total variation distance between Gaussians with different means (Devroye et
al., 2018)) Assume that $\Sigma_{1},\Sigma_{2}$ are positive definite, and let

(3)
$h=h(\mu_{1},\Sigma_{1},\mu_{2},\Sigma_{2})=\big{(}1-\frac{\text{det}(\Sigma_{1})^{1/4}\text{det}(\Sigma_{2})^{1/4}}{\text{det}(\frac{\Sigma_{1}+\Sigma_{2}}{2})^{1/2}}\exp\\{-\frac{1}{8}(\mu_{1}-\mu_{2})^{T}(\frac{\Sigma_{1}+\Sigma_{2}}{2})^{-1}(\mu_{1}-\mu_{2})\\}\big{)}^{1/2}$

Then, we have

(4)
$h^{2}\leq{\text{TV}}(\mathcal{N}(\mu_{1},\Sigma_{1}),\mathcal{N}(\mu_{2},\Sigma_{2}))\leq\sqrt{2}h.$

###### Proposition 1.

We have the following measurements of the privacy leakage based on the
estimation of $\text{TV}(P_{k}^{\mathcal{O}}||P_{k}^{\mathcal{D}})$ for
Randomization (Abadi et al., 2016) and Sparsification (Nori et al., 2021):

  * •

Randomization:

(5)
$\epsilon_{p}=1-\min\\{1,\Theta(\frac{\sigma_{\text{rd}}^{2}}{c_{\text{clip}}^{2}}\sqrt{d_{w}})\\},$

where $\sigma_{\text{rd}}$ is the variance of Gaussian noise,
$c_{\text{clip}}$ is the clip norm and $d_{w}$ is the dimension of model
weights.

  * •

Sparsification:

(6)
$\epsilon_{p}=\frac{1}{K}\sum_{k=1}^{K}\left(1-\sqrt{2}(1-O(\exp\\{-\mu_{k}\\}))^{-1/2}\right),$

where $\mu_{k}$ is the mean of remained weights of $k_{th}$ client.

###### Proof.

For randomization mechanism, the variance of each clients’ model weights are
first changed to $c_{\text{clip}}$, and then
$W_{k}^{\mathcal{D}}=W_{k}^{\mathcal{O}}+\mathcal{N}(0,\sigma_{\text{rd}}^{2})$.
Therefore,
$\text{TV}(P_{k}^{\mathcal{O}},P_{k}^{\mathcal{D}})=\text{TV}(\mathcal{N}(\mu_{0},c_{\text{clip}}^{2}),\mathcal{N}(\mu,c_{\text{clip}}^{2}+\sigma_{\text{rd}}^{2}))$.
According to Eq. (1), we have

(7)
$\begin{split}\epsilon_{p,k}&=1-\text{TV}(P_{k}^{\mathcal{O}},P_{k}^{\mathcal{D}})\\\
&\geq 1-\frac{3}{2}\sqrt{\sum_{i=1}^{n}\lambda_{i}^{2}}\\\
&=1-\frac{3}{2}\sqrt{\sum_{i=1}^{d_{w}}(\frac{c_{\text{clip}}^{2}+\sigma_{\text{rd}}^{2}}{c_{\text{clip}}^{2}}-1)^{2}}\\\
&=1-\frac{3}{2}\sqrt{\sum_{i=1}^{d_{w}}\frac{\sigma_{\text{rd}}^{4}}{c_{\text{clip}}^{4}}}\\\
&=1-\frac{3}{2}\frac{\sigma_{\text{rd}}^{2}}{c_{\text{clip}}^{2}}\sqrt{d_{w}}\\\
&\geq
1-\min\\{1,\frac{3}{2}\frac{\sigma_{\text{rd}}^{2}}{c_{\text{clip}}^{2}}\sqrt{d_{w}}\\}\end{split}$

where the first inequality is due to Lemma 1 that
$\text{TV}(P_{k}^{\mathcal{O}},P_{k}^{\mathcal{D}})\leq\frac{3}{2}\sqrt{\sum_{i=1}^{n}\lambda_{i}^{2}}$,
and the last inequality is because of TV distance does not exceed 1. On the
other hand,

(8)
$\begin{split}\epsilon_{p,k}&=1-\text{TV}(P_{k}^{\mathcal{O}},P_{k}^{\mathcal{D}})\\\
&\leq 1-\frac{1}{100}\min\\{1,\sqrt{\sum_{i=1}^{n}\lambda_{i}^{2}}\\}\\\
&=1-\min\\{1,\frac{1}{100}\sqrt{\sum_{i=1}^{d_{w}}(\frac{c_{\text{clip}}^{2}+\sigma_{\text{rd}}^{2}}{c_{\text{clip}}^{2}}-1)^{2}}\\}\\\
&=1-\frac{1}{100}\min\\{1,\sqrt{\sum_{i=1}^{d_{w}}\frac{\sigma_{\text{rd}}^{4}}{c_{\text{clip}}^{4}}}\\}\\\
&=1-\frac{1}{100}\min\\{1,\frac{\sigma_{\text{rd}}^{2}}{c_{\text{clip}}^{2}}\sqrt{d_{w}}\\}\\\
&\leq
1-\min\\{1,\frac{1}{100}\frac{\sigma_{\text{rd}}^{2}}{c_{\text{clip}}^{2}}\sqrt{d_{w}}\\}.\end{split}$

Therefore, we prove
$\epsilon_{p}=\sum_{k=1}^{K}(1-\min\\{1,\Theta(\frac{\sigma_{\text{rd}}^{2}}{c_{\text{clip}}^{2}}\sqrt{d_{w}})\\})$
for randomization mechanism.

