ERIS: Enhancing the Privacy-Utility-Scalability Trade-Off in Federated Learning via Federated Shard Aggregation

Dario Fenoglio; Pasquale Polverino; Akash Dhasade; Jacopo Quizi; Martin Gjoreski; Marc Langheinrich

cs.LGFeb 9, 2026

ERIS: Enhancing the Privacy-Utility-Scalability Trade-Off in Federated Learning via Federated Shard Aggregation

Authors: Dario Fenoglio, Pasquale Polverino, Akash Dhasade, Jacopo Quizi, Martin Gjoreski, Marc Langheinrich

Organizations: Universit`a della Svizzera italiana Lugano, Switzerland · Carnegie Mellon University Pittsburgh, PA, United States

Abstract

Scaling Federated Learning (FL) to billion-parameter models forces a challenging trade-off between privacy, scalability, and model utility. Existing solutions often tackle these challenges in isolation, sacrificing accuracy, relying on costly cryptographic tools, or introducing communication and optimization inefficiencies that affect convergence. We introduce ERIS, an FL framework centered on Federated Shard Aggregation (FSA), a novel mechanism that partitions each client update into non-overlapping shards whose aggregation is distributed across multiple client-side aggregators. FSA removes the central aggregation bottleneck, limits the information visible to any single observer, and preserves the centralized FL update after reassembly. ERIS can further readily integrate Distributed Shifted Compression (DSC) to reduce transmitted payloads and exposed coordinates. We prove that ERIS preserves convergence under standard assumptions and bounds mutual information leakage by the observable fraction of each update, decreasing with the number of client-side aggregators, and with the compression level when DSC is enabled. Experiments across image and text tasks, including large language models, show that ERIS achieves FedAvg-level utility while substantially reducing communication bottlenecks and improving robustness to membership inference and reconstruction attacks, without relying on heavy cryptography or utility-degrading perturbations.

Figures & tables

Figure 1: Illustration of eris at training round $t$ for two aggregators ( $A\!=\!2$ ). Left: each client optionally applies \compline DSC and then performs FSA partitioning, generating shards $\mathbf{v}^{t}_{k,(a)}$ sent to aggregators $C_{2}$ and $C_{k-1}$ . Right: each aggregator collects and aggregates the corresponding shards across clients to produce partial updated models $\mathbf{x}^{t+1}_{(a)}$ , which are sent back to the clients.

Figure 2: Effect of FSA ( left ) and DSC ( right ).

	CNN/DailyMail – GPT-Neo		IMDB – DistilBERT		CIFAR-10 – ResNet9		MNIST – LeNet5
Method	R-1 ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Acc. ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Acc. ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Acc. ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )
FedAvg	33.22 $\pm$ 0.99	97.94 $\pm$ 0.63	79.60 $\pm$ 0.83	68.21 $\pm$ 1.36	34.86 $\pm$ 0.31	68.46 $\pm$ 0.96	88.91 $\pm$ 0.35	65.11 $\pm$ 0.78
FedAvg ( $\epsilon,\delta$ ) -LDP	26.00 $\pm$ 0.28	51.98 $\pm$ 3.13	53.97 $\pm$ 0.04	50.55 $\pm$ 1.18	19.00 $\pm$ 0.47	63.35 $\pm$ 0.85	61.03 $\pm$ 1.03	57.24 $\pm$ 0.59
SoteriaFL ( $\epsilon,\delta$ )	25.40 $\pm$ 0.70	52.14 $\pm$ 2.97	54.24 $\pm$ 0.15	51.25 $\pm$ 1.19	17.18 $\pm$ 0.24	58.83 $\pm$ 0.56	57.27 $\pm$ 0.88	57.13 $\pm$ 0.56
PriPrune ( $p_{1}$ )	24.67 $\pm$ 4.64	71.35 $\pm$ 2.83	74.15 $\pm$ 1.00	66.36 $\pm$ 1.13	26.30 $\pm$ 0.39	65.67 $\pm$ 0.84	77.41 $\pm$ 1.52	62.21 $\pm$ 1.01
PriPrune ( $p_{2}$ )	24.67 $\pm$ 4.64	71.35 $\pm$ 2.83	66.30 $\pm$ 2.14	63.61 $\pm$ 1.11	11.24 $\pm$ 0.71	56.55 $\pm$ 0.78	27.36 $\pm$ 1.04	52.69 $\pm$ 0.83

Table 1: Mean test performance (ROUGE-1 for CNN/DailyMail, accuracy for others) and MIA accuracy, averaged over varying local sample sizes. Configuration:

\epsilon{=}10

; pruning rate

p\!\in\!\{0.1,0.2,0.3\}

on IMDB/CNN-DailyMail, and

p\!\in\!\{0.01,0.05,0.1\}

on others.

