cs.LGAug 23, 2026

GCA: Global Centroid Alignment in Federated Learning

Authors: Jong-Ik Park, Harry Jiang, Logan Blakely, Georgios Fragkos, Shamina Hossain-McKenzie, Carlee Joe-Wong

Organizations: Carnegie Mellon University · Sandia National Laboratories

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Autoencoder (AE)-based federated learning (FL) is attractive for anomaly detection when clients have limited local data. However, conventional FL exchanges AE parameters or gradients, incurring substantial communication overhead and potentially exposing input training data information, since AEs are explicitly optimized to reconstruct their inputs. We introduce Global Centroid Alignment (GCA), a latent-code-mediated FL protocol that coordinates clients without transmitting AE parameters or gradients. In each round, (1) clients first train their local AEs using a reconstruction update and upload a small subset of encoder latent codes to the FL server. (2) The server pools these codes, fits a clustering model, and broadcasts only global latent centroids and their support counts. (3) Each client then updates its encoder by aligning its local latent codes with the nearest centroid using inverse-count weighting to emphasize globally underrepresented patterns. Steps (1)--(3) repeat over communication rounds. Because GCA exchanges only sampled latent codes and centroid statistics, its communication cost depends on latent dimensionality and the numbers of uploaded codes and returned centroids rather than on AE model size. Across five tabular and two vision benchmarks, GCA yields higher reconstruction error under a server-side client data extraction attack in all 21 comparisons and clearly lower cosine similarity in 20 of 21 comparisons with FedAvg, FedProx, and FedNova, showing its ability to protect training data. It even improves test accuracy over FedAvg by up to 5.76%5.76\%. GCA achieves extraction defense comparable to DP-FedAvg, remains effective when DP-FedAvg does not reduce target resemblance, and lowers per-round communication by up to 99.15%99.15\%.

Figures & tables

Figure 1: GCA pipeline. (1) Local training: each client trains an autoencoder on local normal data. (2) Generate/Upload Latent upload: clients generate and upload a subset of latent codes. (3) Server aggregation: the server pools latents, performs clustering, and computes global latent centroids and support counts. (4) Broadcast: the server sends centroids and support counts to participating clients. (5) Alignment: clients align their encoders to the global latent centroids using the broadcast statistics, improving cross-client consistency while keeping data and model updates private.
Figure 2: Server-side training-data extraction threat models. Top: Standard FL. The server obtains the victim reconstruction map and performs DeepDream-style input optimization. Bottom: GCA. The server receives uploaded latent codes, trains a fresh surrogate reconstruction map, and applies the same input optimization. Both attacks output the model reconstruction of the optimized input.
Figure 3: IID anomaly-detection test accuracy; higher is better. GCA outperforms Single-Client training on all seven datasets and achieves accuracy comparable to the parameter-sharing FL baselines. Bars show three-seed means and standard deviations. Full results are in Appendix E (Table 6 ).
Figure 4: Normalized target MSE (NTMSE) under the server-side extraction attack; higher is better for extraction defense. Higher NTMSE means that the attack outputs have larger reconstruction error relative to held-out normal records and are therefore less similar to the client’s training data. Bars show three-seed means and standard deviations. Full results are in Appendix E (Table 10 ).
Figure 5: Excess cosine similarity under the server-side extraction attack; lower is better for extraction defense. Lower excess cosine similarity means that the attack outputs are less similar to the client’s training data relative to held-out normal records. Bars show three-seed means and standard deviations. Full results are in Appendix E (Table 10 ).
Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

MethodClient objectiveCommunicated objectServer operationKey setting
Single-ClientReconstructionNoneNone10 local epochs
CentralizedReconstructionPooled training dataCentral trainingEpoch-equivalent budget
FedAvgReconstructionAE model updateSample-size-weighted averaging10 local epochs
FedProxReconstruction plus proximal termAE model updateSample-size-weighted averagingConfigured μ=10−2\mu=10^{-2} ; effective coefficient 10−410^{-4}
FedNovaReconstructionNormalized AE updateNormalized aggregationτi=10nibatch\tau_{i}=10n_{i}^{\mathrm{batch}} ; sample-size-weighted normalization
DP-FedAvgReconstructionClipped and noisy AE updateFedAvg aggregationclip 1.0; σ=1.0\sigma=1.0
Appendix
Table 1: Implementation summary for all compared approaches.
More in this topic

Privacy-Preserving Federated Learning

See all 41 papers

Explore similar work

CardsList
Jul 8, 2026

FedCVESA: Taking Away Training Data in Federated Learning via Correlation Value Encoding and Segmented Aggregation

