Paper deep dive
Multi-Agent Privacy Game in Federated Learning: A Unified Mean-Field View
Kun Zhao, Xu Chen
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Federated learning enables collaborative model training across distributed clients without centralising their data, yet privacy remains a persistent concern because the shared model updates can leak information about local datasets. Existing privacy-preserving methods either inject calibrated noise into client updates, limiting their composition guarantees, or formulate client privacy choices as a multi-agent game whose Nash equilibrium becomes intractable as the number of clients grows. We bridge these two lines of work by formulating privacy-preserving federated learning as a mean-field privacy game: each client strategically chooses its own privacy budget while interacting with the population only through a single mean-field statistic. The mean-field limit yields a tractable equilibrium for arbitrarily many clients, accommodates heterogeneous client preferences, and inherits an exponentially decaying privacy guarantee through a log-Sobolev contraction. The framework recovers the entropic privacy baseline as the homogeneous special case and the multi-agent privacy game as the finite-population case. Experiments on quadratic regression, logistic regression, and MNIST demonstrate that the proposed framework attains the privacy-utility trade-off of the entropic baseline while delivering a personalized privacy guarantee that the homogeneous baseline cannot express.
Tags
Links
- Source: https://arxiv.org/abs/2607.23029v1
- Canonical: https://arxiv.org/abs/2607.23029v1
Trouble viewing inline? Open PDF directly →
Full Text
70,412 characters extracted from source content.
Expand or collapse full text
Multi-Agent Privacy Game in Federated Learning: A Unified Mean-Field View Kun Zhao kun.zhao@vumc.org Xu Chen xc2412@columbia.edu Abstract Federated learning enables collaborative model training across distributed clients without centralising their data, yet privacy remains a persistent concern because the shared model updates can leak information about local datasets. Existing privacy-preserving methods either inject calibrated noise into client updates, limiting their composition guarantees, or formulate client privacy choices as a multi-agent game whose Nash equilibrium becomes intractable as the number of clients grows. We bridge these two lines of work by formulating privacy-preserving federated learning as a mean-field privacy game: each client strategically chooses its own privacy budget while interacting with the population only through a single mean-field statistic. The mean-field limit yields a tractable equilibrium for arbitrarily many clients, accommodates heterogeneous client preferences, and inherits an exponentially decaying privacy guarantee through a log-Sobolev contraction. The framework recovers the entropic privacy baseline as the homogeneous special case and the multi-agent privacy game as the finite-population case. Experiments on quadratic regression, logistic regression, and MNIST demonstrate that the proposed framework attains the privacy-utility trade-off of the entropic baseline while delivering a personalised privacy guarantee that the homogeneous baseline cannot express. 1 Introduction Federated Learning (FL) [19, 17] trains a shared model across data-owning clients without centralizing raw data. Although locality reduces some privacy risks, model updates leak through gradient inversion and membership inference [35, 10, 7]. Three largely independent lines of work address this leakage. Where does the control act? Privacy-preserving FL methods can be partitioned by where each client’s control variable enters the system: it can act on the agent’s state (samples or gradients used for local updates) or directly on the model output (an additive perturbation of wkw_k at the aggregation step). DP-SGD [1] and its federated variants [11, 30] act on the state: a calibrated Gaussian is added to each clipped gradient, and the privacy cost accumulates polynomially with rounds under standard composition [21]. FLRA [23] likewise applies its strategic perturbation (Λi+δi)( ^ix+δ^i) to the state, though for robustness rather than privacy. In contrast, the parameter-perturbation game [34] treats δk _k as a control on the model output and aggregates via w=∑kpk(wk+δk)w= _kp_k(w_k+ _k); under FedAvg’s linear constraint, KKT collapses every Nash point to δk= _k=0 (Section 4). Only controls that act on the state admit non-trivial equilibria, so this is where the rest of the paper lives. Mean-field as the N→∞N\!→\!∞ limit. Two parallel lines of work address different aspects of the resulting state-control game. The multi-agent privacy game [34, 33, 9] fixes a finite N and asks for a Nash equilibrium of the controls εk\ _k\, where εk _k scales the noise added to client k’s gradient or sample (the MAPG-DP and MAPG-input formulations of [34]). Mean-Field Entropic Privacy (MFEP) [5] fixes a homogeneous ε and lets N→∞N\!→\!∞, replacing additive noise with an entropic Wasserstein gradient flow that admits exponential log-Sobolev contraction [22, 15]. Neither line on its own captures the joint behaviour: MAPG-DP is intractable for realistic N and uses geometry-agnostic Gaussian noise, while MFEP cannot represent heterogeneous privacy preferences. Our framing. We treat privacy-preserving FL as a standard mean-field stochastic differential game [16, 8]: each agent has a state Xt∈ℝdX_t ^d (a privatised datum), a type β (its privacy preference), and a control εk _k (its privacy budget); the state distribution μt∈2(ℝd) _t _2(R^d) aggregates the population. The empirical state distribution μt(N)=1N∑kμtk _t^(N)= 1N _k _t^k converges, by propagation of chaos [8], to a deterministic μt _t as N→∞N\!→\!∞. This single limit organises three previously separate works: finite N (multi-agent) N→∞N\!→\!∞ (mean-field) no game (homogeneous) DP-SGD [1] MFEP [5] game (heterogeneous control εk _k) MAPG-DP [34] MFPG (this paper) The bottom-right cell is the missing piece. MFEP is MFPG without the game (single ε across the population); MAPG-DP is MFPG without the mean-field limit (finite N). MFPG closes both gaps with one construction. Contributions. (i) Unified MFG framework (Section 3). We formalise privacy-preserving FL as a mean-field stochastic differential game in the standard sense, with state XtX_t, type βk _k, control εk _k, state distribution μt _t, and running cost f(x,μ,ε;β)=ℓ+βδdpf(x,μ, ;β)= +β _dp. A finite-N Nash equilibrium of MAPG-DP and the mean-field Nash equilibrium of MFPG are the two endpoints of the same N→∞N\!→\!∞ limit; MFEP is the no-game special case. (i) Mean-Field Privacy Game (Section 5). We prove existence of an MFNE on a finite action grid via Kakutani’s theorem and certify (ϵdp,δdp)( _dp, _dp)-DP at the equilibrium, with δdp _dp contracting exponentially when αε∗>λ+Gα ^*>λ+G. The bound recovers the MFEP guarantee at homogeneous βk _k and recovers MAPG-DP’s heterogeneity at finite N. (i) Common solver and empirical study (Sections 6, 7). A single Particle–Sinkhorn JKO step services every N→∞N\!→\!