Federated Learning

Follow this topic Ask about this topic

Federated learning studies how multiple devices or institutions can train models collaboratively while keeping data local, for example across hospitals, phones, or companies. A common approach, FedAvg, aggregates local model updates; related methods use personalization or client clustering, split learning, model compression, and lightweight adapters such as LoRA. Differential privacy and secure aggregation can limit exposure of updates, while robust aggregation and client-selection methods address malicious participants and uneven data or resources. The central challenge is balancing accuracy and fairness across heterogeneous clients with privacy, security, communication cost, and reliable evaluation; keeping data local alone does not guarantee privacy or strong performance.

Latest papers

961 papers112 papers in the last four weeks, up 1% on the four weeks before. 0.6% of all new papers.

Jan 10, 2026

Leveraging Soft Prompts for Privacy Attacks in Federated Prompt Tuning

Membership inference attacks (MIAs) pose a serious privacy threat in federated learning (FL). While MIAs have been extensively studied in standard FL, the recent shift toward federated fine-tuning introduces new and largely unexplored attack surfaces. In this work, we show that federated prompt-tuning, which adapts pre-trained foundation models using lightweight input prefixes, exposes a novel and effective vector for membership inference. We propose PromptMIA, a membership inference attack tailored to federated prompt-tuning, in which a malicious server introduces adversarially crafted prompts and exploits their updates during collaborative training to determine whether a target data point belongs to a client's private dataset. We formalize this threat via a security game and demonstrate that PromptMIA achieves consistently high attack advantage across diverse benchmark datasets, substantially outperforming current SOTA federated MIAs. We also provide a theoretical lower bound on the attack advantage that explains the observed empirical behavior. Finally, we show that existing MIA defenses are often ineffective against PromptMIA, highlighting the need for defense mechanisms specifically tailored to prompt-tuning in federated settings.

Quan Minh Nguyen, Min-Seon Kim, Hoang M. Ngo +3

CISE, University of Florida, FL, USA · North Carolina State University, NC, USA · Washington State University, WA, USA +1

Membership Inference Attacks Federated Fine-Tuning Federated Learning

Jan 5, 2026

Digital Twin-Driven Communication-Efficient Federated Anomaly Detection for Industrial IoT

Anomaly detection is increasingly becoming crucial for maintaining the safety, reliability, and efficiency of industrial systems. Recently, with the advent of digital twins and data-driven decision-making, several statistical and machine-learning methods have been proposed. However, these methods face several challenges, such as dependence on only real sensor datasets, limited labeled data, high false alarm rates, and privacy concerns. To address these problems, we propose a suite of digital twin-integrated federated learning (DTFL) methods that enhance global model performance while preserving data privacy and communication efficiency. Specifically, we present five novel approaches: Digital Twin-Based Meta-Learning (DTML), Federated Parameter Fusion (FPF), Layer-wise Parameter Exchange (LPE), Cyclic Weight Adaptation (CWA), and Digital Twin Knowledge Distillation (DTKD). Each method introduces a unique mechanism to combine synthetic and real-world knowledge, balancing generalization with communication overhead. We conduct an extensive experiment using a publicly available cyber-physical anomaly detection dataset. For a target accuracy of 80%, CWA reaches the target in 33 rounds, FPF in 41 rounds, LPE in 48 rounds, and DTML in 87 rounds, whereas the standard FedAvg baseline and DTKD do not reach the target within 100 rounds. These results highlight substantial communication-efficiency gains (up to 62% fewer rounds than DTML and 31% fewer than LPE) and demonstrate that integrating DT knowledge into FL accelerates convergence to operationally meaningful accuracy thresholds for IIoT anomaly detection.

Mohammed Ayalew Belay, Adil Rasheed, Pierluigi Salvo Rossi

Department of Electronic Systems, Norwegian University of Science and Technology, 7034 Trondheim, Norway

Communication-Efficient Distributed Training Industrial Anomaly Detection Digital Twins Federated Learning Anomaly Detection

Jan 2, 2026

CoCo-Fed: A Unified Framework for Memory- and Communication-Efficient Federated Learning at the Wireless Edge

The deployment of large-scale neural networks within the Open Radio Access Network (O-RAN) architecture is pivotal for enabling native edge intelligence. However, this paradigm faces two critical bottlenecks: the prohibitive memory footprint required for local training on resource-constrained gNBs, and the saturation of bandwidth-limited backhaul links during the global aggregation of high-dimensional model updates. To address these challenges, we propose CoCo-Fed, a novel Compression and Combination-based Federated learning framework that unifies local memory efficiency and global communication reduction. Locally, CoCo-Fed breaks the memory wall by performing a double-dimension down-projection of gradients, adapting the optimizer to operate on low-rank structures without introducing additional inference parameters/latency. Globally, we introduce a transmission protocol based on orthogonal subspace superposition, where layer-wise updates are projected and superimposed into a single consolidated matrix per gNB, drastically reducing the backhaul traffic. Beyond empirical designs, we establish a rigorous theoretical foundation, proving the convergence of CoCo-Fed even under unsupervised learning conditions suitable for wireless sensing tasks. Extensive simulations on an angle-of-arrival estimation task demonstrate that CoCo-Fed significantly outperforms state-of-the-art baselines in both memory and communication efficiency while maintaining robust convergence under non-IID settings.

