REVIEW 4 major objections 4 minor 44 references
Strategic Incentivization for Locally Differentially Private Federated Learning
T0 review · 4 major / 4 minor · reviewed 2026-08-05 · deepseek-v4-flash
Pith's one-line read Token pricing can force every federated client to choose the server's desired privacy level.
desk verdict A clean little mechanism-design result that mostly delivers on its claims, but the headline no-cost-knowledge selling point rests on an untested assumption that needs an empirical check. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The token freshness scheme with forced eviction: tokens awarded by a strictly monotone reward function $f(\epsilon)$ expire after $n$ rounds and the global model costs $C$ tokens, with $f(\epsilon_a)=C/n$. This makes "not enough tokens" a binding constraint that rules out $\epsilon<\epsilon_a$ and converts the privacy-cost monotonicity into a Nash equilibrium at $\epsilon_a$. The improved group variant replaces the participation interval $n$ with the group rotation period $G$, making the value gain over $G$ rounds large enough to keep clients participating.
What would settle it
Run federated learning with 3 clients on a disjoint split of MNIST, set all clients at $\epsilon_a=15$, then let one client unilaterally switch to $\epsilon=25$ while keeping token prices and expiry fixed. If the global model's accuracy over the next rounds improves (or stays equal) and that client's utility gain from $V_i(t)$ exceeds the extra privacy cost, then all-clients-$\epsilon_a$ is not a Nash equilibrium and Lemma 1 fails.
Extended reading notes
Core claim
The paper's discovery is a mechanism-design result: the server publishes a strictly increasing token reward $f(\epsilon)$, charges $C$ tokens for the global model, and expires tokens after $n$ rounds, setting $f(\epsilon_a)=C/n$. Any $\epsilon<\epsilon_a$ yields too few tokens and forced eviction; any $\epsilon>\epsilon_a$ costs more privacy with, by assumption, no gain in model value $V_i(t)$. Lemma 1 concludes every participating client chooses $\epsilon=\epsilon_a$, and all-$\epsilon_a$ is a Nash equilibrium. The server's only remaining choice is the smallest $\epsilon_a$ that avoids training collapse, found empirically (collapse at $\epsilon=25,17$, not at $15$ on MNIST). Grouping client
Load-bearing premise
The argument assumes a single client's noise level does not change the value of the global model for any client, so no one gains by sending less noisy gradients.
Editorial extensions
If this is right
- A server can implement the mechanism without knowing clients' privacy costs; only an empirical choice of $\epsilon_a$ and the token parameters are required.
- All participating clients converge to the same privacy level $\epsilon_a$, giving the server uniform-quality updates and avoiding the scattered participation seen in the non-strategic baseline.
- Choosing $n=1$ (token expiry every round) is optimal when all clients participate every round; grouping clients into $G$ groups makes clients willing to participate longer because the value gain is measured over $G$ rounds.
- If $\epsilon_a$ is set below the empirical collapse threshold, training persists for all rounds; above it, clients are evicted and accuracy collapses.
- The grouping mechanism prevents collapse in cases where individual participation fails, as shown for $\epsilon=20$ with MNIST and $\epsilon=25$ with CIFAR10.
Reading between the lines
- The Nash-equilibrium claim rests on the assumption that one client's $\epsilon$ cannot change $V_i(t)$; with small client pools (3 or 10), a deviator's less noisy gradient is a substantial fraction of the aggregate, so a testable check is to measure whether global accuracy rises when a single client raises $\epsilon$ above $\epsilon_a$.
- The mechanism assumes clients honestly report the $\epsilon$ they used; since tokens have no monetary value, the paper argues lying is not strategic, but a malicious client could over-report $\epsilon$ to earn tokens and still send a noisy gradient, which would break the pricing.