∞ variant; the action update is the only block that varies between MFEP and MFPG. We compare all four cells on quadratic, logistic, and MNIST benchmarks, with every reported number traced to results/full_benchmark.csv. 2 Preliminaries Federated learning. Each client k∈[N]k∈[N] holds a local dataset kD_k. The global objective is minwF(w)=∑kpkFk(w) _wF(w)= _kp_kF_k(w) with pk=nk/np_k=n_k/n and Fk(w)=nk−1∑iℓ(w;xik,yik)F_k(w)=n_k^-1 _i (w;x_i^k,y_i^k) [19]. At round t the server broadcasts wtw^t, each client returns a local update wkt+1w_k^t+1, and the server aggregates via FedAvg wt+1=∑kpkwkt+1w^t+1= _kp_kw_k^t+1. Differential privacy. A randomised mechanism ℳM is (ϵ,δ)(ε,δ)-DP if, for all neighbouring datasets and all measurable S, Pr[ℳ()∈S]≤eϵPr[ℳ(′)∈S]+δ [M(D)∈ S]≤ e^ε [M(D )∈ S]+δ. The Gaussian mechanism with σ=C2ln(1.25/δ)/ϵσ=C 2 (1.25/δ)/ε is (ϵ,δ)(ε,δ)-DP for sensitivity C [1]; under T-fold composition ϵε grows as O(T)O( T). Mean-field games. A mean-field game [16, 13, 8] models a continuum of identical agents whose individual optimal control problem depends on the population distribution μt _t. As N→∞N→∞, the N-player Nash equilibrium converges to a mean-field Nash equilibrium (MFNE). The MFNE depends only on μt _t, not on individual identities, which makes it tractable when the N-player problem is not. Wasserstein gradient flows and JKO. For a free-energy functional ℱF on 2(ℝd)P_2(R^d), the Wasserstein gradient flow obeys ∂tμt=−∇W2ℱ(μt) _t _t=- _W_2F( _t) and admits a time-discrete Jordan–Kinderlehrer–Otto scheme [15] μk+1=argminρℱ(ρ)+(2τ)−1W22(ρ,μk) _k+1= _ρ\F(ρ)+(2τ)^-1W_2^2(ρ, _k)\. A measure ν satisfies a log-Sobolev inequality with constant α if Entν(f2)≤(2/α)∫‖∇f‖2νEnt_ν(f^2)≤(2/α) \|∇ f\|^2dν, with ν=(0,σ2I)ν=N(0,σ^2I) giving α=1/σ2α=1/σ^2. Otto–Villani implies W2W_2-contraction at rate αεα for the entropic flow, which we use in Section 5 to certify privacy. 3 A Unified Mean-Field Game Framework We formalise privacy-preserving FL as a mean-field stochastic differential game in the standard sense of [16, 8]. Section 3.1 identifies the four ingredients of the game (state, type, control, dynamics) and Section 3.2 specialises them to FL through two privacy mechanisms; the resulting 2×22× 2 grid in Table 1 populates DP-SGD, MFEP, MAPG-DP, and our proposed MFPG as four named cells. 3.1 State, type, control, and dynamics A representative agent in our game is described by: • State Xt∈ℝdX_t ^d: a (privatised) datum used by an individual client to compute its local update at round t. • Type β∈[βmin,βmax]⊂ℝ+β∈[ _ , _ ] _+: the client’s privacy preference (heterogeneity parameter), distributed by ρ(dβ)ρ(dβ). • Control εk∈ℰ=ε(1),…,ε(m) _k =\ ^(1),…, ^(m)\: a per-client privacy budget chosen on a finite grid; this is the strategic variable of the game. • Dynamics: conditional on εk _k, the state evolves under the controlled SDE dXtk=b(Xtk,μt,εk)dt+σ(εk)dWt,dX_t^k=b (X_t^k, _t, _k )\,dt+σ ( _k )\,dW_t, (3.1) with WtW_t a standard d-dimensional Brownian motion. The drift b and diffusion σ are fixed by the privacy mechanism ℳM (Section 3.2). • State distribution μt∈2(ℝd) _t _2(R^d): the distribution of XtX_t across the agent population. The empirical measure μt(N)=1N∑k=1Nμtk _t^(N)= 1N _k=1^N _t^k converges weakly to a deterministic μt _t as N→∞N→∞ by propagation of chaos [8, 13]. • Running cost (per agent of type β): f(x,μ,ε;β)=ℓ(x;wt)+βδdp(ε),f(x,μ, ;β)= (x;w_t)+β\, _dp( ), (3.2) combining the training loss ℓ against the current global model wtw_t with the privacy term βδdpβ\, _dp scaled by the agent’s type. The disutility minimised by client k is the time-integral of (3.2), written compactly as Uk(εk;ε¯)=Lk(w;εk)+βkδdp(εk),U_k( _k;\, )=L_k(w;\, _k)+ _k\, _dp( _k), (3.3) where LkL_k is the cumulative training loss and ε¯=μ[ε] =E_μ[ ] is the mean control across the population. The model parameters w enter only through ℓ(x;wt) (x;w_t) and are otherwise external to the game; the strategic content lives entirely in (Xt,μt,εk)(X_t, _t, _k) and (3.2). 3.2 Two privacy mechanisms: Gaussian and entropic The drift–diffusion pair (b,σ)(b,σ) in (3.1) is determined by which privacy mechanism the system runs. We consider two: • Gaussian mechanism. The control εk _k scales the additive noise on each clipped gradient, σ(εk)=C2ln(1.25/δ)/εkσ( _k)=C 2 (1.25/δ)/ _k, with drift b given by the clipped loss gradient [1]. Privacy is tracked by Rényi-DP composition, giving a polynomially accumulating ϵdp=O(T) _dp=O( T). • Entropic mechanism. The state distribution evolves under the Wasserstein gradient flow of the KL-regularised free energy ℱλ(μ;εk)=x∼μ[L(x;w)]+εkKL(μ∥ν)+λ2Varμ[x],F_λ(μ; _k)=E_x μ[L(x;w)]+ _k\,KL(μ\|ν)+ λ2\,Var_μ[x], (3.4) with Gaussian prior ν=(0,σ2I)ν=N(0,σ^2I). Equivalently (Appendix C.1), the controlled SDE (3.1) has drift b(x,μ,ε)=−∇L(x;w)−εσ2x−λ(x−x¯)b(x,μ, )=-∇ L(x;w)- σ^2x-λ(x- x) and diffusion σ(ε)=2εσ( )= 2 . Privacy is tracked by log-Sobolev contraction [22], with δdp _dp decaying exponentially when αεk>λ+Gα _k>λ+G. Remark 3.1 (Why the control acts on the state and not on the model). A superficially natural alternative would be to make the control a perturbation δk∈ℝd _k ^d added directly to the local model wkw_k at the aggregation step, w=∑kpk(wk+δk)w= _kp_k(w_k+ _k) [34]. With the disutility Lk(w)−βk‖δk‖2L_k(w)- _k\| _k\|^2, KKT forces δk= _k=0 at every Nash point (Section 4), so the limiting MFG is degenerate. We therefore restrict attention to controls that act on the state SDE (3.1); this is the standard MFG setup in which the agent’s strategy shapes its own state evolution. Table 1: The MFG framework in two axes. Two design choices populate the 2×22× 2 grid: client heterogeneity (rows: no game vs. game) and population size (columns: finite N vs. N→∞N→∞). Entries name the method, the active noise mechanism (Gaussian or Entropic), and the accountant. Finite N (multi-agent) N→∞N→∞ (mean field) No game (single ε ) DP-SGD [1] Gaussian noise on gradient, RDP δ const., ϵ=O(T)ε=O( T) MFEP [5] Entropic flow on μt _t, LSI δ=O(e−αεKτ)δ=O(e^-α Kτ) Game (heterogeneous βk _k) MAPG-DP [34] Gaussian noise, N-Nash on εk\ _k\ Intractable for large N MFPG (ours) Entropic flow, MFNE on ε¯ Heterogeneous + exponential decay 4 The Three Baseline Cells The three already-named cells of Table 1 are recalled below in the language of Section 3; MFPG itself is deferred to Section 5. The MAPG-DP subsection also discharges the model-output alternative, whose δk=0 _k=0 pathology is what prevents the multi-agent privacy game literature from being combined with mean-field analysis directly. 4.1 Finite N, no game: DP-SGD DP-SGD [1] runs the Gaussian mechanism of Section 3.2 with a single shared budget ε=εtgt = _tgt. After clipping Δwk←Δwk⋅min(1,C/‖Δwk‖2) w_k← w_k· (1,C/\| w_k\|_2) each client adds Gaussian noise (0,σ2I)N(0,σ^2I) with σ=C2ln(1.25/δ)/εσ=C 2 (1.25/δ)/ . RDP composition returns ϵdp=O(Tlog(1/δ)/σ) _dp=O( T (1/δ)/σ), so the privacy cost grows polynomially with rounds T. 4.2 N→∞N→∞, no game: MFEP MFEP [5] replaces external noise injection with the entropic free-energy (3.4) at a fixed regularization strength ε , evaluated against the state distribution μt _t. The Wasserstein gradient flow obeys the Fokker–Planck equation ∂tμt=∇⋅[μt(∇L(x)+εσ2x+λ(x−x¯t))]+εΔμt, _t _t=∇\!