FedPix: Learning What to Share with Less Leakage in Federated Intelligence

Jingwei Zhao; Tiantong Sun; Yuanyuan Song; Jinhuan Guo; Zishuo Wei; Shengyu Huang; Ziyuan Ren; Wei Chen

cs.CROct 15, 2026

FedPix: Learning What to Share with Less Leakage in Federated Intelligence

Authors: Jingwei Zhao, Tiantong Sun, Yuanyuan Song, Jinhuan Guo, Zishuo Wei, Shengyu Huang, Ziyuan Ren, Wei Chen,

Organizations: Huazhong University of Science and Technology, Wuhan, China · George Mason University, Fairfax, VA, USA

Abstract

Existing federated intelligence paradigms primarily focus on how models are trained or aggregated, while overlooking a more fundamental question: what information should leave the client? Existing methods often share model updates that users cannot easily inspect, or data representations that may reveal sensitive information. Moreover, generating these representations can be computationally expensive for resource-constrained clients. We observe that image classification does not require all the visual details needed to reconstruct the original image. This suggests that clients could share less information while preserving task performance. However, learning what to preserve is challenging when the server cannot access raw client data. To address this challenge, we propose FedPix, which learns to share compact, visually inspectable images instead of model updates or intermediate features. The key idea is to use the shared representations themselves to learn what information should be preserved and what can be discarded. By balancing task utility and reconstruction resistance, FedPix enables the server to improve the representations without accessing raw client data, while keeping client-side computation lightweight. Extensive experiments on BloodMNIST, CIFAR-10, FashionMNIST, and MNIST demonstrate that FedPix achieves strong reconstruction resistance, with reconstruction PSNR as low as 6.87~~dB and synthetic PSNR as low as 6.74~~dB. Meanwhile, FedPix reduces client runtime by up to 96.0% (from 1223~~s to 49~~s on CIFAR-10), while maintaining competitive classification accuracy of 99.18% on MNIST, 89.97% on FashionMNIST, 82.24% on BloodMNIST, and 65.63% on CIFAR-10.

Figures & tables

MedMNIST-BloodMNIST
Method	ACC $\uparrow$ (%)	Reconstructed Data			Synthetic Data			Time $\downarrow$
		PSNR $\downarrow$	SSIM $\downarrow$	LPIPS $\uparrow$	PSNR $\downarrow$	SSIM $\downarrow$	LPIPS $\uparrow$	(s)
FedAvg (2017)	74.35 $\pm$ 11.39	—	—	—	—	—	—	241 $\pm$ 108
CollabDM (2024)	60.25 $\pm$ 2.94	—	—	—	20.49 $\pm$ 0.23	0.78 $\pm$ 0.01	0.03 $\pm$ 0.00	1830 $\pm$ 170
FedDM (2023)	78.79 $\pm$ 2.40	—	—	—	33.99 $\pm$ 0.92	0.98 $\pm$ 0.00	0.00 $\pm$ 0.00	754 $\pm$ 308
FedSD2C (2024)	68.56 $\pm$ 2.81	10.36 $\pm$ 0.10	0.19 $\pm$ 0.00	0.21 $\pm$ 0.00	13.94 $\pm$ 0.16	0.45 $\pm$ 0.02	0.14 $\pm$ 0.01	245 $\pm$ 9

Table 1: FedPix achieves the best or second-best utility–privacy–efficiency across most metrics: highest ACC on 3 of 4 datasets with the lowest client runtime by a wide margin and competitive reconstruction resistance. “—” indicates an unreported or inapplicable metric under the evaluated protocol; it does not imply immunity to reconstruction.

BloodMNIST
Variant	ACC (%) $\uparrow$	Syn. PSNR $\downarrow$	Syn. SSIM $\downarrow$	Recon. PSNR $\downarrow$	Recon. SSIM $\downarrow$
Direct downsampling	86.58 $\pm$ 3.09	25.22 $\pm$ 0.21	0.8959 $\pm$ 0.0023	—	—
W/o anti-recon. loss	76.48 $\pm$ 13.05	6.73 $\pm$ 1.45	0.2427 $\pm$ 0.1369	8.18 $\pm$ 1.00	0.2838 $\pm$ 0.1412
PSNR only	87.88 $\pm$ 4.37	10.59 $\pm$ 1.72	0.4990 $\pm$ 0.1548	11.64 $\pm$ 1.58	0.4648 $\pm$ 0.1340
SSIM only	75.47 $\pm$ 10.28	6.89 $\pm$ 1.19	0.2294 $\pm$ 0.0927	8.72 $\pm$ 1.06	0.2663 $\pm$ 0.0935
Complete FedPix	81.75 $\pm$ 4.75	9.32 $\pm$ 1.54	0.3442 $\pm$ 0.0932	10.97 $\pm$ 1.50	0.3784 $\pm$ 0.0843

Table 2: SSIM and PSNR losses are not always orthogonal to the utility objective: their effectiveness varies unpredictably across datasets and metrics, indicating that the interaction between reconstruction suppression and task preservation warrants further investigation.