Zhiheng Guo, Zhaoyang Liu, Zihan Cen +5

School of Electronics and Information Technology, Sun Yat-sen University, Guangzhou 510275, China · Department of Computer Science, University of Exeter, Exeter EX4 4QJ, U.K. · Singapore University of Technology and Design, Singapore

Wireless Communications Federated Learning

Dec 31, 2025

Noise-Aware and Dynamically Adaptive Federated Defense Framework for SAR Image Target Recognition

As a critical application of computational intelligence in remote sensing, deep learning-based synthetic aperture radar (SAR) image target recognition facilitates intelligent perception but typically relies on centralized training, where multi-source SAR data are uploaded to a single server, raising privacy and security concerns. Federated learning (FL) provides an emerging computational intelligence paradigm for SAR image target recognition, enabling cross-site collaboration while preserving local data privacy. However, FL confronts critical security risks, where malicious clients can exploit SAR's multiplicative speckle noise to conceal backdoor triggers, severely challenging the robustness of the computational intelligence model. To address this challenge, we propose NADAFD, a noise-aware and dynamically adaptive federated defense framework that integrates frequency-domain, spatial-domain, and client-behavior analyses to counter SAR-specific backdoor threats. Specifically, we introduce a frequency-domain collaborative inversion mechanism to expose cross-client spectral inconsistencies indicative of hidden backdoor triggers. We further design a noise-aware adversarial training strategy that embeds

Γ

-distributed speckle characteristics into mask-guided adversarial sample generation to enhance robustness against both backdoor attacks and SAR speckle noise. In addition, we present a dynamic health assessment module that tracks client update behaviors across training rounds and adaptively adjusts aggregation weights to mitigate evolving malicious contributions. Experiments on MSTAR and OpenSARShip datasets demonstrate that NADAFD achieves higher accuracy on clean test samples and a lower backdoor attack success rate on triggered inputs than existing federated backdoor defenses for SAR target recognition.

Yuchao Hou, Zixuan Zhang, Jie Wang +9

Shanxi Normal University, Taiyuan, China · Guizhou University, Guiyang, China · Shanxi Key Laboratory of Cryptography and Data Security, School of Computer Science and Artificial Intelligence, Shanxi Normal University, Taiyuan 030031, China +15

Adversarial Training Remote Sensing Synthetic Aperture Radar SAR ATR Federated Learning

Dec 28, 2025

Mechanistic Evidence for Preserved-but-Misaligned Representations in Non-IID FedAvg

Federated Averaging (FedAvg) often degrades under non-IID client data, but it remains unclear whether this degradation reflects the loss of client-learned representations or a failure to use representations that are still present. We study this question mechanistically in sparse client-trained vision models, using dense-model controls to test whether the observed effects depend on sparsity. Our analysis combines class-specific circuit discovery, linear probing of frozen representations, head-only finetuning, and sparse feature dictionaries. Across CNN and ResNet models on CIFAR-10 and Fashion-MNIST, severe label skew can drive some per-class accuracies near zero even when class-specific internal structure remains recoverable. Linear probes substantially outperform the aggregated classifier, head-only finetuning partially restores accuracy, and USAE transfer reveals a largely shared feature basis between IID and non-IID models. Together, these diagnostics suggest that, in our setting, non-IID FedAvg degradation is not fully explained by representational erasure; it also reflects misalignment between preserved internal structure and the final prediction pathway.

Muhammad Haseeb, Salaar Masood, Muhammad Abdullah Sohail +2

Department of Computer Science, Lahore University of Management Sciences, Lahore, Pakistan.

Federated Learning Aggregation Non-IID Federated Learning Federated Learning

Dec 21, 2025

FedVideoMAE: Efficient Federated Video Moderation with Differential Privacy and Secure Aggregation

Short-form video moderation is increasingly pushed toward edge and privacy-sensitive settings, where users may intend videos for a limited audience, such as friends or private groups, but sending raw clips to a central server can broaden exposure, consume bandwidth, and add moderation latency. Federated learning can keep videos on device, but unprotected model updates may still leak information, and full-video backbones are expensive to communicate. We present FedVideoMAE, a privacy-preserving federated framework for violence detection that adapts a frozen VideoMAE backbone with lightweight LoRA and prompt parameters. Each training round combines self-supervised masked video reconstruction with client-side differential privacy and pairwise masked aggregation (SA) of adapter updates. Violence labels are held out from federation and used only for downstream evaluation, separating private representation learning from supervised assessment. On RWF-2000, exchanging 5,518,848 trainable parameters instead of the 156,371,328-parameter instantiated pretraining state gives a 28.3x model-state payload ratio. FedVideoMAE reaches 77.25% test accuracy without DP or SA, while accuracy under DP+SA remains in the 65.25-66.00% range. Transfer experiments on RLVS and binary UCF-Crime show similar behavior. These results characterize the privacy-utility trade-off for edge video moderation. Code is available at: https://github.com/zyt-599/FedVideoMAE

Ziyuan Tao, Chuanzhi Xu, Sandaru Jayawardana +4

School of Computing, Macquarie University, Sydney, Australia · School of Computer Science, The University of Sydney, Sydney, Australia · School of Electrical and Computer Engineering, The University of Sydney, Sydney, Australia

Federated Learning Aggregation Video Content Moderation Video Representation Learning Privacy-Preserving ML Secure Aggregation Federated Learning

Dec 3, 2025

How (Mis)calibrated is your Federated CLIP and what to do about it?

Vision-language models (VLMs) such as CLIP are increasingly adapted across decentralized data silos, yet the reliability of their predictions under federated learning (FL) remains largely unexplored. In this work, we present a systematic study of calibration in federated CLIP under non-IID client distributions. Our experiments reveal that widely used prompt-tuning methods consistently degrade calibration, often yielding substantially higher calibration error despite competitive recognition performance, while explicit training-time calibration regularizers provide only limited improvements. Motivated by these findings, we identify the choice of fine-tuning parameterization as a critical factor governing calibration and conduct a controlled comparison between prompt tuning and five backbone fine-tuning (BFT) strategies: AdaptFormer, LayerNorm, LoRA, VeRA, and DoRA. We find that BFT methods generally offer a more favorable accuracy-calibration trade-off than prompt tuning, although their benefits are not universal. Through extensive analysis, we show that calibration behavior is closely linked to the geometry of federated updates, residual parameterization, and the resulting client and logit drift. Across in-distribution, domain-generalization, and base-to-new evaluation settings, our results establish fine-tuning parameterization as a central design choice for building accurate and reliable federated CLIP models. Codes are available at https://github.com/mainaksingha01/FL2oRA.