- The empirical $\epsilon_a$ is dataset- and client-count-dependent (MNIST collapses at 17, CIFAR10 at 20), so the server's 'empirical choice' is not a fixed constant; a practical deployment would need an online rule to detect imminent collapse.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes a token-based incentive mechanism for cross-silo locally differentially private federated learning. A server publishes a token reward function f(epsilon) and charges C tokens for each global model update; tokens expire after n rounds. Lemma 1 claims that any participating client chooses the acceptable privacy level epsilon_a: a lower epsilon yields insufficient tokens and forced eviction, while a higher epsilon increases privacy cost without improving the global model's value. The server is thereby said to extract epsilon_a without knowing client costs. Experiments on MNIST and CIFAR10 study participation, accuracy, and training collapse, and compare against the SBTLF baseline.
Significance. If Lemma 1 held in practice, the mechanism would be an elegant non-monetary way to align client privacy choices with server accuracy goals in cross-silo FL, avoiding monetary payments and client cost knowledge. The token-expiry design is simple and the proof is clean under the stated assumption. However, the load-bearing assumption that a single client cannot affect the global model value is precisely where small-client FL is fragile, and the experimental evaluation does not independently validate it. The current evidence is not sufficient to establish the advertised cost-free extraction guarantee or the claimed improvement over the baseline.
major comments (4)
- [§IV-B, Lemma 1 in §IV-C2] The proof of Lemma 1 rules out unilateral deviations to epsilon > epsilon_a only by invoking the §IV-B assumption that Vi(t) does not change if a single client increases its epsilon. This assumption is not a theorem and is not tested. In the FedAvg update (Eq. 5) with K=3 or K=10 and disjoint/intermediary data (§V-B, Figs. 4–6), one client's gradient is a substantial fraction of the aggregate; a less-noisy update from a deviator can change the global model and hence Vi(t) for all clients. If that value gain exceeds ci(epsilon) - ci(epsilon_a), the deviation is strictly profitable and epsilon_a is not a Nash equilibrium. Since Lemma 1 is the basis for the claimed cost-free extraction of epsilon_a, this is a load-bearing gap. Please provide an explicit empirical check (e.g., measure the utility of a unilateral deviator in the K=3/K=10 setups) or a formal condition on K, gradient norms, and
- [§V-D, Eqs. (6)–(8), Figs. 3–5] The choice epsilon_a = 15 and the 'training collapse' results are not independent of the model. The utility in Fig. 3 is computed from the authors' chosen V(n) (Eq. 6) and c(epsilon) (Eq. 7), and the collapse in Figs. 4–5 is diagnosed by this same utility becoming negative ('this happens because their utility becomes negative'). Thus the finding that training does not collapse at epsilon = 15 is partly by construction: the authors picked epsilon_a from this utility curve and then used the same utility to define collapse. A de-circularized evaluation should report measured global-model accuracy over rounds for fixed epsilon values without filtering through V/c, and should include sensitivity analysis over V/c choices.
- [§V-E, Figs. 1 and 5] The headline comparison against the SBTLF baseline is confounded. The baseline run (Fig. 1b) uses intermediary data distribution (§V-C) and heterogeneous per-client epsilon values (25, 23, ..., 1), while the proposed-mechanism run (Fig. 5c) uses disjoint distribution with uniform epsilon = 15 (§V-D). Differences in accuracy and participation can therefore be attributed to data distribution and privacy-level assignment rather than to the mechanism itself. The comparison should be redone on the same data distribution and with matched privacy levels, or with the baseline using the same heterogeneous epsilon profile that the proposed mechanism is intended to replace.
- [§V-D, Eqs. (7)–(8)] Numerical values for key mechanism parameters are missing: cmin, cmax, epsilon_max, epsilon_min, C, and n are never specified, and G is also unspecified for the grouped mechanism. Eq. (7) and Eq. (8) are therefore not reproducible, and Fig. 3 cannot be regenerated from the information in the paper. The threshold epsilon_a = 15 depends on these values, so the central experimental claim cannot be checked. Please include the exact parameter settings used for all experiments.
minor comments (4)
- [§V-C] The text says 'the client with the highest privacy level (epsilon = 25)'. Higher epsilon means less privacy in LDP; the client with epsilon = 25 has the lowest privacy level. Please correct the terminology.
