Papers

Field

Top tools here

Open problems in Federated learning

Privacy-utility trade-off in federated learning4 papers raise it · 5 address it
Balancing strong privacy guarantees with model performance remains a core challenge, especially for sensitive data like medical imaging or user profiles.
- Privacy Accounting for Empirical Denoisersraises · addresses
- Privacy-Preserving Personalized Federated Learning (PPP-FL) for Medical Imagingraises · addresses
- Guided Diffusion for Trustworthy Synthetic Text Generationraises · addresses
- Profile-DP: Differential Privacy for User-Controlled Profile Release in Personalized LLM Inferenceraises · addresses
- Privacy-preserving inference on hosted models: a learned input-embedding transform for frozen Qwen3.8-27Baddresses
Heterogeneous preferences and gradient conflicts in federated alignment2 papers raise it · 2 address it
Diverse user preferences and competing objectives cause instability in collaborative training, degrading personalization and adaptation.
- Collaborative Personalized Preference Alignment for LLMs under Data Deficiencyraises · addresses
- Communication-Efficient Federated Domain Generalization in Edge Networks via Dynamic Prototype Regulationraises · addresses
Secure aggregation with user dropouts and communication constraints1 paper raises it · 1 addresses it
Existing secure aggregation schemes struggle with dynamic dropouts and high communication costs, limiting scalability in real-world FL.
- Fundamental Limits of Information-Theoretic Secure Aggregation with User Dropouts in Federated Learningraises · addresses
Byzantine-robust client selection without parameter access1 paper raises it · 1 addresses it
Secure aggregation hides client updates, making it hard to detect malicious clients without exposing sensitive data.
- LiBRA: Logit Fingerprints for Byzantine-Robust Client Selection in Federated Learningraises · addresses
Decentralized inference-time collaboration in federated learning1 paper raises it · 1 addresses it
Exploiting distributed expertise without central coordination is difficult, especially under graph constraints and limited budgets.
- Learning to Refer: Inference-Time Collaboration in Decentralized Federated Learningraises · addresses

Named by an AI from these papers' abstracts.

Open problems

Recently funded

Topics in this field

differential privacy · private learning · differentially private99 papers28 this week
federated learning · federated learning fl · distributed learning102 papers23 this week