Mainak Singha, Masih Aminbeidokhti, Paolo Casari +3

University of Trento, Italy · ´Ecole de technologie sup´erieure, QC, Canada · AMIAD, Pˆole Recherche, Palaiseau, France +2

Vision-Language Models VLM Adaptation Non-IID Federated Learning VLM Calibration Federated Fine-Tuning Federated Learning+1

Dec 3, 2025

Over-the-Air Federated Learning: Rethinking Edge AI Through Signal Processing

Over-the-Air Federated Learning (AirFL) is an emerging paradigm that tightly integrates wireless signal processing and distributed machine learning to enable scalable AI at the network edge. By exploiting wireless superposition over a shared multiple-access channel, AirFL turns simultaneous transmissions of local model updates into an analog aggregate at the receiver, thereby reducing communication latency, bandwidth usage, and energy consumption in wireless aggregation domains. This article develops a design-oriented tutorial view of analog AirFL. We organize existing schemes according to the signal-processing mechanism used to enable AirFL aggregation: transmitter-side channel compensation and power control, receiver-side equalization and high-dimensional processing, or learning-aware aggregation weighting. This viewpoint leads to three representative classes -- CSIT-aware, blind, and weighted AirFL -- and clarifies their assumptions, performance tradeoffs, complexity, and deployment limitations. We further discuss synchronization, digital and hybrid analog-digital realization, and open research directions for integrating AirFL into practical wireless edge-AI systems.

Seyed Mohammad Azimi-Abarghouyi, Carlo Fischione, Kaibin Huang

School of Electrical Engineering and Computer Science, KTH Royal Institute of Technology, Stockholm, Sweden · Department of Electrical and Electronic Engineering, The University of Hong Kong, Hong Kong SAR, China

Federated Learning Aggregation Communication-Efficient Distributed Training Wireless Communications Over-the-Air Federated Learning Federated Learning

Nov 30, 2025

FDRMFL: Multimodal Federated Feature Extraction Model Based on Information Maximization and Contrastive Learning

We propose FDRMFL, a task-driven multimodal feature extraction framework for federated regression under non-IID data distributions. Extracting predictive features from high-dimensional multimodal inputs is particularly challenging in this setting: data cannot leave each client, local samples are scarce and heterogeneously distributed, and unsupervised dimensionality reduction discards task-relevant information while federated training introduces representation drift across communication rounds. FDRMFL addresses these challenges through a unified four-term local objective: MSE prediction loss, a correlation-based mutual information surrogate that preserves dependence between the fused representation and the continuous target, a symmetric KL penalty that aligns cross-modal latent distributions before fusion, and an InfoNCE-style contrastive loss that anchors local representations to the global consensus. Experiments on three synthetic and two real-world near-infrared spectroscopy datasets under non-IID federated partitions, with comprehensive ablation and sensitivity analyses, demonstrate that each component contributes to the framework's effectiveness. FDRMFL reduces mean MSE by 33.8% relative to the best traditional baseline (PCA) and by 43.0% relative to VAE in simulation, and attains the lowest overall mean MSE among six federated algorithms including FedAvg, FedProx, MOON, SCAFFOLD, and FedBN.

Haozhe Wu

School of Computing and Data Science, The University of Hong Kong, Hong Kong SAR, China

Multimodal Federated Learning Non-IID Federated Learning Mutual Information Maximization Feature Fusion Federated Learning Multimodal Regression

Nov 25, 2025

Energy-Efficient Federated Learning via Adaptive Encoder Freezing for MRI-to-CT Conversion: A Green AI-Guided Research

Federated Learning (FL) holds the potential to advance equality in health by enabling diverse institutions to collaboratively train deep learning (DL) models, even with limited data. However, the significant resource requirements of FL often exclude centres with limited computational infrastructure, further widening existing healthcare disparities. To address this issue, we propose a Green AI-oriented adaptive layer-freezing strategy designed to reduce energy consumption and computational load while maintaining model performance. We tested our approach using different federated architectures for Magnetic Resonance Imaging (MRI)-to-Computed Tomography (CT) conversion. The proposed adaptive strategy optimises the federated training by selectively freezing the encoder weights based on the monitored relative difference of the encoder weights from round to round. A patience-based mechanism ensures that freezing only occurs when updates remain consistently minimal. The energy consumption and CO2eq emissions of the federation were tracked using the CodeCarbon library. Compared to equivalent non-frozen counterparts, our approach reduced training time, total energy consumption and CO2eq emissions by up to 23%. At the same time, the MRI-to-CT conversion performance was maintained, with only small variations in the Mean Absolute Error (MAE). Notably, for three out of the five evaluated architectures, no statistically significant differences were observed, while two architectures exhibited statistically significant improvements. Our work aligns with a research paradigm that promotes DL-based frameworks meeting clinical requirements while ensuring climatic, social, and economic sustainability. It lays the groundwork for novel FL evaluation frameworks, advancing privacy, equity and, more broadly, justice in AI-driven healthcare.

Ciro Benito Raggio, Lucia Migliorelli, Nils Skupien +6

Institute of Biomedical Engineering Karlsruhe Institute of Technology Fritz-Haber-Weg 1, Karlsruhe 76131 Baden-Württemberg, Germany · Department of Political Science Università Degli Studi Di Teramo Via Renato Balizarini 1, Teramo 64100 Italy · Department of Radiation Oncology University Medical Center Schleswig-Holstein Feldstrasse 21, Kiel 24105 Schleswig-Holstein, Germany +1

Energy-Efficient ML Federated Learning Parameter-Efficient Fine-Tuning

Nov 14, 2025

Computation-aware Energy-harvesting Federated Learning with Pipelined Cyclic Scheduling

Federated learning (FL) is a powerful paradigm for distributed learning, but increasing model complexity leads to significant energy consumption from client-side computations for local training. This challenge is critical in energy-harvesting FL (EHFL) systems, where the participation availability of each device fluctuates because of limited energy. To address this, we propose PipeCycle, a battery-aware distributed learning framework that organizes clients into pipelined cyclic groups. When a group completes its intra-group aggregation, its aggregated model is relayed directly to a newly formed group as a reference for local training, allowing multiple groups to coexist in the pipeline while overlapping client recharging periods with active training in other pipeline stages. We provide a convergence analysis of PipeCycle under a realistic energy consumption model in which local training spans multiple time slots, and show that the cyclic structure of the pipeline imposes a finite-horizon staleness bound that avoids the exponential factors typical of asynchronous FL analyses. Numerical experiments across both IID and non-IID data and various battery charging probabilities show that PipeCycle reaches a target accuracy with substantially lower cumulative energy than existing FL baselines, particularly under severe label skew where competing cyclic schemes collapse to near-chance accuracy.