Appendix figures & tables12 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 7: Increasing

\lambda

improves ACC up to a saturation point (

\lambda\approx 0.035

) beyond which information leakage (SSIM) rises without commensurate utility gain, indicating an optimal operating region.

Figure 8: ACC improves near-linearly with

\rho

while reconstruction leakage (SSIM) remains consistently low, confirming that capacity constraints effectively decouple utility preservation from information leakage across representation sizes.

Figure 9: Total communication scales near-linearly with

\rho

, while client time remains low across all settings, confirming the lightweight client-side overhead of FedPix’s data interface.

Figure 10: The encoder converges stably: within-round accuracy plateaus after 3–4 epochs, and the accuracy floor lifts from $\sim$ 22% to $\sim$ 73% over 6 rounds with variance narrowing to $\pm$ 1–2%.

Method	ACC (%) $\uparrow$
Method	1 Client	5 Clients	20 Clients	100 Clients
FedAvg (2017)	78.52 $\pm$ 1.12	69.83 $\pm$ 2.56	59.29 $\pm$ 8.66	39.02 $\pm$ 5.98
FedProx (2020)	76.68 $\pm$ 0.90	68.87 $\pm$ 2.93	61.82 $\pm$ 7.14	32.84 $\pm$ 3.48
SCAFFOLD (2020)	74.47 $\pm$ 2.59	70.75 $\pm$ 2.40	68.14 $\pm$ 1.31	57.70 $\pm$ 9.90
PARS (2026)	69.70 $\pm$ 4.72	63.02 $\pm$ 2.94	67.16 $\pm$ 1.66	64.03 $\pm$ 0.82
FedSD2C (2024)	28.72 $\pm$ 1.36	39.69 $\pm$ 2.96	45.54 $\pm$ 0.72	44.22 $\pm$ 0.84

Appendix

Table 3: FedPix accuracy remains nearly constant (65.8%

\to

65.1%) as client count grows from 1 to 100, while FL baselines degrade sharply (FedAvg: 78.5%

\to

39.0%), confirming that centralized training on pooled representations provides inherent scalability.

Method	ACC (%) $\uparrow$
Method	$\alpha=0.01$	$\alpha=0.1$	$\alpha=0.3$	$\alpha=1.0$
FedAvg (2017)	11.09 $\pm$ 1.74	22.87 $\pm$ 9.58	60.74 $\pm$ 9.57	71.28 $\pm$ 0.61
FedProx (2020)	11.39 $\pm$ 2.46	24.02 $\pm$ 10.22	60.89 $\pm$ 8.20	71.23 $\pm$ 0.73
SCAFFOLD (2020)	10.22 $\pm$ 0.35	18.93 $\pm$ 19.62	54.02 $\pm$ 22.85	73.28 $\pm$ 0.77
PARS (2026)	9.94 $\pm$ 0.20	21.49 $\pm$ 14.01	48.62 $\pm$ 23.37	58.15 $\pm$ 26.99
FedSD2C (2024)	29.88 $\pm$ 1.86	36.69 $\pm$ 1.12	41.95 $\pm$ 2.12	47.81 $\pm$ 1.40

Appendix

Table 4: FedPix maintains stable accuracy (63–65%) across all

\alpha

, while traditional FL baselines collapse to near-random accuracy under extreme heterogeneity (

\alpha=0.01

), confirming that data-level transmission inherently decouples client data distribution from server-side training.

Parameter	Value	Description
Input channels	3	RGB input
Resize target	$128\times 128$	Pre-resize from native photo
Encoder input	$128\times 128$	Fixed input resolution
Output size	$8\times 8$	Compressed spatial size
Hidden dimension	128	Internal channel count
Convs per block	5	ConvPoolBlock depth

Appendix

Table 5: Encoder configuration for on-device benchmark.

Attribute	Value
Manufacturer / Model	Commercial device (Snapdragon 660)
SoC / Board	Snapdragon 660 (sdm660)
CPU architecture	arm64-v8a, 8 cores @ 2.21 GHz
Total / Available RAM	5.70 GB / 2.02 GB
Total / Available Storage	110.4 GB / 6.77 GB
GPU Renderer	Adreno 512

Appendix

Table 6: Hardware specifications of the benchmark device.

