FedPix: Learning What to Share with Less Leakage in Federated Intelligence

Jingwei Zhao; Tiantong Sun; Yuanyuan Song; Jinhuan Guo; Zishuo Wei; Shengyu Huang; Ziyuan Ren; Wei Chen

cs.CROct 15, 2026

FedPix: Learning What to Share with Less Leakage in Federated Intelligence

Authors: Jingwei Zhao, Tiantong Sun, Yuanyuan Song, Jinhuan Guo, Zishuo Wei, Shengyu Huang, Ziyuan Ren, Wei Chen,

Organizations: Huazhong University of Science and Technology, Wuhan, China · George Mason University, Fairfax, VA, USA

Abstract

Existing federated intelligence paradigms primarily focus on how models are trained or aggregated, while overlooking a more fundamental question: what information should leave the client? Existing methods often share model updates that users cannot easily inspect, or data representations that may reveal sensitive information. Moreover, generating these representations can be computationally expensive for resource-constrained clients. We observe that image classification does not require all the visual details needed to reconstruct the original image. This suggests that clients could share less information while preserving task performance. However, learning what to preserve is challenging when the server cannot access raw client data. To address this challenge, we propose FedPix, which learns to share compact, visually inspectable images instead of model updates or intermediate features. The key idea is to use the shared representations themselves to learn what information should be preserved and what can be discarded. By balancing task utility and reconstruction resistance, FedPix enables the server to improve the representations without accessing raw client data, while keeping client-side computation lightweight. Extensive experiments on BloodMNIST, CIFAR-10, FashionMNIST, and MNIST demonstrate that FedPix achieves strong reconstruction resistance, with reconstruction PSNR as low as 6.87~~dB and synthetic PSNR as low as 6.74~~dB. Meanwhile, FedPix reduces client runtime by up to 96.0% (from 1223~~s to 49~~s on CIFAR-10), while maintaining competitive classification accuracy of 99.18% on MNIST, 89.97% on FashionMNIST, 82.24% on BloodMNIST, and 65.63% on CIFAR-10.

Figures & tables

MedMNIST-BloodMNIST
Method	ACC $\uparrow$ (%)	Reconstructed Data			Synthetic Data			Time $\downarrow$
		PSNR $\downarrow$	SSIM $\downarrow$	LPIPS $\uparrow$	PSNR $\downarrow$	SSIM $\downarrow$	LPIPS $\uparrow$	(s)
FedAvg (2017)	74.35 $\pm$ 11.39	—	—	—	—	—	—	241 $\pm$ 108
CollabDM (2024)	60.25 $\pm$ 2.94	—	—	—	20.49 $\pm$ 0.23	0.78 $\pm$ 0.01	0.03 $\pm$ 0.00	1830 $\pm$ 170
FedDM (2023)	78.79 $\pm$ 2.40	—	—	—	33.99 $\pm$ 0.92	0.98 $\pm$ 0.00	0.00 $\pm$ 0.00	754 $\pm$ 308
FedSD2C (2024)	68.56 $\pm$ 2.81	10.36 $\pm$ 0.10	0.19 $\pm$ 0.00	0.21 $\pm$ 0.00	13.94 $\pm$ 0.16	0.45 $\pm$ 0.02	0.14 $\pm$ 0.01	245 $\pm$ 9

Table 1: FedPix achieves the best or second-best utility–privacy–efficiency across most metrics: highest ACC on 3 of 4 datasets with the lowest client runtime by a wide margin and competitive reconstruction resistance. “—” indicates an unreported or inapplicable metric under the evaluated protocol; it does not imply immunity to reconstruction.

