# Certified Robustness in Federated Learning

Written by AAAI Press Staff1
AAAI Style Contributions by Pater Patel Schneider, Sunil Issar,
J. Scott Penberthy, George Ferguson, Hans Guesgen, Francisco Cruz, Marc Pujol-
Gonzalez With help from the AAAI Publications Committee.

###### Abstract

Federated learning has recently gained significant attention and popularity
due to its effectiveness in training machine learning models on distributed
data privately. However, as in the single-node supervised learning setup,
models trained in federated learning suffer from vulnerability to
imperceptible input transformations known as adversarial attacks, questioning
their deployment in security-related applications. In this work, we study the
interplay between federated training, personalization, and certified
robustness. In particular, we deploy randomized smoothing, a widely-used and
scalable certification method, to certify deep networks trained on a federated
setup against input perturbations and transformations. We find that the simple
federated averaging technique is effective in building not only more accurate,
but also more certifiably-robust models, compared to training solely on local
data. We further analyze personalization, a popular technique in federated
training that increases the model’s bias towards local data, on robustness. We
show several advantages of personalization over both (that is, only training
on local data and federated training) in building more robust models with
faster training. Finally, we explore the robustness of mixtures of global and
local (i.e. personalized) models, and find that the robustness of local models
degrades as they diverge from the global model.

## Introduction

Machine learning models in general, and deep neural networks (DNNs) in
particular, have demonstrated remarkable performance in several domains,
including computer vision (krizhevsky2012imagenet) and natural language
processing (hinton2012speech), among others (lecun2015deep). Despite this
success, DNNs are brittle against small carefully-crafted perturbations in
their input space (szegedy2014intriguing; goodfellow2015explaining). That is,
a DNN $f_{\theta}:\mathbb{R}^{d}\rightarrow\mathcal{P}(\mathcal{Y})$ can
produce different predictions for the inputs $x\in\mathbb{R}^{d}$ and
$x+\delta$, although the adversarial perturbation $\delta$ is small, and thus
$x$ and $x+\delta$ are indistinguishable to the human eye. Moreover, DNNs are
also susceptible to input transformations that preserve an image’s semantic
information, such as rotation, translation, and scaling
(engstrom2018rotation). This observation raises security concerns about
deploying such models in security-critical applications, i.e. self-driving
cars. Consequently, this phenomenon sparked substantial research efforts
towards building machine learning models that are not only accurate, but also
robust. That is, building models that both correctly classify an input $x$,
and maintain their prediction as long $x$ preserves its semantic content.
Further interest arose in theoretically characterizing the output of models
whose input was subjected to perturbations. Whenever a theoretical guarantee
exists about a model’s robustness for classifying inputs, $f_{\theta}$ is said
to be _certifiably_ robust (wong2018provable). Among several methods that
built such certifiably robust models, Randomized Smoothing (RS)
(cohen2019certified) is arguably one of the most effective, scalable, and
popular approaches to certify DNNs. In a nutshell, RS predicts the most
probable class when the classifier’s input is subjected to additive Gaussian
noise. While RS directly operated on pixel-intensity perturbations, a later
work extended this technique to certify against input deformations, such as
rotation and translation (deformrs).

The problem of training large-scale machine learning models in the real world
may need to account for data privacy constraints that arise in distributed
setups. Federated learning (FL) (fedavg; FEDLEARN; konevcny2016federated) is a
viable solution to this problem, which is now commonly used in popular
services (kairouz2021advances). Although the certified robustness of models in
traditional learning settings has been widely studied, few works consider the
interaction between certified robustness and the federated setup.
Specifically, federated learning distributes the training process across a
(possibly large) set of clients (each with their own local data) and privately
builds a global model without leaking nor sharing local raw data. In practice,
federated training is usually performed through a series of communication
rounds between the clients and an orchestrating server. In each round, a
subset of clients trains a local model for multiple steps and sends the model
to the server; the server then aggregates the received models and communicates
the result back to selected clients (kairouz2021advances). In the federated
learning setup, zizzo2020fat showed that (1) adversarial attacks can reduce
the accuracy of state-of-the-art federated learning models to 0%, and (2)
adversarial robustness is higher in the centralized setting than in the
federated setting, illustrating the difficulty of enhancing adversarial
robustness. We further investigate these observations, and identify two key
and challenging settings for analyzing certified robustness in federated
learning: (i) each client has insufficient data to fully train a robust model,
and (ii) each client may be interested in building a model that is robust
against different transformations. These settings raise questions about
whether and when adversarial robustness benefits from federated training.

In this work, we set to study the certified robustness of models trained in a
federated fashion. We deploy Randomized Smoothing to measure certified
robustness against both pixel-intensity perturbations and input deformations.
We first analyze when federated training benefits model robustness. We show
that in the few local-data regimes—where clients have insufficient
data—federated averaging improves not only model performance but also its
robustness. Furthermore, we explore how certified robustness gains from
personalization (smith2017federated; mansour2020three;
arivazhagan2019federated; explicit_personalization), i.e. fine-tuning the
global model on local data. We show that personalization can provide
significant robustness improvements even when federated averaging operates on
models trained without augmentations aimed at enhancing robustness. At last,
we analyze a version of the recently-proposed mixture between global and
personalized models from federated learning (implicit_personalization) from a
certified robustness lens. In summary, our contributions are three-fold:

  1. 1.

We provide a large-scale study of certified robustness in the federated
learning setup. We do so by characterizing the setting, in which federated
learning is more beneficial for model robustness than training solely on local
data.

  2. 2.

We present a comprehensive analysis of the personalization effect on
robustness. We show how personalization, combined with robust training,
compares favorably to robust training on local data, even when individual
clients do not employ robust training.

  3. 3.

We experimentally analyze the certified robustness benefits of using a mixture
of global and local models. We find that as the local model gets closer to the
global one via local training steps, certified robustness against both pixel
perturbations and input deformations improves.

## Related Work

#### Certified Adversarial Robustness.

The seminal work of szegedy2014intriguing demonstrated how DNNs are vulnerable
to small perturbations in their input, now called adversarial attacks.
Subsequent works noted how the brittleness against these attacks was
widespread and easily exploitable (goodfellow2015explaining). This observation
led to further works on defense mechanisms that improved adversarial
robustness (kannan2018adversarial; madry2018towards), and on attacks that
aimed at breaking these mechanisms (carlini2017towards; moosavi2016deepfool).
The development of defenses and attacks of increasing sophistication, akin to
an arms race, highlighted the difficulty of improving robustness. In
particular, the work of athalye2018obfuscated identified how various defenses
provided a false sense of security, and attributed such misperception to the
difficulty of assessing adversarial robustness (carlini2019evaluating). This
difficulty sparkled curiosity on defenses whose robustness could be formally
proven (wong2018provable); that is, defense mechanisms that feature formal
statements about the nonexistence of successful adversarial attacks. To this
aim, cohen2019certified proposed Randomized Smoothing (RS), an approach for
certification that proved to successfully scale with models and datasets.
Notably, RS has been successfully combined with adversarial training
(salman2019provably), regularization (Zhai2020MACER:), and parameter
optimization (alfarra-data; eiras-ancer) for improved robustness. The original
RS formulation certified models against pixel-level additive perturbations,
and was studied in the federated learning setup by chen2021certifiably.
Recently, DeformRS (deformrs) reformulated RS to consider parameterized
deformations, granting robustness certificates against more general and
semantic perturbations, such as rotation and translation. In this work, we
leverage RS and DeformRS to study the certified robustness of models learnt in
federated learning.

#### Federated Learning.

Federated Learning (FL) is a data-decentralized machine learning setting in
which a central server coordinates a large number of clients (e.g. mobile
devices or whole organizations) to collaboratively train a model (fedavg;
FEDLEARN; konevcny2016federated; wang2021field). FL has proven to be a
valuable setting to study, finding interest both from research and practical
applications (kairouz2021advances). In particular, FL has been successfully
deployed by Google (hard2018federated), apple19wwdc, nvidia2020, and many
others, even in safety- and security-critical settings, which motivates our
work. Given how the inherent multiple-devices nature of FL introduces
heterogeneity in the data, interest spurred towards techniques that considered
model personalization (FL-MAML-Jakub; implicit_personalization;
hanzely2020lower; li2021ditto) to improve performance on each device’s data
(mansour2020three; explicit_personalization; jiang2019improving;
paulik2021federated).