Figure 3: Comparison of test accuracy and (1- MIA) accuracy across varying model capacities (one per dataset) and client-side overfitting levels, controlled via the number of training samples per client.

Appendix figures & tables27 assets

Supplementary material from the paper’s appendix.

Appendix

Algorithm	Privacy	Utility / Accuracy
Distributed DP-SRM [ 129 ]	$(\varepsilon,\delta)$ -DP	$\tilde{\mathcal{O}}\!\left(\dfrac{\sqrt{n\log(1/\delta)}}{Km\varepsilon}\right)$
SDM-DSGD [ 130 ]	$(\varepsilon,\delta)$ -LDP	$\tilde{\mathcal{O}}\!\left(\dfrac{\sqrt{n\log(1/\delta)}}{\sqrt{K}m\varepsilon}\right)$
Q-DPSGD-1 [ 36 ]	$(\varepsilon,\delta)$ -LDP	$\tilde{\mathcal{O}}\!\left(\dfrac{\bigl(\frac{\tilde{\nu}^{2}}{K}+\frac{1}{m}\bigr)^{\!\!2/3}\bigl(n\log(1/\delta)\bigr)^{1/3}}{m^{2/3}\varepsilon^{2/3}}\right)$
CDP-SGD [ 60 ]	$(\varepsilon,\delta)$ -LDP	$\tilde{\mathcal{O}}\!\left(\dfrac{\sqrt{(1+\omega)\,n\log(1/\delta)}}{\sqrt{K}m\varepsilon}\right)$
SoteriaFL-SGD [ 60 ]	$(\varepsilon,\delta)$ -LDP	$\tilde{\mathcal{O}}\!\left(\dfrac{\sqrt{(1+\omega)\,n\log(1/\delta)}}{\sqrt{K}m\varepsilon}\,(1+\sqrt{\tau})\right)$
eris -SGD (+ dsc )	—	$\tilde{\mathcal{O}}\!\left(\dfrac{\sqrt{1+\omega}}{\sqrt{K}m}\right)$

Appendix

Table 2: Asymptotic utility / accuracy bounds (average squared gradient norm after

T

rounds) for different (local) differentially-private FL algorithms for the nonconvex problem in ( 1 ), compared to the non-DP utility bound of eris -SGD with DSC. Here

K

is the number of clients,

m

the number of samples per client,

n

the model dimension,

\omega

the compressor variance parameter, and

(\varepsilon,\delta)

the privacy parameters. All bounds hide absolute constants and, where standard, additional logarithmic factors. For SoteriaFL,

\tau:=(1+\omega)^{3/2}/\sqrt{K}

. Note that smaller values of the bound correspond to better utility / accuracy.

Figure 6: Impact of honest-but-curious client collusion in eris .

Figure 7: Weight-value histograms across coordinates over training rounds for DistilBERT, ResNet-9, and LeNet-5. Each 3-D plot shows the distribution of weight values (horizontal axis) over time (depth axis), with frequency on the vertical axis. In all cases, the distributions remain approximately Gaussian-shaped, with empirical standard deviation below $0.2$ throughout training.

Figure 8: Minimum distribution time for a single training round for FedAvg, PriPrune, SoteriaFL, Ako, Shatter, and eris . The figure shows the minimum distribution time for a single round with

M=320

Mbit on a logarithmic scale ( left ), and the minimum distribution time for a single round with 50 training clients as the model size increases on a logarithmic scale ( right ).

Figure 9: Effect of transmission rate on minimum per-round distribution time for FedAvg, PriPrune, SoteriaFL, Ako, Shatter, and eris . eris remains faster across transmission rates due to shard-based communication and distributed aggregation, with further gains from larger

A

and DSC.