BloodMNIST
Variant	ACC (%) $\uparrow$	Syn. PSNR $\downarrow$	Syn. SSIM $\downarrow$	Recon. PSNR $\downarrow$	Recon. SSIM $\downarrow$
Direct downsampling	86.58 $\pm$ 3.09	25.22 $\pm$ 0.21	0.8959 $\pm$ 0.0023	—	—
W/o anti-recon. loss	76.48 $\pm$ 13.05	6.73 $\pm$ 1.45	0.2427 $\pm$ 0.1369	8.18 $\pm$ 1.00	0.2838 $\pm$ 0.1412
PSNR only	87.88 $\pm$ 4.37	10.59 $\pm$ 1.72	0.4990 $\pm$ 0.1548	11.64 $\pm$ 1.58	0.4648 $\pm$ 0.1340
SSIM only	75.47 $\pm$ 10.28	6.89 $\pm$ 1.19	0.2294 $\pm$ 0.0927	8.72 $\pm$ 1.06	0.2663 $\pm$ 0.0935
Complete FedPix	81.75 $\pm$ 4.75	9.32 $\pm$ 1.54	0.3442 $\pm$ 0.0932	10.97 $\pm$ 1.50	0.3784 $\pm$ 0.0843

Table 2: SSIM and PSNR losses are not always orthogonal to the utility objective: their effectiveness varies unpredictably across datasets and metrics, indicating that the interaction between reconstruction suppression and task preservation warrants further investigation.

Appendix figures & tables12 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 7: Increasing

\lambda

improves ACC up to a saturation point (

\lambda\approx 0.035

) beyond which information leakage (SSIM) rises without commensurate utility gain, indicating an optimal operating region.

Figure 8: ACC improves near-linearly with

\rho

while reconstruction leakage (SSIM) remains consistently low, confirming that capacity constraints effectively decouple utility preservation from information leakage across representation sizes.

Figure 9: Total communication scales near-linearly with

\rho

, while client time remains low across all settings, confirming the lightweight client-side overhead of FedPix’s data interface.

Figure 10: The encoder converges stably: within-round accuracy plateaus after 3–4 epochs, and the accuracy floor lifts from $\sim$ 22% to $\sim$ 73% over 6 rounds with variance narrowing to $\pm$ 1–2%.

Method	ACC (%) $\uparrow$
Method	1 Client	5 Clients	20 Clients	100 Clients
FedAvg (2017)	78.52 $\pm$ 1.12	69.83 $\pm$ 2.56	59.29 $\pm$ 8.66	39.02 $\pm$ 5.98
FedProx (2020)	76.68 $\pm$ 0.90	68.87 $\pm$ 2.93	61.82 $\pm$ 7.14	32.84 $\pm$ 3.48
SCAFFOLD (2020)	74.47 $\pm$ 2.59	70.75 $\pm$ 2.40	68.14 $\pm$ 1.31	57.70 $\pm$ 9.90
PARS (2026)	69.70 $\pm$ 4.72	63.02 $\pm$ 2.94	67.16 $\pm$ 1.66	64.03 $\pm$ 0.82
FedSD2C (2024)	28.72 $\pm$ 1.36	39.69 $\pm$ 2.96	45.54 $\pm$ 0.72	44.22 $\pm$ 0.84

Appendix

Table 3: FedPix accuracy remains nearly constant (65.8%

\to

65.1%) as client count grows from 1 to 100, while FL baselines degrade sharply (FedAvg: 78.5%

\to

39.0%), confirming that centralized training on pooled representations provides inherent scalability.

Method	ACC (%) $\uparrow$
Method	$\alpha=0.01$	$\alpha=0.1$	$\alpha=0.3$	$\alpha=1.0$
FedAvg (2017)	11.09 $\pm$ 1.74	22.87 $\pm$ 9.58	60.74 $\pm$ 9.57	71.28 $\pm$ 0.61
FedProx (2020)	11.39 $\pm$ 2.46	24.02 $\pm$ 10.22	60.89 $\pm$ 8.20	71.23 $\pm$ 0.73
SCAFFOLD (2020)	10.22 $\pm$ 0.35	18.93 $\pm$ 19.62	54.02 $\pm$ 22.85	73.28 $\pm$ 0.77
PARS (2026)	9.94 $\pm$ 0.20	21.49 $\pm$ 14.01	48.62 $\pm$ 23.37	58.15 $\pm$ 26.99
FedSD2C (2024)	29.88 $\pm$ 1.86	36.69 $\pm$ 1.12	41.95 $\pm$ 2.12	47.81 $\pm$ 1.40

Appendix

Table 4: FedPix maintains stable accuracy (63–65%) across all

\alpha

, while traditional FL baselines collapse to near-random accuracy under extreme heterogeneity (

\alpha=0.01

), confirming that data-level transmission inherently decouples client data distribution from server-side training.

