  Differentially Private Federated Learning (DP-FL) has garnered attention as a
collaborative machine learning approach that ensures formal privacy. Most DP-FL
approaches ensure DP at the record-level within each silo for cross-silo FL.
However, a single user's data may extend across multiple silos, and the desired
user-level DP guarantee for such a setting remains unknown. In this study, we
present Uldp-FL, a novel FL framework designed to guarantee user-level DP in
cross-silo FL where a single user's data may belong to multiple silos. Our
proposed algorithm directly ensures user-level DP through per-user weighted
clipping, departing from group-privacy approaches. We provide a theoretical
analysis of the algorithm's privacy and utility. Additionally, we enhance the
utility of the proposed algorithm with an enhanced weighting strategy based on
user record distribution and design a novel private protocol that ensures no
additional information is revealed to the silos and the server. Experiments on
real-world datasets show substantial improvements in our methods in
privacy-utility trade-offs under user-level DP compared to baseline methods. To
the best of our knowledge, our work is the first FL framework that effectively
provides user-level DP in the general cross-silo FL setting.
