ERIS: Enhancing the Privacy-Utility-Scalability Trade-Off in Federated Learning via Federated Shard Aggregation

Dario Fenoglio; Pasquale Polverino; Akash Dhasade; Jacopo Quizi; Martin Gjoreski; Marc Langheinrich

cs.LGFeb 9, 2026

ERIS: Enhancing the Privacy-Utility-Scalability Trade-Off in Federated Learning via Federated Shard Aggregation

Authors: Dario Fenoglio, Pasquale Polverino, Akash Dhasade, Jacopo Quizi, Martin Gjoreski, Marc Langheinrich

Organizations: Universit`a della Svizzera italiana Lugano, Switzerland · Carnegie Mellon University Pittsburgh, PA, United States

Abstract

Scaling Federated Learning (FL) to billion-parameter models forces a challenging trade-off between privacy, scalability, and model utility. Existing solutions often tackle these challenges in isolation, sacrificing accuracy, relying on costly cryptographic tools, or introducing communication and optimization inefficiencies that affect convergence. We introduce ERIS, an FL framework centered on Federated Shard Aggregation (FSA), a novel mechanism that partitions each client update into non-overlapping shards whose aggregation is distributed across multiple client-side aggregators. FSA removes the central aggregation bottleneck, limits the information visible to any single observer, and preserves the centralized FL update after reassembly. ERIS can further readily integrate Distributed Shifted Compression (DSC) to reduce transmitted payloads and exposed coordinates. We prove that ERIS preserves convergence under standard assumptions and bounds mutual information leakage by the observable fraction of each update, decreasing with the number of client-side aggregators, and with the compression level when DSC is enabled. Experiments across image and text tasks, including large language models, show that ERIS achieves FedAvg-level utility while substantially reducing communication bottlenecks and improving robustness to membership inference and reconstruction attacks, without relying on heavy cryptography or utility-degrading perturbations.

Figures & tables

Figure 1: Illustration of eris at training round $t$ for two aggregators ( $A\!=\!2$ ). Left: each client optionally applies \compline DSC and then performs FSA partitioning, generating shards $\mathbf{v}^{t}_{k,(a)}$ sent to aggregators $C_{2}$ and $C_{k-1}$ . Right: each aggregator collects and aggregates the corresponding shards across clients to produce partial updated models $\mathbf{x}^{t+1}_{(a)}$ , which are sent back to the clients.

Figure 2: Effect of FSA ( left ) and DSC ( right ).

	CNN/DailyMail – GPT-Neo		IMDB – DistilBERT		CIFAR-10 – ResNet9		MNIST – LeNet5
Method	R-1 ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Acc. ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Acc. ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Acc. ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )
FedAvg	33.22 $\pm$ 0.99	97.94 $\pm$ 0.63	79.60 $\pm$ 0.83	68.21 $\pm$ 1.36	34.86 $\pm$ 0.31	68.46 $\pm$ 0.96	88.91 $\pm$ 0.35	65.11 $\pm$ 0.78
FedAvg ( $\epsilon,\delta$ ) -LDP	26.00 $\pm$ 0.28	51.98 $\pm$ 3.13	53.97 $\pm$ 0.04	50.55 $\pm$ 1.18	19.00 $\pm$ 0.47	63.35 $\pm$ 0.85	61.03 $\pm$ 1.03	57.24 $\pm$ 0.59
SoteriaFL ( $\epsilon,\delta$ )	25.40 $\pm$ 0.70	52.14 $\pm$ 2.97	54.24 $\pm$ 0.15	51.25 $\pm$ 1.19	17.18 $\pm$ 0.24	58.83 $\pm$ 0.56	57.27 $\pm$ 0.88	57.13 $\pm$ 0.56
PriPrune ( $p_{1}$ )	24.67 $\pm$ 4.64	71.35 $\pm$ 2.83	74.15 $\pm$ 1.00	66.36 $\pm$ 1.13	26.30 $\pm$ 0.39	65.67 $\pm$ 0.84	77.41 $\pm$ 1.52	62.21 $\pm$ 1.01
PriPrune ( $p_{2}$ )	24.67 $\pm$ 4.64	71.35 $\pm$ 2.83	66.30 $\pm$ 2.14	63.61 $\pm$ 1.11	11.24 $\pm$ 0.71	56.55 $\pm$ 0.78	27.36 $\pm$ 1.04	52.69 $\pm$ 0.83

Table 1: Mean test performance (ROUGE-1 for CNN/DailyMail, accuracy for others) and MIA accuracy, averaged over varying local sample sizes. Configuration:

\epsilon{=}10

; pruning rate

p\!\in\!\{0.1,0.2,0.3\}

on IMDB/CNN-DailyMail, and

p\!\in\!\{0.01,0.05,0.1\}

on others.