- [§III Step 4 vs §IV-A] Section III Step 4 states that 'the same client can use a different epsilon in the different rounds it participates,' while Section IV-A requires clients to commit to an epsilon 'same in every round.' These are inconsistent. Lemma 1's proof assumes a fixed epsilon; please clarify the action space.
- [§IV-C2] The Nash equilibrium proof considers only deviations to epsilon > epsilon_a. A deviation to non-participation is not analyzed; the statement 'no participation yields 0 rewards' is asserted but participation in the mechanism may yield negative utility for some clients. Please clarify whether participation is assumed or is itself an action in the game.
- [Appendix, CIFAR10] For CIFAR10, the text says at epsilon = 20 'utility drops below zero at the very end of the training process,' yet Figure 9(b) labels this case as 'collapse after most delay.' Please clarify whether a late negative-utility event is considered a collapse and how the threshold is defined.
Circularity Check
No significant circularity: the equilibrium claim is a theorem under stated assumptions, not a reduction to the mechanism's definition.
full rationale
The paper's central derivation is Lemma 1, which argues that participating clients choose ϵa because (i) ϵ < ϵa yields insufficient tokens to buy the global model under the expiry rule, and (ii) ϵ > ϵa costs more privacy with no additional model value under the explicit assumption that a single client's ϵ does not affect Vi(t). Step (i) is a designed property of the mechanism (f(ϵa)=C/n and n-round expiry), but designing a mechanism so that a desired action is feasible is not circular: the equilibrium conclusion also requires step (ii), which is an empirical/behavioral assumption rather than an input equivalent to the conclusion. If that assumption fails, Lemma 1 is wrong, but that is a correctness risk, not circular reasoning. The paper's choice of ϵa=15 in experiments is presented as an empirical calibration using chosen V and c, not as a first-principles prediction; the server-side claim 'without any information about payoffs and costs' is thus overstated relative to the simulations, but the game-theoretic extraction result does not mathematically depend on the specific fitted value. There are no self-citations or imported uniqueness theorems. The experimental validation also fixes ϵ in the collapse experiments rather than letting clients choose, so it does not directly test the strategic claim; again, this is an experimental limitation, not circularity.
Assumptions & free parameters
free parameters (6)
- epsilon_a (acceptable privacy level) =
15 (both MNIST and CIFAR10)
- C (token price for global model) =
unspecified in experimental details
- n (freshness window) =
1 (from analysis)
- value function parameters =
V(n)=30(log(n+1))^2.8/(1+0.15(log(n+1))^1.5)
- cost function parameters (cmin, cmax) =
not specified
- reward function parameters (epsilon_min, epsilon_max) =
not specified
assumptions (5)
- ad hoc to paper Clients are non-malicious and will not misreport their chosen epsilon to the server.
- ad hoc to paper A single client's epsilon choice does not affect the global model value Vi(t).
- domain assumption Global model value Vi(t) has diminishing returns and is non-decreasing.
- domain assumption The server can enforce that clients use a global model from within the last n rounds and that tokens expire.
- standard math Standard definitions of LDP and Nash equilibrium.
invented entities (1)
-
Token currency
Cite this review
Pith. "Pith review of Strategic Incentivization for Locally Differentially Private Federated Learning." pith.science (2026). https://pith.science/paper/SZJV4U5Y
@misc{pith2026250807138,
author = {Pith},
title = {Pith review of: Strategic Incentivization for Locally Differentially Private Federated Learning},
year = {2026},
howpublished = {\url{https://pith.science/paper/SZJV4U5Y}},
note = {Machine review of arXiv:2508.07138}
}
read the original abstract
In Federated Learning (FL), multiple clients jointly train a machine learning model by sharing gradient information, instead of raw data, with a server over multiple rounds. To address the possibility of information leakage in spite of sharing only the gradients, Local Differential Privacy (LDP) is often used. In LDP, clients add a selective amount of noise to the gradients before sending the same to the server. Although such noise addition protects the privacy of clients, it leads to a degradation in global model accuracy. In this paper, we model this privacy-accuracy trade-off as a game, where the sever incentivizes the clients to add a lower degree of noise for achieving higher accuracy, while the clients attempt to preserve their privacy at the cost of a potential loss in accuracy. A token based incentivization mechanism is introduced in which the quantum of tokens credited to a client in an FL round is a function of the degree of perturbation of its gradients. The client can later access a newly updated global model only after acquiring enough tokens, which are to be deducted from its balance. We identify the players, their actions and payoff, and perform a strategic analysis of the game. Extensive experiments were carried out to study the impact of different parameters.