In the sparsification mechanism, clients initiate the sparsity mechanism by
transmitting partial parameters to the server. Specifically, we assume that
each client transmits the first $q$ dimensions to the server, without loss of
generality. We further assume that the vector composed of the last $(n-q)$
dimensions follows a Gaussian distribution, denoted by
$\mathcal{N}(\mu_{g},\Sigma_{g})$, where $\Sigma_{g}$ is a diagonal matrix. In
this context, the private information of the model follows
$P_{k}^{\mathcal{D}}\sim\mathcal{N}(\mu,\Sigma)$, where
$\mu=(\mu_{u},\mu_{g})$ and $\Sigma=\text{diag}(\Sigma_{u}^{q\times
q},\Sigma_{g}^{(n-q)\times(n-q)})$. According to Eq. (1) and Lemma 2, we
obtain

(9) $\epsilon_{p,k}\leq 1-\sqrt{2}h.$

Since the variance $\Sigma$ is bounded and assume the $\mu_{g}=0$, we have

$\begin{split}h&=h(\mu_{0},\Sigma_{0},\mu,\Sigma)=\big{(}1-\frac{\text{det}(\Sigma_{0})^{1/4}\text{det}(\Sigma)^{1/4}}{\text{det}(\frac{\Sigma_{0}+\Sigma}{2})^{1/2}}\exp\\{-\frac{1}{8}(\mu-\mu_{0})^{T}(\frac{\Sigma+\Sigma_{0}}{2})^{-1}(\mu-\mu_{0})\\}\big{)}^{1/2}\\\
&=\big{(}1-\exp\\{-\Theta(\mu_{g}^{T}\mu_{g})\\}\big{)}^{1/2}\end{split}$

Combining Eq. (9) and (A.1), we can further obtain

$\epsilon_{p,k}\leq 1-\sqrt{2}(1-\exp\\{-O(\mu_{k})\\})^{1/2},$

where $\mu_{k}$ is $\mu_{g}$ for $k_{th}$ client, i.e., the mean of remained
weights of $k_{th}$ client. Therefore, we have

$\epsilon_{p}=\sum_{k=1}^{K}\epsilon_{p,k}\leq
1-\sqrt{2}(1-\exp\\{-O(\mu_{k})\\})^{1/2}.$

∎

##  Appendix B Proofs of Theorem 1 and Theorem 2

In this section, we provide proofs of Theorem 1 and Theorem 2. We simplify
these proofs in a centralized setting because the federated learning
optimization utilized in CMOFL-NSGA-II and CMOFL-PSL serve as a black-box
objective function. In addition, we combine the constraint with the objective
function, which is reasonable according to the Lemma 1.

###### Lemma 0.

(Luenberger et al., 1984) Assume $\Omega$ is the convex region, $f$ and $g$
are convex functions. Assume also that there is a point $x_{1}$ such that
$g(x_{1})<0$. Then, if $x^{*}$ solves

$\begin{split}&\min f(x)\\\ \text{subject to }&g(x)<0\text{ and
}x\in\Omega,\end{split}$

then there is a $\alpha$ with $\alpha\geq 0$ such that $x^{*}$ solves the
Lagrangian relaxation problem

$\begin{split}\min f(x)+\alpha g(x)\\\ \text{subject to
}x\in\Omega.\end{split}$

###  B.1. Proof for Theorem 1

###### Lemma 0.

The work (Zheng et al., 2022) considers the following ONEMINMAX and LOTZ
benchmarks in multi-objective problems. Let $d$ be the dimension of the
solution space.

  * •

LOTZ: If the population size $N$ is at least $5(d+1)$, then the expected
runtime is $O(d^{2})$ iterations and $O(Nd^{2})$ fitness evaluations.

  * •

ONEMINMAX: if the population size $N$ is at least $4(d+1)$, then the expected
runtime is $O(d\text{log}d)$ iterations and $O(Nd\text{log}d)$ fitness
evaluations.

Lemma 2 demonstrates the NSGA-II algorithm could obtain almost Pareto optimal
solutions (i.e., within a small $\epsilon$ error) for LOTZ and ONEMINMAX
benchmarks with sufficiently large population size $N$. Further, we provide
the convergence analysis of Algo. 2 when the objective values obtained by
Algo. 2 approaches the finite Pareto optimal objective values within
$\epsilon$ error from the perspective of hypervolume.

###### Theorem 3.

Let $Y^{*}$ be the optimal objective values w.r.t $m$ objectives. If for any
$y^{*}\in Y^{*},\exists y^{T}\in Y_{T}$ obtained by Algo. 2, s.t.
$\|y^{T}-y^{*}\|\leq\epsilon$, then we have

(10) $\text{HV}_{z}(Y^{*})-\text{HV}_{z}(Y_{T})\leq Cm\epsilon,$

where $\text{HV}_{z}(\cdot)$ represents the hypervolume with reference point
$z$ and $C$ is a constant.

###### Proof.

Let $z=[z_{1},\cdots,z_{m}]$ be the reference point. If for any
$y^{*}=[y^{*}_{1},\cdots,y^{*}_{m}]\in Y^{*},\exists
y^{T}=[y^{T}_{1},\cdots,y^{T}_{m}]\in Y_{T}$ obtained by Algo. 2, s.t.
$\|y^{T}-y^{*}\|\leq\epsilon$, we obtain

(11)
$\begin{split}\|z_{i}-y_{i}^{*}\|-\|z_{i}-y_{i}^{T}\|=\|y_{i}^{T}-y_{i}^{*}\|\leq\|y^{T}-y^{*}\|\leq\epsilon,\end{split}$

without loss of generality, assume $z,y\in(0,1)^{m}$, Eq. (11) leads to:

$\begin{split}\text{Volume}(y^{*},r)-\text{Volume}(y^{T},r)&=\prod_{i=1}^{m}(z_{i}-y_{i}^{*})-\prod_{i=1}^{m}(z_{i}-y_{i}^{T})\\\
&\leq\prod_{i=1}^{m}(z_{i}-y_{i}^{T}+\epsilon)-\prod_{i=1}^{m}(z_{i}-y_{i}^{T})\\\
&=\epsilon\sum_{k=0}^{m-1}\sum_{i_{1}<i_{2}<\cdots<i_{k}}(z_{i_{1}}-y_{i_{1}})\cdots(z_{i_{k}}-y_{i_{k}})(\epsilon)^{m-k-1}\\\
&\leq\sum_{k=0}^{m-1}\tbinom{m}{k}(\epsilon)^{m-k}\\\
&=(1+\epsilon)^{m}-1\end{split}$

In addition, as $\epsilon$ tends to zero, the $(1+\epsilon)^{m}-1$ tends to
$m\epsilon$. Since the $Y^{*}$ is finite set, then

$\text{HV}_{z}(Y^{*})-\text{HV}_{z}(Y_{T})\leq Cm\epsilon,$

where $C$ is a constant. ∎

###  B.2. Proof for Theorem 2

In this section, we analyze the convergence of Algo. 3 through regret bound
following works (Zhang and Golovin, 2020; Paria et al., 2020).

Multi-objective Bayesian Optimization (MOBO) is an extension of single-
objective Bayesian optimization that aims at solving expensive multi-objective
optimization problems. The MOBO approach proposed by Paria et al. (Paria et
al., 2020) utilizes scalarization-based algorithms such as Tchebyshev
scalarizations (Nakayama et al., 2009) and Hypervolume scalarizations (Zhang
and Golovin, 2020). In this approach, the multi-objective problem is
iteratively scalarized into single-objective problems with random preferences,
followed by applying single-objective Bayesian Optimization to solve them.
Tchebyshev scalarizations (Nakayama et al., 2009) is defined as:

(12) $s_{\lambda}(y)=\max_{1\leq i\leq m}\lambda_{i}(y_{i}-z_{i}),$

where $z=[z_{1},\cdots,z_{m}]$ is reference point, $y=[y_{1},\cdots,y_{m}]$
and $\lambda=[\lambda_{1},\cdots,\lambda_{m}]$.
Bayes Regret. MOBO aims to return a set of points from the user specified
region $X\subset\mathcal{X}$. This can be achieved by minimizing the following
Bayes regret denoted by $\mathcal{R}_{B}$,

$\mathcal{R}_{B}(X)=\mathbb{E}_{\lambda\in
p(\lambda)}\big{(}\max_{x\in\mathcal{X}}s_{\lambda}(f(x))-\max_{x\in
X}s_{\lambda}(f(x)\big{)},$
$X^{*}=\operatorname*{argmin}_{X\subset\mathcal{X}}\mathcal{R}_{B}(X),$

where $p(\lambda)$ is a prior. Based on the Bayes regret, the instantaneous
regret incurred by our algorithm at step $t$ is defined as:

(13)
$r(x_{t},\lambda^{t})=\max_{x\in\mathcal{X}}s_{\lambda^{t}}(f(x))-s_{\lambda^{t}}(f(x_{t})),$

where $x_{t}$ is obtained by Algo. 3. The cumulative regret till step $T$ is
defined as,

$\mathcal{R}_{C}(T)=\sum_{t=1}^{T}r(x_{t},\lambda^{t})$

###### Lemma 0.

(Paria et al., 2020) The expected regret of algorithm 3 after $T$ observations
(i.e., generations) can be upper bounded:

(14) $\mathbb{E}\mathcal{R}_{C}(T)\leq m(\gamma_{T}lnT)^{1/2},$

where $\gamma_{T}$ is a kernel-dependent quantity known as the maximum
information gain (Paria et al., 2020). For example, $\gamma_{T}=O(\text{poly
}ln(T))$ for the squared exponential kernel. The expectation $\mathbb{E}$ is
the expectation is taken over $\\{\lambda^{t}\\}_{t=1}^{T}$.

Under the further assumption of the space of $\lambda$ being a bounded subset
of a normed linear space, and the scalarizations $s_{\lambda}$ being Lipschitz
in $\lambda$, it can be shown that
$\mathbb{E}r(x_{t},\lambda^{t})\leq\mathbb{E}R_{C}(T)+o(1)$, which combined
with Lemma 4 shows that the Bayes regret converges to zero as $T\to\infty$
(Paria et al., 2020).
Relation between Bayes regret and Hypervolume regret. Hypervolume defined in
Def. 4 reflects the quality of a multi-objective algorithm. Zhang et al.
formulates Hypervolume scalarizations (Zhang and Golovin, 2020) as:

(15) $s_{\lambda}(y)=\max_{1\leq i\leq
m}(\min(0,\frac{y_{i}-z_{i}}{\lambda_{i}})),$

Tchebyshev scalarizations are similar to hypervolume scalarizations, but they
differ in that Tchebyshev scalarizations involve the multiplication of the
coefficient $\lambda$, while hypervolume scalarizations involve the overriding
of $\lambda$. The following Lemma 5 formulates the hypervolume based on the
hypervolume scalarizations:

###### Lemma 0.

(Deng and Zhang, 2019) Let $y=\\{y_{1},...,y_{m}\\}$ and
$z=\\{z_{1},...,z_{m}\\}$ be two sets of $m$ points. Then, the hypervolume of
$y$ with respect to a reference point $z$ is given by:

(16)
$\text{HV}_{z}(y)=c_{k}\mathbb{E}_{\lambda\in\mathcal{S}_{+}^{k-1}}\max_{y\in
Y}s_{\lambda}(y-z).$

Further, we obtain the Theorem 2 when the type of scalarizations method is
hypervolume scalarization,

###### Theorem 6.

(Zhang and Golovin, 2020) If the type of scalarizations method is hypervolume
scalarization, then the hypervolume regret after $T$ observations is upper
bounded as:

(17)
$\sum_{t=1}^{T}\big{(}\text{HV}_{z}(Y^{*})-\text{HV}_{z}(Y_{t})\big{)}\leq
O(m^{2}d^{1/2}[\gamma_{T}ln(T)T]^{1/2}).$

Furthermore, $\text{HV}_{z}(Y^{*})-\text{HV}_{z}(Y_{T})\leq
O(m^{2}d^{1/2}[\gamma_{T}ln(T)/T]^{1/2})$

## References

  * (1)
  * Abadi et al. (2016) Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. 2016.  Deep learning with differential privacy. In _Proceedings of the 2016 ACM SIGSAC conference on computer and communications security_. ACM, New York, NY, USA, 308–318.
  * Biswas et al. (2021) Arpan Biswas, Claudio Fuentes, and Christopher Hoyle. 2021\.  A Multi-Objective Bayesian Optimization Approach Using the Weighted Tchebycheff Method.  _Journal of Mechanical Design_ 144, 1 (08 2021).  https://doi.org/10.1115/1.4051787 011703\.
  * Blakley (1979) G.R. Blakley. 1979\.  Safeguarding cryptographic keys. In _Proceedings of the 1979 AFIPS National Computer Conference_. AFIPS Press, Monval, NJ, USA, 313–317.
  * Bonawitz et al. (2017) Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H. Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth. 2017.  Practical Secure Aggregation for Privacy-Preserving Machine Learning. In _Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security_ (Dallas, Texas, USA) _(CCS ’17)_. Association for Computing Machinery, New York, NY, USA, 1175–1191.  https://doi.org/10.1145/3133956.3133982
  * Chai et al. (04) Zheng-yi Chai, Chuan-dong Yang, and Ya-lun Li. 04.  Communication efficiency optimization in federated learning based on multi-objective evolutionary algorithm.  _Evolutionary intelligence_ (2022 Dec 04).  https://doi.org/10.1007/s12065-022-00718-x
  * Chen et al. (2023a) Depeng Chen, Xiao Jiang, Hong Zhong, and Jie Cui. 2023a.  Building Trusted Federated Learning: Key Technologies and Challenges.  _Journal of Sensor and Actuator Networks_ 12, 1 (2023).  https://doi.org/10.3390/jsan12010013
  * Chen et al. (2021) Weijing Chen, Guoqiang Ma, Tao Fan, Yan Kang, Qian Xu, and Qiang Yang. 2021\.  SecureBoost+ : A High Performance Gradient Boosting Tree Framework for Large Scale Vertical Federated Learning.  _CoRR_ abs/2110.10927 (2021).  arXiv:2110.10927 https://arxiv.org/abs/2110.10927
  * Chen et al. (2023b) Zhenghua Chen, Min Wu, Alvin Chan, Xiaoli Li, and Yew-Soon Ong. 2023b.  Survey on AI Sustainability: Emerging Trends on Learning Algorithms and Research Challenges [Review Article].  _IEEE Computational Intelligence Magazine_ 18, 2 (2023), 60–77.  https://doi.org/10.1109/MCI.2023.3245733
  * Cheng et al. (2021) Kewei Cheng, Tao Fan, Yilun Jin, Yang Liu, Tianjian Chen, Dimitrios Papadopoulos, and Qiang Yang. 2021.  SecureBoost: A Lossless Federated Learning Framework.  _IEEE Intelligent Systems_ 36, 6 (2021), 87–98.  https://doi.org/10.1109/MIS.2021.3082561
  * Cui et al. (2021) Sen Cui, Weishen Pan, Jian Liang, Changshui Zhang, and Fei Wang. 2021.  Addressing Algorithmic Disparity and Performance Inconsistency in Federated Learning. In _Advances in Neural Information Processing Systems_ , M. Ranzato, A. Beygelzimer, Y. Dauphin, P.S. Liang, and J. Wortman Vaughan (Eds.), Vol. 34. Curran Associates, Inc., 26091–26102.  https://proceedings.neurips.cc/paper_files/paper/2021/file/db8e1af0cb3aca1ae2d0018624204529-Paper.pdf
  * Daulton et al. (2022) Samuel Daulton, David Eriksson, Maximilian Balandat, and Eytan Bakshy. 2022.  Multi-objective Bayesian optimization over high-dimensional search spaces. In _Proceedings of the Thirty-Eighth Conference on Uncertainty in Artificial Intelligence_ _(Proceedings of Machine Learning Research, Vol. 180)_ , James Cussens and Kun Zhang (Eds.). PMLR, 507–517.  https://proceedings.mlr.press/v180/daulton22a.html
  * Deb and Deb (2014) Kalyanmoy Deb and Kalyanmoy Deb. 2014.  _Multi-objective Optimization_.  Springer US, Boston, MA, 403–449.  https://doi.org/10.1007/978-1-4614-6940-7_15
  * Deb and Jain (2014) Kalyanmoy Deb and Himanshu Jain. 2014.  An Evolutionary Many-Objective Optimization Algorithm Using Reference-Point-Based Nondominated Sorting Approach, Part I: Solving Problems With Box Constraints.  _IEEE Transactions on Evolutionary Computation_ 18, 4 (2014), 577–601.  https://doi.org/10.1109/TEVC.2013.2281535
  * Deb and Kumar (1995) Kalyanmoy Deb and Amarendra Kumar. 1995.  Real-coded Genetic Algorithms with Simulated Binary Crossover: Studies on Multimodal and Multiobjective Problems.  _Complex Syst._ 9 (1995).
  * Deb et al. (2002) K. Deb, A. Pratap, S. Agarwal, and T. Meyarivan. 2002\.  A fast and elitist multiobjective genetic algorithm: NSGA-II.  _IEEE Transactions on Evolutionary Computation_ 6, 2 (2002), 182–197.  https://doi.org/10.1109/4235.996017