Figure 3: Comparison of test accuracy and (1- MIA) accuracy across varying model capacities (one per dataset) and client-side overfitting levels, controlled via the number of training samples per client.

Appendix figures & tables27 assets

Supplementary material from the paper’s appendix.

Appendix

Algorithm	Privacy	Utility / Accuracy
Distributed DP-SRM [ 129 ]	$(\varepsilon,\delta)$ -DP	$\tilde{\mathcal{O}}\!\left(\dfrac{\sqrt{n\log(1/\delta)}}{Km\varepsilon}\right)$
SDM-DSGD [ 130 ]	$(\varepsilon,\delta)$ -LDP	$\tilde{\mathcal{O}}\!\left(\dfrac{\sqrt{n\log(1/\delta)}}{\sqrt{K}m\varepsilon}\right)$
Q-DPSGD-1 [ 36 ]	$(\varepsilon,\delta)$ -LDP	$\tilde{\mathcal{O}}\!\left(\dfrac{\bigl(\frac{\tilde{\nu}^{2}}{K}+\frac{1}{m}\bigr)^{\!\!2/3}\bigl(n\log(1/\delta)\bigr)^{1/3}}{m^{2/3}\varepsilon^{2/3}}\right)$
CDP-SGD [ 60 ]	$(\varepsilon,\delta)$ -LDP	$\tilde{\mathcal{O}}\!\left(\dfrac{\sqrt{(1+\omega)\,n\log(1/\delta)}}{\sqrt{K}m\varepsilon}\right)$
SoteriaFL-SGD [ 60 ]	$(\varepsilon,\delta)$ -LDP	$\tilde{\mathcal{O}}\!\left(\dfrac{\sqrt{(1+\omega)\,n\log(1/\delta)}}{\sqrt{K}m\varepsilon}\,(1+\sqrt{\tau})\right)$
eris -SGD (+ dsc )	—	$\tilde{\mathcal{O}}\!\left(\dfrac{\sqrt{1+\omega}}{\sqrt{K}m}\right)$

Appendix

Table 2: Asymptotic utility / accuracy bounds (average squared gradient norm after

T

rounds) for different (local) differentially-private FL algorithms for the nonconvex problem in ( 1 ), compared to the non-DP utility bound of eris -SGD with DSC. Here

K

is the number of clients,

m

the number of samples per client,

n

the model dimension,

\omega

the compressor variance parameter, and

(\varepsilon,\delta)

the privacy parameters. All bounds hide absolute constants and, where standard, additional logarithmic factors. For SoteriaFL,

\tau:=(1+\omega)^{3/2}/\sqrt{K}

. Note that smaller values of the bound correspond to better utility / accuracy.

Figure 6: Impact of honest-but-curious client collusion in eris .

Figure 7: Weight-value histograms across coordinates over training rounds for DistilBERT, ResNet-9, and LeNet-5. Each 3-D plot shows the distribution of weight values (horizontal axis) over time (depth axis), with frequency on the vertical axis. In all cases, the distributions remain approximately Gaussian-shaped, with empirical standard deviation below $0.2$ throughout training.

Figure 8: Minimum distribution time for a single training round for FedAvg, PriPrune, SoteriaFL, Ako, Shatter, and eris . The figure shows the minimum distribution time for a single round with

M=320

Mbit on a logarithmic scale ( left ), and the minimum distribution time for a single round with 50 training clients as the model size increases on a logarithmic scale ( right ).

Figure 9: Effect of transmission rate on minimum per-round distribution time for FedAvg, PriPrune, SoteriaFL, Ako, Shatter, and eris . eris remains faster across transmission rates due to shard-based communication and distributed aggregation, with further gains from larger

A

and DSC.