Method	CNN/Daily Mail — GPT-Neo (1.3B)					IMDB — DistilBERT (69M)
Method	Comp.	Upload	Down.	Tot.	Time	Comp.	Upload	Down.	Tot.	Time
FedAvg	100%	5.2 GB	5.2 GB	10.4 GB	5200.0 s	100%	268.0 MB	268.0 MB	536.0 MB	670.0 s
Shatter	100%	5.2 GB	5.2 GB	36.4 GB	780.0 s	100%	268.0 MB	268.0 MB	2.41 GB	53.6 s
Ako ( $p{=}5$ )	100%	9.36 GB	9.36 GB	18.72 GB	936.0 s	100%	1.29 GB	1.29 GB	2.57 GB	128.64 s
Q-DPSGD-1 ( $K_{n}{=}0.4$ )	18.8%	3.51 GB	3.51 GB	37.44 GB	351.0 s	18.8%	482.4 MB	482.4 MB	5.15 GB	48.24 s
PriPrune (0.01)	90%	4.68 GB	5.2 GB	9.88 GB	4940.0 s	90%	241.2 MB	268.0 MB	509.2 MB	636.5 s

Appendix

Table 3: Direct communication comparison (per-client) across FL/DFL baselines.

Method	CIFAR-10 — ResNet9 (1.65M)					MNIST — LeNet5 (62K)
Method	Comp.	Upload	Down.	Tot.	Time	Comp.	Upload	Down.	Tot.	Time
FedAvg	100%	6.6 MB	6.6 MB	13.2 MB	33.0 s	100%	248.0 KB	248.0 KB	496.0 KB	1.24 s
Shatter	100%	6.6 MB	6.6 MB	59.4 MB	1.32 s	100%	248.0 KB	248.0 KB	2.23 MB	0.05 s
Ako ( $p{=}5$ )	100%	64.68 MB	64.68 MB	129.36 MB	6.47 s	100%	2.43 MB	2.43 MB	4.86 MB	0.24 s
Q-DPSGD-1 ( $K_{n}{=}0.4$ )	18.8%	24.25 MB	24.25 MB	258.72 MB	2.43 s	18.8%	911.4 KB	911.4 KB	9.72 MB	0.09 s
PriPrune (0.01)	99%	6.53 MB	6.6 MB	13.13 MB	32.84 s	99%	245.52 KB	248.0 KB	493.52 KB	1.23 s

Appendix

Table 4: Direct communication comparison (per-client) across FL/DFL baselines (continued).

Figure 10: Effect of DSC on CIFAR-10, varying

\omega

across different local training sample sizes.

	64 samples		128 samples		256 samples		415 samples
Method	Acc. ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Acc. ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Acc. ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Acc. ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )
FedAvg	46.4 $\pm$ 0.4	93.9 $\pm$ 0.7	50.0 $\pm$ 0.6	89.9 $\pm$ 0.3	56.6 $\pm$ 0.5	85.9 $\pm$ 0.3	63.3 $\pm$ 0.4	82.2 $\pm$ 0.1
FedAvg+LDP	27.2 $\pm$ 0.4	58.1 $\pm$ 0.2	29.9 $\pm$ 0.2	56.4 $\pm$ 0.4	33.2 $\pm$ 0.3	54.5 $\pm$ 0.5	36.3 $\pm$ 0.2	54.0 $\pm$ 0.8
PriPrune	45.0 $\pm$ 0.3	74.4 $\pm$ 0.8	49.0 $\pm$ 0.5	74.1 $\pm$ 1.0	56.1 $\pm$ 0.5	78.1 $\pm$ 0.8	63.1 $\pm$ 0.3	75.8 $\pm$ 0.3
eris (+ dsc )	46.2 $\pm$ 0.9	71.1 $\pm$ 0.8	49.7 $\pm$ 0.7	69.8 $\pm$ 0.7	56.0 $\pm$ 0.7	68.6 $\pm$ 0.7	62.9 $\pm$ 0.4	68.4 $\pm$ 0.5
Min. Leakage	46.4 $\pm$ 0.3	72.6 $\pm$ 0.9	49.9 $\pm$ 0.7	71.3 $\pm$ 0.8	57.0 $\pm$ 0.2	69.9 $\pm$ 0.5	63.2 $\pm$ 0.3	67.9 $\pm$ 0.6

Appendix

Table 5: CIFAR-10 in a larger-data regime: accuracy and MIA accuracy for increasing numbers of training samples per client. Results confirm a stable utility–privacy trend beyond the low-data regime.