#### Robustness in FL.

Concerns about the adversarial vulnerability of machine learning models have
also been studied in the FL setup (bhagoji2019analyzing). While most prior
works focused on training-time adversarial attacks such as Byzantine attacks
(he2020byzantine), and model (bhagoji2019analyzing) or data poisoning
(steinhardt2017certified; sun2021data), recent works studied test-time
robustness. In particular, the works of zizzo2020fat and shah2021adversarial
studied the incorporation of adversarial training (madry2018towards), arguably
the most effective empirical defense against adversarial attacks, into the FL
setup. Closest to our study, is the recent work of chen2021certifiably that
explored certification via RS in FL. In contrast to chen2021certifiably,
instead of pixel-level perturbations, we study realistic (e.g. rotation and
translation) perturbations. Furthermore, we provide (1) a characterization of
the setting in which federated averaging—a standard technique in FL—enhances
robustness, and (2) analyze how personalization affects model robustness.

## Methodology

We start with a brief overview on Randomized Smoothing.

### Background on Randomized Smoothing

#### Notation.

We consider the standard classification problem where a classifier
$f_{\theta}:\mathbb{R}^{d}\rightarrow\mathcal{P}(\mathcal{Y})$, e.g. a DNN
with parameters $\theta$, maps the input $x\in\mathbb{R}^{d}$ to the
probability simplex $\mathcal{P}(\mathcal{Y})$ over $k$ classes, where
$\mathcal{Y}=\\{1,2,\dots,k\\}$. That is, $\sum_{i=1}^{k}f_{\theta}^{i}(x)=1$
with $f_{\theta}^{i}(x)\geq 0$ being the $i^{\text{th}}$ element of
$f_{\theta}(x)$, representing the probability $x$ belongs to the
$i^{\text{th}}$ class.

#### Randomized Smoothing.

Randomized smoothing is a method for constructing a “smooth” classifier from
an arbitrary base classifier $f_{\theta}$. In a nutshell, when queried at
input $x$, the smooth classifier returns $f_{\theta}$’s average prediction
when its input is subjected to isotropic additive Gaussian noise:

$g(x)=\mathbb{E}_{\epsilon\sim\mathcal{N}(0,\sigma^{2}I)}\left[f_{\theta}(x+\epsilon)\right].$
(1)

Let $g$ predict label $c_{A}$ for input $x$ with some confidence, i.e.
$\mathbb{E}_{\epsilon}[f^{c_{A}}_{\theta}(x+\epsilon)]=p_{A}\geq
p_{B}=\max_{c\neq c_{A}}\mathbb{E}_{\epsilon}[f^{c}_{\theta}(x+\epsilon)]$,
then, as proved in (Zhai2020MACER:), $g_{\theta}$’s prediction is certifiably
robust at $x$ with certification radius:

$\displaystyle
R=\frac{\sigma}{2}\left(\Phi^{-1}(p_{A})-\Phi^{-1}(p_{B})\right).$ (2)

That is,
$\text{arg}\max_{i}g^{i}(x+\delta)=\text{arg}\max_{i}g^{i}(x),\>\forall\|\delta\|_{2}\leq
R$, where $\Phi^{-1}$ is the inverse CDF of the standard Gaussian
distribution.

### Background on DeformRS

While the original RS framework certified against additive pixel perturbations
in images, DeformRS (deformrs) extended RS to certify against image
deformations. DeformRS achieved this objective by proposing a parametric-
domain smooth classifier. In particular, given an image $x$ with pixel
coordinates $p$, a parametric deformation function $\nu_{\phi}$ with
parameters $\phi$ (e.g. if $\nu$ is a rotation, then $\phi$ is the angle of
rotation) and an interpolation function $I_{T}$, DeformRS defined the
parametric smooth classifier as:

$g_{\phi}(x,p)=\mathbb{E}_{\epsilon\sim\mathcal{D}}\left[f_{\theta}(I_{T}(x,p+\nu_{\phi+\epsilon}))\right].$
(3)

In a nutshell, $g$ outputs the average prediction of $f_{\theta}$ over
transformed versions of the input $x$. Note that, in contrast to traditional
RS, this formulation perturbs the pixels’ location, rather than their
intensities. DeformRS showed that parametric-domain smooth classifiers are
certifiably robust against perturbations to the parameters of the deformation
function via the following corollary.

###### Corollary 1

(restated from (deformrs)) Suppose that $g$ predicts class $c_{A}$ for an
input $x$, i.e. $c_{A}=arg\,max_{i}g^{i}_{\phi}(x,p)$ with

$p_{A}=g_{\phi}^{c_{A}}(x,p)\,\,\emph{and}\,\,p_{B}=\max_{c\neq
c_{A}}g_{\phi}^{c}(x,p)$

Then $arg\,max_{i}g^{i}_{\phi+\delta}(x,p)=c_{A}$ for all parametric
perturbations $\delta$ satisfying:

$\displaystyle\begin{split}&\|\delta\|_{1}\leq\sigma\left(p_{A}-p_{B}\right)\qquad\qquad\qquad\quad\,\,\,\,\text{for
}\mathcal{D}=\mathcal{U}[-\sigma,\sigma],\\\
&\|\delta\|_{2}\leq\frac{\sigma}{2}\left(\Phi^{-1}(p_{A})-\Phi^{-1}(p_{B})\right)\qquad\text{for
}\mathcal{D}=\mathcal{N}(0,\sigma^{2}I).\end{split}$

In short, Corollary 1 states that, as long as the parameters of the
deformation function (e.g. rotation angle) are perturbed by a quantity upper
bounded by the certified radius, $g$’s prediction will remain constant. This
theoretical result then allowed for certifying parametric image deformations.

Experimentally, we consider three common image corruptions: (1) additive
pixel-intensity perturbations, (2) pixel-location translations, and (3) pixel-
location rotations. Perturbing pixel intensities corresponds to RS’ original
formulation from Eq. (1), in which the input $x$ is additively perturbed by
noise. The other two corruptions require DeformRS’ formulation from Eq. (3).
For this formulation, let $\Omega^{\mathbb{Z}}$ be the grid of an $N\times
M$-sized image, where $p_{n,m}=(n,m)\in\Omega^{\mathbb{Z}}$ represents a pixel
location. If this grid is additively perturbed by a vector field
$\nu_{\phi}(p_{n,m})=(u_{n,m},v_{n,m})\in\mathbb{R}^{2}$, modeling
translations and rotations corresponds to defining $\nu_{\phi}(p_{n,m})$ as
follows:

#### Translation.

Image translation requires two parameters $\phi=\\{t_{u},\,t_{v}\\}$, i.e. the
translation magnitude along each axis, namely
$\nu_{\phi}(p_{n,m})=(t_{u},t_{v})~{}~{}\forall p$ $~{}\forall n,m$ as per Eq.
(3).

#### Rotation.

2D rotation is parameterized by the rotation angle, thus $\phi=\\{\beta\\}$,
where $u_{n,m}=n(\cos(\beta)-1)-m\sin(\beta)$ and
$\nu_{n,m}=n\sin(\beta)+m(\cos(\beta)-1)$.

Figure 1: Certified Accuracy against rotation. We plot the certified accuracy
curves for rotation deformation with varying $\sigma\in\\{0.1,0.5\\}$ in the
top and bottom rows respectively. We vary the number of clients on which we
divide the dataset. Left: 4 clients, middle: 10 clients, right: 20 clients. As
the number of clients increases, performance of local training worsens.

### Specialization to Federated Training

Earlier works proposed various training frameworks to enhance the robustness
of smooth classifiers. The schemes studied by these frameworks ranged from
simple data augmentation (cohen2019certified) to more sophisticated
techniques, including adversarial training (salman2019provably) and
regularization (Zhai2020MACER:). In this work, we robustify the classifier via
simple and nondemanding data augmentation. We select this approach since our
main aim is to analyze the effect of federated training on certified
robustness in isolation of additional and more sophisticated training schemes.
In addition, this setup allows compatibility with other FL-specific
constraints and technologies, such as differential privacy and secure
aggregation, which can be essential for real-world deployment
(kairouz2021advances).

We analyze certified robustness against three different input transformations.
In particular, we consider pixel perturbations (cohen2019certified), and image
rotation and translation (deformrs). Note that the first setting perturbs
pixel intensities, whereas the other two perturb pixel locations. We measure
the certified radius for each sample according to Eq. (2) for input
perturbations, and leverage Corollary 1 for measuring certification radii for
rotation and translation. Following deformrs, we smooth with a uniform
distribution for rotation, and Gaussian smoothing for pixel perturbations and
translation.