Method	CNN/Daily Mail — GPT-Neo (1.3B)					IMDB — DistilBERT (69M)
Method	Comp.	Upload	Down.	Tot.	Time	Comp.	Upload	Down.	Tot.	Time
FedAvg	100%	5.2 GB	5.2 GB	10.4 GB	5200.0 s	100%	268.0 MB	268.0 MB	536.0 MB	670.0 s
Shatter	100%	5.2 GB	5.2 GB	36.4 GB	780.0 s	100%	268.0 MB	268.0 MB	2.41 GB	53.6 s
Ako ( $p{=}5$ )	100%	9.36 GB	9.36 GB	18.72 GB	936.0 s	100%	1.29 GB	1.29 GB	2.57 GB	128.64 s
Q-DPSGD-1 ( $K_{n}{=}0.4$ )	18.8%	3.51 GB	3.51 GB	37.44 GB	351.0 s	18.8%	482.4 MB	482.4 MB	5.15 GB	48.24 s
PriPrune (0.01)	90%	4.68 GB	5.2 GB	9.88 GB	4940.0 s	90%	241.2 MB	268.0 MB	509.2 MB	636.5 s

Appendix

Table 3: Direct communication comparison (per-client) across FL/DFL baselines.

Method	CIFAR-10 — ResNet9 (1.65M)					MNIST — LeNet5 (62K)
Method	Comp.	Upload	Down.	Tot.	Time	Comp.	Upload	Down.	Tot.	Time
FedAvg	100%	6.6 MB	6.6 MB	13.2 MB	33.0 s	100%	248.0 KB	248.0 KB	496.0 KB	1.24 s
Shatter	100%	6.6 MB	6.6 MB	59.4 MB	1.32 s	100%	248.0 KB	248.0 KB	2.23 MB	0.05 s
Ako ( $p{=}5$ )	100%	64.68 MB	64.68 MB	129.36 MB	6.47 s	100%	2.43 MB	2.43 MB	4.86 MB	0.24 s
Q-DPSGD-1 ( $K_{n}{=}0.4$ )	18.8%	24.25 MB	24.25 MB	258.72 MB	2.43 s	18.8%	911.4 KB	911.4 KB	9.72 MB	0.09 s
PriPrune (0.01)	99%	6.53 MB	6.6 MB	13.13 MB	32.84 s	99%	245.52 KB	248.0 KB	493.52 KB	1.23 s

Appendix

Table 4: Direct communication comparison (per-client) across FL/DFL baselines (continued).

Figure 10: Effect of DSC on CIFAR-10, varying

\omega

across different local training sample sizes.

	64 samples		128 samples		256 samples		415 samples
Method	Acc. ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Acc. ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Acc. ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Acc. ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )
FedAvg	46.4 $\pm$ 0.4	93.9 $\pm$ 0.7	50.0 $\pm$ 0.6	89.9 $\pm$ 0.3	56.6 $\pm$ 0.5	85.9 $\pm$ 0.3	63.3 $\pm$ 0.4	82.2 $\pm$ 0.1
FedAvg+LDP	27.2 $\pm$ 0.4	58.1 $\pm$ 0.2	29.9 $\pm$ 0.2	56.4 $\pm$ 0.4	33.2 $\pm$ 0.3	54.5 $\pm$ 0.5	36.3 $\pm$ 0.2	54.0 $\pm$ 0.8
PriPrune	45.0 $\pm$ 0.3	74.4 $\pm$ 0.8	49.0 $\pm$ 0.5	74.1 $\pm$ 1.0	56.1 $\pm$ 0.5	78.1 $\pm$ 0.8	63.1 $\pm$ 0.3	75.8 $\pm$ 0.3
eris (+ dsc )	46.2 $\pm$ 0.9	71.1 $\pm$ 0.8	49.7 $\pm$ 0.7	69.8 $\pm$ 0.7	56.0 $\pm$ 0.7	68.6 $\pm$ 0.7	62.9 $\pm$ 0.4	68.4 $\pm$ 0.5
Min. Leakage	46.4 $\pm$ 0.3	72.6 $\pm$ 0.9	49.9 $\pm$ 0.7	71.3 $\pm$ 0.8	57.0 $\pm$ 0.2	69.9 $\pm$ 0.5	63.2 $\pm$ 0.3	67.9 $\pm$ 0.6

Appendix

Table 5: CIFAR-10 in a larger-data regime: accuracy and MIA accuracy for increasing numbers of training samples per client. Results confirm a stable utility–privacy trend beyond the low-data regime.

Figure 11: Robustness of eris to aggregator dropout. Left: test accuracy remains nearly constant up to a 70% dropout rate. Right: convergence slows as dropout increases, eventually hitting the 200-round cap, which explains the accuracy drop beyond 70%.