Eunjeong Jeong, Nikolaos Pappas

E. Jeong and N. Pappas are with the Department of Computer and Information Science, Linköping University, Sweden.

Energy-Efficient ML Federated Learning

Nov 12, 2025

Unveiling Hidden Threats: Using Fractal Triggers to Boost Stealthiness of Distributed Backdoor Attacks in Federated Learning

Traditional distributed backdoor attacks (DBA) in federated learning improve stealthiness by decomposing global triggers into sub-triggers, which however requires more poisoned data to maintian the attck strength and hence increases the exposure risk. To overcome this defect, This paper proposes a novel method, namely Fractal-Triggerred Distributed Backdoor Attack (FTDBA), which leverages the self-similarity of fractals to enhance the feature strength of sub-triggers and hence significantly reduce the required poisoning volume for the same attack strength. To address the detectability of fractal structures in the frequency and gradient domains, we introduce a dynamic angular perturbation mechanism that adaptively adjusts perturbation intensity across the training phases to balance efficiency and stealthiness. Experiments show that FTDBA achieves a 92.3% attack success rate with only 62.4% of the poisoning volume required by traditional DBA methods, while reducing the detection rate by 22.8% and KL divergence by 41.2%. This study presents a low-exposure, high-efficiency paradigm for federated backdoor attacks and expands the application of fractal features in adversarial sample generation.

Jian Wang, Hong Shen, Chan-Tong Lam

Faculty of Applied Sciences, Macao Polytechnic University, Macao SAR, China · School of Cyberspace Security, Guangzhou University of Software, Guangzhou, China · School of Engineering and Technology, Central Queensland University, Australia

Adversarial Attacks Backdoor Attacks in Federated Learning Adversarial Perturbations Federated Learning

Nov 4, 2025

A Byzantine-Robust Federated Learning with Nesterov Momentum

We investigate robust federated learning, where a group of workers collaboratively train a shared model under the orchestration of a central server in the presence of Byzantine adversaries capable of arbitrary and potentially malicious behaviors. To improve communication efficiency while retaining resilience against such adversaries, we propose a Byzantine-resilient Nesterov-augmented federated learning (Byrd-NAFL) algorithm. Byrd-NAFL applies Nesterov's momentum at the server to the output of any soft

γ

-Byzantine resilient aggregation rule, while each worker only computes and uploads a stochastic gradient, which keeps the workers stateless, as desired for intermittently participating Internet of Things devices. For smooth non-convex losses, we establish a finite-time convergence guarantee for all momentum factors

β\in[0,1)

without requiring the aggregated gradient to be unbiased or bounded; the bound reduces to that of Byzantine-resilient stochastic gradient descent at

β=0

and is tighter than that of server-side heavy-ball momentum. Experiments on MNIST, CIFAR-10, and Sentiment140 show that Byrd-NAFL converges faster and attains higher accuracy than existing benchmarks in most i.i.d. and non-i.i.d. setups under diverse attacks, while its resilience is bounded by that of the underlying aggregation rule.

Lihan Xu, Xiaoyi Fan, Gang Wang +3

School of Cyber Science and Engineering, Xi’an Jiaotong University, Xi’an 710049, China. · the Artificial Intelligence Research Institute and Guangdong-Hong Kong-Macao Joint Laboratory for Emotional Intelligence and Pervasive Computing, Shenzhen MSU-BIT University, Shenzhen 518172, China. · the State Key Laboratory of Autonomous Intelligent Unmanned Systems, Beijing Institute of Technology, Beijing 100081, China.

Federated Learning Aggregation Byzantine-Robust Federated Learning Communication-Efficient Distributed Training Gradient Descent Federated Learning

Oct 14, 2025

FedHUG: Federated Heterogeneous Unsupervised Generalization for Remote Physiological Measurements

Remote physiological measurement gained wide attention, while it requires collecting users' privacy-sensitive information, and existing contactless measurements still rely on labeled client data. This presents challenges when we want to further update real-world deployed models with numerous user data lacking labels. To resolve these challenges, we instantiate a new protocol called Federated Unsupervised Domain Generalization (FUDG) in this work. Subsequently, the Federated Heterogeneous Unsupervised Generalization (FedHUG) framework is proposed and consists of: (1) Minimal Bias Aggregation module dynamically adjusts aggregation weights based on prior-driven bias evaluation to cope with heterogeneous non-IID features from multiple domains. (2) The Global Distribution-aware Learning Controller parameterizes the label distribution and dynamically manipulates client-specific training strategies, thereby mitigating the server-client label distribution skew and long-tail issue. The proposal shows superior performance across state-of-the-art techniques in estimation with either RGB video or mmWave radar. The code will be released.

Xiao Yang, Dengbo He, Duoxun Tang +2

Systems Hub, the Hong Kong University of Science and Technology (Guangzhou), Guangzhou, China

Federated Domain Generalization Federated Learning Federated Learning Aggregation Heterogeneous Federated Learning Non-IID Federated Learning Remote Photoplethysmography

Oct 6, 2025

Federated Computation of ROC and PR Curves

Receiver Operating Characteristic (ROC) and Precision-Recall (PR) curves are fundamental analytical tools for evaluating classification models, providing a comprehensive view of performance across decision thresholds. In modern data management settings, such evaluation must often be performed over data that is distributed across multiple parties and subject to strict privacy constraints. This setting arises naturally in federated learning (FL) and collaborative data platforms, where raw prediction scores and labels cannot be centrally collected. We study the problem of computing ROC and PR curves over distributed data under formal privacy guarantees. The key challenge is that exact computation requires access to all prediction scores and labels, leading to linear communication costs and privacy risks. To address this, we propose a novel framework for approximating ROC and PR curves using quantiles of the score distribution, which can be computed efficiently under secure aggregation and distributed differential privacy. Our approach requires only

O(Q)

communication, where

Q

is the number of quantiles, and avoids sharing raw data entirely. We provide theoretical guarantees on the approximation quality by bounding the Area Error (AE) between the true and estimated curves, demonstrating principled trade-offs among approximation accuracy, privacy protection, and communication cost. Our method is robust to data heterogeneity and skew, making it suitable for real-world distributed data management scenarios. Experiments on real-world datasets show that our approach achieves high accuracy with low communication overhead under strong privacy constraints. Overall, this work provides a practical and theoretically grounded solution for privacy-preserving evaluation of classification models over distributed data.