  * Deng and Zhang (2019) Jingda Deng and Qingfu Zhang. 2019.  Approximating hypervolume and hypervolume contributions using polar coordinate.  _IEEE Transactions on Evolutionary Computation_ 23, 5 (2019), 913–918.
  * Devroye et al. (2018) Luc Devroye, Abbas Mehrabian, and Tommy Reddad. 2018\.  The total variation distance between high-dimensional Gaussians.  _arXiv preprint arXiv:1810.08693_ (2018).
  * du Pin Calmon and Fawaz (2012) Flávio du Pin Calmon and Nadia Fawaz. 2012.  Privacy against statistical inference. In _2012 50th annual Allerton conference on communication, control, and computing (Allerton)_. IEEE, 1401–1408.
  * Duchi et al. (2013) John Duchi, Martin J Wainwright, and Michael I Jordan. 2013\.  Local Privacy and Minimax Bounds: Sharp Rates for Probability Estimation. In _Advances in Neural Information Processing Systems_ , C.J. Burges, L. Bottou, M. Welling, Z. Ghahramani, and K.Q. Weinberger (Eds.), Vol. 26. Curran Associates, Inc.  https://proceedings.neurips.cc/paper_files/paper/2013/file/5807a685d1a9ab3b599035bc566ce2b9-Paper.pdf
  * Désidéri (2012a) Jean-Antoine Désidéri. 2012a.  MGDA Variants for Multi-Objective Optimization.  (09 2012).
  * Désidéri (2012b) Jean-Antoine Désidéri. 2012b.  Multiple-gradient descent algorithm (MGDA) for multiobjective optimization.  _Comptes Rendus Mathematique_ 350, 5 (2012), 313–318.  https://doi.org/10.1016/j.crma.2012.03.014
  * Geiping et al. (2020) Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller. 2020.  Inverting Gradients - How Easy is It to Break Privacy in Federated Learning? _(NIPS’20)_. Curran Associates Inc., Red Hook, NY, USA, Article 1421, 11 pages.
  * Gentry (2009) Craig Gentry. 2009\.  _A fully homomorphic encryption scheme_.  Stanford university.
  * Geyer et al. (2017) Robin C Geyer, Tassilo Klein, and Moin Nabi. 2017.  Differentially private federated learning: A client level perspective.  _arXiv preprint arXiv:1712.07557_ (2017).
  * Gu et al. (2021) Hanlin Gu, Lixin Fan, Bowen Li, Yan Kang, Yuan Yao, and Qiang Yang. 2021.  Federated Deep Learning with Bayesian Privacy.  _arXiv preprint arXiv:2109.13012_ (2021).
  * Hu et al. (2022) Zeou Hu, Kiarash Shaloudegi, Guojun Zhang, and Yaoliang Yu. 2022.  Federated Learning Meets Multi-Objective Optimization.  _IEEE Transactions on Network Science and Engineering_ 9, 4 (2022), 2039–2051.  https://doi.org/10.1109/TNSE.2022.3169117
  * Huang et al. (2020) Yangsibo Huang, Zhao Song, Kai Li, and Sanjeev Arora. 2020\.  Instahide: Instance-hiding schemes for private distributed learning. In _International conference on machine learning_. PMLR, 4507–4518.
  * Ju et al. (2023) Li Ju, Tianru Zhang, Salman Toor, and Andreas Hellander. 2023.  Accelerating Fair Federated Learning: Adaptive Federated Adam.  _arXiv e-prints_ , Article arXiv:2301.09357 (Jan. 2023), arXiv:2301.09357 pages.  https://doi.org/10.48550/arXiv.2301.09357 arXiv:2301.09357 [cs.LG]
  * Kang et al. (2022) Yan Kang, Yuanqin He, Jiahuan Luo, Tao Fan, Yang Liu, and Qiang Yang. 2022\.  Privacy-preserving Federated Adversarial Domain Adaptation over Feature Groups for Interpretability.  _IEEE Transactions on Big Data_ (2022), 1–12.  https://doi.org/10.1109/TBDATA.2022.3188292
  * Kim et al. (2004) Mifa Kim, Tomoyuki Hiroyasu, Mitsunori Miki, and Shinya Watanabe. 2004.  SPEA2+: Improving the performance of the strength Pareto evolutionary algorithm 2. In _Parallel Problem Solving from Nature-PPSN VIII: 8th International Conference, Birmingham, UK, September 18-22, 2004. Proceedings 8_. Springer, 742–751.
  * Krizhevsky et al. (2014) Alex Krizhevsky, Vinod Nair, and Geoffrey Hinton. 2014\.  The CIFAR-10 dataset.  _online: http://www. cs. toronto. edu/kriz/cifar. html_ 55, 5 (2014).
  * Laumanns and Ocenasek (2002) Marco Laumanns and Jiri Ocenasek. 2002.  Bayesian Optimization Algorithms for Multi-objective Optimization. In _Parallel Problem Solving from Nature — PPSN VII_ , Juan Julián Merelo Guervós, Panagiotis Adamidis, Hans-Georg Beyer, Hans-Paul Schwefel, and José-Luis Fernández-Villacañas (Eds.). Springer Berlin Heidelberg, Berlin, Heidelberg, 298–307.
  * LeCun et al. (1998) Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. 1998.  Gradient-based learning applied to document recognition.  _Proc. IEEE_ 86, 11 (1998), 2278–2324.
  * Li et al. (2023) Bo Li, Peng Qi, Bo Liu, Shuai Di, Jingen Liu, Jiquan Pei, Jinfeng Yi, and Bowen Zhou. 2023.  Trustworthy AI: From Principles to Practices.  _ACM Comput. Surv._ 55, 9, Article 177 (jan 2023), 46 pages.  https://doi.org/10.1145/3555803