·\! [ _t (∇ L(x)+ σ^2x+λ(x- x_t) ) ]+ _t, (4.1) with x¯t=μt[x] x_t=E_ _t[x]. Three mechanisms operate simultaneously: loss-driven drift, prior attraction at rate ε/σ2 /σ^2, and entropic diffusion εΔμt _t that delivers privacy intrinsically. Under LSI for the prior with constant α=1/σ2α=1/σ^2, the JKO discretization contracts [22]: for neighbouring measures μk _k and μk′ _k differing in a single client’s data, W2(μK,μK′)≤e−(αε−λ−G)KτW2(μ0,μ0′),W_2( _K, _K )≤ e^-(α -λ-G)Kτ\,W_2( _0, _0 ), (4.2) provided αε>λ+Gα >λ+G, with G the clipped gradient norm bound. Converting through total-variation gives the exponentially decaying δdp _dp bound used throughout the paper: δdp(ε)≤CdNexp(−(αε−λ−G)Kτ2),Cd=min(d,10). _dp( )≤ C_d N \! (- (α -λ-G)Kτ2 ), C_d= ( d,10). (4.3) 4.3 Finite N, game: MAPG-DP MAPG-DP [34, § 3.2.2, 3.3.4] gives each client k a per-client privacy budget εk∈ℝ+ _k _+ that scales the Gaussian noise added to its local gradient, with scale σk(εk)=2ηC/εk _k( _k)=2η C/ _k, or, equivalently, an additive shift on its features as in FLRA [23]. The disutility (3.3) is delivered by RDP composition, and the N-player Nash equilibrium (ε1∗,…,εN∗)( _1^*,…, _N^*) satisfies Uk(εk∗,ε−k∗)≤Uk(εk,ε−k∗)U_k( _k^*, _-k^*)≤ U_k( _k, _-k^*) for every k, where ε−k∗ _-k^* denotes the strategies of all other clients at equilibrium. Existence follows by standard arguments, but computation is intractable for realistic N because each best response couples through every εj _j via the FedAvg constraint w=1N∑j=1N(wj+(0,σj(εj)2I)).w= 1N\! _j=1^N\! (w_j+N(0, _j( _j)^2I) ). (4.4) The same multi-agent literature also studies a superficially natural alternative in which the strategy is an additive perturbation δk∈ℝd _k ^d on the local model wkw_k, with disutility Lk(w)−βk‖δk‖2L_k(w)- _k\| _k\|^2 subject to w=∑kpk(wk+δk)w= _kp_k(w_k+ _k) [34, § 3.3.1]. The KKT stationarity conditions in feature dimension m, ∂ℒ∂wk,m=1Nλk,m,∂ℒ∂δk,m=1Nλk,m−2βkδk,m, ∂ w_k,m= 1N\, _k,m, ∂ _k,m= 1N\, _k,m-2 _k\, _k,m, (4.5) together force λk,m=0 _k,m=0 and hence δk,m=0 _k,m=0 at every Nash point: the aggregation constraint cancels the privacy term. We therefore restrict the rest of the paper to controls that act on the state, since only such controls admit both non-trivial equilibria and the N→∞N\!→\!∞ limit developed next. 5 Mean-Field Privacy Game (MFPG) We now instantiate the N→∞N→∞ limit of MAPG-DP. The construction below is structurally identical to MAPG-DP except that (i) the Gaussian noise mechanism is replaced by the entropic flow (4.1), which the LSI contraction (4.3) certifies, and (i) the N-Nash equilibrium of εk\ _k\ is replaced by the mean-field Nash equilibrium on the population mean ε¯ . MFEP is recovered as the homogeneous special case (βk _k constant). 5.1 Formulation Each client k chooses a control εk∈ℰ=ε(1),…,ε(m) _k =\ ^(1),…, ^(m)\ on a finite grid; conditional on εk _k, its state slice μtk _t^k evolves under the entropic flow (4.1) and contributes to the population state distribution μt _t through the loss Lk(w;εk)=x∼μtk[ℓ(w;x)]L_k(w; _k)=E_x _t^k[ (w;x)]. The empirical measure μt(N)=1N∑kμtk _t^(N)= 1N _k _t^k converges, by propagation of chaos [8, 13], to a deterministic μt∈2(ℝd) _t _2(R^d) as N→∞N→∞, so each client’s disutility (3.3) couples to the rest of the population only through the scalar mean-field strength ε¯=μ[ε] =E_μ[ ] that replaces the vector ε−k _-k of the finite-N game. Throughout this section we use the disutility in the form Uk(εk;ε¯)=Lk(w;εk)+βkδdp(εk),U_k( _k;\, )=L_k(w;\, _k)+ _k\, _dp( _k), (5.1) with δdp _dp now given by the LSI bound (4.3) rather than by RDP composition. This N→∞N→∞ limit is well-posed only because the controls act on the state: each client’s best response in (4.4) depends on ε−k _-k only through aggregate statistics of μt(N) _t^(N), which collapse to ε¯ in the limit. The model-output alternative does not admit such a limit, since each perturbation enters w=∑jpj(wj+δj)w= _jp_j(w_j+ _j) with vanishing weight O(1/N)O(1/N) and the δk=0 _k=0 collapse of (4.5) is its finite-N shadow. 5.2 Game equilibrium A pair (μ∗,ε∗)(μ^*, ^*) is a mean-field Nash equilibrium (MFNE) of MFPG if (i) μ∗μ^* is the stationary state distribution of (4.1) at the population mean ε¯∗=μ∗[ε] ^*=E_μ^*[ ], and (i) ε∗ ^* is a best response to ε¯∗ ^* for every client given its preference βk _k (formal definition in Appendix C.4). At equilibrium, no client can reduce its disutility by unilaterally changing εk _k given that every other client plays ε−k∗ ^*_-k. For heterogeneous clients with distinct βk _k, the MFNE is characterised by a fixed point of the averaged best-response map Φ:ε¯↦k[BRk(ε¯)] : _k[BR_k( )]; existence follows from Kakutani’s theorem on the convex hull of ℰE (Appendix C.4). Section 5.3 gives an equivalent differential characterisation through coupled HJB and FPK PDEs. 5.3 HJB–FPK characterisation The fixed-point characterisation of Section 5.2 is convenient for existence and for the finite-grid solver of Section 6, but it hides the dynamical content of the equilibrium. Following the standard mean-field game system of [16, 8] and the FL–MFG analogy of [20], we now give an equivalent differential characterisation through coupled forward Fokker–Planck–Kolmogorov (FPK) and backward Hamilton–Jacobi–Bellman (HJB) equations specialised to our disutility (5.1). To this end we momentarily relax the finite grid ℰE to the interval [εmin,εmax]⊂ℝ+[ _ , _ ] _+ and parameterise each client by a privacy preference β∈[βmin,βmax]β∈[ _ , _ ] distributed according to ρ(dβ)ρ(dβ), so that the state distribution splits across types as μt=∫μtβρ(dβ) _t= _t^β\,ρ(dβ) with global mean x¯t=μt[X] x_t=E_ _t[X]. Under control ε , a representative state of type β obeys the controlled SDE dXt=b(Xt,μt,ε)dt+2εdWt,b(x,μ,ε)=−∇L(x;wt)−εσ2x−λ(x−x¯),dX_t=b(X_t, _t, )\,dt+ 2 \,dW_t, b(x,μ, )=-∇ L(x;w_t)- σ^2x-λ(x- x), (5.2) with WtW_t a standard Brownian motion, and seeks to minimise the cumulative cost Jμ(ε;β)=[∫0Tℓ(Xt;wt)t]+βδdp(ε),J^μ( ;β)=E\! [ _0^T (X_t;w_t)\,dt ]+β\, _dp( ), (5.3) where δdp(ε)=(Cd/N)exp(−θ(ε−ε0)) _dp( )=(C_d/ N) (-θ( - _0)) with θ:=αKτ/2θ:=α Kτ/2 and ε0:=(λ+G)/α _0:=(λ+G)/α is the LSI bound (4.3). Plugging the optimal feedback control ε∗(t,x;β) ^*(t,x;β) derived below into (5.2) gives the forward type-conditional Fokker–Planck equation ∂tμtβ(x)+∇⋅[μtβ(x)b(x,μt,ε∗(t,x;β))]=ε∗(t,x;β)Δμtβ(x); _t _t^β(x)+∇\!·\! [ _t^β(x)\,b (x, _t, ^*(t,x;β) ) ]= ^*(t,x;β)\, _t^β(x); (5.4) marginalising over ρ recovers (4.1) but with the optimal control in place of a fixed ε . Defining the type-conditional value function V(t,x;β)=infεXt=x[⋅]V(t,x;β)= _ E_X_t=x[\,·\,] of (5.3), dynamic programming yields the backward HJB −∂tV(t,x;β)=ℋ(x,∇V,D2V,μt;β),V(T,x;β)=0,- _tV(t,x;β)=H (x,∇ V,D^2V, _t;β ), V(T,x;β)=0, (5.5) with Hamiltonian ℋ(x,p,M,μ;β)=ℓ(x;wt)−p⋅∇L(x;wt)−λp⋅(x−x¯)+minε≥0βδdp(ε)−εσ2p⋅x+εTr(M).H(x,p,M,μ;β)= (x;w_t)-p\!·\!∇ L(x;w_t)-λ\,p\!·\!(x- x)+ _ ≥ 0 \β\, _dp( )- σ^2\,p\!