Topics in this field

Active contributors · 90 days

Active contributors

Activity · 12 weeks

Coming with more sources: repos

Activity

Recent papers

All in Research →

arXiv cs.LGOct 7
Robust Decentralized Fairness Auditing
Sayan Biswas, Jade Garcia Bourrée, Anne-Marie Kermarrec, Palak, Martijn de Vos
Emerging legislation requires large language models (LLMs) to be audited for compliance with regulatory standards, particularly fairness. Such black-box audits typically assume a single auditor with access to a large, representative set of queries. In practice, it can be difficult for an auditor to obtain such a query set, but multiple auditors can together cover the relevant demographic groups by auditing the LLM collaboratively with their individual query sets. However, relying on multiple auditors raises a fundamental trust problem, as they may act on behalf of the LLM provider to portray a misleading appearance of fairness, i.e., fairwashing. We propose Auditopus, a novel approach for robust decentralized fairness auditing. In Auditopus, auditing proceeds in rounds without a central server. In each round, every auditor issues a fixed number of queries to the LLM, and sends only cumulative statistics vectors of its query results to other auditors instead of sensitive queries in clear. The fairness of the audited LLM is then estimated by aggregating all the vectors. We show theoretically and empirically that even a single adversarial auditor in the network can steer this…
PDF arXiv
arXiv cs.LGOct 7
Efficient Provably Private Classification with a Tabular Foundation Model
Talal Alrawajfeh, Cristiana Diaconu, Ossi Räisä, Sebastian Rodriguez Beltran, Yuan He +3
Tabular data underpin prediction and decision-making in medicine, finance, government and science, but often contain sensitive individual-level information, creating a need for accurate prediction while preserving privacy. Traditional private learning provides formal privacy guarantees, but requires slow dataset-specific optimisation, suffers substantial utility loss under strong privacy, and is often difficult to apply correctly. Tabular foundation models adapt rapidly to new datasets, but existing models lack formal privacy guarantees, and are highly vulnerable to membership-inference attacks, limiting their use on sensitive data. Here we introduce PrivTab, an easy to use tabular foundation model for differentially private classification that embeds a privacy mechanism within its architecture. Pretrained on simulated datasets, PrivTab uses in-context learning to transform sensitive rows into compact, provably private summaries---effectively learning how to learn under privacy. PrivTab outperforms private linear and neural-network baselines under moderate-to-strong privacy, shows negligible membership leakage, maintains well-calibrated predictions under strong privacy, and…
PDF arXiv
arXiv cs.LGOct 7
Closed-Form Noise Calibration Against Membership Inference for Random-Allocation DP-SGD
Murat Bilgehan Ertan, Marten van Dijk
DP-SGD protects training data by adding Gaussian noise to clipped gradients. The amount of noise is usually chosen by running a numerical privacy accountant inside a search. We study DP-SGD with random allocation, where each epoch uses every record once, at a randomly chosen step. For this setting we give a one-line formula that bounds the accuracy of every membership inference attack (MIA) on the trained model. With $M$ steps per epoch, $E$ epochs and noise multiplier $σ$, and with membership and non-membership equally likely a priori, the attack accuracy is at most $\frac12+\frac14\sqrt{(1+(e^{1/σ^2}-1)/M)^E-1}$. The formula comes from the chi-square divergence between a Gaussian distribution and a Gaussian mixture that dominates random allocation. It is interpretable and gives $σ$ in about a microsecond. Where applicable, our formula needs at most about half the noise of the state-of-the-art closed-form bound. To measure how close the bound is, we also derive an exact expression for the attack accuracy of these two distributions and evaluate it numerically. Calibrating to this exact expression requires $13.0\%$ to $20.2\%$ less noise than the formula in our main experiments,…
PDF arXiv
arXiv cs.CROct 6
Certified Corruption Budgets: Anytime-Valid Leaderboard Claims under Adaptive Rigging
Hamed Khosravi, Xiaoming Huo
Public leaderboards for AI models are read continuously, and attackers can see every published standing. Vote rigging, selective disclosure of private variants, and benchmark contamination can each move a ranking. Existing guarantees assume genuine records or bound the corruption per step, which an attacker who corrupts in bursts evades. We introduce the certified corruption budget, a tolerance $\widehat{B}_t$ computed after $t$ records and published with each pairwise claim. With probability at least $1-α$, simultaneously at all times, the claim is correct or more than $\widehat{B}_t$ records were corrupted. It holds against attackers who watch every certificate, with no bound on their budget. Forged records and records altered once seen require different certificates: the certificate for forgeries fails, with probability approaching one, against an attacker who flips votes it has seen, while one that charges roughly twice as much per record remains valid, with constant bets even against attackers who see the future, and no smaller charge is valid at every level. The certified budget grows nearly as fast as any valid method allows: with a win fraction $\frac{1}{2}+δ$, each new…
PDF arXiv
arXiv cs.LGOct 6
FedRSPO+: A Heterogeneity-aware Algorithm for Decision-focused Federated Learning
Konstantinos Ziliaskopoulos, Alexander Vinel, Jiaqi Wang
Decision-focused learning (DFL) trains predictive models for downstream optimization, but existing methods largely assume centralized data. In cross-silo settings, federated learning offers a natural alternative, yet standard federated methods optimize prediction over decision quality and do not address heterogeneity in downstream objectives or feasible sets. This heterogeneity is especially challenging for DFL because small perturbations in polyhedral problems can cause discontinuous changes in optimal decisions, destabilizing client updates and aggregation. We propose FedRSPO+, a heterogeneity-aware framework for decision-focused federated learning, built on RSPO+, a regularized predict-then-optimize surrogate that smooths the decision map through projection. We show that RSPO+ upper bounds decision error and regret for the regularized decision and, under exact regularization and consistent LP solution selection, for the original LP decision. We further derive cross-client heterogeneity bounds that depend on both objective and feasible-set heterogeneity, vanish at homogeneity, and require no strong convexity. FedRSPO+ uses an annealed, modular training procedure compatible with…
PDF arXiv
arXiv cs.LGOct 6
Removing Information Content Does Not Certify Tamper Resistance in Open-Weight Models
Domenic Rosati, Alessa Carbo, Ali Dadsetan, Hong Huang, Matthew Young +3
Does removing harmful information make open-weight models resistant to fine-tuning attacks? We show that mutual information at release alone cannot universally certify slow recovery. Function-preserving reparameterizations leave information unchanged while altering gradient-descent geometry, so an invariant certificate is bounded by the fastest reachable parameterization. We apply this principle to weight--data mutual information under training-data filtering and label--representation mutual information under capability removal. Training order can change recovery time at fixed weight--data information, while exact representation-level independence can preserve the entire parameter Jacobian. An explicit construction has both information quantities equal to zero and recovers in one gradient step. Controlled experiments illustrate order-dependent recovery and parameterization-dependent attack speed. These results identify the missing requirement for certification: constraints on attack dynamics beyond mutual information at release.
PDF arXiv