Figure 11: Robustness of eris to aggregator dropout. Left: test accuracy remains nearly constant up to a 70% dropout rate. Right: convergence slows as dropout increases, eventually hitting the 200-round cap, which explains the accuracy drop beyond 70%.

Figure 12: Robustness of eris to client–aggregator link failures. Left: accuracy remains close to the no-failure setting up to 50% link failures. Right: convergence slows as link failures increase, with the best round approaching the 200-round cap, which explains the accuracy drop at higher failure rates.

Figure 13: Reconstruction quality under DLG, iDLG, and ROG attacks as a function of the percentage of model parameters available to the attacker. The LPIPS score (higher is better) is averaged over 200 samples. The x-axis is plotted on a non-linear scale for improved clarity of the low-percentage regime. Shaded regions highlight the obfuscation achieved by eris , which renders reconstruction attacks ineffective even in its weakest configuration (two aggregators and no compression).

Method	ROG	GGL
FedAvg	0.193 $\pm$ 0.059	0.666 $\pm$ 0.053
QSGD ( $s=16$ )	0.209 $\pm$ 0.060	0.670 $\pm$ 0.057
QSGD ( $s=8$ )	0.250 $\pm$ 0.065	0.671 $\pm$ 0.058
QSGD ( $s=4$ )	0.343 $\pm$ 0.074	0.676 $\pm$ 0.055
Uniform Quantization ( $s=16$ )	0.243 $\pm$ 0.066	0.676 $\pm$ 0.055
Uniform Quantization ( $s=8$ )	0.302 $\pm$ 0.071	0.673 $\pm$ 0.064

Appendix

Table 6: Reconstruction quality under ROG and GGL attacks across privacy-preserving mechanisms and compression techniques on CIFAR-10 and ImageNet, respectively. For LPIPS, higher values indicate stronger defenses (

\uparrow

Local Training Size	$16$ samples		$32$ samples		$64$ samples		$128$ samples
Method	R-1 ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	R-1 ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	R-1 ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	R-1 ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )
FedAvg	30.37 ± 1.25	100.00 ± 0.00	32.21 ± 1.46	98.75 ± 1.25	34.27 ± 0.65	96.46 ± 0.36	36.04 ± 0.57	96.57 ± 0.90
FedAvg ( $10,\delta$ )-LDP	25.66 ± 0.86	54.17 ± 5.20	26.26 ± 0.07	50.00 ± 3.31	26.30 ± 0.10	49.33 ± 2.53	25.78 ± 0.10	54.41 ± 1.47
FedAvg ( $100,\delta$ )-LDP	26.33 ± 0.07	54.17 ± 5.20	26.36 ± 0.10	50.42 ± 2.89	24.90 ± 0.13	48.75 ± 2.25	26.32 ± 0.10	54.31 ± 1.19
SoteriaFL ( $\epsilon=100$ )	25.89 ± 0.12	54.13 ± 1.15	26.09 ± 0.07	54.27 ± 5.20	26.01 ± 0.11	50.35 ± 2.89	24.02 ± 0.15	49.15 ± 2.15
SoteriaFL ( $\epsilon=10$ )	25.78 ± 0.91	54.02 ± 1.48	25.90 ± 0.36	54.17 ± 5.20	25.90 ± 0.75	50.83 ± 2.60	24.75 ± 0.79	49.54 ± 2.60

Appendix

Table 7: Comparison of eris with and without compression (

\omega

) against SOTA baselines in terms of ROUGE-1 and MIA accuracy on CNN/DailyMail with 16, 32, 64, and 128 local training samples.