  * Lim et al. (2020) Wei Yang Bryan Lim, Zehui Xiong, Chunyan Miao, Dusit Niyato, Qiang Yang, Cyril Leung, and H. Vincent Poor. 2020.  Hierarchical Incentive Mechanism Design for Federated Machine Learning in Mobile Networks.  _IEEE Internet of Things Journal_ 7, 10 (2020), 9575–9588.  https://doi.org/10.1109/JIOT.2020.2985694
  * Lin et al. (2022) Xi Lin, Zhiyuan Yang, Xiaoyuan Zhang, and Qingfu Zhang. 2022\.  Pareto Set Learning for Expensive Multi-Objective Optimization. In _Advances in Neural Information Processing Systems_ , S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh (Eds.), Vol. 35. Curran Associates, Inc., 19231–19247.  https://proceedings.neurips.cc/paper_files/paper/2022/file/7a583691ccfcf8945ab714b677ccbf0b-Paper-Conference.pdf
  * Liu et al. (2022) Haochen Liu, Yiqi Wang, Wenqi Fan, Xiaorui Liu, Yaxin Li, Shaili Jain, Yunhao Liu, Anil Jain, and Jiliang Tang. 2022.  Trustworthy AI: A Computational Perspective.  _ACM Trans. Intell. Syst. Technol._ 14, 1, Article 4 (nov 2022), 59 pages.  https://doi.org/10.1145/3546872
  * Liu et al. (2022) Qiqi Liu, Yuping Yan, Peter Ligeti, and Yaochu Jin. 2022\.  A Secure Federated Data-Driven Evolutionary Multi-objective Optimization Algorithm.  _arXiv e-prints_ , Article arXiv:2210.08295 (Oct. 2022), arXiv:2210.08295 pages.  https://doi.org/10.48550/arXiv.2210.08295 arXiv:2210.08295 [cs.AI]
  * Liu and Vicente (2021) Suyun Liu and Luis Nunes Vicente. 2021.  The stochastic multi-gradient algorithm for multi-objective optimization and its application to supervised machine learning.  _Annals of Operations Research_ (2021), 1–30.
  * Long et al. (2020) Guodong Long, Yue Tan, Jing Jiang, and Chengqi Zhang. 2020\.  Federated learning for open banking.  In _Federated Learning: Privacy and Incentive_. Springer, 240–254.
  * Luenberger et al. (1984) David G Luenberger, Yinyu Ye, et al. 1984\.  _Linear and nonlinear programming_. Vol. 2.  Springer.
  * Lyu et al. (2022) Lingjuan Lyu, Han Yu, Xingjun Ma, Chen Chen, Lichao Sun, Jun Zhao, Qiang Yang, and Philip S. Yu. 2022\.  Privacy and Robustness in Federated Learning: Attacks and Defenses.  _IEEE Transactions on Neural Networks and Learning Systems_ (2022), 1–21.  https://doi.org/10.1109/TNNLS.2022.3216981
  * Mahapatra and Rajan (2020) Debabrata Mahapatra and Vaibhav Rajan. 2020.  Multi-Task Learning with User Preferences: Gradient Descent with Controlled Ascent in Pareto Optimization. In _Proceedings of the 37th International Conference on Machine Learning_ _(Proceedings of Machine Learning Research, Vol. 119)_ , Hal Daumé III and Aarti Singh (Eds.). PMLR, 6597–6607.  https://proceedings.mlr.press/v119/mahapatra20a.html
  * McMahan et al. (2017) Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. 2017\.  Communication-efficient learning of deep networks from decentralized data. In _Artificial Intelligence and Statistics_. PMLR, 1273–1282.
  * McMahan et al. (2016) H. B. McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Agüera y Arcas. 2016\.  Communication-Efficient Learning of Deep Networks from Decentralized Data. In _International Conference on Artificial Intelligence and Statistics_.
  * Mehrabi et al. (2022) Ninareh Mehrabi, Cyprien de Lichy, John McKay, Cynthia He, and William Campbell. 2022.  Towards Multi-Objective Statistically Fair Federated Learning.  _arXiv e-prints_ , Article arXiv:2201.09917 (Jan. 2022), arXiv:2201.09917 pages.  https://doi.org/10.48550/arXiv.2201.09917 arXiv:2201.09917 [cs.LG]
  * Morell et al. (2022) José Ángel Morell, Zakaria Abdelmoiz Dahi, Francisco Chicano, and Gabriel Luque. 2022\.  Optimising Communication Overhead in Federated Learning Using NSGA-II.  , 317-333 pages.  https://doi.org/10.1007/978-3-031-02462-7_21
  * Nakayama et al. (2009) Hirotaka Nakayama, Yeboon Yun, and Min Yoon. 2009.  _Sequential approximate multiobjective optimization using computational intelligence_.  Springer Science & Business Media.
  * Nguyen et al. (2022) Dinh C. Nguyen, Quoc-Viet Pham, Pubudu N. Pathirana, Ming Ding, Aruna Seneviratne, Zihuai Lin, Octavia Dobre, and Won-Joo Hwang. 2022\.  Federated Learning for Smart Healthcare: A Survey.  _ACM Comput. Surv._ 55, 3, Article 60 (feb 2022), 37 pages.  https://doi.org/10.1145/3501296
  * Nori et al. (2021) Milad Khademi Nori, Sangseok Yun, and Il-Min Kim. 2021\.  Fast federated learning by balancing communication trade-offs.  _IEEE Transactions on Communications_ 69, 8 (2021), 5168–5182.
  * Paria et al. (2020) Biswajit Paria, Kirthevasan Kandasamy, and Barnabás Póczos. 2020.  A flexible framework for multi-objective bayesian optimization using random scalarizations. In _Uncertainty in Artificial Intelligence_. PMLR, 766–776.