As in the Federated Learning setup, we employ the common federated averaging
(Povey2014; fedavg) technique. In a nutshell, we consider the case when a
dataset is distributed across multiple clients in a non-overlapping manner. We
assume that all clients share the architecture $f_{\theta}$, to allow for
weight averaging across clients. Furthermore, we study three different
training schemes, where each client is minimizing the following regularized
risk (implicit_personalization):

$\min_{\theta_{1},\dots,\theta_{n}}\frac{1}{n}\sum_{i=1}^{n}\lambda\mathcal{L}_{i}(\theta_{i})+(1-\lambda)\left\|\theta_{i}-\bar{\theta}\right\|_{2}^{2},$
(4)

where $\mathcal{L}_{i}$ is a training loss function (e.g. cross entropy)
evaluated on local data of client $i$, $\theta_{i}$ represents the
$i^{\text{th}}$ client’s model parameters, $\lambda\in[0,1]$ is a
personalization parameter, and
$\bar{\theta}=\frac{1}{n}\sum_{i=1}^{n}\theta_{i}$ is the average model.

#### Local Training.

Each client trains solely on their own local data, without communication with
other clients. At test time, each client employs their own local model. This
setting is equivalent to minimizing the risk in Eq. (4) with $\lambda=1$.

#### Federated Training.

All clients are collaborating in building one global model. This is achieved
by iteratively performing (1) client-side model updates with optimization on
local data (i.e. solving Eq. (4) with $\lambda=1$), and (2) communication of
client models to the server, which averages all models and broadcasts the
result back to the clients (i.e. solving Eq. (4) with $\lambda=0$). This
process is repeated until convergence or for a fixed number of communication
rounds. At test time, all clients employ the global model sent from the server
at the last communication round.

#### Personalized Training.

Since yu2020salvaging exposed how the basic FL formulation with $\lambda=1$
and $\theta_{1}=\dots=\theta_{n}$ degrades the performance of some clients, we
explore a personalization approach. Namely, upon federated training
convergence, each client fine-tunes the global model communicated in the last
round with a few optimization steps on their local data (i.e. solving Eq. (4)
with $\lambda=1$). Despite its simplicity, this approach was shown to perform
well in various tasks (yu2020salvaging).

Figure 2: Personalization effect on certified robustness. Certified accuracy
curves against pixel perturbations (left), rotation (middle), and translation
(right). We use $\sigma\in\\{0.12,0.5\\}$ for pixel perturbations and
$\sigma\in\\{0.1,0.5\\}$ for rotation and translation.

Figure 3: Certified Robustness against Rotation starting from Affine.  Left:
personalization with rotation augmentation. Right: translation augmentation.
The color convention follows that of Figure 2.

#### Mixture of models.

We also consider a more sophisticated personalized ERM setting via a mixture
of global and local models (implicit_personalization), seeking an explicit
trade-off between the global model and the local models for $\lambda\in(0,1)$.
We choose this approach because the formulation in Eq. (4) provably benefits
from local training (as it is done in local SGD and FedAvg) in terms of
communication efficiency. In fact, hanzely2020lower showed that methods with
local steps are optimal in this case. In contrast, for standard ERM, local
methods are known to be worse than their non-local counterparts in the
heterogeneous data regime (woodworth2020minibatch).

Our implementation for solving problem (4) for every client $i$ requires local
gradient descent steps (with step size $\gamma$) and a mixing of current
global and local models through:

$\theta_{i}\leftarrow\theta_{i}-\gamma\left(\lambda\nabla\mathcal{L}_{i}(\theta_{i})+2(1-\lambda)(\theta_{i}-\bar{\theta})\right),$
(5)

alternating with communication to the server for computing the current average
model $\bar{\theta}$. At test time, each client uses its corresponding
personalized model $\theta_{i}$.

While the effect of federated training and personalization in improving model
performance is widely explored in the literature, its impact on the trained
model’s certified robustness remains unclear. Thus, in our experiments, we
empirically study the following questions: (i) Is local training sufficient to
build robust models? (ii) Does federated training improve the certified
robustness of the trained model? (iii) Is personalization beneficial for
improving the certified robustness of local models? (iv) How would the mixture
of models when setting $\lambda\in(0,1)$ interact with the resultant certified
accuracy of each local model?

## Experiments

Figure 4: Comparison between personalization and local training. We plot the
certified accuracy curves against pixel perturbations (left), rotation
(middle), and translation (right) with varying $\sigma\in\\{0.1,0.5\\}$ for
rotation and translation an $\sigma\in\\{0.12,0.5\\}$ for pixel perturbations.
Last row: Experiments on MNIST dataset.

Training Setup. We fix ResNet18 (resnet) as our architecture and train on the
CIFAR10 (cifars) and MNIST (lecun2010mnist) datasets. We split the training
and test sets across clients in a homogeneous and non-overlapping fashion.
Note that this split forms a best-case condition for local training, allowing
compatibility with federated training and its associated data-privacy
constraints. We conduct 90 epochs of training, divided in 45 communication
rounds, i.e. 2 epochs of local training per communication round. We set a
batch size to 64, and use a starting learning rate of $0.1$, which is
decreased by a factor of 10 every 30 epochs (15 communication rounds). Unless
specified otherwise, given a transformation we are interested in robustifying
against (e.g. rotation), we train the model by augmenting the data with such
transformation. This procedure is equivalent to estimating the output of the
smooth classifier in Eq. (3) with one sample. We set the
$\sigma\in\\{0.1,0.5\\}$ for rotation and translation and
$\sigma\in\\{0.12,0,5\\}$ for pixel perturbations, following
cohen2019certified; deformrs. For local models, we train each client on their
local data only with the aforementioned setup without any communication.

Certification Setup. For certification, we use the public implementation from
cohen2019certified for pixel-intensity perturbations, and the one from
deformrs for rotation and translation. We use $100$ Monte Carlo samples for
computing the top prediction $c_{A}$, and $100$k samples for estimating a
lower bound to the prediction probability $p_{A}$; we further use a failure
probability of $\alpha=0.001$, and bound the runner-up prediction via
$p_{B}=1-p_{A}$. For experiments on deformations, we choose $I_{T}$ to be a
bi-linear interpolation function, following deformrs; perez20223deformrs. To
evaluate each client’s certification, we fix a random subset of $500$ local
samples. At last, we plot the average certified accuracy curves across
clients, highlighting the minimum and maximum values as the limits of shaded
regions. We report “certified accuracy at radius $R$”, defined as the
percentage of test samples that is both, classified correctly, and has a
certified radius of at least $R$. We report the ablations for all clients in
the appendix.

### Is Federated Training Good for Robustness?

Figure 5: Mixture of models. We explore the effect of “intermediate” levels of
personalization by varying $\lambda\in\\{0.1,0.5,0.9,1.0\\}$ from Eq. (4). We
experiment with rotation (top row) and translation (bottom row). The first two
columns report certified accuracy curves, while the third one shows the
associated the Average Certified Radius (ACR), i.e. area under the curves, as
a function of $\lambda$. The robustness of local models degrades, when they
diverge from the global model.

We first investigate the benefits of federated training on certified
robustness. To that regard, we use a rotation transformation and vary the
number of clients on which the dataset is distributed. We conduct experiments
with 4, 10, and 20 clients, and report the results in Figure 1. From these
results, we draw the following observations. (i) When the number of clients is
small (4 clients), i.e. when each client has large data, local training can be
sufficient for building a model that is accurate and robust. (ii) As the
number of clients increases, i.e. a typical scenario in FL, and the amount of
data available to each client is not large, federated averaging shines in
providing a model with better performance and robustness. In particular, we
find federated training can bring robustness improvements of over 20% in the
few-local-data regime (10 or 20 clients). This can be interpreted as follows:
when local data can sufficiently approximate the real-data distribution, then
there is no advantage to conducting federated training. On the other hand,
when local data is insufficient for approximating the data-distribution,
federated learning is useful. (iii) The performance and robustness of
personalized (fine-tuned) models are comparable to the global federated model.
We attribute this observation to the federated model being trained with data
augmentation, and thus converging to a reasonably-good local optimum. Hence,
personalizing this model with few epochs of local training would not have very
significant impact. We delve more into the benefits of personalization in the
next section. (iv) At last, we observe that, as the number of clients
increases, the performance difference between the best and worst performing
clients is significantly larger for local training. This is evidenced by the
spread in Figure 1, where the shaded area is notably larger for local
training.