Figure 12: Robustness of eris to client–aggregator link failures. Left: accuracy remains close to the no-failure setting up to 50% link failures. Right: convergence slows as link failures increase, with the best round approaching the 200-round cap, which explains the accuracy drop at higher failure rates.

Figure 13: Reconstruction quality under DLG, iDLG, and ROG attacks as a function of the percentage of model parameters available to the attacker. The LPIPS score (higher is better) is averaged over 200 samples. The x-axis is plotted on a non-linear scale for improved clarity of the low-percentage regime. Shaded regions highlight the obfuscation achieved by eris , which renders reconstruction attacks ineffective even in its weakest configuration (two aggregators and no compression).

Method	ROG	GGL
FedAvg	0.193 $\pm$ 0.059	0.666 $\pm$ 0.053
QSGD ( $s=16$ )	0.209 $\pm$ 0.060	0.670 $\pm$ 0.057
QSGD ( $s=8$ )	0.250 $\pm$ 0.065	0.671 $\pm$ 0.058
QSGD ( $s=4$ )	0.343 $\pm$ 0.074	0.676 $\pm$ 0.055
Uniform Quantization ( $s=16$ )	0.243 $\pm$ 0.066	0.676 $\pm$ 0.055
Uniform Quantization ( $s=8$ )	0.302 $\pm$ 0.071	0.673 $\pm$ 0.064

Appendix

Table 6: Reconstruction quality under ROG and GGL attacks across privacy-preserving mechanisms and compression techniques on CIFAR-10 and ImageNet, respectively. For LPIPS, higher values indicate stronger defenses (

\uparrow

Local Training Size	$16$ samples		$32$ samples		$64$ samples		$128$ samples
Method	R-1 ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	R-1 ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	R-1 ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	R-1 ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )
FedAvg	30.37 ± 1.25	100.00 ± 0.00	32.21 ± 1.46	98.75 ± 1.25	34.27 ± 0.65	96.46 ± 0.36	36.04 ± 0.57	96.57 ± 0.90
FedAvg ( $10,\delta$ )-LDP	25.66 ± 0.86	54.17 ± 5.20	26.26 ± 0.07	50.00 ± 3.31	26.30 ± 0.10	49.33 ± 2.53	25.78 ± 0.10	54.41 ± 1.47
FedAvg ( $100,\delta$ )-LDP	26.33 ± 0.07	54.17 ± 5.20	26.36 ± 0.10	50.42 ± 2.89	24.90 ± 0.13	48.75 ± 2.25	26.32 ± 0.10	54.31 ± 1.19
SoteriaFL ( $\epsilon=100$ )	25.89 ± 0.12	54.13 ± 1.15	26.09 ± 0.07	54.27 ± 5.20	26.01 ± 0.11	50.35 ± 2.89	24.02 ± 0.15	49.15 ± 2.15
SoteriaFL ( $\epsilon=10$ )	25.78 ± 0.91	54.02 ± 1.48	25.90 ± 0.36	54.17 ± 5.20	25.90 ± 0.75	50.83 ± 2.60	24.75 ± 0.79	49.54 ± 2.60

Appendix

Table 7: Comparison of eris with and without compression (

\omega

) against SOTA baselines in terms of ROUGE-1 and MIA accuracy on CNN/DailyMail with 16, 32, 64, and 128 local training samples.

Local Training Size	$4$ samples		$8$ samples		$16$ samples
Method	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )
FedAvg	71.73 ± 4.93	82.93 ± 6.39	79.56 ± 0.61	78.40 ± 3.95	80.52 ± 0.30	66.91 ± 1.81
FedAvg ( $\epsilon=100,\delta$ )-LDP	53.79 ± 0.08	55.56 ± 4.91	53.82 ± 0.06	53.33 ± 1.00	53.92 ± 0.11	50.06 ± 2.81
FedAvg ( $\epsilon=10,\delta$ )-LDP	53.80 ± 0.03	52.80 ± 5.82	53.81 ± 0.02	50.40 ± 3.12	53.83 ± 0.06	49.89 ± 1.74
SoteriaFL ( $\epsilon=100,\delta$ )	53.46 ± 0.15	55.56 ± 6.00	54.73 ± 0.15	54.40 ± 1.96	53.74 ± 0.16	50.30 ± 2.69
SoteriaFL ( $\epsilon=10,\delta$ )	53.36 ± 0.29	55.20 ± 5.63	54.01 ± 0.24	51.36 ± 3.48	53.67 ± 0.29	50.11 ± 1.58

Appendix

Table 8: Comparison of eris with and without compression (

\omega

) against SOTA baselines in terms of test and MIA accuracy on IMDB with 4, 8, and 16 local training samples.