  * Rassouli and Gündüz (2019) Borzoo Rassouli and Deniz Gündüz. 2019.  Optimal utility-privacy trade-off with total variation distance as a privacy measure.  _IEEE Transactions on Information Forensics and Security_ 15 (2019), 594–603.
  * Rieke et al. (2020) Nicola Rieke, Jonny Hancox, Wenqi Li, Fausto Milletari, Holger R Roth, Shadi Albarqouni, Spyridon Bakas, Mathieu N Galtier, Bennett A Landman, Klaus Maier-Hein, et al. 2020\.  The future of digital health with federated learning.  _NPJ digital medicine_ 3, 1 (2020), 1–7.
  * Shamir (1979) Adi Shamir. 1979\.  How to Share a Secret.  _Commun. ACM_ 22, 11 (nov 1979), 612–613.  https://doi.org/10.1145/359168.359176
  * Tan et al. (2020) Ben Tan, Bo Liu, Vincent Zheng, and Qiang Yang. 2020\.  _A Federated Recommender System for Online Services_.  Association for Computing Machinery, New York, NY, USA, 579–581.  https://doi.org/10.1145/3383313.3411528
  * Thapa et al. (2022) Chandra Thapa, Pathum Chamikara Mahawaga Arachchige, Seyit Camtepe, and Lichao Sun. 2022\.  SplitFed: When Federated Learning Meets Split Learning.  _Proceedings of the AAAI Conference on Artificial Intelligence_ 36, 8 (Jun. 2022), 8485–8493.  https://doi.org/10.1609/aaai.v36i8.20825
  * Thiebes et al. (2020) Scott Thiebes, Sebastian Lins, and Ali Sunyaev. 2020.  Trustworthy artificial intelligence.  _Electronic Markets_ 31 (10 2020).  https://doi.org/10.1007/s12525-020-00441-4
  * Truex et al. (2020) Stacey Truex, Ling Liu, Ka-Ho Chow, Mehmet Emre Gursoy, and Wenqi Wei. 2020.  LDP-Fed: Federated learning with local differential privacy. In _Proceedings of the Third ACM International Workshop on Edge Systems, Analytics and Networking_. 61–66.
  * Wei et al. (2020) Kang Wei, Jun Li, Ming Ding, Chuan Ma, Howard H. Yang, Farhad Farokhi, Shi Jin, Tony Q. S. Quek, and H. Vincent Poor. 2020.  Federated Learning With Differential Privacy: Algorithms and Performance Analysis.  _IEEE Transactions on Information Forensics and Security_ 15 (2020), 3454–3469.  https://doi.org/10.1109/TIFS.2020.2988575
  * Wu et al. (2022) Yuezhou Wu, Yan Kang, Jiahuan Luo, Yuanqin He, and Qiang Yang. 2022.  FedCG: Leverage Conditional GAN for Protecting Privacy and Maintaining Competitive Performance in Federated Learning. In _Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence, IJCAI-22_. International Joint Conferences on Artificial Intelligence Organization.
  * Xiao et al. (2017) Han Xiao, Kashif Rasul, and Roland Vollgraf. 2017.  _Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms_.  arXiv:cs.LG/1708.07747 [cs.LG]
  * Xu et al. (2021a) Jinjin Xu, Yaochu Jin, and Wenli Du. 2021a.  A federated data-driven evolutionary algorithm for expensive multi-/many-objective optimization.  _Complex & Intelligent Systems_ 7, 6 (01 Dec 2021), 3093–3109.  https://doi.org/10.1007/s40747-021-00506-7
  * Xu et al. (2021b) Jinjin Xu, Yaochu Jin, Wenli Du, and Sai Gu. 2021b.  A federated data-driven evolutionary algorithm.  _Knowledge-Based Systems_ 233 (2021), 107532.  https://doi.org/10.1016/j.knosys.2021.107532
  * Yang et al. (2019a) Kaifeng Yang, Michael Emmerich, André Deutz, and Thomas Bäck. 2019a.  Multi-Objective Bayesian Global Optimization using expected hypervolume improvement gradient.  _Swarm and Evolutionary Computation_ 44 (2019), 945–956.  https://doi.org/10.1016/j.swevo.2018.10.007
  * Yang et al. (2020) Liu Yang, Ben Tan, Vincent W Zheng, Kai Chen, and Qiang Yang. 2020.  Federated recommendation systems.  _Federated Learning: Privacy and Incentive_ (2020), 225–239.
  * Yang et al. (2023) Qiang Yang, Anbu Huang, Lixin Fan, Chee Seng Chan, Jian Han Lim, Kam Woh Ng, Ding Sheng Ong, and Bowen Li. 2023\.  Federated Learning with Privacy-preserving and Model IP-right-protection.  _Machine Intelligence Research_ 20, 1 (2023), 19–37.
  * Yang et al. (2019b) Qiang Yang, Yang Liu, Tianjian Chen, and Yongxin Tong. 2019b.  Federated machine learning: Concept and applications.  _ACM Transactions on Intelligent Systems and Technology (TIST)_ 10, 2 (2019), 1–19.
  * Yin et al. (2022) Benshun Yin, Zhiyong Chen, and Meixia Tao. 2022\.  Predictive GAN-powered Multi-Objective Optimization for Hybrid Federated Split Learning.  _arXiv e-prints_ , Article arXiv:2209.02428 (Sept. 2022), arXiv:2209.02428 pages.  https://doi.org/10.48550/arXiv.2209.02428 arXiv:2209.02428 [cs.LG]
  * Yin et al. (2021) Hongxu Yin, Arun Mallya, Arash Vahdat, Jose M Alvarez, Jan Kautz, and Pavlo Molchanov. 2021\.  See through Gradients: Image Batch Recovery via GradInversion. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 16337–16346.