Local Training Size	$4$ samples		$8$ samples		$16$ samples
Method	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )
FedAvg	71.73 ± 4.93	82.93 ± 6.39	79.56 ± 0.61	78.40 ± 3.95	80.52 ± 0.30	66.91 ± 1.81
FedAvg ( $\epsilon=100,\delta$ )-LDP	53.79 ± 0.08	55.56 ± 4.91	53.82 ± 0.06	53.33 ± 1.00	53.92 ± 0.11	50.06 ± 2.81
FedAvg ( $\epsilon=10,\delta$ )-LDP	53.80 ± 0.03	52.80 ± 5.82	53.81 ± 0.02	50.40 ± 3.12	53.83 ± 0.06	49.89 ± 1.74
SoteriaFL ( $\epsilon=100,\delta$ )	53.46 ± 0.15	55.56 ± 6.00	54.73 ± 0.15	54.40 ± 1.96	53.74 ± 0.16	50.30 ± 2.69
SoteriaFL ( $\epsilon=10,\delta$ )	53.36 ± 0.29	55.20 ± 5.63	54.01 ± 0.24	51.36 ± 3.48	53.67 ± 0.29	50.11 ± 1.58

Appendix

Table 8: Comparison of eris with and without compression (

\omega

) against SOTA baselines in terms of test and MIA accuracy on IMDB with 4, 8, and 16 local training samples.

Local Training Size	$32$ samples		$64$ samples		$128$ samples
Method	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )
FedAvg	81.62 ± 0.11	63.58 ± 1.47	81.70 ± 0.05	60.54 ± 2.11	82.45 ± 0.18	56.89 ± 0.81
FedAvg ( $\epsilon=100,\delta$ )-LDP	54.11 ± 0.15	51.56 ± 1.71	54.50 ± 0.19	50.67 ± 1.60	55.09 ± 0.32	51.26 ± 0.49
FedAvg ( $\epsilon=10,\delta$ )-LDP	53.97 ± 0.10	50.02 ± 1.52	54.12 ± 0.12	49.84 ± 0.86	54.30 ± 0.19	50.37 ± 0.92
SoteriaFL ( $\epsilon=100,\delta$ )	54.87 ± 0.72	51.94 ± 1.94	55.81 ± 0.62	50.98 ± 1.87	56.08 ± 1.19	51.17 ± 0.52
SoteriaFL ( $\epsilon=10,\delta$ )	54.35 ± 0.39	50.10 ± 1.83	54.79 ± 0.35	50.12 ± 0.93	55.28 ± 0.57	50.64 ± 0.92

Appendix

Table 9: Comparison of eris with and without compression (

\omega

) against SOTA baselines in terms of test and MIA accuracy on IMDB with 32, 64, and 128 local training samples.

Local Training Size	$4$ samples		$8$ samples		$16$ samples
Method	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )
FedAvg	27.12 ± 1.20	84.80 ± 4.59	32.98 ± 0.61	75.84 ± 2.85	34.43 ± 1.04	70.15 ± 1.41
FedAvg ( $\epsilon=10,\delta$ )-LDP	10.33 ± 0.53	81.20 ± 3.90	14.93 ± 2.01	72.40 ± 2.60	18.92 ± 1.31	62.55 ± 1.19
FedAvg ( $\epsilon=1,\delta$ )-LDP	10.34 ± 0.22	66.50 ± 3.78	10.00 ± 0.00	63.60 ± 2.42	10.00 ± 0.00	56.05 ± 0.49
SoteriaFL ( $\epsilon=10,\delta$ )	10.00 ± 0.00	69.87 ± 1.86	10.06 ± 0.12	64.16 ± 1.25	10.85 ± 1.06	58.25 ± 2.10
SoteriaFL ( $\epsilon=1,\delta$ )	9.99 ± 0.00	65.67 ± 1.11	10.00 ± 0.00	62.10 ± 1.56	10.00 ± 0.00	53.86 ± 0.67

Appendix

Table 10: Comparison of eris with and without compression (

\omega

) against SOTA baselines in terms of test and MIA accuracy on CIFAR-10 with 4, 8, and 16 local training samples.

