@inproceedings{22146,
  abstract     = {We study differentially private model training with stochastic gradient descent under learning rate scheduling and correlated noise. Although correlated noise, in particular via matrix factorizations, has been shown to improve accuracy, prior theoretical work focused primarily on the prefix-sum workload. That workload assumes a constant learning rate, whereas in practice learning rate schedules are widely used to accelerate training and improve convergence. We close this gap by deriving general upper and lower bounds for a broad class of learning rate schedules in both single- and multi-epoch settings. Building on these results, we propose a learning-rate-aware factorization that achieves improvements over prefix-sum factorizations under both MaxSE and MeanSE error metrics. Our theoretical analysis yields memory-efficient constructions suitable for practical deployment, and experiments on CIFAR-10 and IMDB datasets confirm that schedule-aware factorizations improve accuracy in private training.},
  author       = {Kalinin, Nikita and Andersson, Joel D},
  booktitle    = {7th Symposium on Foundations of Responsible Computing},
  isbn         = {9783959774192},
  issn         = {1868-8969},
  keywords     = {differential privacy, machine learning, matrix factorization},
  location     = {Cambridge, MA; United States},
  publisher    = {Schloss Dagstuhl - Leibniz-Zentrum für Informatik},
  title        = {{Learning rate scheduling with matrix factorization for private training}},
  doi          = {10.4230/LIPIcs.FORC.2026.2},
  volume       = {368},
  year         = {2026},
}

@phdthesis{21198,
  abstract     = {In recent years there has been a massive increase in the amount of data generated in a
decentralized manner. Ever more powerful edge devices, such as smartphones, have become
ubiquitous in most societies on earth. Through text typed, photos taken and apps used,
these devices, which we refer to as clients, generate enormous amounts of high quality and
complex data. Moreover, the nature of these devices means the data they generate is often
sensitive and privacy concerns prevent it being gathered and stored in a central location. This
presents a challenge to the modern machine learning paradigm that requires central access
to large amounts of data. Federated learning (FL) has emerged as one of the answers to
this problem. Rather than bringing the data to the model, FL sends the model to the data.
Model training takes place on device, with periodically synchronized updates, allowing data to
remain locally stored. While this approach offers significant privacy advantages it comes with
its own set of unique challenges. These include: data heterogeneity, the notion that different
devices generate data in distinct ways which can negatively impact training dynamics; systems
heterogeneity, meaning that different devices may have differing hardware specifications; high
communication costs, which are induced by the repeated transferring of models over the
network and low device computational power, which limits the use of larger models on device.
In this thesis we present a range of methods for federated learning. We focus primarily on
the challenge of data heterogeneity, though the methods presented are designed to be well
adapted to the other challenges of a federated setting, such as the constraints of limited
compute and communication overhead. We first present a method for explicitly modeling client
data heterogeneity. The approach formulates clients as samples from a certain probability
distribution and infers the parameters of this distribution from the available training clients.
This learned distribution then represents the heterogeneity present among the clients and can
be sampled from in order to create new simulated clients that are similar to the real clients we
have observed so far. Following this we present two methods for directly dealing with data
heterogeneity through personalization. Highly heterogeneous client data distributions can mean
that learning a single global model becomes suboptimal, and some form of personalization of
models to each individual client is required. Our approaches are based around hypernetworks,
which we use to generate personalized model parameters without the need for additional
training or finetuning. In the first approach we focus on generating full parameterizations of
client models using learned embeddings of client data and labels, with a hypernetwork located
on the central server. In the second approach we address the more challenging scenario where
we want to generate a personalized model for a client without any label information. The
hypernetwork is trained to generate a low dimensional representation of a client’s personalized
model parameters, allowing it to be transferred to and run on the client devices. In our final
presented method, we change our focus and rather than aim to directly address the challenge
of data heterogeneity, we instead ensure we are unaffected by it. This is done in the context
of k-means clustering and we present a method for federated clustering with a focus on added
privacy guarantees.},
  author       = {Scott, Jonathan A},
  issn         = {2663-337X},
  pages        = {158},
  publisher    = {Institute of Science and Technology Austria},
  title        = {{Data heterogeneity and personalization in federated learning}},
  doi          = {10.15479/AT-ISTA-21198},
  year         = {2026},
}