Papers

Topics in this field

differential privacy · private learning · differentially private99 papers28 this week
federated learning · federated learning fl · distributed learning102 papers23 this week

Recent papers

All in Research →

arXiv cs.LGOct 7
Robust Decentralized Fairness Auditing
Sayan Biswas, Jade Garcia Bourrée, Anne-Marie Kermarrec, Palak, Martijn de Vos
Emerging legislation requires large language models (LLMs) to be audited for compliance with regulatory standards, particularly fairness. Such black-box audits typically assume a single auditor with access to a large, representative set of queries. In practice, it can be difficult for an auditor to obtain such a query set, but multiple auditors can together cover the relevant demographic groups by auditing the LLM collaboratively with their individual query sets. However, relying on multiple auditors raises a fundamental trust problem, as they may act on behalf of the LLM provider to portray a misleading appearance of fairness, i.e., fairwashing. We propose Auditopus, a novel approach for robust decentralized fairness auditing. In Auditopus, auditing proceeds in rounds without a central server. In each round, every auditor issues a fixed number of queries to the LLM, and sends only cumulative statistics vectors of its query results to other auditors instead of sensitive queries in clear. The fairness of the audited LLM is then estimated by aggregating all the vectors. We show theoretically and empirically that even a single adversarial auditor in the network can steer this…
PDF arXiv
arXiv cs.LGOct 7
Efficient Provably Private Classification with a Tabular Foundation Model
Talal Alrawajfeh, Cristiana Diaconu, Ossi Räisä, Sebastian Rodriguez Beltran, Yuan He +3
Tabular data underpin prediction and decision-making in medicine, finance, government and science, but often contain sensitive individual-level information, creating a need for accurate prediction while preserving privacy. Traditional private learning provides formal privacy guarantees, but requires slow dataset-specific optimisation, suffers substantial utility loss under strong privacy, and is often difficult to apply correctly. Tabular foundation models adapt rapidly to new datasets, but existing models lack formal privacy guarantees, and are highly vulnerable to membership-inference attacks, limiting their use on sensitive data. Here we introduce PrivTab, an easy to use tabular foundation model for differentially private classification that embeds a privacy mechanism within its architecture. Pretrained on simulated datasets, PrivTab uses in-context learning to transform sensitive rows into compact, provably private summaries---effectively learning how to learn under privacy. PrivTab outperforms private linear and neural-network baselines under moderate-to-strong privacy, shows negligible membership leakage, maintains well-calibrated predictions under strong privacy, and…
PDF arXiv
arXiv cs.LGOct 7
Closed-Form Noise Calibration Against Membership Inference for Random-Allocation DP-SGD
Murat Bilgehan Ertan, Marten van Dijk
DP-SGD protects training data by adding Gaussian noise to clipped gradients. The amount of noise is usually chosen by running a numerical privacy accountant inside a search. We study DP-SGD with random allocation, where each epoch uses every record once, at a randomly chosen step. For this setting we give a one-line formula that bounds the accuracy of every membership inference attack (MIA) on the trained model. With $M$ steps per epoch, $E$ epochs and noise multiplier $σ$, and with membership and non-membership equally likely a priori, the attack accuracy is at most $\frac12+\frac14\sqrt{(1+(e^{1/σ^2}-1)/M)^E-1}$. The formula comes from the chi-square divergence between a Gaussian distribution and a Gaussian mixture that dominates random allocation. It is interpretable and gives $σ$ in about a microsecond. Where applicable, our formula needs at most about half the noise of the state-of-the-art closed-form bound. To measure how close the bound is, we also derive an exact expression for the attack accuracy of these two distributions and evaluate it numerically. Calibrating to this exact expression requires $13.0\%$ to $20.2\%$ less noise than the formula in our main experiments,…
PDF arXiv
arXiv cs.CROct 6
Certified Corruption Budgets: Anytime-Valid Leaderboard Claims under Adaptive Rigging