Local Training Size	$32$ samples		$64$ samples		$128$ samples
Method	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )
FedAvg	37.24 ± 0.41	64.57 ± 0.72	38.50 ± 0.44	59.29 ± 0.79	38.88 ± 0.32	56.11 ± 0.75
FedAvg ( $\epsilon=10,\delta$ )-LDP	22.31 ± 1.12	57.14 ± 1.39	23.36 ± 0.85	53.99 ± 0.83	24.13 ± 0.32	52.81 ± 0.49
FedAvg ( $\epsilon=1,\delta$ )-LDP	10.00 ± 0.00	57.57 ± 0.26	13.96 ± 1.14	54.42 ± 0.40	19.29 ± 0.37	53.12 ± 0.16
SoteriaFL ( $\epsilon=10,\delta$ )	19.68 ± 0.78	55.68 ± 1.09	26.04 ± 0.52	52.94 ± 0.74	26.46 ± 0.25	52.07 ± 0.55
SoteriaFL ( $\epsilon=1,\delta$ )	10.00 ± 0.00	54.57 ± 0.50	10.00 ± 0.00	53.28 ± 0.61	12.20 ± 1.25	52.58 ± 0.53

Appendix

Table 11: Comparison of eris with and without compression (

\omega

) against SOTA baselines in terms of test and MIA accuracy on CIFAR-10 with 32, 64, and 128 local training samples.

Local Training Size	$4$ samples		$8$ samples		$16$ samples
Method	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )
FedAvg	80.69 ± 1.71	82.13 ± 1.65	86.42 ± 0.88	72.00 ± 3.01	89.23 ± 0.74	65.78 ± 2.24
FedAvg ( $\epsilon=10,\delta$ )-LDP	39.65 ± 3.14	69.07 ± 1.67	50.84 ± 4.75	59.44 ± 2.00	64.40 ± 1.53	57.67 ± 1.61
FedAvg ( $\epsilon=1,\delta$ )-LDP	9.73 ± 0.46	69.50 ± 1.72	10.70 ± 1.27	58.50 ± 0.71	19.80 ± 1.38	57.55 ± 1.66
SoteriaFL ( $\epsilon=10,\delta$ )	8.83 ± 2.65	71.47 ± 1.81	32.15 ± 2.00	57.68 ± 1.83	67.01 ± 1.31	56.87 ± 1.69
SoteriaFL ( $\epsilon=1,\delta$ )	10.31 ± 0.38	67.50 ± 2.33	10.84 ± 0.79	57.90 ± 2.37	12.72 ± 1.33	57.27 ± 1.44

Appendix

Table 12: Comparison of eris with and without compression (

\omega

) against SOTA baselines in terms of test and MIA accuracy on MNIST with 4, 8, and 16 local training samples.

Local Training Size	$32$ samples		$64$ samples		$128$ samples
Method	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )
FedAvg	91.48 ± 0.37	59.94 ± 1.11	92.55 ± 0.06	56.68 ± 1.92	93.11 ± 0.16	54.14 ± 0.65
FedAvg ( $\epsilon=10,\delta$ )-LDP	70.35 ± 1.31	53.05 ± 1.09	70.43 ± 1.27	53.00 ± 1.00	70.48 ± 0.39	51.20 ± 0.91
FedAvg ( $\epsilon=1,\delta$ )-LDP	57.75 ± 0.87	54.71 ± 0.85	70.96 ± 0.71	52.72 ± 0.74	70.56 ± 0.34	51.40 ± 0.66
SoteriaFL ( $\epsilon=10,\delta$ )	77.95 ± 2.38	53.28 ± 0.60	78.15 ± 2.66	52.16 ± 0.84	79.50 ± 1.45	51.29 ± 0.77
SoteriaFL ( $\epsilon=1,\delta$ )	8.49 ± 1.87	54.14 ± 0.53	40.37 ± 1.44	52.83 ± 0.24	68.75 ± 0.38	51.89 ± 0.53

Appendix

Table 13: Comparison of eris with and without compression (

\omega

) against SOTA baselines in terms of test and MIA accuracy on MNIST with 32, 64, and 128 local training samples.

Figure 14: Comparison of accuracy and (1-MIA) accuracy across varying model sizes and client-side overfitting levels, controlled via the number of client training samples under non-IID setting.

