  Providing privacy protection has been one of the primary motivations of
Federated Learning (FL). Recently, there has been a line of work on
incorporating the formal privacy notion of differential privacy with FL. To
guarantee the client-level differential privacy in FL algorithms, the clients'
transmitted model updates have to be clipped before adding privacy noise. Such
clipping operation is substantially different from its counterpart of gradient
clipping in the centralized differentially private SGD and has not been
well-understood. In this paper, we first empirically demonstrate that the
clipped FedAvg can perform surprisingly well even with substantial data
heterogeneity when training neural networks, which is partly because the
clients' updates become similar for several popular deep architectures. Based
on this key observation, we provide the convergence analysis of a differential
private (DP) FedAvg algorithm and highlight the relationship between clipping
bias and the distribution of the clients' updates. To the best of our
knowledge, this is the first work that rigorously investigates theoretical and
empirical issues regarding the clipping operation in FL algorithms.