·\!x+ \,Tr(M) \. (5.6) The first-order condition for the inner minimisation in ℋH admits a closed-form solution ε∗(t,x;β) ^*(t,x;β), derived in Appendix C.7. Two qualitative properties of this solution carry the intuition of the result: ε∗ ^* is decreasing in β, so privacy-sensitive clients adopt stronger regularisation, and ε∗ ^* is decreasing in the local curvature Tr(D2V)Tr(D^2V), so clients near sharp minima can afford stronger noise. The MFNE is the pair (V,μtβ)(V, _t^β) that simultaneously satisfies (5.5) and (5.4), coupled through ε∗ ^* in the FPK drift–diffusion and through μt _t in the Hamiltonian; integrating ε∗ ^* against the equilibrium population recovers the scalar fixed point ε¯∗=Φ(ε¯∗) ^*= ( ^*) that drives the discrete-grid solver in Section 6. Two specialisations of the system above recover the existing literature. If βk≡β _k≡β is constant across the population, the type-conditional structure collapses, ε∗ ^* becomes spatially constant on the optimum, and (5.4) reduces to the single-strength entropic flow of [5]. If we instead replace (5.4) by its N-particle empirical version and (5.5) by the N-player backward Bellman system, with δdp _dp replaced by RDP composition, we recover the dynamic MAPG-DP of [34]. MFPG is therefore the joint N→∞N\!→\!∞ and entropic-mechanism limit of MAPG-DP. When the activation condition αε∗>λ+Gα ^*>λ+G holds at the equilibrium, the LSI contraction yields an exponentially decaying δdp _dp bound of the form (Cd/N)exp(−(αε∗−λ−G)Kτ/2)(C_d/ N) (-(α ^*-λ-G)Kτ/2) (Appendix C.8); compared with DP-SGD, whose ϵdp _dp grows as O(K)O( K) at fixed δ=10−5δ=10^-5, MFPG’s privacy guarantee tightens with the number of training rounds. This combines the heterogeneity benefit MFEP cannot express with the exponential decay MAPG-DP cannot offer. 6 Algorithms A single training round of every cell in Table 1 consists of the same three steps applied independently by each client and then composed by the server: an action update that selects the strategic variable εk _k (skipped in the no-game cells), a local update that advances the privatised state distribution μtk _t^k and produces a parameter contribution wk(t+1)w_k^(t+1), and an accountant update that records the privacy cost. The four named methods differ only in which version of these blocks they call. Algorithm 1 writes the outer loop once; the rest of this section specifies the three blocks in turn. Algorithm 1 Unified training round (one round, all four cells). 1:Global params w(t)w^(t); population mean ε¯(t) ^(t) (mean-field cells only); per-client preferences βk\ _k\; active mechanism (Gaussian / Entropic) and accountant (RDP / LSI). 2:for each client k∈[N]k∈[N] in parallel do 3: εk(t)← _k^(t)← ActionUpdate(ε¯(t),βj)k_k( ^(t),\ _j\) ⊳ skipped if no game 4: wk(t+1)←w_k^(t+1)← LocalUpdate(w(t),εk(t))ℳ_M(w^(t), _k^(t)) ⊳ Alg. 2 or 3 5: η←η← AccountantUpdate(η,εk(t))(η, _k^(t)) ⊳ RDP or LSI 6:end for 7:ε¯(t+1)←N−1∑kεk(t) ^(t+1)← N^-1 _k _k^(t) ⊳ mean-field cells only 8:w(t+1)←∑kpkwk(t+1)w^(t+1)← _kp_k\,w_k^(t+1) ⊳ FedAvg The local-update block advances client k’s data slice under the active noise mechanism. The two mechanisms supported by Table 1 are the familiar additive Gaussian step (used by DP-SGD and MAPG-DP) and the Particle–Sinkhorn JKO step that discretises the entropic Wasserstein gradient flow (4.1) (used by MFEP and MFPG); both consume the same inputs and produce a privatised local model. The Gaussian variant (Algorithm 2) clips the per-sample gradient to norm C and adds isotropic noise of scale σk=C2ln(1.25/δ)/εk _k=C 2 (1.25/δ)/ _k, recovering the standard DP-SGD update of [1]. Across cells the only difference is whether σk _k is shared (DP-SGD: εk≡εtgt _k≡ _tgt) or set per client by the action-update block (MAPG-DP). The entropic variant (Algorithm 3) instead approximates the JKO step μk+1=argminρℱλ(ρ)+(2τ)−1W22(ρ,μk) _k+1= _ρ\F_λ(ρ)+(2τ)^-1W_2^2(ρ, _k)\ by a particle method: each particle takes a forward Euler step on the free-energy gradient (the drift–diffusion line), and a single Sinkhorn projection enforces the Wasserstein constraint by averaging each particle against its barycentric image under the entropic optimal transport plan. The drift contains three terms—loss-driven, prior-attractive, and variance-penalising—all read off from (3.4). The diffusion strength 2εkτ 2 _kτ is what the LSI bound (4.3) later contracts. To keep the projection tractable on large parameter tensors we cap the Sinkhorn at n=512n=512 flattened entries; tensors larger than this are advanced by drift–diffusion only, which preserves the δdp _dp guarantee but skips the optimal-transport refinement. Algorithm 2 Gaussian local update (DP-SGD, MAPG-DP). 1:Local model wkw_k; clip C; per-client budget εk _k (or shared εtgt _tgt for DP-SGD). 2:σk←C2ln(1.25/δ)/εk _k← C 2 (1.25/δ)/ _k 3:g←clip(∇Lk(wk),C)g (∇ L_k(w_k),\,C) 4:wk←wk−η(g+(0,σk2I))w_k← w_k-η\,(g+N(0, _k^2I)) Algorithm 3 Particle–Sinkhorn JKO step (MFEP, MFPG). 1:Particles xii=1n\x_i\_i=1^n; JKO step τ; clip C; entropic strength εk _k; prior variance σ2σ^2; variance penalty λ; Sinkhorn regulariser ηS _S. 2:gi←clip(∇L(xi),C)g_i (∇ L(x_i),\,C) 3:xi′←xi−τ[gi+εkσ2xi+λ(xi−x¯)]+2εkτzix_i ← x_i-τ\! [g_i+ _kσ^2x_i+λ(x_i- x) ]+ 2 _kτ\,z_i, zi∼(0,I)z_i (0,I) ⊳ drift + diffusion 4:P←Sinkhorn(n,n,Cij,ηS)P (1_n,1_n,\,C_ij,\, _S) with Cij=‖xi′−xj′‖2C_ij=\|x_i -x_j \|^2 ⊳ entropic OT plan 5:xinew←∑jPijxj′x_i^new← _jP_ij\,x_j ⊳ barycentric projection The action-update block is the only place where the four cells differ algorithmically once the mechanism is fixed: it is empty in the no-game cells, a closed-form N-player best response in MAPG-DP, and a finite-grid mean-field best response in MFPG. For MFPG the client solves εknew←argminε∈ℰ[Lkε+c+βkδdp(ε;Gk)], _k^new← _ [\, L_k +c+ _k\, _dp( ;\,G_k) ], (6.1) where GkG_k is the latest clipped gradient-norm estimate, c is a small constant that absorbs the low-ε singularity of the regulariser, and δdp _dp is computed via (4.3) at the current mean-field ε¯(t) ^(t). The cost is O(|ℰ|)O(|E|) per client per round, dwarfed by the local update of Algorithm 3. MAPG-DP replaces (6.1) with the closed-form KKT best response of [34], and DP-SGD and MFEP skip this block entirely. Existence of a fixed point of the averaged best-response map Φ:ε¯↦N−1∑kεknew : N^-1 _k _k^new is guaranteed by Proposition C.1; in practice ten outer iterations suffice for the grid sizes |ℰ|≤5|E|≤ 5 we report. Each cell carries a privacy accountant that updates after every local step. The Gaussian cells use a Rényi-DP moments accountant tracking RDP at order α=2α=2 and converting to (ϵ,δ)(ε,δ) via the standard amplification-by-subsampling formula [21]; the cumulative ϵε grows as O(T)O( T). The entropic cells instead apply the LSI-contraction bound (4.3) at the current εk _k (MFEP) or ε¯(t) ^(t) (MFPG), which gives an exponentially decaying δdp _dp whenever the activation condition αε∗>λ+Gα ^*>λ+G is met. Both accountants are black-box and consume only (σk( _k or εk,K,τ) _k,K,τ), so any method can be re-audited under either accountant; the experiments report the accountant each method was originally designed to use. 7 Numerical Results Our experiments verify that the four cells of Table 1 produce the privacy decay each cell predicts and show that MFPG attains MFEP-level utility at the population level while delivering a personalised privacy guarantee that single-ε MFEP cannot. The full experimental setup—datasets, hyperparameters, and accountant configurations—is given in Appendix D. Every numerical claim below is reproducible from results/full_benchmark.csv (seed =42=42); paper/cross_check.py verifies that no