Xuefeng Xu, Graham Cormode

University of Warwick

Privacy-Preserving ML Secure Aggregation Federated Learning

Oct 6, 2025

Federated Learning for Surgical Vision in Appendicitis Classification: Results of the FedSurg EndoVis 2024 Challenge

Developing generalizable surgical AI requires multi-institutional data, yet privacy constraints preclude direct data sharing, making Federated Learning (FL) a natural candidate. Its application to complex, spatiotemporal surgical video remains largely unbenchmarked. We present the FedSurg Challenge, the first international initiative dedicated to FL in surgical vision, as a proof-of-concept evaluation using a multi-center dataset of laparoscopic appendectomies (subset of Appendix300). Three participant submissions were evaluated on generalization to an unseen clinical center and center-specific local adaptation, alongside centralized, Swarm Learning, parameter-efficient fine-tuning baselines, and reference classifiers. Our analysis identifies temporal modeling as the architectural factor most consistently associated with generalization to the unseen center, although effects vary across metrics. Classifier collapse arises from both the global model's failure to transfer under domain shift and unconstrained fine-tuning on small, imbalanced local datasets, motivating structured personalized FL for center-specific adaptation. Absolute performance remains far from clinical viability: even with all data pooled centrally, the task reached a 26.31% F1-score on the unseen center. Paired permutation tests resolve only large differences, and no adaptation comparison reaches significance at this sample size. By characterizing these limitations, this work establishes a methodological reference point for privacy-preserving surgical video AI.

Max Kirchner, Hanna Hoffmann, Alexander C. Jenke +16

Surgical Video Understanding Cross-Dataset Generalization Federated Learning

Sep 26, 2025

Trajectory-Aware Information Matching for Multi-Step Gradient Inversion in Federated Learning

Federated learning enables distributed information sharing and collaborative model training without exposing raw client data. However, shared gradients or model updates may still contain sensitive information, making federated learning vulnerable to gradient inversion attacks. Most existing gradient inversion attacks rely on simplified update observations, such as single-step gradients or endpoint-based matching. In practical FL, however, FedAvg produces an accumulated trajectory-dependent update after multiple local steps, rather than a gradient computed at a single model state.To address this issue, we propose NL-SME, a trajectory-aware information matching method for multi-step gradient inversion. NL-SME constructs a learnable nonlinear surrogate trajectory to approximate hidden local states and integrates trajectory-level information with calibrated gradient matching. For perturbed updates, NL-SME can further use an observed-update reliability-aware strategy to reduce the influence of unreliable components. Extensive experiments under diverse multi-step FedAvg settings show that NL-SME outperforms state-of-the-art gradient inversion baselines in reconstruction quality and update-matching accuracy. Additional evaluations on natural and medical images, as well as under fused-update observations and representative defense strategies, further suggest that observable multi-step updates may still retain reconstruction signals. These results reveal potential privacy leakage risks in federated information sharing. Code is available at https://anonymous.4open.science/r/NL-SME-main/README.md.

Li Xia, Jing Yu, Zheng Liu +3

Key Laboratory of Ethnic Language Intelligent Analysis and Security Governance of MOE, Minzu University of China, Beijing, 100081, China

Gradient Inversion Attacks Adversarial Attacks Privacy-Preserving ML Federated Learning

Sep 25, 2025

Task-Agnostic Federated Continual Learning via Replay-Free Gradient Projection

Federated continual learning (FCL) enables collaborative model training across distributed clients on sequentially arriving tasks without revisiting past data. However, existing approaches often suffer from catastrophic forgetting, rely on replay buffers or generative models that may violate privacy constraints, or assume knowledge of task identities during inference. We propose FedProTIP (Federated Projection-based Continual Learning with Task Identity Prediction), a replay-free FCL framework that maintains shared task-specific feature subspaces across clients. Each client extracts low-rank core bases from intermediate activations using randomized singular value decomposition, capturing dominant feature directions associated with the current task. These bases are transmitted to the server and aggregated to construct global task subspaces that capture shared feature directions across clients without requiring data sharing. During training, client updates are projected onto the orthogonal complement of previously learned subspaces to reduce cross-task interference and mitigate catastrophic forgetting. The learned subspaces are also reused during inference to estimate task identity via subspace relevance, enabling task-agnostic prediction without requiring explicit task labels. Experiments on CIFAR100, ImageNet-R, and DomainNet demonstrate that FedProTIP consistently outperforms state-of-the-art federated continual learning baselines while maintaining lower training time, memory footprint, and communication cost.

Seohyeon Cha, Huancheng Chen, Haris Vikalo

Department of Electrical and Computer Engineering The University of Texas at Austin

Federated Continual Learning Gradient Projection Task-Free Continual Learning Federated Learning

Sep 17, 2025

FedIA: Importance-Aware Aggregation for Domain-Robust Federated Graph Learning

Federated graph learning (FGL) is a natural paradigm for social-media user graphs, where language communities, regional markets, and service boundaries can prevent raw graph pooling. We use the Twitch Gamers networks as the primary live-streaming social-media benchmark, and study a question that is often hidden by representation-level evaluation: after local message passing, what update signals are actually exposed to server aggregation? Through update-space measurements, we identify an aggregation-level failure in which graph-domain clients gradually place salient update signals on less shared parameter coordinates, while message-passing backbones show weaker cross-domain directional compatibility than an MLP control. This update-support fragmentation means that standard averaging can dilute locally important coordinates even when no raw graph data are exchanged. Across five backbones, homophily remains relevant but is not the dominant correlate of support retention; feature, label, and degree discrepancies show stronger associations. These findings indicate that graph-domain shifts damage not only local representations, but also the coordinate support on which aggregation operates. Motivated by this diagnosis, we propose FedIA, a plug-and-play server-side importance-aware aggregation method. Importance Masking selects a shared high-magnitude coordinate support, and Contribution-Aware Momentum Weighting smooths client contributions within that support. FedIA requires no raw graph sharing, no graph-statistics upload, and no auxiliary communication payload, while adding only

O(D+N)

persistent server state for

D

model coordinates and

N

clients.