	IMDB – DistilBERT		CIFAR-10 – ResNet9		MNIST – LeNet5
Method	Acc. ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Acc. ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Acc. ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )
FedAvg	68.02 $\pm$ 7.03	72.34 $\pm$ 3.33	29.83 $\pm$ 0.85	63.52 $\pm$ 1.28	84.80 $\pm$ 1.76	60.17 $\pm$ 1.29
FedAvg ( $\epsilon,\delta$ ) -LDP	53.79 $\pm$ 0.30	52.00 $\pm$ 3.97	15.13 $\pm$ 1.37	58.83 $\pm$ 1.73	55.69 $\pm$ 2.83	57.39 $\pm$ 2.31
SoteriaFL ( $\epsilon,\delta$ )	53.75 $\pm$ 0.81	52.70 $\pm$ 3.86	14.46 $\pm$ 0.55	59.07 $\pm$ 1.64	51.75 $\pm$ 2.77	57.64 $\pm$ 1.80
PriPrune ( $p_{1}$ )	57.01 $\pm$ 7.37	70.48 $\pm$ 3.42	21.30 $\pm$ 2.36	59.73 $\pm$ 1.52	74.80 $\pm$ 3.78	58.50 $\pm$ 1.56
PriPrune ( $p_{2}$ )	53.64 $\pm$ 3.40	67.52 $\pm$ 3.52	11.51 $\pm$ 1.41	57.71 $\pm$ 3.03	24.94 $\pm$ 5.34	53.95 $\pm$ 1.89

Appendix

Table 14: Mean test accuracy and MIA accuracy, averaged over varying local sample sizes under non-IID setting. For DP-based methods,

\epsilon{=}10

; for PriPrune, pruning rates are

p\!\in\!\{0.1,0.2,0.3\}

on IMDB and

p\!\in\!\{0.01,0.05,0.1\}

on CIFAR-10/MNIST.

Figure 15: Comparison of test accuracy and (1-MIA) accuracy across varying model capacities (one per dataset) and client-side overfitting levels, controlled via the number of training samples per client using a biased gradient estimator.

	IMDB – DistilBERT		CIFAR-10 – ResNet9		MNIST – LeNet5
Method	Acc. ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Acc. ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Acc. ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )
FedAvg	78.11 $\pm$ 1.42	80.13 $\pm$ 2.11	39.23 $\pm$ 0.76	94.03 $\pm$ 0.69	89.95 $\pm$ 0.77	68.65 $\pm$ 1.63
FedAvg ( $\epsilon_{1},\delta$ ) -LDP	54.39 $\pm$ 0.57	51.75 $\pm$ 2.69	10.78 $\pm$ 0.36	59.17 $\pm$ 1.21	29.02 $\pm$ 1.20	58.81 $\pm$ 0.95
FedAvg ( $\epsilon_{2},\delta$ ) -LDP	55.00 $\pm$ 1.10	52.69 $\pm$ 2.74	20.62 $\pm$ 0.57	67.34 $\pm$ 1.46	68.77 $\pm$ 2.09	60.33 $\pm$ 1.42
SoteriaFL ( $\epsilon_{1},\delta$ )	54.90 $\pm$ 0.74	52.66 $\pm$ 2.73	10.03 $\pm$ 0.01	56.30 $\pm$ 0.84	14.23 $\pm$ 1.39	56.25 $\pm$ 0.95
SoteriaFL ( $\epsilon_{2},\delta$ )	55.40 $\pm$ 1.88	53.44 $\pm$ 2.62	11.70 $\pm$ 0.75	60.69 $\pm$ 0.89	65.11 $\pm$ 1.88	57.16 $\pm$ 1.16

Appendix

Table 15: Mean test accuracy and MIA accuracy, averaged over varying local sample sizes using a biased gradient estimator. For DP-based methods,

\epsilon\!\in\!\{10,100\}

on IMDB and

\epsilon\!\in\!\{1,10\}

on others; for PriPrune, pruning rates are

p\!\in\!\{0.1,0.2,0.3\}

on IMDB and

p\!\in\!\{0.01,0.05,0.1\}

on others.

Figure 16: Utility–privacy trade-off on CIFAR-10 under varying strengths of the privacy-preserving mechanisms. Each subplot shows test accuracy vs. (1-MIA) accuracy for methods with different client training samples. The Pareto front represents a set of optimal trade-off points.