number drifts away from the CSV. Table 2: Final-round metrics from results/full_benchmark.csv (seed =42=42). For the entropic cells, ϵε is the linear-budget value at the final round; for the Gaussian cells it is the value reported by the RDP accountant. “−-” marks settings we omit (MAPG-DP on MNIST). Quadratic (d=5d=5, T=10T=10) Logistic (d=20d=20, T=15T=15) MNIST (MLP, T=20T=20) Method loss — ϵε δ loss acc ϵε δ acc ϵε δ DP-SGD 69.1 — 12.3 10−510^-5 5.78 0.500 14.2 10−510^-5 0.120 23.7 10−510^-5 MFEP 74.1 — 1.00 9.1×10−29.1×10^-2 5.67 0.460 1.00 1.0×10−11.0×10^-1 0.126 1.00 1.5×10−11.5×10^-1 MAPG-DP 65.8 — 0.37 10−510^-5 4.49 0.395 0.08 10−510^-5 — — — MFPG (ours) 75.3 — 1.00 6.1×10−16.1×10^-1 6.11 0.460 1.00 4.7×10−14.7×10^-1 0.094 1.00 1.01.0 Table 2 reports the final-round numbers, and Figures 1–3 show the round-by-round trajectories of loss, accuracy, and δdp _dp. The headline finding is that the two axes of Table 1 have predictable, separable effects: the noise-mechanism axis controls the shape of δdp _dp (constant for Gaussian cells, decreasing for entropic cells), and the heterogeneity axis controls how privacy budget is distributed across clients. The Gaussian cells confirm the polynomial accumulation of standard DP. After T=10T=10 quadratic rounds, DP-SGD has reached ϵ=12.3ε=12.3 at δ=10−5δ=10^-5; on logistic regression and MNIST the cumulative ϵε rises to 14.214.2 and 23.723.7 respectively. MAPG-DP keeps ϵε much smaller per round through its strategic per-client budgets (0.370.37 on quadratic, 0.080.08 on logistic) at the cost of utility on logistic regression (39.5%39.5\% vs. 50.0%50.0\% for DP-SGD), but its δ does not tighten with rounds. The entropic cells follow the linear-budget schedule ϵ=1ε=1 for every round and exhibit a non-trivial δ that contracts when the LSI rate αε∗−λ−Gα ^*-λ-G is positive; with C=1,σ=1C=1,σ=1 the rate sits on the boundary of activation, so MFEP and MFPG fall back to the polynomial 1/(K+1)1/(K+1) envelope on the simpler tasks. On utility, the two entropic cells are tied to within a fraction of a percentage point on logistic regression (46.0%46.0\% for both) and within 33 points on MNIST (12.6%12.6\% vs. 9.4%9.4\%); on the convex quadratic problem they trail MAPG-DP by about 1010 units of loss but match each other. This is the expected behaviour: when the MFNE concentrates close to a single ε¯∗ ^* (Appendix E), the population-level loss of MFPG is well-approximated by MFEP at that strength. Where the methods differ visibly is in the per-round δ for the logistic experiment: MFEP reports 1.0×10−11.0\!×\!10^-1 versus 4.7×10−14.7\!×\!10^-1 for MFPG. The MFPG bound is looser at the population level because privacy-tolerant clients self-select larger εk∗ _k^*, which inflates the mean-field ε¯ entering (4.3); the per-client guarantee for high-β clients is correspondingly tighter than what MFEP can express at all. The MNIST stress test isolates a different regime. With a ∼ 100100\,k parameter MLP, the JKO drift–diffusion noise 2ετzi 2 τ\,z_i dominates the gradient signal, and all three methods we ran (DP-SGD, MFEP, MFPG) plateau near chance accuracy. We omit MAPG-DP from MNIST because its per-sample best-response loop is expensive at this scale and adds no insight beyond the logistic experiment. We retain MNIST in the paper precisely because it makes the LSI bound’s failure mode visible: when the regime αε∗>λ+Gα ^*\!>\!λ+G is far from satisfied, the entropic-flow advantage over Gaussian noise vanishes and MFEP and MFPG converge to the same poor utility, consistent with the convex-hull argument of Proposition C.1. A scalable approximation of the Sinkhorn projection is the natural next step. Figure 1: Quadratic regression. The two entropic cells (MFEP, MFPG) deliver a slowly decaying δdp _dp at fixed ϵ=1ε=1; both Gaussian cells (DP-SGD, MAPG-DP) deliver a flat δ at higher cumulative ϵε. Figure 2: Logistic regression. MFPG matches MFEP on test accuracy at a fraction of DP-SGD’s privacy cost; MAPG-DP keeps ϵε small at the cost of utility. Figure 3: MNIST. In the high-dimensional regime where the LSI bound’s activation condition αε∗>λ+Gα ^*\!>\!λ+G is loose, MFEP and MFPG converge to the same poor utility, while DP-SGD reaches comparable accuracy at much higher cumulative ϵε. References [1] M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang (2016) Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, p. 308–318. Cited by: Appendix A, §1, §1, §2, 1st item, Table 1, §4.1, §6. [2] C. D. Aliprantis and K. C. Border (2006) Infinite dimensional analysis: a hitchhiker’s guide. 3 edition, Springer. Cited by: item (i), §C.4. [3] L. Ambrosio, N. Gigli, and G. Savaré (2008) Gradient flows in metric spaces and in the space of probability measures. 2 edition, Birkhäuser. Cited by: §C.2, §C.2. [4] G. Andrew, O. Thakkar, B. McMahan, and S. Ramaswamy (2021) Differentially private learning with adaptive clipping. In Advances in Neural Information Processing Systems, Vol. 34. Cited by: Appendix A. [5] Anonymous (2025) Mean-field entropic privacy (MFEP): a unified dynamics framework for private federated learning. Note: Under review at AISTATS 2026 Cited by: Appendix A, Table 3, §C.2, §1, §1, Table 1, §4.2, §5.3. [6] C. Berge (1963) Topological spaces. Oliver & Boyd, Edinburgh and London. Cited by: §C.4. [7] N. Carlini, F. Tramer, E. Wallace, M. Jagielski, A. Herbert-Voss, K. Lee, A. Roberts, T. Brown, D. Song, U. Erlingsson, et al. (2021) Extracting training data from large language models. In 30th USENIX Security Symposium, p. 2633–2650. Cited by: §1. [8] R. Carmona and F. Delarue (2018) Probabilistic theory of mean field games with applications I–I. Springer. Cited by: §1, §2, 5th item, §3, §5.1, §5.3. [9] J. Du, C. Jiang, K. Chen, Y. Ren, and H. V. Poor (2017) Community-structured evolutionary game for privacy protection in social networks. IEEE Transactions on Information Forensics and Security 13 (3), p. 574–589. Cited by: Appendix A, Table 3, §1. [10] J. Geiping, H. Bauermeister, H. Dröge, and M. Moeller (2020) Inverting gradients–how easy is it to break privacy in federated learning?. In Advances in Neural Information Processing Systems, Vol. 33, p. 16937–16947. Cited by: §1. [11] R. C. Geyer, T. Klein, and M. Nabi (2017) Differentially private federated learning: a client level perspective. In NeurIPS Workshop on Machine Learning on the Phone and other Consumer Devices, Cited by: Appendix A, §1. [12] R. Hu and Y. Gong (2020) Trading data for learning: incentive mechanism for on-device federated learning. In 2020 IEEE Global Communications Conference (GLOBECOM), p. 1–6. Cited by: Appendix A, Table 3. [13] M. Huang, R. P. Malhamé, and P. E. Caines (2006) Large population stochastic dynamic games: closed-loop McKean-Vlasov systems and the Nash certainty equivalence principle. In Communications in Information & Systems, Vol. 6, p. 221–252. Cited by: §2, 5th item, §5.1. [14] R. Jin, X. He, and H. Dai (2017) On the tradeoff between privacy and utility in collaborative intrusion detection systems-a game theoretical approach. In Proceedings of the Hot Topics in Science of Security: Symposium and Bootcamp, p. 45–51. Cited by: Appendix A, Table 3. [15] R. Jordan, D. Kinderlehrer, and F. Otto (1998) The variational formulation