Zhanting Zhou, Zeyu Ma, Ziqiang Zheng +1

University of Electronic Science and Technology of China, No. 2006, Xiyuan Ave, West Hi-Tech Zone, Chengdu, Sichuan 611731, China

Federated Learning Aggregation Domain Generalization Non-IID Federated Learning Federated Graph Learning Federated Learning

Sep 15, 2025

FedDAF: Federated Domain Adaptation Using Model Functional Distance

Federated Domain Adaptation (FDA) improves model performance at a target client by collaborating with source clients while preserving data privacy. FDA faces two key challenges: domain shift between source and target data, and limited labeled data at the target, a common constraint when a new site joins a federation before it has accumulated its own labeled data, as in clinical deployments. Most existing methods address domain shift alone, assuming ample target data; those that also tackle data scarcity still fail to prioritize source information according to the target's specific objective. We propose FedDAF, which addresses both challenges through similarity-based aggregation of the global source and target models, using their model functional distance, computed from the angle between their mean gradient fields on target data and normalized via a Gompertz function. The global source model itself is formed using a distance-based weighted average, giving greater weight to source models closer to the target model. Experiments on real-world datasets show FedDAF outperforms existing federated learning (FL), personalized FL, and FDA methods in test accuracy.

Mrinmay Sen, Sidhant Nair, C Krishna Mohan

Department of Artificial Intelligence, Indian Institute of Technology Hyderabad, Hyderabad, 502285, Telangana, India. · Department of Mechanical Engineering, Indian Institute of Technology Delhi, New Delhi, 110016, Delhi, India.

Federated Learning Aggregation Domain Adaptation Model Merging Federated Learning

Aug 27, 2025

Practical Feasibility of Gradient Inversion Attacks in Federated Learning

Gradient inversion attacks are often presented as a serious privacy threat in federated learning, with recent work reporting increasingly strong reconstructions under favorable experimental settings. However, it remains unclear whether such attacks are feasible in modern, performance-optimized systems deployed in practice. In this work, we evaluate the practical feasibility of gradient inversion for image-based federated learning. We conduct a systematic study across multiple datasets and tasks, including image classification and object detection, using canonical vision architectures at contemporary resolutions. Our results show that while gradient inversion remains possible for certain legacy or transitional designs under highly restrictive assumptions, modern, performance-optimized models consistently resist meaningful reconstruction visually. We further demonstrate that many reported successes rely on upper-bound settings, such as inference mode operation or architectural simplifications which do not reflect realistic training pipelines. Taken together, our findings indicate that, under an honest-but-curious server assumption, high-fidelity image reconstruction via gradient inversion does not constitute a critical privacy risk in production-optimized federated learning systems, and that practical risk assessments must carefully distinguish diagnostic attack settings from real-world deployments.

Viktor Valadi, Lucas Beerens, Mattias Åkesson +4

Scaleout Systems Sweden · Recorded Future Sweden · AI Sweden Sweden +1

Gradient Inversion Attacks Adversarial Attacks Federated Learning

Aug 16, 2025

FAIRVAR: Fair Federated Learning via Variance Regularization

Federated learning (FL) allows collaborative training of machine learning models across multiple parties without sharing raw data. However, heterogeneous data can cause some clients to have disproportionate influence on the global model, leading to disparities in their performance. Fairness, understood as reducing these disparities, is therefore a crucial concern in FL and has been addressed in various ways. We studied performance equitable fairness in FL, where the goal is to minimize performance disparities across clients. We evaluated several existing fairness-aware methods and introduce here a new gradient-variance-regularized method, implemented in two variants: FairGrad (approximate) and FairGrad* (exact). We theoretically characterize the connections between these methods and, empirically, on heterogeneous benchmarks, show that FairGrad and FairGrad* consistently improve fairness by reducing variance in client accuracies, while maintaining competitive or improved mean performance compared to existing fairness-aware baselines.

Zahra Kharaghani, Ali Dadras, Tommy Löfstedt

Department of Computing Science, Umeå University, Umeå, Sweden · Department of Mathematics and Mathematical Statistics, Umeå University, Umeå, Sweden

Algorithmic Fairness Federated Learning Heterogeneous Federated Learning

Aug 16, 2025

FedUHD: Unsupervised Federated Learning using In-Memory Hyperdimensional Computing

Unsupervised federated learning (UFL) enables privacy-preserving distributed training without data labeling, yet practical deployment remains challenging due to non-IID data, high computational and communication costs at edge devices, and sensitivity to communication noise. We propose FedUHD, the first UFL framework based on Hyperdimensional Computing (HDC). On the client side, FedUHD employs kNN-based cluster hypervector removal to mitigate non-IID effects by filtering detrimental local outliers. On the server side, cluster-aware HDC aggregation leverages cluster-level statistics to stabilize learning across heterogeneous clients. To further improve efficiency, we design a compute-in-memory (CIM) accelerator based on a novel phase-change memory (PCM) device, integrated with lightweight ASIC digital modules to execute the client-side HDC pipeline within the accelerator. The intrinsic robustness of HDC to low precision and device variations enables efficient mapping onto analog PCM crossbars, exploiting massive parallelism while minimizing data movement. Experimental results show that FedUHD achieves comparable accuracy to state-of-the-art neural network-based UFL methods across all datasets. On HAR and CIFAR10/100, FedUHD delivers an average 2,239x speedup and 1,542x higher energy efficiency on GPU. In addition, FedUHD reduces communication cost by up to 176x on HAR and CIFAR10/100 and demonstrates greater robustness than Orchestra under communication noise. Compared to GPU implementation of FedUHD, the proposed PCM-based accelerator provides an additional 4.07x speedup and three orders of magnitude higher energy efficiency on average. Furthermore, the results demonstrate the benefit of PCM over RRAM as a CIM substrate.