Figures
Figures from the paper (9 more)
Reference graph
Works this paper leans on
-
[1]
Towards efficient and privacy-preserving federated deep learning,
M. Hao et al., “Towards efficient and privacy-preserving federated deep learning,” in IEEE ICC , 2019, pp. 1–6
work page 2019
-
[2]
Collecting telemetry data privately,
B. Ding et al., “Collecting telemetry data privately,” NEURIPS, vol. 30, 2017
work page 2017
-
[3]
Motivating workers in federated learning: A stackelberg game perspective,
Y . Sarikaya and O. Ercetin, “Motivating workers in federated learning: A stackelberg game perspective,” 2019. [Online]. Available: https://arxiv.org/abs/1908.03092
arXiv 2019
-
[4]
A learning-based incentive mechanism for federated learning,
Y . Zhan et al. , “A learning-based incentive mechanism for federated learning,” IEEE Internet of Things Journal , vol. 7, no. 7, pp. 6360– 6368, 2020
work page 2020
-
[5]
Joint Service Pricing and Cooperative Relay Communication for Federated Learning
S. Feng et al. , “Joint service pricing and cooperative relay communication for federated learning,” 2018. [Online]. Available: https://arxiv.org/abs/1811.12082
work page Pith review arXiv 2018
-
[6]
Fmore: An incentive scheme of multi-dimensional auction for federated learning in mec,
R. Zeng et al. , “Fmore: An incentive scheme of multi-dimensional auction for federated learning in mec,” in IEEE ICDCS, 2020, pp. 278– 288
work page 2020
-
[7]
Toward an Automated Auction Framework for Wireless Federated Learning Services Market
Y . Jiao et al. , “Toward an automated auction framework for wireless federated learning services market,” 2020. [Online]. Available: https://arxiv.org/abs/1912.06370
work page Pith review arXiv 2020
-
[8]
Auction based incentive design for efficient federated learning in cellular wireless networks,
T. H. T. Le et al., “Auction based incentive design for efficient federated learning in cellular wireless networks,” in IEEE WCNC , 2020, pp. 1–6
work page 2020
Show all 44 references
-
[9]
Incentivized federated learning with local differential privacy using permissioned blockchains,
S. De Chaudhury et al. , “Incentivized federated learning with local differential privacy using permissioned blockchains,” in IFIP DBSEC , 2024, pp. 301–319
2024
-
[10]
Blockchain based secure federated learning with local differential privacy and incentivization,
——, “Blockchain based secure federated learning with local differential privacy and incentivization,” IEEE Transactions on Privacy , vol. 1, pp. 31–44, 2024
2024
-
[11]
Incentive mechanism for differentially private federated learning in industrial internet of things,
Y . Xu et al. , “Incentive mechanism for differentially private federated learning in industrial internet of things,” IEEE Transactions on Industrial Informatics, vol. 18, no. 10, pp. 6927–6939, 2022
2022
-
[12]
The mnist database of handwritten digit images for machine learning research,
L. Deng, “The mnist database of handwritten digit images for machine learning research,” IEEE Signal Processing Magazine , vol. 29, no. 6, pp. 141–142, 2012
2012
-
[13]
Learning multiple layers of features from tiny images,
A. Krizhevsky, “Learning multiple layers of features from tiny images,” University of Toronto , 05 2012
2012
-
[14]
Communication-efficient learning of deep networks from decentralized data,
H. B. McMahan et al. , “Communication-efficient learning of deep networks from decentralized data,” 2023. [Online]. Available: https://arxiv.org/abs/1602.05629
2023 arXiv
-
[15]
What is federated learning?