  * Yu et al. (2020) Han Yu, Zelei Liu, Yang Liu, Tianjian Chen, Mingshu Cong, Xi Weng, Dusit Niyato, and Qiang Yang. 2020\.  A Fairness-Aware Incentive Scheme for Federated Learning. In _Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society_ (New York, NY, USA) _(AIES ’20)_. Association for Computing Machinery, New York, NY, USA, 393–399.  https://doi.org/10.1145/3375627.3375840
  * Zhang et al. (2020a) Chengliang Zhang, Suyi Li, Junzhe Xia, Wei Wang, Feng Yan, and Yang Liu. 2020a.  BatchCrypt: Efficient Homomorphic Encryption for Cross-Silo Federated Learning. In _Proceedings of the 2020 USENIX Conference on Usenix Annual Technical Conference_ _(USENIX ATC’20)_. USENIX Association, USA, Article 33, 14 pages.
  * Zhang et al. (2020b) Chengliang Zhang, Suyi Li, Junzhe Xia, Wei Wang, Feng Yan, and Yang Liu. 2020b.  BatchCrypt: Efficient Homomorphic Encryption for Cross-Silo Federated Learning. In _2020 USENIX Annual Technical Conference (USENIX ATC 20)_. USENIX Association, 493–506.  https://www.usenix.org/conference/atc20/presentation/zhang-chengliang
  * Zhang et al. (2018) Hongyi Zhang, Moustapha Cisse, Yann N Dauphin, and David Lopez-Paz. 2018.  mixup: Beyond Empirical Risk Minimization. In _International Conference on Learning Representations_.
  * Zhang and Li (2007) Qingfu Zhang and Hui Li. 2007.  MOEA/D: A Multiobjective Evolutionary Algorithm Based on Decomposition.  _IEEE Transactions on Evolutionary Computation_ 11, 6 (2007), 712–731.  https://doi.org/10.1109/TEVC.2007.892759
  * Zhang and Golovin (2020) Richard Zhang and Daniel Golovin. 2020.  Random hypervolume scalarizations for provable multi-objective black box optimization. In _International Conference on Machine Learning_. PMLR, 11096–11105.
  * Zhang et al. (2022) Xiaojin Zhang, Hanlin Gu, Lixin Fan, Kai Chen, and Qiang Yang. 2022.  No Free Lunch Theorem for Security and Utility in Federated Learning.  _ACM Trans. Intell. Syst. Technol._ 14, 1, Article 1 (nov 2022), 35 pages.  https://doi.org/10.1145/3563219
  * Zhang et al. (2023a) Xiaojin Zhang, Yan Kang, Kai Chen, Lixin Fan, and Qiang Yang. 2023a.  Trading Off Privacy, Utility and Efficiency in Federated Learning.  arXiv:2209.00230 [cs.LG]
  * Zhang et al. (2023b) Yifei Zhang, Dun Zeng, Jinglong Luo, Zenglin Xu, and Irwin King. 2023b.  A Survey of Trustworthy Federated Learning with Perspectives on Security, Robustness, and Privacy.  arXiv:2302.10637 [cs.LG]
  * Zhao et al. (2020) Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. 2020\.  idlg: Improved deep leakage from gradients.  _arXiv preprint arXiv:2001.02610_ (2020).
  * Zheng et al. (2022) Weijie Zheng, Yufei Liu, and Benjamin Doerr. 2022.  A first mathematical runtime analysis of the Non-Dominated Sorting Genetic Algorithm II (NSGA-II). In _Proceedings of the AAAI Conference on Artificial Intelligence_ , Vol. 36. 10408–10416.
  * Zhong et al. (2022) Jialin Zhong, Yahui Wu, Wubin Ma, Su Deng, and Haohao Zhou. 2022.  Optimizing Multi-Objective Federated Learning on Non-IID Data with Improved NSGA-III and Hierarchical Clustering.  _Symmetry_ 14, 5 (2022), 1070.
  * Zhu and Jin (2019) Hangyu Zhu and Yaochu Jin. 2019.  Multi-objective evolutionary federated learning.  _IEEE transactions on neural networks and learning systems_ 31, 4 (2019), 1310–1322.
  * Zhu and Jin (2020) Hangyu Zhu and Yaochu Jin. 2020.  Multi-Objective Evolutionary Federated Learning.  _IEEE Transactions on Neural Networks and Learning Systems_ 31, 4 (2020), 1310–1322.  https://doi.org/10.1109/TNNLS.2019.2919699
  * Zhu et al. (2019) Ligeng Zhu, Zhijian Liu, and Song Han. 2019.  Deep Leakage from Gradients. In _Advances in Neural Information Processing Systems_ , H. Wallach, H. Larochelle, A. Beygelzimer, F. d'Alché-Buc, E. Fox, and R. Garnett (Eds.), Vol. 32. Curran Associates, Inc.  https://proceedings.neurips.cc/paper/2019/file/60a6c4002cc7b29142def8871531281a-Paper.pdf
  * Zitzler and Künzli (2004) Eckart Zitzler and Simon Künzli. 2004.  Indicator-Based Selection in Multiobjective Search. In _Parallel Problem Solving from Nature - PPSN VIII_ , Xin Yao, Edmund K. Burke, José A. Lozano, Jim Smith, Juan Julián Merelo-Guervós, John A. Bullinaria, Jonathan E. Rowe, Peter Tiňo, Ata Kabán, and Hans-Paul Schwefel (Eds.). Springer Berlin Heidelberg, Berlin, Heidelberg, 832–842.
  * Zitzler et al. (2001) Eckart Zitzler, Marco Laumanns, and Lothar Thiele. 2001\.  SPEA2: Improving the strength Pareto evolutionary algorithm.  _TIK-report_ 103 (2001).