You Hak Lee, Keming Fan, Xiaofan Yu +4

University of California San Diego, USA

Compute-in-Memory Federated Learning Aggregation Communication-Efficient Distributed Training Non-IID Federated Learning Hyperdimensional Computing Federated Learning+1

Aug 14, 2025

FlexP-SFT: A Flexible Aggregation-Free Framework for On-Device Personalized Split Federated Fine-Tuning of LLMs

To fine-tune large language models (LLMs) over private data, federated learning (FL) has emerged as a promising paradigm. However, the prohibitive memory and communication demands of LLMs render standard FL impractical for resource-constrained edge devices. While split federated learning (SFL) alleviates the computing burdens via model partitioning, existing frameworks still suffer from communication bottlenecks and straggler problem due to the parameter aggregation process. To address these challenges, we propose FlexP-SFT, a novel aggregation-free framework for personalized split federated fine-tuning, which fundamentally eliminates the client-side aggregation process. Crucially, to ensure robust training in the absence of global synchronization, we introduce a layer-flexible alignment strategy to balance personalization and generalization capabilities. We further formulate split-ratio selection as a resource-aware discrete optimization problem that jointly accounts for personalization accuracy and system cost. Our proposed scheme simultaneously enhances personalized performance, reduces communication overhead, and resolves the straggler problem. Extensive results show that FlexP-SFT substantially outperforms baselines in both accuracy and latency, and that the optimized split ratio achieves a better resource-accuracy trade-off than static or memory-only choices.

Jiaxiang Geng, Tianjun Yuan, Pengchao Han +3

Duke Kunshan University, Suzhou, China · Guangdong University of Technology, Guangzhou, China · Jade Bird Fire (JBF), China +1

Communication-Efficient Distributed Training LLM Fine-Tuning Split Federated Learning Federated Fine-Tuning Federated Learning

Aug 7, 2025

FedCoT: Communication-Efficient Federated Reasoning Enhancement for Large Language Models

Enhancing LLM reasoning in federated settings is nontrivial due to stringent computational, communication, and privacy constraints, especially in healthcare, where clinically consequential decisions require not only accuracy but also interpretable, auditable rationales to meet safety, accountability, and regulatory requirements. Conventional federated fine-tuning largely imitates final answers rather than cultivating step-by-step reasoning, often relying on privacy-sensitive centralized distillation and still incurring substantial communication overhead. We address this gap with \ours{}, a federated reasoning framework that combines lightweight chain-of-thought resampling with a compact discriminator for selection, and client-aware LoRA stacking with weighted classifier aggregation to accommodate heterogeneity while reducing aggregation noise and communication; clients generate candidate chains and supervision locally, and only lightweight modules are aggregated on the server. Experiments on medical reasoning benchmarks show consistent gains under tight resource budgets while keeping data local and respecting privacy, offering an interpretable and resource-efficient solution. Our code is made publicly available at https://github.com/DIaacKr/FedCoT

Chuan Li, Qianyi Zhao, Fengran Mo +1

East China Normal University, China · University of Montreal, Canada

Communication-Efficient Distributed Training Medical LLMs LLM Reasoning Federated Learning

Aug 6, 2025

FLAT: Revealing Hidden Latent-Conditioned Backdoor Failures in Federated Learning

Horizontal federated learning (HFL) backdoor audits often summarize model behavior through clean accuracy (CA), mean attack success rate (ASR), or a single known-trigger test. Such summaries can hide a different failure mode, in which one target label is activated by many trigger realizations. We study this failure mode with FLAT, a latent-conditioned reliability stress test for HFL backdoors. In FLAT, compromised clients still submit ordinary classifier updates to the server, while an attacker-side generator

G(x,t,z)

separates target intent

t

from trigger realization

z

. This separation shifts the audit question from whether one known trigger succeeds to how the hidden behavior varies across targets, latent samples, defenses, and post-stop rounds. On CIFAR-10, CIFAR-100, and Tiny-ImageNet, FLAT preserves clean utility while reaching 99.49%, 99.66%, and 94.10% single-target FedAvg ASR. The evaluation also reveals non-uniform defense responses, where a server rule can suppress one target mode while leaving another active. These observations motivate HFL backdoor audits that report target-wise ASR, worst-target ASR, target coverage, latent-sampled behavior, post-stop persistence, and defense response.

Tuan Nguyen, Sze Jue Yang, Khoa D. Doan +2

College of Engineering and Computer Science, VinUniversity, Hanoi, Vietnam · VinUni-Illinois Smart Health Center, VinUniversity, Hanoi, Vietnam · Siebel School of Computing and Data Science, University of Illinois Urbana-Champaign, Urbana, IL, USA +1

Backdoor Attacks in Federated Learning Federated Learning

Jul 24, 2025

FedSA-GCL: A Semi-Asynchronous Federated Graph Learning Framework with Personalized Aggregation and Cluster-Aware Broadcasting

Federated Graph Learning (FGL) is a distributed learning paradigm that enables collaborative training over large-scale subgraphs located on multiple local systems. However, most existing FGL approaches rely on synchronous communication, which leads to inefficiencies and is often impractical in real-world deployments. Meanwhile, current asynchronous federated learning (AFL) methods are primarily designed for conventional tasks such as image classification and natural language processing, consequently failing to account for the unique topological properties of graph data. Directly applying these methods to graph learning frequently results in semantic drift and representational inconsistency within the global model. To address these challenges, we propose FedSA-GCL, a semi-asynchronous federated framework that leverages both inter-client label distribution divergence and graph topological characteristics through a novel ClusterCast mechanism for efficient training. We evaluate FedSA-GCL on multiple real-world graph datasets using the Louvain and Metis algorithms and conduct comparative analysis against 10 baselines. Extensive experiments demonstrate that our method achieves superior robustness and outstanding efficiency, outperforming the baselines by an average margin of 1.9% with Louvain and 3.0% with Metis.

Zhongzheng Yuan, Lianshuai Guo, Xunkai Li +3

Shandong University, School of Airspace Science and Engineering, Weihai 264209, China · Beijing Institute of Technology, School of Computer Science and Technology, Beijing 100081, China · Sun Yat-sen University, School of Computer Science and Engineering, Guangzhou 510275, China

Asynchronous Federated Learning Non-IID Federated Learning Federated Graph Learning Federated Learning

Jun 18, 2025

Federated Learning for MRI-based BrainAGE: a multicenter study on post-stroke functional outcome prediction

\textbf{Objective:}

Brain-predicted age difference (BrainAGE) is a neuroimaging biomarker reflecting brain health. However, training robust BrainAGE models requires large datasets, often restricted by privacy concerns. This study evaluates the performance of federated learning (FL) for BrainAGE estimation in ischemic stroke patients treated with mechanical thrombectomy, and investigates its association with clinical phenotypes and functional outcomes.