### Is Personalization Beneficial for Robustness?

Next, we investigate the effect of personalization on certified robustness. In
essence, the experiments in Figure 1 assumed all clients train robustly,
aiming at collaboratively building a global robust model. However, in a more
realistic federated setup, this is not necessarily the case. For instance,
different clients could target robustness against different transformations
or, in the extreme case, some clients could disregard robustness entirely and
simply target accuracy.

To study this case, we use 10 clients and modify the averaging and
personalization phases as follows. During the federated training phase, all
models train without augmentations (i.e. targeting accuracy and disregarding
robustness). During the personalization phase, we augment data with the
transformation for which the client is interested in being robust against.
Experimentally, we personalize against pixel perturbations, rotations, and
translations, and report results in Figure 2. Our results show that
personalization has a significant impact on improving model robustness.
Moreover, this improvement is observed across the board, irrespective of the
choice of the augmentation or $\sigma$.

Next, we address the question: what if all other clients aim to build a model
robust against transformations that are different than the desired one? We
analyze the scenario when all clients train with an augmentation that differs
from the one a certain client desires. Thus, we deploy augmentation with
affine deformation (deformrs) during the federated training phase, and then
personalize with either rotation or translation. We report the results in
Figure 3 showing that personalization enhances the robustness even when
federated training is conducted with a different augmentation.

### Advantages of Personalization

Further, we address the following question: when is it better to robustly
train on local data than to do robust personalization (starting from a
nominally trained federated model)? We examine this question by comparing the
performance of a nominally trained federated model that is robustly
personalized (Figure 2) against local robust training. We display this
comparison in Figure 4. We observe the following: (i) When the target local
transformation is similar to the target federated one (small values of
$\sigma$), personalized models significantly outperform local models, despite
robust training only occurring in the personalization phase. That is, with far
less computation and much faster training111While our experiments used simple
data augmentation, practitioners may use more effective (and computationally
expensive (madry2018towards)) alternatives for robust training., federated
training with personalization offers a better alternative to training only on
local data. Furthermore, the performance gap increases with the number of
clients—equivalent to assigning each client fewer local data. (ii) As the
difference between the transformation in the federated and personalized
settings increases, the performance of personalized models becomes comparable
to that of their local counterparts. Note that this is an artifact of choosing
a relatively small number of clients, on which the dataset is distributed.
Indeed, in the appendix we report how a larger number of clients ($N=100$)
displays significant robustness improvements of personalized models compared
to local models.

### FL with Mixture Model

At last, we explore how using the mixture of models formulation in Eq. (4)
affects robustness of the resulting local models. Note that through all the
aforementioned experiments, we studied the case when $\lambda=1.0$ for local
training, or $\lambda=0.0$ for federated training. To this end, we compare the
performance of models trained with various values $\lambda\in(0,1)$, leading
to different personalization levels. That is, during local training, each
client is leveraging the update step in (5) before communicating the local
model to the orchestrating server for an averaging step.

Figure 5 plots the results of this experiment. The first two columns display
certified accuracy curves against rotation and translation for different
$\lambda$ values. The last column summarizes the results in terms of Average
Certified Radius (ACR), i.e. the average certified radius of correctly-
classified examples (Zhai2020MACER:). From these results we observe that: (i)
for every deformation (rotation, translation) and every $\sigma$ value, the
mixture of models formulation outperforms the robustness of standard federated
training. This phenomenon is consistent with almost any value of the
personalization parameter $\lambda$. In particular, we observe that setting
$\lambda=0.1$, corresponding to the least personalized local models, yields
the best results. (ii) By contrasting these results to Figure 4, we notice
that, across clients, the spread of certified accuracy is smaller than both
naïve personalization (via simple local fine-tuning) and local training.

## Conclusions

We analyzed the certified robustness of deep networks trained in a federated
learning setup. We found that federated averaging and personalization deliver
simple yet effective methods for providing models that are both more accurate
and robust than locally-trained models. At last, we examined the effect of
deploying a mixture of local and global models on certified robustness.


All-fiber, near-infrared, laser system at 780 nm for atom cooling

Matteo Marchesini1*,
Michelangelo Dondi1,
Leonardo Rossi2,
Gabriele Bolognini2,
Marco Prevedelli1, and
Francesco Minardi1

1 Dipartimento di Fisica e Astronomia, Alma Mater Studiorum Università di Bologna, 40127 Bologna, Italy

2 Consiglio Nazionale delle Ricerche, Istituto per la Microelettronica e i Microsistemi, 40129 Bologna, Italy

Cold neutral atoms are a promising “architecture” for novel and innovative quantum technology applications. These range from quantum sensors for magnetic fields, interferometers for gravimetry measurements, to quantum computing and simulations. Within this technological landscape, reliable laser systems are crucial in order to cool and manipulate atoms efficiently.
We present the design, experimental realization and characterization of a relatively simple, compact, and economical laser system for quantum technology applications. It operates at 780 nm in order to work with Rubidium atoms, and it is entirely based on fiber components. This improves its reliability, and makes it less complex and more versatile with respect to a free-space system.

In order to cut costs, we take advantage of already available commercial fiber devices at 1560 nm: due to their ubiquity in telecom applications they are in fact cheap and standardized. To operate at Rubidium wavelengths the system employs Second-Harmonic Generation (SHG) of the 1560 nm infrared radiation: two semiconductor lasers at 1560 nm (one for cooling, one for repumping) are combined, amplified in an Erbium-Doped Fiber Amplifier (EDFA), and frequency-doubled in a Periodically-Poled Lithium Niobate (PPLN) crystal.

We characterize the amplitude stability of the lasers, their frequency noise, and the SHG efficiency. The measured features (rms relative amplitude noise of 3$\times$10$^{-4}$ at 1 s; linewidths well below 1 MHz) make our system a suitable candidate for applications in quantum sensors and atom interferometers.

§ INTRODUCTION

Quantum technologies based on cold atoms call for integrated, reliable and robust experimental setups, in order to lead to commercial devices. Notable examples of quantum sensors are the atom interferometers [1] used as accelerometers [2, 3, 4], already marketed as gravimeteres [5] and gyroscopes [6, 7] where integration is paramount.

Among the key elements of all these setups and devices are the laser sources needed for atom cooling and manipulation. These sources should provide radiation with power of the order of several hundreds mW and spectral width of the order of 1 MHz. The workhorse of atom cooling is Rubidium (Rb), for which the cooling D2 transition $5\, ^{2}S_{1/2} \rightarrow 5\, ^2 P_{3/2}$ has a wavelength of 780 nm [8]. For Rb, a traditional approach is to employ semiconductor lasers, suitably narrowed in frequency, e.g. by means of an extended-cavity [9], and amplified with other semiconductor devices - such as tapered amplifiers - to make up for their typically low power.

Over the last years an alternative solution has been developed, taking advantage of the fact that 780 nm light can be obtained by second harmonic generation of 1560 nm infrared radiation [10]. Since 1560 nm lies within the C-band of fiber telecommunications, a panoply of commercial fibers devices (sources, splitters and combiners, polarizers, amplifiers, detectors …) is readily available, with well-characterized performances. Thus, the alternative solution is to process the laser beams in the infrared domain, and perform second-harmonic generation of 780 nm light at the very end. Several works have shown the advantages of this solution, capable of generating tens of watts at 780 nm [11, 12, 13], that naturally lends itself to integration with optical fibers.

In this paper, we describe the experimental realization of a simple, compact and relatively economic laser system for Rb atom cooling, comprising two sources at 1560 nm, differing in frequency by approximately 3 GHz, combined and amplified in the same Erbium-doped fiber amplifier (EDFA) and then frequency-doubled in a non-linear crystal with fiber input and output.

§ ARCHITECTURE DESCRIPTION

Sketch of the system architecture:  EDFA Erbium-doped-fiber-amplifier, SHG second-harmonic generation crystal, AOM acousto-optic modulator, OC optical combiner, PIN photodiode.

