Federated Learning with Differential Privacy for End-to-End Speech Recognition

We thank Reviewer Jahb for their time and feedback. Please find below our comments:

In Table 2, the authors hypothetically scale the number of users to ~6.9M.

We would like to scale to 7M speakers (which is a practical number for mid-resource languages), however we are not aware of any publicly available ASR dataset of that scale. In practice, if we have 2.5 min per user (like in CV) and 7M users total, training of our model for central simulation of FL with 1024 GPUs, cohort size of 200k, and 2k central steps would take 10 days (see Table below for the training we have run for CV).

In fact, training depends on cohort size and central iterations, but not the population size.

This is hard to achieve even in a central setting, and will be even harder considering the implementation challenges in the FL setting. Therefore, it is not clear whether the findings have practical meaning.

We would like to highlight that prior works, e.g. Mike Chatzidakis et.al. (2023), Learning iconic scenes with differential privacy, https://machinelearning.apple.com/research/scenes-differential-privacy, and Xu et al. (2023), Federated Learning of Gboard Language Models with Differential Privacy, showed i) it is realistic to have millions of users to participate in FL and ii) use a large cohort size of 150k in FL deployments. Indeed, practical deployments of PFL described in those works work at that scale.

We acknowledge that there are additional challenges such as communication cost that need to be addressed for successful deployment of the proposed ASR FL+DP, and believe that further research on the problem will help alleviate this issue. In this paper, we focus on understanding limitations of large-scale ASR in FL and FL+DP with e.g. practical i) central number of steps; ii) data distribution per user; iii) out-of-domain shift.

The seed model in Table 2 is only pre-trained on LS-100, whose size is more than 10 times smaller than the fine-tuning dataset. Why use such a small pre-training dataset? Recent work in this area shows that private learning significantly benefits from better pre-trained models, e.g., see [1] and the references therein. The authors may want to explore pre-training the model on increasingly large datasets, e.g., from LS-100 to LS-960, and see whether better pre-trained models help private training of ASR models.

We use LS-100 for seed model training to simulate practical scenario where i) central data are an order of magnitude smaller (16x in our case) than federated data; ii) central data are of reasonable size for mid-resource languages as labeling process is expensive.

At the same time, we did ablation with LS-960 seed model in Appendix D.5, Table 18. We have run more ablations on DP, see Table below. Overall, results are similar to LS-100 seed model and per-layer clipping improves WER significantly for the same DP guarantees. However, indeed, the DP noise can be increased by 3x ($30\cdot 10^{-8}$ instead of $10\cdot 10^{-8}$) with similar 30% relative WER degradation (17.8% w/o DP drops to 22.2% with DP): then in theory, we can use 50k cohort size and 2M population for practical DP guarantees ($\epsilon=6.5$). Though, it could be due to 1:1 proportion between central and federated data, which is less realistic scenario.

He et al., 2023 [2] also use pre-layer clipping, although their focus is NLP tasks. They also observe the difference in gradient norms of different transformer layers. However, they show that per-layer clipping only achieves comparable or slightly better results compared to global clipping. It would be interesting to the community if the authors could explain why per-layer clipping is much more important in the training of ASR models.

Thanks for the pointer! Also original work of McMahan et al. (2018) showed that per-layer clipping achieves similar results as global clipping (see discussion in Section 3). For ASR:

• We study it in detail and observe different behaviour in Appendices D.5 and D.6 where we exclude different confound factors, like speech language, seed models, optimizers, gradient clipping, DP, federated training. We observe that imbalanced gradients occur already in central training and depend on the speech language: they occur for English but not for German and French.
• We attribute it to the complexity of the language / data, and central training has a similar behavior to FL and FL + DP.

We would like to highlight

• Our architecture is encoder-based trained with a sequence loss (CTC), while in the pointed work it is decoder-based (causal) with cross-entropy loss for NLP which makes models totally different for optimization.
• Tables 3, 4 of He et al., 2023 shows that, per-layer clipping significantly improves results for GLUE tasks for some settings.
• Moreover, He et al., 2023 fine-tunes pretrained model for the downstream task with another objective, while in ASR we keep it the same.

We thank Reviewer JcFR for recognition the quality of our paper and comprehensive experiments we did, their time and feedback. Please find below our comments:

It is not clear to me how user-level DP is defined in this work. What is a user with respect to data (e.g. is user - collection of all records with the same ‘author’ or something entirely different?) In fact I could not fully grasp how the number of users go from 50k users to 1M for N? Additionally, how do you split the data such that it is realistic i.e. so that a user does not have data which is entirely random/disjoint?

Yes, we consider all audio recordings from the same speaker as one user. For both LS and CV, speaker id is an additional meta information provided in the datasets which we use to group the audio data per speaker (=user).

With user-level DP, the DP guarantee defines the bounds on how much the model can change if we took any user (all data of this user) out of the dataset. To achieve meaningful privacy guarantees when training large models, it is important to work with a large enough population of users. Since CV and LS datasets are not large enough (up to 40K users), we theoretically extrapolated the privacy bounds to assess how much the privacy guarantees would change if the dataset had e.g. 1M users similar to McMahan et al., 2018.

Cross-device FL: is it sync/async? What are the implications?

We use cross-device FL as described in Algorithm 1 (thus, sync). In each iteration, we randomly sample a cohort of users of specified size, and then wait for all users to finish the training and send model updates, which are then aggregated at the server to update the central model. In a live deployment, each device would typically decide to participate with a given probability and one would typically have to wait for a sufficient number of clients to share model updates until the aggregation can start. Async FL introduces additional level of complexity, is not naturally compatible with differential privacy in the federated setting, and may be considered in the future work.

