  We consider cross-silo federated linear contextual bandit (LCB) problem under
differential privacy, where multiple silos (agents) interact with the local
users and communicate via a central server to realize collaboration while
without sacrificing each user's privacy. We identify three issues in the
state-of-the-art: (i) failure of claimed privacy protection and (ii) incorrect
regret bound due to noise miscalculation and (iii) ungrounded communication
cost. To resolve these issues, we take a two-step principled approach. First,
we design an algorithmic framework consisting of a generic federated LCB
algorithm and flexible privacy protocols. Then, leveraging the proposed
framework, we study federated LCBs under two different privacy constraints. We
first establish privacy and regret guarantees under silo-level local
differential privacy, which fix the issues present in state-of-the-art
algorithm. To further improve the regret performance, we next consider shuffle
model of differential privacy, under which we show that our algorithm can
achieve nearly ``optimal'' regret without a trusted server. We accomplish this
via two different schemes -- one relies on a new result on privacy
amplification via shuffling for DP mechanisms and another one leverages the
integration of a shuffle protocol for vector sum into the tree-based mechanism,
both of which might be of independent interest. Finally, we support our
theoretical results with numerical evaluations over contextual bandit instances
generated from both synthetic and real-life data.