@inproceedings{20296,
  abstract     = {Learning-based systems are increasingly deployed across various domains, yet the complexity of traditional neural networks poses significant challenges for formal verification. Unlike conventional neural networks, learned Logic Gate Networks (LGNs) replace multiplications with Boolean logic gates, yielding a sparse, netlist-like architecture that is inherently more amenable to symbolic verification, while still delivering promising performance. In this paper, we introduce a SAT encoding for verifying global robustness and fairness in LGNs. We evaluate our method on five benchmark datasets, including a newly constructed 5-class variant, and find that LGNs are both verification-friendly and maintain strong predictive performance.},
  author       = {Kresse, Fabian and Yu, Zhengqi and Lampert, Christoph and Henzinger, Thomas A},
  booktitle    = {2nd International Conferenceon Neuro-Symbolic Systems},
  issn         = {2640-3498},
  location     = {Philadephia, PA, United States},
  publisher    = {ML Research Press},
  title        = {{Logic gate neural networks are good for verification}},
  volume       = {288},
  year         = {2025},
}

@inproceedings{20819,
  abstract     = {Clustering is a cornerstone of data analysis that is particularly suited to identifying coherent subgroups or substructures in unlabeled data, as are generated continuously in large amounts these days. However, in many cases traditional clustering methods are not applicable, because data are increasingly being produced and stored in a distributed way, e.g. on edge devices, and privacy concerns prevent it from being transferred to a central server. To address this challenge, we present FedDP-KMeans, a new algorithm for 
-means clustering that is fully-federated as well as differentially private. Our approach leverages (potentially small and out-of-distribution) server-side data to overcome the primary challenge of differentially private clustering methods: the need for a good initialization. Combining our initialization with a simple federated DP-Lloyds algorithm we obtain an algorithm that achieves excellent results on synthetic and real-world benchmark tasks. We also provide a theoretical analysis of our method that provides bounds on the convergence speed and cluster identification success.},
  author       = {Scott, Jonathan A and Lampert, Christoph and Saulpic, David},
  booktitle    = {42nd International Conference on Machine Learning},
  issn         = {2640-3498},
  location     = {Vancouver, Canada},
  pages        = {53757--53790},
  publisher    = {ML Research Press},
  title        = {{Differentially private federated k-means clustering with server-side data}},
  volume       = {267},
  year         = {2025},
}

@inproceedings{22828,
  abstract     = {We propose Joint Moment Estimation (JME), a method for continually and privately estimating both the first and second moments of a data stream with reduced noise compared to naive approaches. JME supports the matrix mechanism and exploits a joint sensitivity analysis to identify a privacy regime in which the second-moment estimation incurs no additional privacy cost, thereby improving accuracy while maintaining privacy. We demonstrate JME’s effectiveness in two applications: estimating the running mean and covariance matrix for Gaussian density estimation and model training with DP-Adam.},
  author       = {Kalinin, Nikita and Upadhyay, Jalaj and Lampert, Christoph},
  booktitle    = {Advances in Neural Information Processing Systems},
  isbn         = {9798331338275},
  issn         = {1049-5258},
  location     = {San Diego, CA, United States},
  pages        = {64002--64047},
  publisher    = {Neural Information Processing Systems Foundation},
  title        = {{Continual release moment estimation with differential privacy}},
  doi          = {10.52202/085713-1924},
  volume       = {38},
  year         = {2025},
}

@inproceedings{22823,
  abstract     = {This position paper argues that setting the privacy budget in differential privacy should not be viewed as an important limitation of differential privacy compared to alternative methods for privacy-preserving machine learning. The so-called problem of interpreting the privacy budget is often presented as a major hindrance to the wider adoption of differential privacy in real-world deployments and is sometimes used to promote alternative mitigation techniques for data protection. We believe this misleads decision-makers into choosing unsafe methods. We argue that the difficulty in interpreting privacy budgets does not stem from the definition of differential privacy itself, but from the intrinsic difficulty of estimating privacy risks in context, a challenge that any rigorous method for privacy risk assessment face. Moreover, we claim that any sound method for estimating privacy risks should, given the current state of research, be expressible within the differential privacy framework or justify why it cannot.},
  author       = {Cyffers, Edwige Audrey Lucienne},
  booktitle    = {39th Conference on Neural Information Processing Systems},
  isbn         = {9798331338275},
  issn         = {1049-5258},
  location     = {San Diego, CA, United States},
  pages        = {159016--159028},
  publisher    = {Neural Information Processing Systems Foundation},
  title        = {{Setting ε is not the issue in differential privacy}},
  doi          = {10.52202/085713-4798},
  volume       = {38},
  year         = {2025},
}