Local Training Size	$32$ samples		$64$ samples		$128$ samples
Method	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )
FedAvg	81.62 ± 0.11	63.58 ± 1.47	81.70 ± 0.05	60.54 ± 2.11	82.45 ± 0.18	56.89 ± 0.81
FedAvg ( $\epsilon=100,\delta$ )-LDP	54.11 ± 0.15	51.56 ± 1.71	54.50 ± 0.19	50.67 ± 1.60	55.09 ± 0.32	51.26 ± 0.49
FedAvg ( $\epsilon=10,\delta$ )-LDP	53.97 ± 0.10	50.02 ± 1.52	54.12 ± 0.12	49.84 ± 0.86	54.30 ± 0.19	50.37 ± 0.92
SoteriaFL ( $\epsilon=100,\delta$ )	54.87 ± 0.72	51.94 ± 1.94	55.81 ± 0.62	50.98 ± 1.87	56.08 ± 1.19	51.17 ± 0.52
SoteriaFL ( $\epsilon=10,\delta$ )	54.35 ± 0.39	50.10 ± 1.83	54.79 ± 0.35	50.12 ± 0.93	55.28 ± 0.57	50.64 ± 0.92

Appendix

Table 9: Comparison of eris with and without compression (

\omega

) against SOTA baselines in terms of test and MIA accuracy on IMDB with 32, 64, and 128 local training samples.

Local Training Size	$4$ samples		$8$ samples		$16$ samples
Method	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )
FedAvg	27.12 ± 1.20	84.80 ± 4.59	32.98 ± 0.61	75.84 ± 2.85	34.43 ± 1.04	70.15 ± 1.41
FedAvg ( $\epsilon=10,\delta$ )-LDP	10.33 ± 0.53	81.20 ± 3.90	14.93 ± 2.01	72.40 ± 2.60	18.92 ± 1.31	62.55 ± 1.19
FedAvg ( $\epsilon=1,\delta$ )-LDP	10.34 ± 0.22	66.50 ± 3.78	10.00 ± 0.00	63.60 ± 2.42	10.00 ± 0.00	56.05 ± 0.49
SoteriaFL ( $\epsilon=10,\delta$ )	10.00 ± 0.00	69.87 ± 1.86	10.06 ± 0.12	64.16 ± 1.25	10.85 ± 1.06	58.25 ± 2.10
SoteriaFL ( $\epsilon=1,\delta$ )	9.99 ± 0.00	65.67 ± 1.11	10.00 ± 0.00	62.10 ± 1.56	10.00 ± 0.00	53.86 ± 0.67

Appendix

Table 10: Comparison of eris with and without compression (

\omega

) against SOTA baselines in terms of test and MIA accuracy on CIFAR-10 with 4, 8, and 16 local training samples.

Local Training Size	$32$ samples		$64$ samples		$128$ samples
Method	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )
FedAvg	37.24 ± 0.41	64.57 ± 0.72	38.50 ± 0.44	59.29 ± 0.79	38.88 ± 0.32	56.11 ± 0.75
FedAvg ( $\epsilon=10,\delta$ )-LDP	22.31 ± 1.12	57.14 ± 1.39	23.36 ± 0.85	53.99 ± 0.83	24.13 ± 0.32	52.81 ± 0.49
FedAvg ( $\epsilon=1,\delta$ )-LDP	10.00 ± 0.00	57.57 ± 0.26	13.96 ± 1.14	54.42 ± 0.40	19.29 ± 0.37	53.12 ± 0.16
SoteriaFL ( $\epsilon=10,\delta$ )	19.68 ± 0.78	55.68 ± 1.09	26.04 ± 0.52	52.94 ± 0.74	26.46 ± 0.25	52.07 ± 0.55
SoteriaFL ( $\epsilon=1,\delta$ )	10.00 ± 0.00	54.57 ± 0.50	10.00 ± 0.00	53.28 ± 0.61	12.20 ± 1.25	52.58 ± 0.53

Appendix

Table 11: Comparison of eris with and without compression (

\omega

) against SOTA baselines in terms of test and MIA accuracy on CIFAR-10 with 32, 64, and 128 local training samples.