Parameter	Value	Description
Input channels	3	RGB input
Resize target	$128\times 128$	Pre-resize from native photo
Encoder input	$128\times 128$	Fixed input resolution
Output size	$8\times 8$	Compressed spatial size
Hidden dimension	128	Internal channel count
Convs per block	5	ConvPoolBlock depth

Appendix

Table 5: Encoder configuration for on-device benchmark.

Attribute	Value
Manufacturer / Model	Commercial device (Snapdragon 660)
SoC / Board	Snapdragon 660 (sdm660)
CPU architecture	arm64-v8a, 8 cores @ 2.21 GHz
Total / Available RAM	5.70 GB / 2.02 GB
Total / Available Storage	110.4 GB / 6.77 GB
GPU Renderer	Adreno 512

Appendix

Table 6: Hardware specifications of the benchmark device.

Metric	Value
Total images processed	100
Total wall-clock time	85.62 s
Avg. encode time / img	849.33 ms
Throughput (images/sec)	1.17 img/s
Throughput (input data)	3.83 MB/s
Total input data	328.22 MB

Appendix

Table 7: End-to-end on-device encoder benchmark results (100 photographs).

Metric	Before	After	Delta
Battery level	97.0%	94.0%	$-3.0$ pp
Battery voltage	4,089 mV	3,849 mV	$-240$ mV
Charge counter	1,859 $\mu$ Ah	1,832 $\mu$ Ah	$-27$ $\mu$ Ah
Device temperature	31.5 ∘ C	32.0 ∘ C	$+0.5^{\circ}$ C
Charging state	Not charging (battery-only)

Appendix

Table 8: Battery and thermal measurements before and after the benchmark.

Dataset	Attack Type	PSNR (dB) $\downarrow$	SSIM $\downarrow$	LPIPS $\uparrow$
BloodMNIST	Adaptive (ResUNet)	13.53 $\pm$ 1.07	0.48 $\pm$ 0.07	0.11 $\pm$ 0.02
	Synthetic	8.84 $\pm$ 1.34	0.32 $\pm$ 0.10	0.26 $\pm$ 0.02
	Reconstructed (MoIA)	10.20 $\pm$ 1.02	0.34 $\pm$ 0.08	0.26 $\pm$ 0.03
FashionMNIST	Adaptive (ResUNet)	13.81 $\pm$ 1.88	0.56 $\pm$ 0.06	0.08 $\pm$ 0.02
	Synthetic	8.27 $\pm$ 2.34	0.29 $\pm$ 0.09	0.39 $\pm$ 0.09
	Reconstructed (MoIA)	8.19 $\pm$ 0.98	0.26 $\pm$ 0.05	0.41 $\pm$ 0.05

Appendix

Table 9: Adaptive reconstruction attack results under the white-box setting. Best value in each column is bolded .

\downarrow

= lower is better for reconstruction resistance;

\uparrow

= higher is better for reconstruction resistance.

