Worth skimming if you want to see how much ceremony can be wrapped around a pretty ordinary FedAvg variant. The similarity weighting is fine, but the privacy story leans on an “empirically estimated sensitivity” from a simulated neighbor, which is a very soft place to hang a DP claim. And the ϵtotal = 200 number is basically the paper’s way of saying the model works once the privacy budget stops being annoying.