of the Fokker–Planck equation. SIAM Journal on Mathematical Analysis 29 (1), p. 1–17. Cited by: §C.2, §1, §2. [16] J. Lasry and P. Lions (2007) Mean field games. Japanese Journal of Mathematics 2 (1), p. 229–260. Cited by: §1, §2, §3, §5.3. [17] T. Li, A. K. Sahu, M. Zaheer, M. Sanjabi, A. Talwalkar, and V. Smith (2020) Federated optimization in heterogeneous networks. Proceedings of Machine Learning and Systems 2, p. 429–450. Cited by: §1. [18] J. Liu, J. Lou, L. Xiong, J. Liu, and X. Meng (2021-12) Projected federated averaging with heterogeneous differential privacy. Proceedings of the VLDB Endowment 15 (4), p. 828–840. External Links: ISSN 2150-8097, Document Cited by: Appendix A. [19] B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y. Arcas (2017) Communication-efficient learning of deep networks from decentralized data. In Artificial Intelligence and Statistics, p. 1273–1282. Cited by: §1, §2. [20] A. Mehrjou (2021) Federated learning as a mean-field game. External Links: 2107.03770 Cited by: Appendix A, §5.3. [21] I. Mironov (2017) Rényi differential privacy. In 2017 IEEE 30th Computer Security Foundations Symposium (CSF), p. 263–275. Cited by: Appendix A, §1, §6. [22] F. Otto and C. Villani (2000) Generalization of an inequality by Talagrand and links with the logarithmic Sobolev inequality. Journal of Functional Analysis 173 (2), p. 361–400. Cited by: §C.2, §1, 2nd item, §4.2. [23] A. Reisizadeh, F. Farnia, R. Pedarsani, and A. Jadbabaie (2020) Robust federated learning: the case of affine distribution shifts. In Advances in Neural Information Processing Systems (NeurIPS), Cited by: Appendix A, §1, §4.3. [24] S. Rigot (2023) Entropic regularization of Wasserstein distance and applications to federated learning. Machine Learning 112 (4), p. 1235–1261. Cited by: Appendix A. [25] L. Ruthotto, S. J. Osher, W. Li, L. Nurbekyan, and S. W. Fung (2020) A machine learning framework for solving high-dimensional mean field game and mean field control problems. In Proceedings of the National Academy of Sciences, Vol. 117, p. 9183–9193. Cited by: Appendix A. [26] A. R. Sfar, Y. Challal, P. Moyal, and E. Natalizio (2019) A game theoretic approach for privacy preserving model in iot-based transportation. IEEE Transactions on Intelligent Transportation Systems 20 (12), p. 4405–4414. Cited by: Appendix A, Table 3. [27] Z. Sun, L. Yin, C. Li, W. Zhang, A. Li, and Z. Tian (2020) The qos and privacy trade-off of adversarial deep learning: an evolutionary game approach. Computers & Security 96, p. 101876. Cited by: Appendix A, Table 3. [28] S. Truex, N. Baracaldo, A. Anwar, T. Steinke, H. Ludwig, R. Zhang, and Y. Zhou (2019) A hybrid approach to privacy-preserving federated learning. In Proceedings of the 12th ACM Workshop on Artificial Intelligence and Security, p. 1–11. Cited by: Appendix A. [29] C. Villani (2009) Optimal transport: old and new. Springer. Cited by: §C.1, §C.2. [30] K. Wei, J. Li, M. Ding, C. Ma, H. H. Yang, F. Farokhi, S. Jin, T. Q. Quek, and H. V. Poor (2020) Federated learning with differential privacy: algorithms and performance analysis. Vol. 15, p. 3454–3469. Cited by: Appendix A, §1. [31] X. Wu, T. Wu, M. K. Khan, Q. Ni, and W. Dou (2017) Game theory based correlated privacy preserving analysis in big data. IEEE Transactions on Big Data 7 (4), p. 643–656. Cited by: Appendix A, Table 3. [32] L. Xiao, Y. Li, G. Han, H. Dai, and H. V. Poor (2017) A secure mobile crowdsensing game with deep reinforcement learning. IEEE Transactions on Information Forensics and Security 13 (1), p. 35–47. Cited by: Appendix A, Table 3. [33] L. Xu, C. Jiang, Y. Qian, J. Li, Y. Zhao, and Y. Ren (2021) Privacy-accuracy trade-off in differentially-private distributed classification: a game theoretical approach. IEEE Transactions on Big Data 7 (4), p. 770–783. Cited by: Appendix A, Table 3, §1. [34] L. Yin, S. Lin, Z. Sun, R. Li, Y. He, and Z. Hao (2021) A game-theoretic approach for federated learning: a trade-off among privacy, accuracy and energy. Digital Communications and Networks. Cited by: Appendix A, Table 3, §C.3, §1, §1, §1, Table 1, Remark 3.1, §4.3, §4.3, §5.3, §6. [35] L. Zhu, Z. Liu, and S. Han (2019) Deep leakage from gradients. In Advances in Neural Information Processing Systems, Vol. 32. Cited by: §1. Appendix A Related Work Each of the four cells in Table 1 traces back to a distinct line of prior work; our contribution is to organise them along the two axes of N and client heterogeneity rather than to introduce new machinery. Differential privacy in federated learning. The finite-N, no-game cell is occupied by a substantial literature. DP-SGD [1] introduced the per-sample-clipped Gaussian mechanism, and DP-FedAvg [11, 30] adapted it to the federated setting. Subsequent work tightens the privacy accountant via Rényi DP [21], allows adaptive clipping [4], combines DP with secure aggregation [28], and accommodates per-client privacy budgets through projected averaging [18]. Each of these methods operates on the data side (gradients or samples) under RDP composition, which is exactly the cell we recover when MFPG is reduced to homogeneous βk _k and the entropic mechanism is swapped for additive Gaussian noise. Game-theoretic privacy. The finite-N, game cell has been studied through both cooperative and non-cooperative formulations: community-structured evolutionary games [9], correlated privacy analysis [31], deep-RL crowdsensing [32], IoT transportation [26], distributed classification [33], on-device incentive mechanisms [12], evolutionary QoS trade-offs [27], and intrusion-detection games [14]. The most directly relevant precedent is the multi-agent privacy game [34], whose MAPG-DP and MAPG-input formulations we adopt as our finite-N baseline; we discharge the model-output variant (MAPG-parameter) as a δk=0 _k=0 pathology in Section 4.3, since only state-acting controls admit the N→∞N→∞ limit we develop. The robust-FL framework FLRA [23] is not a privacy method but its state-acting affine perturbation (Λi+δi)( ^ix+δ^i) is the structural precedent for treating the state distribution as the strategic object of FL. Mean-field methods and entropic privacy. The FL–mean-field analogy through coupled HJB and Fokker–Planck PDEs [20] provides the dynamical foundation we build on. High-dimensional mean-field control with neural networks is studied in [25], and entropic-Wasserstein regularisation in FL in [24], but neither addresses the privacy game. The closest prior work is MFEP [5], which occupies the N→∞N→∞, no-game cell of Table 1 with a homogeneous entropic strength and the LSI-based privacy analysis we adopt for our δ bound. MFPG is the natural generalisation of MFEP that admits heterogeneous client preferences, equivalently, the N→∞N→∞ limit of MAPG-DP under the entropic mechanism. Appendix B Game-Theoretic Privacy Frameworks Table 3: Comparison of game-theoretic privacy frameworks. N-N = N-player Nash; MFNE = mean-field Nash equilibrium. Work Player Hierarch. Coop. Strategy Utility [33, 14, 31] Clients No Yes ϵi _i maxQ(ϵ) Q( ε) [9, 32] Clients No No ϵi _i maxQ+P(ϵi) Q+P( _i) [26, 27, 12, 34] S+C Yes No ϵi,b _i,b Stackelberg MFEP [5] — — — none (ε fixed) L+εKLL+ \,KL MFPG (ours) Clients (MF) No No εk∈ℰ _k Lk+βkδdp(εk)L_k+ _k _dp( _k) Appendix C Derivations and proofs This appendix supplies the derivations behind each labelled equation and theorem of the body. Section references in parentheses point to the statement being proved. C.1 Wasserstein gradient flow yields the Fokker–Planck equation (4.1) (§4.2) We compute the first variation of the free energy (3.4) and use the standard correspondence between Wasserstein gradient flows on ℱF and continuity equations driven by ∇(δℱ/δμ)∇( /δμ). The three terms of ℱλF_λ have first variations δμμ[L(x;w)] δμ\,E_μ[L(x;w)] =L(x;w), =L(x;w), δμKL(μ∥ν) δμ\,KL(μ\|ν) =logdμdν(x), = \! dμdν(x), δμVarμ[x] δμ\,Var_μ[x] =‖x−x¯‖2−Varμ[x],x¯=μ[x]. =\|x- x\|^2-Var_μ[x], x=E_μ[x]. The first two are classical [29]; the third follows from Varμ[x]=μ‖x‖2−‖μx‖2Var_μ[x]=E_μ\|x\|^2-\|E_μx\|^2 by direct computation. Taking gradients in x, ∇δℱλδμ(x)=∇L(x;w)+ε∇logdμdν(x)+λ(x−x¯).