Local Training Size	$4$ samples		$8$ samples		$16$ samples
Method	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )
FedAvg	80.69 ± 1.71	82.13 ± 1.65	86.42 ± 0.88	72.00 ± 3.01	89.23 ± 0.74	65.78 ± 2.24
FedAvg ( $\epsilon=10,\delta$ )-LDP	39.65 ± 3.14	69.07 ± 1.67	50.84 ± 4.75	59.44 ± 2.00	64.40 ± 1.53	57.67 ± 1.61
FedAvg ( $\epsilon=1,\delta$ )-LDP	9.73 ± 0.46	69.50 ± 1.72	10.70 ± 1.27	58.50 ± 0.71	19.80 ± 1.38	57.55 ± 1.66
SoteriaFL ( $\epsilon=10,\delta$ )	8.83 ± 2.65	71.47 ± 1.81	32.15 ± 2.00	57.68 ± 1.83	67.01 ± 1.31	56.87 ± 1.69
SoteriaFL ( $\epsilon=1,\delta$ )	10.31 ± 0.38	67.50 ± 2.33	10.84 ± 0.79	57.90 ± 2.37	12.72 ± 1.33	57.27 ± 1.44

Appendix

Table 12: Comparison of eris with and without compression (

\omega

) against SOTA baselines in terms of test and MIA accuracy on MNIST with 4, 8, and 16 local training samples.

Local Training Size	$32$ samples		$64$ samples		$128$ samples
Method	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )
FedAvg	91.48 ± 0.37	59.94 ± 1.11	92.55 ± 0.06	56.68 ± 1.92	93.11 ± 0.16	54.14 ± 0.65
FedAvg ( $\epsilon=10,\delta$ )-LDP	70.35 ± 1.31	53.05 ± 1.09	70.43 ± 1.27	53.00 ± 1.00	70.48 ± 0.39	51.20 ± 0.91
FedAvg ( $\epsilon=1,\delta$ )-LDP	57.75 ± 0.87	54.71 ± 0.85	70.96 ± 0.71	52.72 ± 0.74	70.56 ± 0.34	51.40 ± 0.66
SoteriaFL ( $\epsilon=10,\delta$ )	77.95 ± 2.38	53.28 ± 0.60	78.15 ± 2.66	52.16 ± 0.84	79.50 ± 1.45	51.29 ± 0.77
SoteriaFL ( $\epsilon=1,\delta$ )	8.49 ± 1.87	54.14 ± 0.53	40.37 ± 1.44	52.83 ± 0.24	68.75 ± 0.38	51.89 ± 0.53

Appendix

Table 13: Comparison of eris with and without compression (

\omega

) against SOTA baselines in terms of test and MIA accuracy on MNIST with 32, 64, and 128 local training samples.

Figure 14: Comparison of accuracy and (1-MIA) accuracy across varying model sizes and client-side overfitting levels, controlled via the number of client training samples under non-IID setting.

	IMDB – DistilBERT		CIFAR-10 – ResNet9		MNIST – LeNet5
Method	Acc. ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Acc. ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Acc. ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )
FedAvg	68.02 $\pm$ 7.03	72.34 $\pm$ 3.33	29.83 $\pm$ 0.85	63.52 $\pm$ 1.28	84.80 $\pm$ 1.76	60.17 $\pm$ 1.29
FedAvg ( $\epsilon,\delta$ ) -LDP	53.79 $\pm$ 0.30	52.00 $\pm$ 3.97	15.13 $\pm$ 1.37	58.83 $\pm$ 1.73	55.69 $\pm$ 2.83	57.39 $\pm$ 2.31
SoteriaFL ( $\epsilon,\delta$ )	53.75 $\pm$ 0.81	52.70 $\pm$ 3.86	14.46 $\pm$ 0.55	59.07 $\pm$ 1.64	51.75 $\pm$ 2.77	57.64 $\pm$ 1.80
PriPrune ( $p_{1}$ )	57.01 $\pm$ 7.37	70.48 $\pm$ 3.42	21.30 $\pm$ 2.36	59.73 $\pm$ 1.52	74.80 $\pm$ 3.78	58.50 $\pm$ 1.56
PriPrune ( $p_{2}$ )	53.64 $\pm$ 3.40	67.52 $\pm$ 3.52	11.51 $\pm$ 1.41	57.71 $\pm$ 3.03	24.94 $\pm$ 5.34	53.95 $\pm$ 1.89

Appendix

Table 14: Mean test accuracy and MIA accuracy, averaged over varying local sample sizes under non-IID setting. For DP-based methods,

\epsilon{=}10

; for PriPrune, pruning rates are

p\!\in\!\{0.1,0.2,0.3\}

on IMDB and

p\!\in\!\{0.01,0.05,0.1\}

on CIFAR-10/MNIST.