Federated learning (FL) avoids explicit data exposure by keeping raw data on local clients, yet privacy risks remain in the training process and the learned model itself. Recently, centralized Taking Away Training Data (TATD) attacks have shown that malicious training could abuse the memorization capacity of deep models to store and later recover training data. However, this memorization-based threat has not been systematically studied under FL environments, where multi-client averaging could overwrite encoded training data. In this paper, we study a white-box TATD attack in which a malicious server selects n target clients from K participating clients and actively writes private training data into the global model during federated training. We propose FedCVESA, a federated variant of Correlation Value Encoding Attack (CVEA), by adding a Pearson-correlation regularizer to the loss function of target clients, so that private training data are gradually encoded into selected model parameters, referred to as carrier parameters. To reduce the overwriting of carrier parameters during server aggregation, we further propose segmented aggregation over dispersed carrier parameters, preserving selected carrier parameters while keeping standard averaging on the remaining parameters. Experiments on MNIST, Fashion-MNIST, and CIFAR-10 under Dirichlet non-IID partitions show that the proposed method can steal semantically meaningful private training images from the trained model while maintaining acceptable main-task utility in a controlled proof-of-concept setting. These results demonstrate that FL can become a parameter-level memorization channel for active TATD attack under the studied white-box malicious-server setting.

Chongkai Li, Bang Zhang, Wenjian Luo

Guangdong Provincial Key Laboratory of Novel Security Intelligence Technologies, Institute of Cyberspace Security, School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen 518055, China

Privacy-Preserving MLTraining Data Extraction AttacksFederated Learning
AskPDF
May 20, 2026

CRAFT: Conflict-Resolved Aggregation for Federated Training

The aggregation of conflicting client updates remains a fundamental bottleneck in federated learning (FL) under heterogeneous data distributions. Naive averaging can produce a global update that improves the global objective while conflicting with specific clients, causing degradation for those clients. In this work, we propose CRAFT (Conflict-Resolved Aggregation for Federated Training), a new aggregation framework that treats the global update as a geometric correction problem. We formulate aggregation as finding the update closest to a reference direction while satisfying conflict-free alignment constraints. We derive a closed-form expression for the constrained optimization problem, avoiding the computational overhead of iterative solvers. Furthermore, we use a layer-wise adaptation to address conflicts at varying feature granularities. We provide a theoretical analysis showing that CRAFT promotes a common-descent structure and mitigates conflicts through its projection geometry. Extensive experiments on heterogeneous benchmarks demonstrate that CRAFT improves the accuracy of the global model while reducing performance disparity across clients compared with state-of-the-art baselines. The source code for CRAFT is available at https://github.com/tum-pbs/CRAFT.

Ziqi Wang, Qiang Liu, Nils Thuerey

Department of Mathematics, Friedrich-Alexander-Universität Erlangen-Nürnberg, Erlangen, Germany. · School of Computation, Information and Technology, Technical University of Munich, Garching, Germany. · Munich Center for Machine Learning, Munich, Germany.

Federated Learning AggregationGradient InterferenceFederated LearningHeterogeneous Federated Learning
AskPDF
Sep 22, 2026

When Clients Are Orchestrated: Strategic Gradient Manipulation to Defeat Federated Learning Servers with Efficient Defense

Federated Learning enables decentralized model training by exchanging model updates--rather than raw data--with a central parameter server (PS). While most of the existing defenses primarily assume static or independently acting adversaries, we reveal a new class of dynamically adaptive attacks that systematically bypass such protections. We propose Fed-ADR, a holistic attack framework in which a malicious orchestrator server (OS) dynamically coordinates a heterogeneous set of adversarial clients, including both targeted and untargeted attackers. Through real-time coordination by the OS, malicious clients strategically adapt their gradient updates to evade defenses deployed by the PS, while either severely degrading global model performance or steering training toward adversarial objectives.To mitigate this threat, we offer a detection mechanism that estimates each client's true gradient from historical updates, enabling real-time detection of coordinated malicious behavior without additional overhead. We further introduce an in-situ recovery mechanism that restores global model performance without restarting training, preserving convergence and minimizing recovery time. Comprehensive experiments on MNIST, Fashion-MNIST, and CIFAR-10 benchmark datasets demonstrate that Fed-ADR's attack scheme can reduce global accuracy from over 90% to below 10%, bypassing several state-of-the-art defenses. When our detection and recovery modules are employed, they identify malicious clients and restore accuracy to over 90% within a few rounds, at a substantially lower cost than retraining from scratch--achieving a reduction of at least 20x in computational overhead.

Mohamed Shaaban, Ahmed Abdelnaby, Mohamed Elmahallawy

School of Engineering and Applied Sciences, Washington State University, Richland, WA 99354, USA

Federated LearningByzantine-Robust Federated Learning
AskPDF