Method	Privacy Aware?	Protection Mechanism	Limitations	Our Innovation	Edge-friendly?
Traditional FL
FedAvg ’17	$\checkmark$	Uploads model parameters instead of raw data	Uploaded data is not user-auditable	Uploads human-interpretable compressed images instead of model parameters	$\times$
SCAFFOLD ’20	$\checkmark$				$\times$
FedProx ’20	$\checkmark$				$\times$
PARS ’26	$\checkmark$				$\times$
Federated Data Condensation

Appendix

Table 10: Comparison of representative methods—FedAvg’17 ( McMahan et al., 2017a ) , SCAFFOLD’20 ( Karimireddy et al., 2020 ) , FedProx’20 ( Li et al., 2020b ) , PARS’26 ( Akpinar et al., 2026 ) , FedDM’23 ( Xiong et al., 2023 ) , CollabDM’24 ( Holland et al., 2024 ) , FedSD2C’24 ( Zhang et al., 2024b ) , SFL’20 ( Thapa et al., 2022 ) , FLEX-SFL’25 ( Yu et al., 2025 ) , DP-Pix’19 ( Fan, 2018 ) , DP-GLOW’23 ( Shibata et al., 2023 ) , LDP-Slicing’26 ( Cao et al., 2026 ) , Scalable Privacy’21 ( Alvar and Bajić, 2021 ) , PPA’24 ( Azizian and Bajić, 2024 ) , JPEG’92 ( Wallace, 1992 ) , and DeepFixCX’23 ( Gaudio et al., 2023 ) —and FedPix. Columns summarize privacy mechanisms, limitations, the FedPix design, and client efficiency.

Privacy-Preserving Representation Learning

See all 9 papers

A Full Compression Pipeline for Green Federated Learning in Communication-Constrained Environments
Apr 13, 2026Elouan Colybes, Shirin Salehi, Anke SchmeinkFederated Learning Communication-Efficient Distributed Training
Chair of Information Theory and Data Analytics (INDA), RWTH Aachen University, Aachen, Germany
ERIS: Enhancing the Privacy-Utility-Scalability Trade-Off in Federated Learning via Federated Shard Aggregation
Feb 9, 2026Dario Fenoglio, Pasquale Polverino, Akash Dhasade +3Federated Learning Federated Learning Aggregation
Universit`a della Svizzera italiana Lugano, Switzerland · Carnegie Mellon University Pittsburgh, PA, United States
Collaborative Synthetic Data Generation for Knowledge Transfer in Federated Learning
Jul 8, 2026Maximilian Andreas Hoefler, Karsten Mueller, Wojciech SamekNon-IID Federated Learning Federated Learning
Fraunhofer Heinrich Hertz Institute · BIFOLD Technical University Berlin

Apr 13, 2026J/K move · Enter open · S save

A Full Compression Pipeline for Green Federated Learning in Communication-Constrained Environments

Elouan Colybes, Shirin Salehi, Anke Schmeink

Chair of Information Theory and Data Analytics (INDA), RWTH Aachen University, Aachen, Germany

Federated Learning Communication-Efficient Distributed Training

Open paper AskPDF arXiv

Federated Learning (FL) enables collaborative model training across distributed clients without sharing raw data, thereby preserving privacy. However, FL often suffers from significant communication and computational overhead, limiting its scalability and sustainability. In this work, we introduce a Full Compression Pipeline (FCP) for FL in communication-constrained environments. FCP integrates three complementary deep compression techniques (pruning, quantization, and Huffman encoding) into a unified end-to-end framework. By compressing local models and communication payloads, FCP substantially reduces transmission costs and resource consumption while maintaining competitive accuracy. To quantify its impact, we develop an evaluation framework that captures both communication and computation overheads as a unified model cost, allowing a holistic assessment of efficiency trade-offs. The pipeline is evaluated in an independent and identically distributed (IID) and non-IID data setting. In one representative scenario, training a ResNet-12 model on the CIFAR-10 dataset with ten clients and a 2 Mbps bandwidth, the FCP achieves more than 11

\times

reduction in model size, with only a 2% drop in accuracy compared to the uncompressed baseline. This results in an FL training that is more than 60% faster.

Abstract

Privacy-Preserving Representation Learning

Explore similar work

A Full Compression Pipeline for Green Federated Learning in Communication-Constrained Environments

ERIS: Enhancing the Privacy-Utility-Scalability Trade-Off in Federated Learning via Federated Shard Aggregation

Collaborative Synthetic Data Generation for Knowledge Transfer in Federated Learning