FedAvg + LDP
	4 samples		8 samples		16 samples
Method	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )	Accuracy ( $\uparrow$ )	MIA Acc. ( $\downarrow$ )
No LDP	27.12% $\pm$ 1.20%	84.80% $\pm$ 4.59%	32.98% $\pm$ 0.61%	75.84% $\pm$ 2.85%	34.43% $\pm$ 1.04%	70.15% $\pm$ 1.41%
LDP ( $\epsilon$ =0.001, C=10)	23.01% $\pm$ 2.00%	84.67% $\pm$ 4.24%	26.13% $\pm$ 2.30%	75.44% $\pm$ 1.90%	30.88% $\pm$ 1.30%	69.53% $\pm$ 1.31%
LDP ( $\epsilon$ =0.01, C=5)	22.20% $\pm$ 0.71%	83.33% $\pm$ 4.17%	25.91% $\pm$ 2.23%	74.08% $\pm$ 2.58%	28.48% $\pm$ 0.72%	66.95% $\pm$ 1.29%
LDP ( $\epsilon$ =0.1, C=2)	18.20% $\pm$ 1.58%	83.07% $\pm$ 2.78%	23.60% $\pm$ 0.76%	72.16% $\pm$ 4.06%	24.97% $\pm$ 0.48%	64.18% $\pm$ 2.05%

Appendix

Table 16: Mean test accuracy and privacy leakage (with standard deviation) for various privacy‐preserving mechanisms across different local sample sizes. DP‐based methods use epsilon

\epsilon

and clipping norm

C

; PriPrune uses rate

p

Figure 17: Temporal evolution of utility and privacy leakage on MNIST. Left: validation accuracy. Right: MIA accuracy, with random guessing indicated at 50%. Curves and shaded regions report the mean and standard deviation over three seeds.

Federated Learning

Federated learning trains shared models across data holders without requiring them to pool their raw data.

See all 921 papers

A Full Compression Pipeline for Green Federated Learning in Communication-Constrained Environments
Apr 13, 2026Elouan Colybes, Shirin Salehi, Anke SchmeinkFederated Learning Communication-Efficient Distributed Training
Chair of Information Theory and Data Analytics (INDA), RWTH Aachen University, Aachen, Germany
Shard the Gradient, Scale the Model: Serverless Federated Aggregation via Gradient Partitioning
Apr 23, 2026Amine BarrakFederated Learning Aggregation Cloud Computing
Department of Computer Science and Engineering, Oakland University, Rochester, MI 48309, USA
Latent Information Sharing for Accelerating Federated Learning
Oct 1, 2026Seungjun Lee, Ensieh Khazaei, Dimitrios Hatzinakos +2Federated Learning Aggregation Federated Learning
Inha University · University of Toronto · University of Birmingham

Apr 13, 2026J/K move · Enter open · S save

A Full Compression Pipeline for Green Federated Learning in Communication-Constrained Environments

Elouan Colybes, Shirin Salehi, Anke Schmeink

Chair of Information Theory and Data Analytics (INDA), RWTH Aachen University, Aachen, Germany

Federated Learning Communication-Efficient Distributed Training

Open paper AskPDF arXiv

Federated Learning (FL) enables collaborative model training across distributed clients without sharing raw data, thereby preserving privacy. However, FL often suffers from significant communication and computational overhead, limiting its scalability and sustainability. In this work, we introduce a Full Compression Pipeline (FCP) for FL in communication-constrained environments. FCP integrates three complementary deep compression techniques (pruning, quantization, and Huffman encoding) into a unified end-to-end framework. By compressing local models and communication payloads, FCP substantially reduces transmission costs and resource consumption while maintaining competitive accuracy. To quantify its impact, we develop an evaluation framework that captures both communication and computation overheads as a unified model cost, allowing a holistic assessment of efficiency trade-offs. The pipeline is evaluated in an independent and identically distributed (IID) and non-IID data setting. In one representative scenario, training a ResNet-12 model on the CIFAR-10 dataset with ten clients and a 2 Mbps bandwidth, the FCP achieves more than 11

\times

reduction in model size, with only a 2% drop in accuracy compared to the uncompressed baseline. This results in an FL training that is more than 60% faster.

Abstract

Federated Learning

Explore similar work

A Full Compression Pipeline for Green Federated Learning in Communication-Constrained Environments

Shard the Gradient, Scale the Model: Serverless Federated Aggregation via Gradient Partitioning

Latent Information Sharing for Accelerating Federated Learning