We describe the general architecture of the laser system, depicted in fig:setup and designed to meet the requirements for laser cooling and trapping  atoms in a magneto-optical trap. Two distinct laser frequencies are needed since the ground electronic level $5 ^2 S_{1/2}$ is split by hyperfine interactions in two sublevels, $|F=1\rangle$ and $ | F=2\rangle$, separated in energy by $\Delta E_{\rm HFS}/h = 6.83468$ GHz, that are both populated by collisions and by optical pumping. The two lasers, commonly referred to as "cooler" and "repumper", are usually imbalanced in power by one order of magnitude because most of the laser power is needed for the cooling transition $(F=2\rightarrow F'=3)$, while less power is sufficient for the repumping one $(F=2\rightarrow F'=2)$. For both lasers, and most notably for the cooler, the frequency agility - i.e. the possibility to perform frequency jumps and/or rapid sweeps of tens of MHz - is highly advantageous, because different stages of the laser cooling/trapping protocol require frequency (as well as amplitude) variations in the ms timescale.

We start with two semiconductor lasers at 1560 nm (Eblana EP-1550-0-NLW), with a nominal power of 5 mW – at the maximum current of 240 mA – and nominal Lorentzian linewidth of 150 kHz; actually the measured powers of the two lasers, that increase linearly with the injection current above the threshold value $I_{th} \simeq 33$ mA, are larger than the nominal value, being 5.7 and 7.5 mW already at injection current of 200 mA.

Both laser output fibers are connected to aMEMS switch (OF-LinkMEMS-1x2-PM-1560-M2-P-09-10-FA) and then to a 2 × 2 power combiner (OF-Link FPMC-1560-22-50-PM-L-10-FA-B). As we wish to amplify both lasers with the same polarization, we cannot use a 2 × 1 polarization power combiner, whereby two beams are combined into the same output port with orthogonal polarization. One output port of the combiner is relayed to an Erbium-doped fiber amplifier (EDFA), with a 30dB gain and a maximum output power of 5 W (Keopsys CEFA-C-PB-HP), while the other output port can be used for external monitoring of the seeds.
Power monitoring of the lasers is performed with a couple of photodiodes connected to the secondary exits of the MEMS.

The EDFA output is frequency-doubled by a second-harmonic-generation (SHG), periodically poled, lithium niobate (PPLN) crystal, with fiber input and output (NTT WH-0780-000-F-B-C). Since the maximum input power allowed in the PPLN crystal is only 500 mW, the EDFA output is split by a $1\times 2$, 50/50, polarization beam splitter/combiner (OF-Link HPMFC-1560-12-50-PM-L-10-FA-B-05)  and half power at 1560 nm is used for far off-resonant trapping of atoms.

The SHG converts more than 50% of the injected power, generating nearly 300 mW of light at 780 nm that are divided in a $1\times 2$, 10/90, polarization beam splitter (OF-Link FPMC-7800-12-10-PM-L-10-FA-B). Thus, 90% of 780 nm light is used for the three retroreflected beams of the magneto-optical trap, while the remaining 10% fraction goes for frequency stabilization, optical pumping and detection. The 90% port is relayed to an acousto-optic modulator (Aerodiode 780AOM-1), operating at 100 MHz, that is inserted for quick amplitude control of the MOT beams. Finally, the AOM output is fed to a $1\times3$ power splitter (OF-Link FPMC-7800-12-10-PM-L-10-FA-B) to generate three beams of equal power for the magneto-optical trap.

§ AMPLITUDE AND FREQUENCY NOISE AT 1560 NM

Here we report the amplitude and frequency noise characterization of our laser sources, starting from the seed lasers at 1560 nm. As a prelude, we present the noise measurement of our home-built current sources used to drive the seed lasers.

§.§ Current noise of laser driver

Power spectral density (PSD) of the current driving the seed lasers. Grey line: PSD calculated as FFT of scope trace; blue line: 256-points running average, smoothing the trace.

The current drivers are based on a well known circuit described
originally in [14] and upgraded to be digitally
controlled in [15]. They can provide up to 250 mA and
have a modulation input with a peak deviation of $\pm 1$ mA with a
bandwidth of about 200 kHz and are completely remote–controlled via
an I2C bus.

The current noise power spectral density (PSD) of the drivers has been
measured at 10 mA using a low noise transimpedance amplifier in the
10 Hz–500 kHz bandwidth by acquiring data in the time domain and
computing their FFT with a digital oscilloscope. The results are shown in fig:LDDnoise. The current noise
integrated in the above mentioned bandwidth amounts to about 74 nA
rms. In terms of laser amplitude noise, since the power increases with the driving current at a rate of 35/mA, the RMS current noise contributes to the RMS power noise by 2.6 nW, i.e. 0.5 ppm of our working power.

In general, the current noise is more relevant for the laser frequency noise. After converting the current PSD to the frequency PSD using the
measured tuning coefficient of 500 MHz/mA, the contribution of the current noise to laser linewidth has been evaluated by  the $\beta$–separation line
method, described in [16]: it amounts to 50 kHz, which is nearly negligible given the nominal linewidth of 150 kHz.

§.§ Seed laser RIN

Setup for intensity noise measurement:  ATT attenuator, OF optical filter, PIN photodiode, TIA transimpedence amplifier, OSA/ESA optical/electronic spectrum analyzer. The parts in bracket are present only for the measurements of the amplified radiation.

Calculated RIN based on the ESA traces for different values of the dc photocurrent, hence power; dashed lines indicate the RIN baseline due to shot-noise and Johnson thermal noise.

To measure the seed laser amplitude noise we use an InGaAs detector with FC/APC input receptacle (Thorlabs DET010CFC); the photodiode is inversely biased with an internal 5V voltage regulator, powered by a 12V battery, and it has a 1 resistor connected in series to the output. When followed by a transimpedance amplifier (TIA), the internal resistor is irrelevant for current-to-voltage conversion and merely limits the maximum photocurrent. Indeed, the detector output is fed to a TIA (Femto DLPCA-200) with variable current-to-voltage gain ($G$) and bandwidth, whose output is analyzed with a spectrum analyzer (Rigol  DSA875) or a digital oscilloscope (Rigol DS2302A). The measurement setup is shown in fig:RINMEAS, omitting the part within square brackets. The electrical spectrum analyzer (ESA) nominal range is 9 kHz to 1.5 GHz; at high frequency we are limited by the TIA bandwidth, below 9 kHz we Fourier-transform the digital oscilloscope trace.

Intensity noise fluctuations are quantified through relative intensity noise (RIN), which is defined as the Fourier transform of the optical intensity auto-correlation function $C_P (t,\tau)$:

\begin{align}
\mathrm{RIN} (f ) &=\int_{-\infty}^{+\infty} C_P(\tau ) e^{-i 2 \pi f \tau} d\tau \\
C_P (t,\tau) &= \frac{\langle \delta P_{\mathrm{opt}} (t) \delta P_{\mathrm{opt}} (t+\tau) \rangle}{\bar P_{\mathrm{opt}}^2}
\end{align}

where  $\bar P_{\mathrm{opt}}$
is the average of optical power, $\delta P_{\mathrm{opt}}(t) = P_{\mathrm{opt}}(t) - \bar P_{\mathrm{opt}}$ represents time-dependent power fluctuations and $\langle \rangle$ denotes the time average. With the usual assumption of time invariance, $C_P(t,\tau)$ depends only on the time difference $\tau$. Moreover, by definition $P_{\mathrm{rms}}^2~=~\bar P_{\mathrm{opt}}^2 C_P(0)$; thus:

\begin{align}
P_{\mathrm{rms}}^2 = \bar P_{\mathrm{opt}}^2 \int_{-\infty}^{+\infty}\mathrm{RIN} (f ) df.
\end{align}

RIN then yields the fractional contribution to the power variance of the fluctuations with Fourier frequencies contained in a small interval $[f, f+df]$, i.e. the spectral density of relative power fluctuations, usually expressed in dB units over 1 Hz bandwidth, i.e. [dB/Hz].

The reading of the ESA is related to the above defined RIN as follows:

\begin{align}
% &= V_{\mathrm{rms}}^2(f, B) /Z_\mathrm{in} \\
& = \frac{[G I_{\mathrm{rms}} (f,B)]^2}{Z_\mathrm{in}}
= \frac{G^2 I_\mathrm{dc}^2 B}{Z_\mathrm{in} } \mathrm{RIN} (f)
\end{align}

where $I_{\mathrm{rms}}^2(f,B)$ is the RMS of photocurrent fluctuations in the frequency interval of width $B$ centered at $f$, $I_\mathrm{dc}$ the dc photocurrent output by the detector, $G$ the transimpedance gain, and $Z_\mathrm{in}$ = 50  the ESA input impedance.