Figure 15: Comparison of test accuracy and (1-MIA) accuracy across varying model capacities (one per dataset) and client-side overfitting levels, controlled via the number of training samples per client using a biased gradient estimator.

	IMDB – DistilBERT		CIFAR-10 – ResNet9		MNIST – LeNet5
Method	Acc. ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Acc. ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Acc. ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )
FedAvg	78.11 $\pm$ 1.42	80.13 $\pm$ 2.11	39.23 $\pm$ 0.76	94.03 $\pm$ 0.69	89.95 $\pm$ 0.77	68.65 $\pm$ 1.63
FedAvg ( $\epsilon_{1},\delta$ ) -LDP	54.39 $\pm$ 0.57	51.75 $\pm$ 2.69	10.78 $\pm$ 0.36	59.17 $\pm$ 1.21	29.02 $\pm$ 1.20	58.81 $\pm$ 0.95
FedAvg ( $\epsilon_{2},\delta$ ) -LDP	55.00 $\pm$ 1.10	52.69 $\pm$ 2.74	20.62 $\pm$ 0.57	67.34 $\pm$ 1.46	68.77 $\pm$ 2.09	60.33 $\pm$ 1.42
SoteriaFL ( $\epsilon_{1},\delta$ )	54.90 $\pm$ 0.74	52.66 $\pm$ 2.73	10.03 $\pm$ 0.01	56.30 $\pm$ 0.84	14.23 $\pm$ 1.39	56.25 $\pm$ 0.95
SoteriaFL ( $\epsilon_{2},\delta$ )	55.40 $\pm$ 1.88	53.44 $\pm$ 2.62	11.70 $\pm$ 0.75	60.69 $\pm$ 0.89	65.11 $\pm$ 1.88	57.16 $\pm$ 1.16

Appendix

Table 15: Mean test accuracy and MIA accuracy, averaged over varying local sample sizes using a biased gradient estimator. For DP-based methods,

\epsilon\!\in\!\{10,100\}

on IMDB and

\epsilon\!\in\!\{1,10\}

on others; for PriPrune, pruning rates are

p\!\in\!\{0.1,0.2,0.3\}

on IMDB and

p\!\in\!\{0.01,0.05,0.1\}

on others.

Figure 16: Utility–privacy trade-off on CIFAR-10 under varying strengths of the privacy-preserving mechanisms. Each subplot shows test accuracy vs. (1-MIA) accuracy for methods with different client training samples. The Pareto front represents a set of optimal trade-off points.

FedAvg + LDP
	4 samples		8 samples		16 samples
Method	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )
No LDP	27.12% $\pm$ 1.20%	84.80% $\pm$ 4.59%	32.98% $\pm$ 0.61%	75.84% $\pm$ 2.85%	34.43% $\pm$ 1.04%	70.15% $\pm$ 1.41%
LDP ( $\epsilon$ =0.001, C=10)	23.01% $\pm$ 2.00%	84.67% $\pm$ 4.24%	26.13% $\pm$ 2.30%	75.44% $\pm$ 1.90%	30.88% $\pm$ 1.30%	69.53% $\pm$ 1.31%
LDP ( $\epsilon$ =0.01, C=5)	22.20% $\pm$ 0.71%	83.33% $\pm$ 4.17%	25.91% $\pm$ 2.23%	74.08% $\pm$ 2.58%	28.48% $\pm$ 0.72%	66.95% $\pm$ 1.29%
LDP ( $\epsilon$ =0.1, C=2)	18.20% $\pm$ 1.58%	83.07% $\pm$ 2.78%	23.60% $\pm$ 0.76%	72.16% $\pm$ 4.06%	24.97% $\pm$ 0.48%	64.18% $\pm$ 2.05%

Appendix

Table 16: Mean test accuracy and privacy leakage (with standard deviation) for various privacy‐preserving mechanisms across different local sample sizes. DP‐based methods use epsilon

\epsilon

and clipping norm

C

; PriPrune uses rate

p

Figure 17: Temporal evolution of utility and privacy leakage on MNIST. Left: validation accuracy. Right: MIA accuracy, with random guessing indicated at 50%. Curves and shaded regions report the mean and standard deviation over three seeds.