Data splitting: is there an overlap for LS-960? Since the datasets are combined, how do you ensure that the clients are not accounted from twice from privacy budget perspective How do you ensure a representative data distribution across train-val-test? It was not covered in the dataset description, I am uncertain if your client distribution at test is necessarily similar to the one at test time

Thanks for the great question! Every split of LS and CV has a separate set of speakers, and validation and test sets also have entirely different speakers from the train. E.g. train-clean-100 and train-clean-360 have a disjoint set of speakers. For LS, dev/test set has 5h with mean of ~8min and std 0.1min for the total duration per user. For CV, dev/test set has ~30h with mean ~15s and std 1.5s for the total duration per user. Thus validation and test data has homogeneous distribution which weights users equally for evaluation. For both datasets we use original validation and test sets, without any modification. Thus, the disjoint set of speakers in different splits and disjoint set of speakers in seed model and FL training ensure that clients are not accounted for twice in privacy budget.

Comment on norm layers: these are indeed harder in FL, but I did not find any discussion on this (maybe worth adding how the choice of norm layers affects FL performance in the appendix?)

Yes, we have some discussion in Appendix C.2 and some results in Table 7. Let us know if this clarifies the main text and discussion on complexity of post-LN training.

Seed models improve results: this is expected, the domain shift result is, however, interesting, but also not unusual (if by seed I have correctly interpreted pre-trained models, often on different datasets of the same modality).

Yes, that is correct. What was surprising to us is that domain shift didn’t have much effect on the final model performance.

In contrast, Hsu, et.al. Robust wav2vec 2.0: Analyzing domain shift in self-supervised pre-training, Interspeech 2021 showed that domain mismatch affects the final results for SSL pretraining and Chan, et.al. SpeechStew: Simply Mix All Available Speech Recognition Data to Train One Large Neural Network showed that pretraining on diverse data is helpful, but does not resolve domain shift entirely in ASR.

Another difference with prior works is that we have smaller (# of hours) pre-training dataset that is enough to use for the seed model training and does not affect the final WER. In practice, central data in FL are typically manually curated (possibly public) datasets of smaller size and of different distribution than FL data.

We thank Reviewer 4uMy for recognition the quality of our work, their time and feedback. Please find below our comments.

Originality. This paper proposes to apply DP-federated learning to the ASR task, which has not been done before. However, DP for federated learning has already been done long ago, and this work only tests the algorithm on the data instead of improving the frame. Maybe there is a small originality but it’s not enough for ICLR.

We refer to the general response to all reviewers.

Clarify. The content and structure of the article are relatively comprehensive. However, the experiment logic may not be very clear. For example, from the algorithm pseudocode, it appears that this article only combines DP (Differential Privacy) and FedAvg (Federated Averaging). Yet, later in the text, there is an experimental analysis of Scaffold and FedProx, showing that FedProx yields the best results. So, what is the significance of exploring data heterogeneity? The article could benefit from providing a more explicit and coherent explanation of the rationale for the experimental choices and their implications for understanding data heterogeneity.

Thanks for the feedback! We list only final simplest version in Algorithm 1, which throughout the paper we demonstrate is enough to tackle the data heterogeneity for ASR task with proper combination of hyper-parameters and adaptive optimizer. We discuss other techniques, like scaffold and fedprox, as ablations and show consistent results that for large ASR models adaptive optimizers resolve data heterogeneity issue as opposite to prior works. See details e.g. in Appendix C.3 and C.6.

Significance. Well this work is the first to combine federated learning with differential privacy in the ASR (Automatic Speech Recognition) field, which can be considered pioneering. The choice of this application direction is valid, but it appears that the level of innovation is relatively limited, which might diminish its overall importance.

Our main contributions are:

• via empirical analysis we show inconsistent results with respect to prior works on FL, FL+DP, and FL specifically for ASR, e.g. (1) data heterogeneity does not prevent FL from finding competitive models when using adaptive optimizers even for simple FedAvg; (2) FL for ASR can train competitive ASR models even (a) from scratch unlike prior works or (b) using a seed model trained on out-of-domain data; and (3) per-layer clipping provides a significant performance boost for FL+DP in ASR.
• to the best of our knowledge, we are the first to successfully train FL / FL + DP ASR model with simplest known algorithm (FedAvg + gaussian moments accountant) and practical settings (2k central steps, realistic data distribution, out-of-domain central data).

We truly think that our empirical observations and new benchmark has their place at ICLR to contribute to community knowledge and foster development of general FL and FL + DP algorithms generalizable across domains including ASR.

The level of innovation in this paper is insufficient, not absent but lacking. The combination of federated learning and differential privacy is something that has been explored before, as mentioned in your paper. I suggest further research to discover if there is a federated learning algorithm specifically suited for ASR.

ICLR is a highly prestigious conference, and you need to enhance the innovation of your paper in terms of algorithms. The paper lacks innovation in terms of algorithms.

Given the prior works on FL for ASR, it would indeed seem to be necessary to develop new FL algorithms to successfully tackle ASR with FL (see Section 2). However, we show empirically that this is unnecessary and with the right combination of existing simple (e.g. FedAvg) components which we analyze in depth, FL and FL+DP is capable of finding competitive ASR models in many scenarios.

The logical relationships between experiments are not clear, and there is a weak connection between the models involved in the experiments and the models proposed in paper.

Could Reviewer clarify this statement and be concrete about particular experiments and models?