I. Introduction
Recently, federated learning (FL) has received tremendous research attention due to its capability in protecting data privacy for machine learning. In vanilla FL, a parameter server (PS) is in charge of collection, aggregation and distribution of model parameters with scattered clients. Clients conduct local iterations to update model parameters for multiple rounds, but never expose their original samples to the PS [1], [2], [3], [4], [5].