∇ _λδμ(x)=∇ L(x;w)+ \,∇ \! dμdν(x)+λ(x- x). For the Gaussian prior ν=(0,σ2I)ν=N(0,σ^2I), ∇logν(x)=−x/σ2∇ ν(x)=-x/σ^2, so ∇log(dμ/dν)=∇logμ+x/σ2∇ (dμ/dν)=∇ μ+x/σ^2. Substituting, ∇δℱλδμ=∇L+εσ2x+λ(x−x¯)+ε∇logμ.∇ _λδμ=∇ L+ σ^2x+λ(x- x)+ \,∇ μ. The Wasserstein gradient flow ∂tμt=∇⋅(μt∇(δℱ/δμ)) _t _t=∇\!·\!( _t∇( /δμ)) then becomes ∂tμt=∇⋅[μt(∇L+εσ2x+λ(x−x¯))]+ε∇⋅(μt∇logμt). _t _t=∇\!·\! [ _t (∇ L+ σ^2x+λ(x- x) ) ]+ \,∇\!·\!( _t∇ _t). Using the identity μt∇logμt=∇μt _t∇ _t=∇ _t, the last term simplifies to εΔμt _t, recovering (4.1). ∎ C.2 LSI contraction implies the privacy bound (4.3) (§4.2) The argument is a standard composition of three steps: log-Sobolev contraction of the entropic flow, total-variation control by Wasserstein distance, and a 1/N1/N initial gap. Step 1 (LSI ⇒ W2W_2 contraction). The Hessian of ℱλF_λ in the Wasserstein sense decomposes as Hessμℱλ=Hessμμ[L]⏟⪰−GId+εHessμKL(⋅∥ν)⏟⪰αεId+λ2HessμVar⏟⪰−λId,Hess_μ\,F_λ= Hess_μ\,E_μ[L]_ -G\,Id+ \,Hess_μ\,KL(·\|ν)_ α \,Id+ λ2Hess_μ\,Var_ -λ\,Id, where the loss term contributes −GId-G\,Id when ‖∇L‖∞≤G\|∇ L\|_∞≤ G, the KL term contributes αεIdα \,Id by Otto–Villani applied to LSI(α) for ν [22], and the variance penalty contributes −λId-λ\,Id [3]. The overall Wasserstein convexity constant is r:=αε−λ−Gr:=α -λ-G. By the standard contraction result for r-displacement-convex functionals on 2P_2 [29, Thm. 23.9], W2(μt,μt′)≤e−rtW2(μ0,μ0′)whenever r>0.W_2( _t, _t )≤ e^-rt\,W_2( _0, _0 ) r>0. The same rate transfers to the JKO discretisation with step τ [15]: after K steps, W2(μK,μK′)≤e−rKτW2(μ0,μ0′).W_2( _K, _K )≤ e^-rKτ\,W_2( _0, _0 ). (C.1) Step 2 (W2W_2 to total variation). For absolutely continuous measures with bounded second moments, the transportation inequality gives TV(μ,μ′)2≤Cd2W2(μ,μ′)TV(μ,μ )^2≤ C_d^2\,W_2(μ,μ ) with Cd=min(d,10)C_d= ( d,10) [3], equivalently TV(μ,μ′)≤CdW2(μ,μ′).TV(μ,μ )≤ C_d W_2(μ,μ ). (C.2) Step 3 (initial 1/N1/N gap). For neighbouring datasets differing in a single client’s contribution out of N, the corresponding initial population measures satisfy W2(μ0,μ0′)≤D2/NW_2( _0, _0 )≤ D^2/N for some data-domain constant D folded into CdC_d [5]. Combination. Substituting Step 3 into (C.1) and that into (C.2), TV(μK,μK′)≤Cde−rKτ⋅1/N=CdNe−rKτ/2.TV( _K, _K )≤ C_d\, e^-rKτ· 1/N= C_d N\,e^-rKτ/2. Since δdp≤TV(μK,μK′) _dp ( _K, _K ) in this neighbouring-data formulation, we obtain (4.3). ∎ C.3 KKT analysis: the δk=0 _k=0 collapse (§4.3) We expand the partial derivatives of the Lagrangian summarised in the body text. The static model-output MAPG of [34] solves mink,k12nk∑i=1nk(⊤ik−yik)2−βk‖k‖22s.t.=1K∑j=1K(j+j). _w_k, δ_k\; 12n_k _i=1^n_k(W X_i^k-y_i^k)^2- _k\| δ_k\|_2^2 .t.\;\;W= 1K _j=1^K(w_j+ δ_j). Forming the Lagrangian with multiplier k∈ℝd λ_k ^d, ℒk=12nk∑i(⊤ik−yik)2−βk‖k‖22−k⊤[−1K∑j(j+j)].L_k= 12n_k\! _i(W X_i^k-y_i^k)^2- _k\| δ_k\|_2^2- λ_k \! [W- 1K\! _j(w_j+ δ_j) ]. Computing partials in feature dimension m∈1,…,dm∈\1,…,d\: ∂ℒk∂Wm _k∂ W_m =1nk∑i(⊤ik−yik)xi,mk−λk,m, = 1n_k\! _i(W X_i^k-y_i^k)\,x_i,m^k- _k,m, (A.1) ∂ℒk∂wk,m _k∂ w_k,m =1Kλk,m, = 1K\, _k,m, (A.2) ∂ℒk∂δk,m _k∂ _k,m =1Kλk,m−2βkδk,m. = 1K\, _k,m-2 _k\, _k,m. (A.3) The KKT stationarity conditions set each partial to zero. From (A.2), λk,m=0 _k,m=0 for every m. Substituting λk,m=0 _k,m=0 into (A.3) yields −2βkδk,m=0-2 _k\, _k,m=0, hence k= δ_k=0 for every k since βk>0 _k>0. The KKT point is unique modulo regularity of the data block. ∎ C.4 MFNE: definition and existence (§5.2) Definition C.1 (Mean-field Nash equilibrium). A pair (μ∗,ε∗)(μ^*, ^*) is a mean-field Nash equilibrium (MFNE) of MFPG if (i) μ∗μ^* is the stationary state distribution of (4.1) at the population mean ε¯∗=μ∗[ε] ^*=E_μ^*[ ], and (i) ε∗∈argminε∈ℰUk(ε;ε¯∗) ^*∈ _ U_k( ; ^*) for every client k. Proposition C.1 (Existence). If ℰE is finite and UkU_k is continuous in ε , then the averaged best-response map Φ:ε¯↦N−1∑kBRk(ε¯) : N^-1 _kBR_k( ) admits a fixed point on the convex hull of ℰE. Proof. Let ℰ=ε(1),…,ε(m)E=\ ^(1),…, ^(m)\ and let E:=[minℰ,maxℰ]=conv(ℰ)E:=[ , ]=conv(E). For each client k, the disutility Uk(⋅,ε¯)U_k(·, ) is continuous in the second argument by inspection of (3.3) and (4.3). The set-valued best response BRk(ε¯):=argminε∈ℰUk(ε;ε¯)⊆ℰBR_k( ):= _ \,U_k( ; ) is therefore upper hemi-continuous in ε¯ on E (Berge’s maximum theorem [6]). Define the averaged correspondence Φ:E→2E :E→ 2^E by Φ(ε¯):=1N∑k=1NconvBRk(ε¯), ( ):= 1N\! _k=1^N\,conv\,BR_k( ), where the right-hand side is the Minkowski average of convex hulls. Three properties hold: (i) Convex-valued: each convBRk(ε¯)conv\,BR_k( ) is convex, and Minkowski sums of convex sets are convex. (i) Upper hemi-continuous: the convex-hull operator preserves upper hemi-continuity [2, Thm. 17.35], and the Minkowski average of upper hemi-continuous correspondences is upper hemi-continuous. (i) Self-mapping: every value in Φ(ε¯) ( ) is a convex combination of points in ℰ⊂EE⊂ E, so Φ(ε¯)⊆E ( ) E. Since E is a non-empty compact convex subset of ℝR, Kakutani’s fixed-point theorem [2] guarantees a fixed point ε¯∗∈Φ(ε¯∗) ^*∈ ( ^*), which is the population mean of an MFNE strategy profile. ∎ C.5 Forward FPK from the controlled SDE (eq. (5.4)) Fix a type β and a feedback control ε∗(t,x;β) ^*(t,x;β). Under the controlled SDE (5.2), Itô’s formula applied to a test function φ∈Cc2(ℝd) ∈ C_c^2(R^d) gives dφ(Xt)=(∇φ⋅b+ε∗Δφ)dt+2ε∗∇φ⋅dWt.d (X_t)= (∇ · b+ ^* )dt+ 2 ^*\,∇ · dW_t. Taking expectations against μtβ _t^β and using ⟨φ,μtβ⟩=Xt∼μtβ[φ] , _t^β =E_X_t _t^β[ ], dt⟨φ,μtβ⟩=⟨∇φ⋅b+ε∗Δφ,μtβ⟩. ddt , _t^β = ∇ · b+ ^* ,\; _t^β . Two integration-by-parts identities (with vanishing boundary terms by φ∈Cc2 ∈ C_c^2), ⟨∇φ⋅b,μtβ⟩=−⟨φ,∇⋅(μtβb)⟩,⟨ε∗Δφ,μtβ⟩=⟨φ,Δ(ε∗μtβ)⟩, ∇ · b, _t^β =- ,∇\!·\!( _t^βb) , ^* , _t^β = , ( ^* _t^β) , yield dt⟨φ,μtβ⟩=⟨φ,−∇⋅(μtβb)+Δ(ε∗μtβ)⟩ ddt , _t^β = ,\,-∇\!·\!( _t^βb)+ ( ^* _t^β) . By density of Cc2C_c^2 in distributions, ∂tμtβ+∇⋅(μtβb(x,μt,ε∗(t,x;β)))=Δ(ε∗(t,x;β)μtβ). _t _t^β+∇\!