IBM, “What is federated learning?” 2022, https://research.ibm.com/blog/ what-is-federated-learning
2022
-
[16]
Advances and open problems in federated learning,
P. Kairouz et al. , “Advances and open problems in federated learning,” F ound. Trends Mach. Learn., vol. 14, no. 1–2, p. 1–210, Jun. 2021
2021
-
[17]
Calibrating noise to sensitivity in private data analysis,
C. Dwork et al., “Calibrating noise to sensitivity in private data analysis,” in Theory of Cryptography , 2006, pp. 265–284
2006
-
[18]
Local differential privacy and its applications: A comprehensive survey,
M. Yang et al. , “Local differential privacy and its applications: A comprehensive survey,” arXiv preprint arXiv:2008.03686 , 2020
2008 arXiv
-
[19]
What can we learn privately?
Kasiviswanathan et al. , “What can we learn privately?” SIAM Journal on Computing , vol. 40, no. 3, pp. 793–826, 2011
2011
-
[20]
Differentially private asynchronous federated learning for mobile edge computing in urban informatics,
Y . Lu et al. , “Differentially private asynchronous federated learning for mobile edge computing in urban informatics,” IEEE Transactions on Industrial Informatics , vol. 16, no. 3, pp. 2134–2143, 2020
2020
-
[21]
Ldp-fed: Federated learning with local differential privacy,
S. Truex et al. , “Ldp-fed: Federated learning with local differential privacy,” in Third ACM International Workshop on Edge Systems, Analytics and Networking , 2020, pp. 61–66
2020
-
[22]
Local differential privacy-based federated learning for internet of things,
Y . Zhao et al. , “Local differential privacy-based federated learning for internet of things,” IEEE Internet of Things Journal , vol. 8, no. 11, pp. 8836–8853, 2020
2020
-
[23]
LDP-FL: Practical private aggregation in federated learning with local differential privacy,
L. Sun et al. , “LDP-FL: Practical private aggregation in federated learning with local differential privacy,” in IJCAI, 2021, pp. 1571–1578
2021
-
[24]
Nisan et al., Algorithmic Game Theory
N. Nisan et al., Algorithmic Game Theory. Cambridge University Press, 2007
2007
-
[25]
Ldp-fl: Practical private aggregation in federated learning with local differential privacy,
L. Sun et al., “Ldp-fl: Practical private aggregation in federated learning with local differential privacy,” 08 2021, pp. 1571–1578
2021
-
[26]
Local differential privacy for federated learning,
P. C. Mahawaga Arachchige et al. , “Local differential privacy for federated learning,” in ESORICS, 2022, pp. 195–216
2022
-
[27]
Incentivizing federated learning,
S. Kong, Y . Li, and H. Zhou, “Incentivizing federated learning,” 2022. [Online]. Available: https://arxiv.org/abs/2205.10951
2022 arXiv
-
[28]
Towards fair and privacy-preserving federated deep models,
L. Lyu et al. , “Towards fair and privacy-preserving federated deep models,” 2020. [Online]. Available: https://arxiv.org/abs/1906.01167
2020 arXiv
-
[29]
Incentive-aware federated learning with training- time model rewards,
Z. Wu et al. , “Incentive-aware federated learning with training- time model rewards,” in The Twelfth International Conference on Learning Representations , 2024. [Online]. Available: https: //openreview.net/forum?id=FlY7WQ2hWS
2024
-
[30]
A sustainable incentive scheme for federated learning,
H. Yu et al. , “A sustainable incentive scheme for federated learning,” IEEE Intelligent Systems , vol. 35, no. 4, pp. 58–69, 2020
2020
-
[31]
A note on stackelberg games,
P. yan Nie and P. ai Zhang, “A note on stackelberg games,” in 2008 Chinese Control and Decision Conference , 2008, pp. 1201–1203. (a) ϵ = 25 (b) ϵ = 20 (c) ϵ = 15 Fig. 9. FL Accuracy variation for the CIFAR10 dataset tested on a Global Dataset with Disjoint Distribution for 3 ...