Metric	Value
Total images processed	100
Total wall-clock time	85.62 s
Avg. encode time / img	849.33 ms
Throughput (images/sec)	1.17 img/s
Throughput (input data)	3.83 MB/s
Total input data	328.22 MB

Appendix

Table 7: End-to-end on-device encoder benchmark results (100 photographs).

Metric	Before	After	Delta
Battery level	97.0%	94.0%	$-3.0$ pp
Battery voltage	4,089 mV	3,849 mV	$-240$ mV
Charge counter	1,859 $\mu$ Ah	1,832 $\mu$ Ah	$-27$ $\mu$ Ah
Device temperature	31.5 ∘ C	32.0 ∘ C	$+0.5^{\circ}$ C
Charging state	Not charging (battery-only)

Appendix

Table 8: Battery and thermal measurements before and after the benchmark.

Dataset	Attack Type	PSNR (dB) $\downarrow$	SSIM $\downarrow$	LPIPS $\uparrow$
BloodMNIST	Adaptive (ResUNet)	13.53 $\pm$ 1.07	0.48 $\pm$ 0.07	0.11 $\pm$ 0.02
	Synthetic	8.84 $\pm$ 1.34	0.32 $\pm$ 0.10	0.26 $\pm$ 0.02
	Reconstructed (MoIA)	10.20 $\pm$ 1.02	0.34 $\pm$ 0.08	0.26 $\pm$ 0.03
FashionMNIST	Adaptive (ResUNet)	13.81 $\pm$ 1.88	0.56 $\pm$ 0.06	0.08 $\pm$ 0.02
	Synthetic	8.27 $\pm$ 2.34	0.29 $\pm$ 0.09	0.39 $\pm$ 0.09
	Reconstructed (MoIA)	8.19 $\pm$ 0.98	0.26 $\pm$ 0.05	0.41 $\pm$ 0.05

Appendix

Table 9: Adaptive reconstruction attack results under the white-box setting. Best value in each column is bolded .

\downarrow

= lower is better for reconstruction resistance;

\uparrow

= higher is better for reconstruction resistance.

Method	Privacy Aware?	Protection Mechanism	Limitations	Our Innovation	Edge-friendly?
Traditional FL
FedAvg ’17	$\checkmark$	Uploads model parameters instead of raw data	Uploaded data is not user-auditable	Uploads human-interpretable compressed images instead of model parameters	$\times$
SCAFFOLD ’20	$\checkmark$				$\times$
FedProx ’20	$\checkmark$				$\times$
PARS ’26	$\checkmark$				$\times$
Federated Data Condensation

Appendix

Table 10: Comparison of representative methods—FedAvg’17 ( McMahan et al., 2017a ) , SCAFFOLD’20 ( Karimireddy et al., 2020 ) , FedProx’20 ( Li et al., 2020b ) , PARS’26 ( Akpinar et al., 2026 ) , FedDM’23 ( Xiong et al., 2023 ) , CollabDM’24 ( Holland et al., 2024 ) , FedSD2C’24 ( Zhang et al., 2024b ) , SFL’20 ( Thapa et al., 2022 ) , FLEX-SFL’25 ( Yu et al., 2025 ) , DP-Pix’19 ( Fan, 2018 ) , DP-GLOW’23 ( Shibata et al., 2023 ) , LDP-Slicing’26 ( Cao et al., 2026 ) , Scalable Privacy’21 ( Alvar and Bajić, 2021 ) , PPA’24 ( Azizian and Bajić, 2024 ) , JPEG’92 ( Wallace, 1992 ) , and DeepFixCX’23 ( Gaudio et al., 2023 ) —and FedPix. Columns summarize privacy mechanisms, limitations, the FedPix design, and client efficiency.