Thus, we have:

\begin{align}
\mathrm{RIN  [dB/Hz]} &= 10 \log_{10}[S(f) Z_\mathrm{in}/G^2 I_\mathrm{dc}^2 B ] \nonumber\\
&= S(f)\mathrm{[dBm]}-30 + 10 \log_{10}(Z_\mathrm{in}\mathrm{[\Omega]})  -10\log_{10}(B \mathrm{ [Hz]}) + \\
& \quad -20\log_{10}(G\mathrm{[\Omega]}) -20\log_{10}(I_\mathrm{dc}\mathrm{[A]}). \nonumber
\label{eq:RIN(5)}
\end{align}

In fig:YE4140, we show the corresponding RIN for one of the two seed lasers, namely Eblana YE4140, which is designed as Cooler. Different traces correspond to different values of the laser power, from slightly above the lasing threshold to nearly maximum, and correspondingly different values of the dc photocurrent $I_\mathrm{dc}$. We have verified that the other seed laser, Eblana YE4142, designed as Repumper, has similar traces.

When photocurrent fluctuations are solely due to shot-noise, i.e. $I_{\mathrm{rms}} (f,B)^2 = \sigma^2_{I,shot} = 2e I_\mathrm{dc} B$, then $\mathrm{RIN} = 2eB/I_\mathrm{dc}$. In addition, Johnson thermal noise on the internal resistor $R_L$ is to be taken into account, contributing to $I_{\mathrm{rms}}^2$ with $\sigma^2_{I,J} = 4 (k_B T/R_L) B$.
In our case the photodiode has a responsivity very close to 1 A/W, corresponding to a quantum efficiency of 0.8: at the largest supply current and power, the Johnson noise is negligible with respect to shot-noise, which amounts to 27 pA/$\sqrt{\si{\hertz}}$, and nearly accounts for the measured RIN [We neglect the TIA input current noise, with a nominal value of 0.13 pA/$\sqrt{\si{\hertz}}$.].

§.§ Seed laser frequency noise

PSD of the beat note signal generated by the seed lasers, calculated as the FFT of the digital scope time traces. A moving average over 101 point is applied upon the $y$ vector of 3601 points.

To characterize the frequency noise of our lasers, we perform a heterodyne measurement placing an InGaAs photodiode with integrated transimpedance amplifier (New Focus 1811-FC) on the unused output port of the 2 x 2 power combiner. A 20 dB power attenuator is necessary for the input light not to exceed the saturation power of 50. The detector has a nominal conversion of 40 kV/W and a bandwidth of 125 MHz. We adjust the temperature and driving current of the two laser to have their frequency difference approximately 19 MHz, well within the accepted bandwidth.

We observe the beatnote of the two sources by computing the FFT of time-domain traces acquired on a digital scope. We find this method more convenient than the use of an ESA because it allows a shorter interrogation time, shielding from the low frequency instabilities. We acquire traces of total length equal to 240 and compute the PSD of the photocurrent [8]:

\begin{align*}
PSD_i(\omega) &\propto \int_{-\infty}^\infty R(\tau) e^{i\omega \tau} d\tau \\
R(\tau ) &\equiv \langle E^*(t)E^*(t+\tau)E(t+\tau)E(t) \rangle \\
&= (|A_1|^2 + |A_2|^2 )^2 + |A_1|^2|A_2|^2  e^{-\frac12\langle \varphi_{12}^2 (\tau) \rangle}
\left( e^{i \Delta_{12}\tau } + \mathrm{c.c.} \right)
\end{align*}

with $E(t) = \sum_{j=1,2} A_j e^{i\omega_j t} e^{i\phi_j(t)}$, $\Delta_{12}~\equiv \omega_1 -\omega_2$ is the frequency difference and $\varphi_{12} (\tau)~\equiv~\phi_{12}(t+\tau) - \phi_{12}(t)$ and $\phi_{12}(t) = \phi_1(t) -\phi_2(t)$; clearly,

\begin{align}
\langle \varphi_{12}^2 (\tau) \rangle &= 2 C_{12}(0) - 2 C_{12}(\tau) \\
C_{12} (\tau) &\equiv \langle \phi_{12}(t) \phi_{12}(t+\tau) \rangle \nonumber
\end{align}

and, since for two independent sources the mutual phase correlations vanish,

\begin{align}
\label{eq:c12}
C_{12} (\tau) &= C_1(\tau) + C_2(\tau) .
\end{align}

The full-width at half-maximum (FWHM) of the lasers, hence of their beatnote, depends on the type of phase noise [16].  It can be shown that, in case of white frequency noise, $C_i(\tau) = C_i(0) - \gamma_i |\tau| \, (i=1,2)$, and $2\gamma_i$ are the FWHM of the Lorentzian-broadened PSD of the laser electric fields. In this case, Eq. <ref> shows that also the photocurrent PSD displays a Lorentzian peak at the beatnote frequency, with a FWHM equal to the sum of the lasers FWHM.
From fig:beat1560 we see that a Lorenzian fit is well suited to the detected beatnote photocurrent PSD and we obtain a HWHM of 193$\pm$1 kHz for each laser, close to the nominal value of 150 kHz.

§.§ Amplitude noise of EDFA output

at (0,0)
at (6.75,0)
at (-3,2.75) (a);
at (3.75,2.75) (b);

(a) Spectrum of the EDFA output signal, with an input power of 2 mW from the seed laser. (b) Zoomed-in spectrum of the amplified signal, in linear y-scale.

at (0,0)

at (6.75,0)

at (-3,2.75) (a);
at (3.75, 2.75) (b);

(a) RIN of EDFA output at different EDFA pump currents; for comparison, the RIN of the Cooler seed laser (YE4140) reported above is also shown; (b) RIN at low frequencies, as obtained from FFT of digital oscilloscope, below the ESA cut-off (10 kHz).

To assess the performance of the laser system, we have also characterized the amplitude noise of the amplified radiation delivered by the EDFA. The measurement setup is also shown in fig:RINMEAS, where the elements in square brackets are now included: we used a 20 dB attenuator (Thorlabs FA20T-APC, ATT in figure) to reduce the EDFA output power below the photodetector saturation value, i.e. photocurrent < 5mA. In addition, we inserted a tunable optical filter (Micron Optics FFP-TF, OF in figure) based on a Fabry-Pérot etalon, to filter out unwanted broadband amplified spontaneous emission (ASE), which is caused by the optical pumping within the Erbium doped fiber: indeed, a fraction of excited Er atoms
decay to their ground level by spontaneous emission, instead of stimulated emission, resulting in a broadband incoherent light spectrum that adds to the amplified seed light [17]. To evaluate the overall contribution of the ASE to the EDFA emission, the optical filter was removed, and the attenuated EDFA output was coupled into an optical spectrum analyzer (OSA, model EXFO FTB-5240S/BP). The resulting spectra are shown in fig:OSA. In particular, fig:OSA (a) reports the spectra of amplified laser source for different values of EDFA pump current; the observed ASE background noise has a broadband spectrum approximately centered around the signal wavelength of 1560 nm. At this specific wavelength, the ratio between the power of the amplified signal and the one of the ASE (signal-to-noise ratio of ASE - SNRASE, 0.1 nm resolution bandwidth), is 55 dB at all pump current values.

Integrating the spectra obtained in fig:OSA over a range from 1540 to 1580 nm, and taking into account the fact that the measurements were taken with a resolution bandwidth of 0.1 nm, we obtain a fractional ASE power of approximately 0.04%, indicating a small impact of ASE to the amplified light in all employed pump current conditions.

The EDFA output was also characterized in terms of RIN. The measurement set-up was  analogous to the one performed for the semiconductor laser, using the 99% branch in fig:RINMEAS and the photodetector and the process is identical to the one described in Subsection <ref>. As was done there, the RIN is extracted from the output of the ESA, normalized with respect to average power, gain and measurement bandwidth using Eq. <ref>.

fig:EDFA-RIN displays the RIN frequency spectra (in dB/Hz) of the EDFA output light vs frequency for different pump current values (red, purple and blue curves for current values of 1400, 1200 and 1000 mA respectively). These curves are compared with the RIN spectrum of the corresponding seed light (same as blue "2.71 mA" trace in fig:YE4140).
The results in fig:EDFA-RIN show that EDFA amplification adds significantly, i.e. up to 50 dB, to the intensity noise below $\sim  150$ kHz, while at higher frequencies the RIN of the amplified light and the RIN of to the seed light are similar. Such an increase in RIN after EDFA amplification  is expected:
actually the intensity noise of the amplified light is affected by a variety of different noise sources, especially at lower frequencies, with a significant contribution of the intensity noise of EDFA pump lasers [18]. Indeed, similar RIN profiles as the one shown in fig:EDFA-RIN were also found in earlier works with EDFA-amplified laser sources [19].