·\! ( _t^β\,b (x, _t, ^*(t,x;β) ) )= ( ^*(t,x;β)\, _t^β ). When ε∗ ^* is spatially constant on the support of μtβ _t^β (for instance, after an interior optimum is reached), Δ(ε∗μtβ)=ε∗Δμtβ ( ^* _t^β)= ^* _t^β, recovering the form printed in (5.4). ∎ C.6 Backward HJB from the dynamic programming principle (eq. (5.5)) We treat the privacy term βδdp(ε)β\, _dp( ) in (5.3) as a running cost rate, consistent with the per-round accounting in the discrete-time game: under a feedback control ε , the cost incurred between t and t+ht+h is [∫t+h(ℓ(Xs;ws)+βδdp(εs))s]E [ _t^t+h\! ( (X_s;w_s)+β _dp( _s) )ds ]. The dynamic programming principle gives, for any h>0h>0, V(t,x;β)=infε[∫t+h(ℓ(Xs;ws)+βδdp(εs))s+V(t+h,Xt+h;β)].V(t,x;β)= _ \,E\! [ _t^t+h\! ( (X_s;w_s)+β _dp( _s) )ds+V(t+h,X_t+h;β) ]. For smooth V, Itô’s formula with the SDE (5.2) and a Taylor expansion in h yield V(t+h,Xt+h;β)=V(t,x;β)+h(∂tV+∇V⋅b+εTr(D2V))+o(h)+martingale.V(t+h,X_t+h;β)=V(t,x;β)+h ( _tV+∇ V· b+ \,Tr(D^2V) )+o(h)+martingale. Substituting and dividing by h→0+h→ 0^+, 0=infε∂tV+ℓ+βδdp(ε)+∇V⋅b(x,μt,ε)+εTr(D2V).0= _ \! \ _tV+ +β _dp( )+∇ V· b(x, _t, )+ \,Tr(D^2V) \. The ∂tV _tV and ℓ terms do not depend on ε and can be pulled out of the infimum, giving the backward HJB −∂tV=ℓ+infεβδdp(ε)+∇V⋅b(x,μt,ε)+εTr(D2V).- _tV= + _ \! \β _dp( )+∇ V· b(x, _t, )+ \,Tr(D^2V) \. Expanding ∇V⋅b(x,μt,ε)=−∇V⋅∇L−εσ2∇V⋅x−λ∇V⋅(x−x¯)∇ V· b(x, _t, )=-∇ V·∇ L- σ^2∇ V· x-λ∇ V·(x- x) and grouping the ε -independent terms outside the infimum yields the Hamiltonian (5.6) and the HJB (5.5). The terminal condition V(T,x;β)=0V(T,x;β)=0 encodes the zero terminal cost in (5.3). ∎ C.7 Closed-form optimal control (§5.3) Differentiating the bracketed expression of the Hamiltonian (5.6) in ε , ∂εβδdp(ε)−εσ2∇V⋅x+εTr(D2V)=βδdp′(ε)−1σ2∇V⋅x+Tr(D2V). ∂ \! \β _dp( )- σ^2∇ V· x+ \,Tr(D^2V) \=β _dp ( )- 1σ^2∇ V· x+Tr(D^2V). The LSI bound (4.3) can be written δdp(ε)=CdNexp(−θ(ε−ε0)) _dp( )= C_d N (-θ( - _0)) with θ:=αKτ/2θ:=α Kτ/2 and ε0:=(λ+G)/α _0:=(λ+G)/α, so δdp′(ε)=−θδdp(ε) _dp ( )=-θ\, _dp( ). Setting the derivative above to zero and rearranging gives the first-order condition θβδdp(ε∗)=Tr(D2V)−1σ2∇V⋅x.θ\,β\, _dp( ^*)=Tr(D^2V)- 1σ^2∇ V· x. (C.3) Solving for ε∗ ^* when the right-hand side M:=Tr(D2V)−(∇V⋅x)/σ2M:=Tr(D^2V)-(∇ V· x)/σ^2 is positive yields the closed form ε∗(t,x;β)=ε0+1θlog(βθCd/NM). ^*(t,x;β)= _0+ 1θ\, \! ( βθ C_d/ NM ). (C.4) The second-order condition ∂2/∂ε2⋅=θ2βδdp(ε∗)>0∂^2/∂ ^2\·\=θ^2β\, _dp( ^*)>0 confirms that this critical point is a minimum of the bracketed Hamiltonian. When M≤0M≤ 0 no interior optimum exists and ε∗ ^* saturates at the upper boundary εmax _ ; when the log argument is so large that ε∗<εmin ^*< _ , the optimum saturates at εmin _ . Integrating ε∗ ^* against the equilibrium population recovers the consistency condition ε¯t=∫ε∗(t,x;β)μtβ(dx)ρ(dβ), _t= ^*(t,x;β)\, _t^β(dx)\,ρ(dβ), (C.5) which is the integrated form of the scalar fixed point ε¯∗=Φ(ε¯∗) ^*= ( ^*) used by the discrete-grid solver of Section 6. ∎ C.8 Exponential DP at MFNE Theorem C.2 (Exponential DP at MFNE). Under the MFNE with mean-field strength ε∗ ^* satisfying αε∗>λ+Gα ^*>λ+G, MFPG training is (ϵdp,δdp)( _dp, _dp)-DP with δdp≤CdNexp(−(αε∗−λ−G)Kτ2), _dp≤ C_d N \! (- (α ^*-λ-G)Kτ2 ), where K is the number of training rounds. By contrast DP-SGD achieves constant δdp=δ _dp=δ with ϵdp=O(Klog(1/δ)/σ) _dp=O( K (1/δ)/σ) growing as K K. Proof. We prove the bound first under the homogeneous specialisation (βk≡β _k≡β), then extend to the heterogeneous case under a uniform activation hypothesis. Homogeneous case. If every client has the same preference β, the MFNE collapses to a single ε¯∗=ε∗ ^*= ^* shared by every client, and the population measure μt _t evolves under (4.1) with ε≡ε∗ ≡ ^*. The activation hypothesis αε∗>λ+Gα ^*>λ+G then implies r=αε∗−λ−G>0r=α ^*-λ-G>0, and Appendix C.2 gives δdp≤CdNexp(−rKτ/2) _dp≤ C_d N (-rKτ/2), which is the statement of the theorem. Heterogeneous case. For type-dependent equilibria ε∗(β) ^*(β), the per-type FPK is (5.4). For two neighbouring populations differing in a single client of type β0 _0, the contraction acts only on the affected slice μtβ0 _t _0, and the Wasserstein contraction rate of Appendix C.2 becomes r(β0)=αε∗(β0)−λ−Gr( _0)=α ^*( _0)-λ-G. The privacy guarantee for that client is δdp(β0)≤CdNexp(−r(β0)Kτ/2). _dp^( _0)≤ C_d N\, (-r( _0)Kτ/2 ). A uniform user-level guarantee is obtained by taking the worst-case rate rmin=minβr(β)=αεmin∗−λ−Gr_ = _βr(β)=α ^*_ -λ-G where εmin∗=minβε∗(β) ^*_ = _β ^*(β). The theorem states the result at the population-mean strength ε¯∗ ^* for compactness; the strict per-client guarantee applies at εmin∗≤ε¯∗ ^*_ ≤ ^* and is therefore weaker by at most a factor of exp((ε¯∗−εmin∗)αKτ/2) (( ^*- ^*_ )α Kτ/2). Both forms agree in the homogeneous case. ∎ Appendix D Experimental setup We use FedAvg with gradient clip C=1C=1 and learning rate η=0.01η=0.01 throughout. The three benchmarks span increasing complexity. (i) The quadratic task uses L(w)=12‖Aw−b‖2L(w)= 12\|Aw-b\|^2 per client with d=5,N=5,T=10d=5,\,N=5,\,T=10, providing analytical ground truth. (i) Logistic regression on synthetic binary data with d=20,N=8,T=15d=20,\,N=8,\,T=15 is the primary utility benchmark, since all four cells reach a non-trivial test accuracy. (i) MNIST classification with the MLP 784→128→64→10784→ 128→ 64→ 10 on 2,0002,000 IID-split images and N=10,T=20N=10,\,T=20 is a stress test for high parameter dimension. For the entropic cells we use the strength grid ℰ=0.1,0.3,0.5,1.0,2.0E=\0.1,0.3,0.5,1.0,2.0\, Gaussian prior ν=(0,I)ν=N(0,I), JKO step τ=0.1τ=0.1, and variance penalty λ=0.01λ=0.01. Heterogeneous client preferences are linearly spaced as βk∈[0.5β, 1.5β] _k∈[0.5β,\,1.5β] with β=1.0β=1.0. Each method’s ϵdp _dp is the value reported by its active accountant (RDP for DP-SGD and MAPG-DP, linear-budget for the entropic cells), and δdp _dp is constant for the Gaussian cells (target 10−510^-5) and computed via (4.3) for the entropic cells. Appendix E Mean-field equilibrium structure Figure 4 characterises the MFNE as a function of the heterogeneous client preferences. The equilibrium strength ε¯∗ ^* is monotonically decreasing in β: as clients become more privacy-sensitive, the population adopts stronger entropic regularisation, matching the qualitative prediction of Theorem C.2. The middle panel confirms that the corresponding δ∗δ^* tightens with β, so the LSI bound improves at exactly the clients who care most. The right panel shows the equilibrium distribution under the realistic preference range βk∈[0.5,1.5] _k∈[0.5,1.5] used elsewhere in the paper: clients concentrate on ε∗∈0.3, 0.5 ^*∈\0.3,\,0.5\ with population mean ε¯∗≈0.5 ^*≈ 0.5. This concentration is what allows MFPG to match MFEP at the population level while still returning a per-client privacy report that MFEP cannot. Figure 4: MFNE structure. Left: ε¯∗ ^* decreases with β. Centre: the corresponding LSI δ∗δ^* tightens with β. Right: for a heterogeneous population βk∈[0.5,1.5] _k∈[0.5,1.5], clients concentrate on ε∗∈0.3, 0.5 ^*∈\0.3,\,0.5\ with mean ε¯∗≈0.5 ^*≈ 0.5. Sweeping the target ϵ∈[0.1,5]ε∈[0.1,5] on logistic regression yields the privacy–utility frontier in Figure 5. MFPG matches or exceeds DP-SGD at every privacy level; MFEP and MFPG trace nearly coincident curves in this single-objective sweep because the population mean ε¯∗ ^* converges to a value MFEP can also pick. The MFPG benefit beyond MFEP appears only under heterogeneous βk _k, as documented in Figure 4 above. Figure 5: Privacy–utility frontier on logistic regression. MFPG matches or exceeds DP-SGD at every privacy level; the gap over MFEP appears only when client preferences are heterogeneous (Figure 4).