Privacy-Preserving Representation Learning

See all 9 papers

Apr 13, 2026

A Full Compression Pipeline for Green Federated Learning in Communication-Constrained Environments

Federated Learning (FL) enables collaborative model training across distributed clients without sharing raw data, thereby preserving privacy. However, FL often suffers from significant communication and computational overhead, limiting its scalability and sustainability. In this work, we introduce a Full Compression Pipeline (FCP) for FL in communication-constrained environments. FCP integrates three complementary deep compression techniques (pruning, quantization, and Huffman encoding) into a unified end-to-end framework. By compressing local models and communication payloads, FCP substantially reduces transmission costs and resource consumption while maintaining competitive accuracy. To quantify its impact, we develop an evaluation framework that captures both communication and computation overheads as a unified model cost, allowing a holistic assessment of efficiency trade-offs. The pipeline is evaluated in an independent and identically distributed (IID) and non-IID data setting. In one representative scenario, training a ResNet-12 model on the CIFAR-10 dataset with ten clients and a 2 Mbps bandwidth, the FCP achieves more than 11

\times

reduction in model size, with only a 2% drop in accuracy compared to the uncompressed baseline. This results in an FL training that is more than 60% faster.

Elouan Colybes, Shirin Salehi, Anke Schmeink

Chair of Information Theory and Data Analytics (INDA), RWTH Aachen University, Aachen, Germany

Federated Learning Communication-Efficient Distributed Training

Ask PDF

Feb 9, 2026

ERIS: Enhancing the Privacy-Utility-Scalability Trade-Off in Federated Learning via Federated Shard Aggregation

Scaling Federated Learning (FL) to billion-parameter models forces a challenging trade-off between privacy, scalability, and model utility. Existing solutions often tackle these challenges in isolation, sacrificing accuracy, relying on costly cryptographic tools, or introducing communication and optimization inefficiencies that affect convergence. We introduce ERIS, an FL framework centered on Federated Shard Aggregation (FSA), a novel mechanism that partitions each client update into non-overlapping shards whose aggregation is distributed across multiple client-side aggregators. FSA removes the central aggregation bottleneck, limits the information visible to any single observer, and preserves the centralized FL update after reassembly. ERIS can further readily integrate Distributed Shifted Compression (DSC) to reduce transmitted payloads and exposed coordinates. We prove that ERIS preserves convergence under standard assumptions and bounds mutual information leakage by the observable fraction of each update, decreasing with the number of client-side aggregators, and with the compression level when DSC is enabled. Experiments across image and text tasks, including large language models, show that ERIS achieves FedAvg-level utility while substantially reducing communication bottlenecks and improving robustness to membership inference and reconstruction attacks, without relying on heavy cryptography or utility-degrading perturbations.

Dario Fenoglio, Pasquale Polverino, Akash Dhasade +3

Universit`a della Svizzera italiana Lugano, Switzerland · Carnegie Mellon University Pittsburgh, PA, United States

Federated Learning Federated Learning Aggregation Privacy-Preserving Federated Learning Privacy-Preserving ML Communication-Efficient Distributed Training

Ask PDF

Jul 8, 2026

Collaborative Synthetic Data Generation for Knowledge Transfer in Federated Learning

One-shot federated learning (OSFL) addresses the communication overhead of federated learning by limiting training to a single round, but doing so without sacrificing model quality is non-trivial, particularly when client data distributions diverge. Recent work has addressed this challenge by aggregating client knowledge on the server through the construction of transferable synthetic datasets or distillates. However, most of these methods lack formal privacy guarantees, leaving a gap in jointly achieving low communication, robustness to heterogeneity, and rigorous privacy. We propose FedKT-CSD (Federated Knowledge Transfer via Collaborative Synthetic Data), a framework inspired by neural image compression that closes this gap by leveraging publicly pretrained autoencoders as a shared latent space. Each client encodes its private data in a single forward pass, computes class-conditional latent statistics, and transmits these to the server. The server aggregates these statistics via secure aggregation, adds calibrated differential privacy noise, and decodes a synthetic dataset for training a global model and further downstream tasks. This design provides formal

(\varepsilon,δ)

-differential privacy by construction, while keeping client-side computation and communication lightweight. Despite operating under privacy constraints, FedKT-CSD is competitive with and even outperforms non-private baselines across diverse datasets and heterogeneity settings, and scales to a large number of clients. Our code is available at: https://github.com/an7123/FedKT-CSD

Maximilian Andreas Hoefler, Karsten Mueller, Wojciech Samek

Fraunhofer Heinrich Hertz Institute · BIFOLD Technical University Berlin

Non-IID Federated Learning Federated Learning Synthetic Data Generation Federated Learning Aggregation Differentially Private Federated Learning Knowledge Distillation+1

Ask PDF

Abstract

Privacy-Preserving Representation Learning

Explore similar work

A Full Compression Pipeline for Green Federated Learning in Communication-Constrained Environments

ERIS: Enhancing the Privacy-Utility-Scalability Trade-Off in Federated Learning via Federated Shard Aggregation

Collaborative Synthetic Data Generation for Knowledge Transfer in Federated Learning