Federated Learning

Federated learning trains shared models across data holders without requiring them to pool their raw data.

See all 921 papers

Apr 13, 2026

A Full Compression Pipeline for Green Federated Learning in Communication-Constrained Environments

Federated Learning (FL) enables collaborative model training across distributed clients without sharing raw data, thereby preserving privacy. However, FL often suffers from significant communication and computational overhead, limiting its scalability and sustainability. In this work, we introduce a Full Compression Pipeline (FCP) for FL in communication-constrained environments. FCP integrates three complementary deep compression techniques (pruning, quantization, and Huffman encoding) into a unified end-to-end framework. By compressing local models and communication payloads, FCP substantially reduces transmission costs and resource consumption while maintaining competitive accuracy. To quantify its impact, we develop an evaluation framework that captures both communication and computation overheads as a unified model cost, allowing a holistic assessment of efficiency trade-offs. The pipeline is evaluated in an independent and identically distributed (IID) and non-IID data setting. In one representative scenario, training a ResNet-12 model on the CIFAR-10 dataset with ten clients and a 2 Mbps bandwidth, the FCP achieves more than 11

\times

reduction in model size, with only a 2% drop in accuracy compared to the uncompressed baseline. This results in an FL training that is more than 60% faster.

Elouan Colybes, Shirin Salehi, Anke Schmeink

Chair of Information Theory and Data Analytics (INDA), RWTH Aachen University, Aachen, Germany

Federated Learning Communication-Efficient Distributed Training

Ask PDF

Apr 23, 2026

Shard the Gradient, Scale the Model: Serverless Federated Aggregation via Gradient Partitioning

Federated learning (FL) aggregation on serverless platforms faces a hard scalability ceiling: existing architectures (lambda-FL, LIFL) partition clients across aggregators, but every aggregator must hold the complete model gradient in memory. When gradients exceed the per-function memory limit (e.g., 10 GB on AWS Lambda), aggregation becomes infeasible regardless of tree depth or branching factor. We propose GradsSharding, which instead partitions the gradient tensor into M shards, each averaged independently by a serverless function that receives contributions from all clients. Because FedAvg averaging is element-wise, this produces bit-identical results to tree-based approaches, so model accuracy is invariant by construction. Per-function memory is bounded at O(|θ|/M), independent of client count, enabling aggregation of arbitrarily large models. We evaluate GradsSharding against lambda-FL and LIFL through HPC experiments and real AWS Lambda deployments across model sizes from 43 MB to 5 GB. Results show a cost crossover at approximately 500 MB gradient size, 2.7x cost reduction at VGG-16 scale, and that GradsSharding is the only architecture that remains deployable beyond the serverless memory ceiling.

Amine Barrak

Department of Computer Science and Engineering, Oakland University, Rochester, MI 48309, USA

Federated Learning Aggregation Cloud Computing Federated Learning

Ask PDF

Oct 1, 2026

Latent Information Sharing for Accelerating Federated Learning

Federated learning (FL) is a communication-efficient distributed learning paradigm. However, client drift remains one of the most critical challenges, hindering the efficient training of a global model. In this study, we propose a novel latent information sharing scheme that directly mitigates data heterogeneity across clients. Our theoretical and empirical results show that sharing a small amount of hidden-layer activations significantly improves training efficiency while preserving convergence guarantees and data privacy. Furthermore, we compare our method with existing FL approaches designed to address client drift, including FedProx, SCAFFOLD, FedPVR, FedProto, and SplitFed, and demonstrate superior model accuracy under a fixed round budget without incurring excessive communication overhead. Overall, this work presents a promising new knowledge aggregation scheme and provides a comprehensive analysis of the impact of activation sharing on federated optimization.

Seungjun Lee, Ensieh Khazaei, Dimitrios Hatzinakos +2

Inha University · University of Toronto · University of Birmingham

Federated Learning Aggregation Federated Learning Heterogeneous Federated Learning

Ask PDF

Abstract

Federated Learning

Explore similar work

A Full Compression Pipeline for Green Federated Learning in Communication-Constrained Environments

Shard the Gradient, Scale the Model: Serverless Federated Aggregation via Gradient Partitioning

Latent Information Sharing for Accelerating Federated Learning