It is to note that the frequency range of RIN measurements above  is limited by the TIA bandwidth (200 kHz).
Although RIN values of amplified and non-amplified sources do not differ significantly beyond 150 kHz, as a further verification of the low-RIN behaviour beyond 200 kHz frequency, RIN measurements were repeated with a New Focus 1811-FC InGaAs photodiode, featuring an integrated TIA and a larger bandwidth (125 MHz). For frequencies beyond 200 kHz, it was found that the RIN values for both the seed laser and the EDFA output were similar, thus confirming that the EDFA only adds intensity noise for frequencies below 150 kHz.

§ SECOND-HARMONIC GENERATION

at (0,0)
at (6.75,0)
at (-3.2,2.75) (a);
at (3.75,2.75) (b);

(a) Normalized SHG power as a function of the measured resistance of the internal thermistor. The resistance-to-temperature conversion is provided by the manufacturer, according to the empirical equation $R = R_0 \exp(B/T - B/T_0)$, with $R_0=10$ k$\Omega$, $B=3456$ K, $T_0=317$ K; (b) 780 nm output power as a function of the 1560 nm input power, showing the non-linear conversion of the SHG, at the temperature of maximum conversion.

The light output of the amplifier is injected to a 1 x 2 fibered power splitter, and one of the two ouput port is connected to the input fiber of the second-harmonic generator, i.e. the periodically poled lithium niobate crystal with fiber input and output. The device is rated to accept a maximum injection power of 500 mW at the fundamental wavelength, which is at 1560 nm in our case.

Periodically-poling (PP) is greatly beneficial to ease the “phase-matching” constraints required for optimal wavelength conversion [20]. In a PP crystal, the “quasi phase-matching” condition is achieved when

\begin{align}
\left| \frac{2\pi}{\lambda_2} (n_1 - n_2) - m \frac{2 \pi}{\Lambda}  \right| \ll \frac1{L_c}
\end{align}

where $\lambda_2$ is the vacuum wavelength of the second harmonic, $\Lambda$ the poling period, $m$ an integer number (usually $\pm 1$), $L_c$ the crystal length, and $(n_1, n_2)$ are the refraction indexes for the fundamental and second harmonic waves, respectively.

Since $n_1 - n_2$ varies with temperature, thermal stabilization is required and it is actively enforced by a PI loop. The NTT device integrates both a thermistor to sense the crystal temperature and a Peltier cell. An home-made PI loop stabilizes the thermistor reading to within a few mK,
independently on the fundamental power injected, thus the temperature instability is well below the width of the peak in the SHG efficiency  versus temperature, equal to 2.4 K (FWHM), as shown in fig:SHGeff(a).

Also, $n_1 -n_2$ depends on the wavelength, thus quasi phase-matching temperature $T_Q$
changes with the fundamental wavelength $\lambda_1$, at a measured rate of $d T_Q/d\lambda_1 = -11$ K/nm. It follows that, at a given temperature, SHG filters the ASE in the fundamental power off a spectral window $ \Delta \lambda_1 \simeq 2.4/11 \simeq 0.2 $ nm.

At the peak temperature, we measured the SHG efficiency by varying the EDFA  output power $P_{1560}$ up to 25 dBm, i.e. approximately 0.32 W, where we reached a SH power $P_{780}$ of 93 mW. This amounts to a conversion efficiency $P_{780}/P_{1560} = 0.29$, which corresponds to a non-linear efficiency $\eta = P_{780}/P_{1560}^2 = 0.92$ W$^{-1}$. When the converted SH power is negligible with respect to input power ("undepleted pump regime"), we expect $\eta$ to be independent of $P_{1560}$. fig:SHGeff(b) shows that this is the case only for input power below $\sim 50$ mW, where we measured the non-linear conversion of approximately 2 W$^{-1}$ in agreement with the manufacturer specifications. In a previous set of measurements, we had increased the EDFA power to 0.5 W and obtained 0.27 W of SH at 780 nm. This level of power is perfectly adequate for a laser cooling experiment with Rb atoms, especially as we take into account that the light is output from a fiber, thus with a clean spatial mode. As a rule of thumb, for the light amplified by semiconductor tapered amplifiers (TA), which are commonplace in laser cooling experiments, the fiber injection efficiency is of the order of 50%.

§ FREQUENCY NOISE AND AMPLITUDE STABILITY AT 780 NM

Phase noise on the 1560nm-amplification and the SHG could increase the linewidth of the lasers, therefore it is advisable to repeat the heterodyne measurement also at 780 nm. In addition we measure the long-term amplitude and polarization stabilities.

§.§ Linewidth at 780 nm

at (0,0)
at (6.75,0)
at (-3,2.75) (a);
at (3.75,2.75) (b);

PSD of the beat notes calculated as the FFT of the digital scope time traces at: (a) $\Delta_{12}/(2\pi) \simeq  20$ MHz with half-width at half-maximum equal to 174 kHz; (b) $2\Delta_{12}/(2\pi) \simeq 40$ MHz, with half-width at half-maximum equal to 600 kHz. A moving average over 101 point is applied upon the $y$ vector of 9001 points; units are the same in the two panels.

To observe the beatnote after SHG, the InGaAS photodiode has been replaced with a Si photodetector (Hamamatsu G4176-03). The detector is biased with a 9V battery through a bias-tee (Minicircuits ZX85-12G-S+) that allows to feed the dc bias and extract the ac signal.

It must be noted that when the two fundamental frequencies are as close as $\Delta_{12} = 2\pi\times 20$ MHz, at 780 nm we observe not only the beatnote between the two frequency-doubled sources at $2\Delta_{12}$ but also a beatnote, actually stronger, at $\Delta_{12}$, as shown in fig:beat780.  Alongside SHG, sum-frequency generation (SFG) takes place, whereby two fields $(\omega_1, \omega_2)$ generate a field at the sum frequency $\omega_1+\omega_2$. The beatnote of the latter field with any of the two SHG beams generates a signal at frequency $\Delta_{12}$.
Indeed the complex amplitude of the field at 780 nm emitted by the non-linear crystal of the length $L$, $E_3(L,t)$, contains three frequency components [21]:

\begin{align*}
E_3(L,t) &= \frac{i\epsilon_0 \mu_0 \chi^{NL} L}{2 k_3}
\left[
4 \omega_1^2 |E_1|^2 e^{-i(2\omega_1 t + 2\phi_1)} +
4 \omega_2^2 |E_2|^2 e^{-i(2\omega_2 t + 2\phi_2)} + \right. \\
\quad + \left. 2 (\omega_1+\omega_2)^2 |E_1 E_2| e^{-i(\omega_1 t + \omega_2 t + \phi_1 + \phi_2)}
\right]
\end{align*}

where $\chi^{NL}$ is the relevant non-linear susceptibility and perfect quasi-phase matching is assumed for all conversions.

At 780 nm, the detector photocurrent PSD is

\begin{align*}
PSD_i(\omega) &\propto \int R(\tau) e^{i\omega \tau} d\tau
\end{align*}

\begin{align*}
R(\tau ) &\equiv \langle E_3^*(t)E_3^*(t+\tau)E_3(t+\tau)E_3(t) \rangle \\
& \propto  (|E_1|^4 + |E_2|^4 + 4 |E_1|^2|E_2|^2)^2 + \\
& \quad + |E_1|^4|E_2|^4 e^{-2\langle \varphi_{12}^2(\tau) \rangle}
\left( e^{i 2 \Delta_{12}\tau } + \mathrm{c.c.} \right) + \\
& \quad + 4|E_1|^2|E_2|^2 (|E_1|^2+|E_2|^2)^2 e^{-\frac12\langle \varphi_{12}^2 (\tau) \rangle}
\left( e^{i \Delta_{12}\tau } + \mathrm{c.c.} \right).
\end{align*}

Thus the $PSD_i$ component at $\omega=\Delta_{12}$ is expected to display the same broadening as the beatnote of the two input fields at 1560 nm, since both are due to the same phase noise factor
$\exp [-\langle \varphi_{12}^2 (\tau) \rangle/2]$.
From fig:beat780(a) we observe that the FWHM here is approximately the same as seen above, in Subsection <ref> and fig:beat1560, thus we conclude that the fields at SHG input have nearly the same frequency spectrum of the two seed sources, with no appreciable impact of the EDFA amplification.