\textbf{Methods:}

We used FLAIR brain images from 1674 stroke patients across 16 hospital centers. We implemented standard machine learning and deep learning models for BrainAGE estimates under three data management strategies: centralized learning (pooled data), FL (local training at each site), and single-site learning. We reported prediction errors and examined associations between BrainAGE and vascular risk factors (e.g., diabetes mellitus, hypertension, smoking), as well as functional outcomes at three months post-stroke. Logistic regression evaluated BrainAGE's predictive value for these outcomes, adjusting for age, sex, vascular risk factors, stroke severity, time between MRI and arterial puncture, prior intravenous thrombolysis, and recanalisation outcome.

\textbf{Results:}

While centralized learning yielded the most accurate predictions, FL consistently outperformed single-site models. BrainAGE was significantly higher in patients with diabetes mellitus across all models. Comparisons between patients with good and poor functional outcomes, and multivariate predictions of these outcomes showed the significance of the association between BrainAGE and post-stroke recovery.

\textbf{Conclusion:}

FL enables accurate age predictions without data centralization. The strong association between BrainAGE, vascular risk factors, and post-stroke recovery highlights its potential for prognostic modeling in stroke care.

Vincent Roca, Marc Tommasi, Paul Andrey +8

Univ. Lille, CNRS, Inserm, CHU Lille, Institut Pasteur de Lille, US 41 - UAR 2014 - PLBS, F-59000 Lille, France · Univ. Lille, Inria, F-59000 Lille, France · Univ. Montpellier, Inria, F-34090 Montpellier, France +3

Brain Age Prediction Clinical Outcome Prediction Privacy-Preserving ML Brain MRI Federated Learning

May 29, 2025

TRIP-Shapley: Propagation-Aware Contribution Attribution Framework for Peer-to-Peer Federated Learning

Contribution attribution is a fundamental problem in federated learning (FL), yet it remains challenging in peer-to-peer FL (P2PFL), where participant influence propagates through repeated model exchanges. Recent work, DICE, addresses this issue by directly tracking multi-round propagation paths. However, its practical deployment is hindered by two challenges: (i) communication explosion caused by multi-hop propagation path tracking, and (ii) vulnerability to misreporting attacks. To overcome these challenges, we consider contribution attribution in P2PFL with a model-free coordinator used solely for auditing. Based on this setting, we propose TRIP-Shapley, a propagation-aware Shapley-inspired surrogate for contribution attribution. Instead of explicitly tracking multi-round paths, TRIP-Shapley computes round-wise contribution scores independently and propagates only scalar contribution values. This enables attribution of influence accumulated throughout the entire training process while maintaining practical communication costs. In addition, we introduce lightweight mechanisms to detect and mitigate misreporting attacks. Rather than theoretically approximating Shapley values, TRIP-Shapley is empirically evaluated against Shapley values as a reference. Experiments demonstrate communication savings of up to

45.8\times

relative to the compared DICE configurations, with favorable cost--reference-alignment trade-offs overall, although alignment is weaker in some FMNIST and 25-client settings. The proposed defenses reduce contribution inflation under the two evaluated attacks.

Honoka Anada, Tatsuya Kaneko, Yafei Ou +1

The University of Tokyo · Institute of Science Tokyo · RIKEN AIP

Federated Learning Shapley Value Attribution

May 28, 2025

Inclusive Federated Learning Through Compliance-Weighted Noise Allocation in Healthcare AI

Background: Federated learning (FL) enables collaborative training of clinical AI models without centralizing patient data, but adoption is limited by privacy concerns, heterogeneous institutional compliance, and resource disparities; standard differential privacy (DP) applies uniform noise to all clients, penalizing well-compliant or under-resourced institutions. Objective: We introduce a compliance-aware FL framework that adapts DP to institutional compliance, letting lower-compliance sites participate without uniformly penalizing others. Methods: A compliance scoring tool aligned with HIPAA, GDPR, NIST, ISO, and HL7/FHIR maps each client score to a per-step Gaussian noise scale for server-side DP-SGD on a small aggregator dataset. The formal

(ε,δ)

bound applies to the aggregator dataset under a semi-honest aggregator; client-level DP needs secure aggregation (future work). We evaluate five FL strategies on PneumoniaMNIST and BreastMNIST (16 clients, 50 rounds, five seeds); the cumulative aggregator-dataset

ε

is about 1434 (Breast) and 513 (Pneumonia) at

δ=10^{-5}

. Results: Including 12 lower-compliance clients (Experiment 1) versus a compliant-only baseline (Experiment 4) changed BreastMNIST accuracy by +4.5 (FedAvg), +6.8 (FedMedian), +5.2 (FedProx), +1.6 (FedYogi), and -4.1 (FedAdam) percentage points (pooled +2.8 pp; not significant at n=5; up to +17 pp per configuration); compliance-weighted allocation matched uniform server-side DP at equal mean noise (+0.1 pp), carrying no utility penalty, and first-round noise cost 1.3 pp (Breast) and 2.5 pp (Pneumonia, FedAvg). Conclusions: Compliance-weighted server-side DP lets lower-compliance institutions join FL without degrading performance, giving auditable per-site noise control at no utility cost; formal guarantees apply to the aggregator dataset, with client-level DP requiring secure aggregation.

Santhosh Parampottupadam, Melih Coşğun, Sarthak Pati +7

German Cancer Research Center (DKFZ), Division of Medical Image Computing, Heidelberg, Germany · Department of Computer Engineering, Bilkent University, Universiteler 06800 Çankaya/Ankara, Türkiye · Medical Research Group, MLCommons, San Francisco, CA, USA +2

Federated Learning Aggregation Differentially Private Stochastic Gradient Descent Healthcare Privacy-Preserving ML Differentially Private Federated Learning Federated Learning+1