2008
-
[32]
Optimality and stability in federated learning: A game-theoretic approach,
K. Donahue and J. Kleinberg, “Optimality and stability in federated learning: A game-theoretic approach,” 2021. [Online]. Available: https://arxiv.org/abs/2106.09580
2021 arXiv
-
[33]
Stackelberg game approach for resource alloca- tion in device-to-device communication with heterogeneous networks,
R. Rathi et al. , “Stackelberg game approach for resource alloca- tion in device-to-device communication with heterogeneous networks,” Robotics and Autonomous Systems , vol. 156, p. 104222, 08 2022
2022
-
[34]
A game theory-based incentive mechanism for collabora- tive security of federated learning in energy blockchain environment,
Y . He et al. , “A game theory-based incentive mechanism for collabora- tive security of federated learning in energy blockchain environment,” IEEE Internet of Things Journal , vol. 10, no. 24, pp. 21 294–21 308, 2023
2023
-
[35]
Decentral and incentivized federated learning frame- works: A systematic literature review,
L. Witt et al. , “Decentral and incentivized federated learning frame- works: A systematic literature review,” IEEE Internet of Things Journal , vol. 10, no. 4, pp. 3642–3663, 2023
2023
-
[36]
When federated learning meets game theory: A cooperative framework to secure iiot applications on edge computing,
Z. A. E. Houda et al. , “When federated learning meets game theory: A cooperative framework to secure iiot applications on edge computing,” IEEE Transactions on Industrial Informatics , vol. 18, no. 11, pp. 7988– 7997, 2022
2022
-
[37]
A game-theoretic approach for federated learning: A trade- off among privacy, accuracy and energy,
L. Yin et al., “A game-theoretic approach for federated learning: A trade- off among privacy, accuracy and energy,” Digital Communications and Networks, vol. 10, no. 2, pp. 389–403, 2024
2024
-
[38]
A game-theoretic approach for robust federated learning,
E. Tahanian et al. , “A game-theoretic approach for robust federated learning,” International Journal of Engineering , vol. 34, no. 4, pp. 832– 842, 2021. [Online]. Available: https://www.ije.ir/article 127844.html
2021
-
[39]
Collaboration in participant-centric federated learning: A game-theoretical perspective,
G. Huang et al., “Collaboration in participant-centric federated learning: A game-theoretical perspective,” IEEE Transactions on Mobile Comput- ing, vol. 22, no. 11, pp. 6311–6326, 2023. APPENDIX For the sake of brevity, the following figures on experimen- tal results using th...
2023
-
[40]
A 2D convolutional layer with 32 filters (3 ×3), ReLU activation, followed by a 2D max pooling layer (2 ×2)
-
[41]
Next, a convolutional layer with 64 filters (3 ×3), ReLU activation, followed by 2D max pooling layer (2 ×2)
-
[42]
A third convolutional layer with 128 filters (3 ×3) and ReLU activation
-
[43]
For the baseline scheme, we considered only use the MNIST dataset, while for the proposed schemes in the paper, we use both the MNIST and CIFAR10 datasets
A flatten layer followed by a dense layer with 128 neurons and ReLU activation followed by an output dense layer with 10 units (no activation). For the baseline scheme, we considered only use the MNIST dataset, while for the proposed schemes in the paper, we use both the MNIST...
-
[44]
Figure 12 shows the accuracy of clients participating in the experiment same as in Figure 8a but with CIFAR10 dataset
Recall that the utility remains positive until the end of 30 rounds. Figure 12 shows the accuracy of clients participating in the experiment same as in Figure 8a but with CIFAR10 dataset. The accuracy of the clients is shown for the group- based mechanism in Figure 12a. It can...
Reviewed August 5, 2026 · model on record in the stance chip above.
Discussion (0). Sign in to comment.