As mentioned above, even for the beatnote at $\omega = 2\Delta_{12}$ the FWHM depends on the type of phase noise.  In case of white frequency noise, the FWHM of the component at $\omega=2\Delta_{12}$ is four times larger than the component at $\omega=\Delta_{12}$. This is in qualitative agreement with the observed FWHM$_{780}/$FWHM$_{1560}$ = 3.4.

We conclude that each beam at 780 nm has a linewidth of approximately 0.6 MHz, determined by the linewidth of the corresponding seed laser at the fundamental wavelength of 1560 nm.

§.§ Power and polarization stability

at (0,0)
at (6.75,0)
at (-3,2.75) (a);
at (3.75,2.75) (b);

(a) Normalized SHG power (red) and polarization angle (blue) as a function of time; (b) relative Allan deviations calculated from the acquired data.

Finally, we have measured the long-term stability of the SH power at 780 nm simply by reading the photodetector (Thorlabs PM400K3) with a sample rate of 1 s for approximately 3 hours. To assess any potential instability of polarization we have repeated the same measurement with the addition of a polarizer inserted between the fiber output and the photodetector.

After removing the data of the initial half-hour warm-up, we notice that, with and without the polarizer, the power is stable within $\sim 1\%$ [see fig:stability780(a)]. To be more quantitative, we show the fractional Allan deviations [fig:stability780(b)] that decrease with integration time $\tau$, as $\sigma_{y,P} \simeq \tau^{-0.7}$. No significant differences are visible due to the polarizer, thus we conclude that our measurement can only provide us with an upper bound for the polarization noise.

§ CONCLUSIONS

We have designed, implemented and characterized a laser system suitable for laser cooling of Rb atoms. The system is entirely realized with fiber components to ensure compactness and robustness, and to avoid the need of optical alignments. With the exception of the control electronics, we have employed all commercial components, taking advantage of the many available in the telecom spectral region around 1550 nm.

Two low-power semiconductor lasers at 1560 nm are combined and fed to a single commercial EDFA module. The amplified radiation undergoes SHG to 780 nm in a PPLN crystal. As a side effect, also SFG takes place and is significant. This represents a potential loss of power; even more importantly, this populates the spectrum of beatnotes observed at 780 nm and complicates the frequency stabilization of the sources (not described), achieved through the beat note signals with a third laser (reference) at 780 nm.

We have obtained up to 300 mW at 780 nm with a linewidth of 0.6 MHz, limited by the linewidth of the laser sources at 1560 nm, which is perfectly adequate for laser cooling of Rb, for which the D2 transition has a natural linewidth 10 times larger.

Funding is acknowledged through the project CRYST$^3$, under the European Union’s Horizon 2020 Research and Innovation programme, Grant Agreement No. 964531.

Disclosures The authors declare no conflicts of interest.

Data availability Data underlying the results presented in this paper are available in Ref. [22].

[1]
M. Kasevich and S. Chu, Atomic interferometry using stimulated raman transitions, Phys. Rev. Lett. 67, 181–184 (1991).

[2]
A. Peters, K. Chung, and S. Chu, High-precision gravity measurements using atom interferometry, Metrologia 38, 25 (2001).

[3]
V. Ménoret, P. Vermeulen, N. Le Moigne, S. Bonvalot, P. Bouyer, A. Landragin, and B. Desruelle, Gravity measurements below $10^{-9} g$ with a transportable absolute quantum gravimeter, Sci. Rep. 8, 12300 (2018).

[4]
B. Stray, A. Lamb, A. Kaushik, J. Vovrosh, A. Rodgers, J. Winch, F. Hayati, D. Boddice, A. Stabrawa, A. Niggebaum, M. Langlois, Y.-H. Lien, S. Lellouch, S. Roshanmanesh, K. Ridley, G. de Villiers, G. Brown, T. Cross, G. Tuckwell, A. Faramarzi, N. Metje, K. Bongs, and M. Holynski, Quantum sensing for gravity cartography, Nature 602, 590–594 (2022).

[5]
See iXBlue, <https://www.ixblue.com/quantum-gravimeter>;, AOSense, <https://aosense.com/products/atom-optic-sensors/gravimeter/>.

[6]
T. L. Gustavson, P. Bouyer, and M. A. Kasevich, Precision rotation measurements with an atom interferometer gyroscope, Phys. Rev. Lett. 78, 2046–2049 (1997).

[7]
Y.-J. Chen, A. Hansen, G. W. Hoth, E. Ivanov, B. Pelle, J. Kitching, and E. A. Donley, Single-source multiaxis cold-atom interferometer in a centimeter-scale cell, Phys. Rev. Appl. 12, 014019 (2019).

[8]
D. A. Steck, Quantum and Atom Optics (available online at http://steck.us/teaching, 2023).

[9]
L. Ricci, M. Weidemüller, T. Esslinger, A. Hemmerich, C. Zimmermann, V. Vuletic, W. Kijnig, and T. W. Hänsch, A compact grating-stabilized diode laser system for atomic physics, Optics Communications 117, 541–541 (1995).

[10]
R. J. Thompson, M. Tu, D. C. Aveline, N. Lundblad, and L. Maleki, High power single frequency 780nm laser source generated from frequency doubling of a seeded fiber amplifier in a cascade of ppln crystals, Opt. Express 11, 1709–1713 (2003).

[11]
S. S. Sané, S. Bennetts, J. E. Debs, C. C. N. Kuhn, G. D. McDonald, P. A. Altin, J. D. Close, and N. P. Robins, 11 W narrow linewidth laser source at 780nm for laser cooling and manipulation of rubidium, Opt. Express 20, 8915–8919 (2012).

[12]
J. Dong, X. Zeng, S. Cui, J. Zhou, and Y. Feng, More than 20 W fiber-based continuous-wave single frequency laser at 780 nm, Opt. Express 27, 35362–35367 (2019).

[13]
M. Kim, R. Notermans, C. Overstreet, J. Curti, P. Asenbaum, and M. A. Kasevich, 40 W, 780 nm laser system with compensated dual beam splitters for atom interferometry, Optics Letters 45, 6555–6558 (2020).

[14]
K. G. Libbrecht and J. L. Hall, A low-noise high‐speed diode laser current controller, Rev. Sci. Instrum. 64, 2133–2135 (1993).

[15]
C. J. Erickson, M. Van Zijll, G. Doermann, and D. G. Durfee, An ultrahigh stability, low-noise laser current driver with digital control, Rev. Sci. Instrum. 79, 073107 (2008).

[16]
G. Di Domenico, S. Schilt, and P. Thomann, Simple approach to the relation between laser frequency noise and laser line shape, Appl. Opt. 49, 4801–4807 (2010).

[17]
E. Desurvire, Erbium-Doped Fiber Amplifiers: Principles and Application (John Wiley and Sons, 2002).

[18]
H. T. A. W. Setiawan Putra, M. Yamada and S. Ambran, Theoretical analysis of noise in erbium doped fiber amplifier, IEEE J. Quantum Electron. 53, 1–8 (2017).

[19]
F. C. Cruz, D. L. M. Maser, T. Johnson, G. Ycas, A. Klose, F. R. Giorgetta, I. Coddington, and S. A. Diddams, Mid-infrared optical frequency combs based on difference frequency generation for molecular spectroscopy, Opt. Express 23, 26814–26824 (2015).

[20]
A. Yariv and P. Yeh, Photonics: Optical Electronics in Modern Communications (Oxford University Press, 2007).

[21]
R. Boyd, Contemporary Nonlinear Optics (Academic Press, 2012).

[22]
M. Marchesini, M. Dondi, L. Rossi, G. Bolognini, M. Prevedelli, and F. Minardi, All-fiber, near-infrared, laser system at 780 nm for1 atom cooling, Dataset in AMS Acta repository <https://amsacta.unibo.it/id/eprint/7651/>.