Hamed Khosravi, Xiaoming Huo
Public leaderboards for AI models are read continuously, and attackers can see every published standing. Vote rigging, selective disclosure of private variants, and benchmark contamination can each move a ranking. Existing guarantees assume genuine records or bound the corruption per step, which an attacker who corrupts in bursts evades. We introduce the certified corruption budget, a tolerance $\widehat{B}_t$ computed after $t$ records and published with each pairwise claim. With probability at least $1-α$, simultaneously at all times, the claim is correct or more than $\widehat{B}_t$ records were corrupted. It holds against attackers who watch every certificate, with no bound on their budget. Forged records and records altered once seen require different certificates: the certificate for forgeries fails, with probability approaching one, against an attacker who flips votes it has seen, while one that charges roughly twice as much per record remains valid, with constant bets even against attackers who see the future, and no smaller charge is valid at every level. The certified budget grows nearly as fast as any valid method allows: with a win fraction $\frac{1}{2}+δ$, each new…
PDF arXiv
arXiv cs.LGOct 6
FedRSPO+: A Heterogeneity-aware Algorithm for Decision-focused Federated Learning
Konstantinos Ziliaskopoulos, Alexander Vinel, Jiaqi Wang
Decision-focused learning (DFL) trains predictive models for downstream optimization, but existing methods largely assume centralized data. In cross-silo settings, federated learning offers a natural alternative, yet standard federated methods optimize prediction over decision quality and do not address heterogeneity in downstream objectives or feasible sets. This heterogeneity is especially challenging for DFL because small perturbations in polyhedral problems can cause discontinuous changes in optimal decisions, destabilizing client updates and aggregation. We propose FedRSPO+, a heterogeneity-aware framework for decision-focused federated learning, built on RSPO+, a regularized predict-then-optimize surrogate that smooths the decision map through projection. We show that RSPO+ upper bounds decision error and regret for the regularized decision and, under exact regularization and consistent LP solution selection, for the original LP decision. We further derive cross-client heterogeneity bounds that depend on both objective and feasible-set heterogeneity, vanish at homogeneity, and require no strong convexity. FedRSPO+ uses an annealed, modular training procedure compatible with…
PDF arXiv
arXiv cs.LGOct 6
Removing Information Content Does Not Certify Tamper Resistance in Open-Weight Models
Domenic Rosati, Alessa Carbo, Ali Dadsetan, Hong Huang, Matthew Young +3
Does removing harmful information make open-weight models resistant to fine-tuning attacks? We show that mutual information at release alone cannot universally certify slow recovery. Function-preserving reparameterizations leave information unchanged while altering gradient-descent geometry, so an invariant certificate is bounded by the fastest reachable parameterization. We apply this principle to weight--data mutual information under training-data filtering and label--representation mutual information under capability removal. Training order can change recovery time at fixed weight--data information, while exact representation-level independence can preserve the entire parameter Jacobian. An explicit construction has both information quantities equal to zero and recovers in one gradient step. Controlled experiments illustrate order-dependent recovery and parameterization-dependent attack speed. These results identify the missing requirement for certification: constraints on attack dynamics beyond mutual information at release.
PDF arXiv

Active contributors · 90 days

Activity · 12 weeks

Coming with more sources: repos

Fields · AI · updated 1m ago

Federated learning

Found by the topic model: federated learning, differential privacy.

51papers this week+37.8% vs last week

All papers · 201 With code · 0

Newest Most relevant

192 papers this month

Open problems in Federated learning

Privacy-utility trade-off in federated learning4 papers raise it · 5 address it
Balancing strong privacy guarantees with model performance remains a core challenge, especially for sensitive data like medical imaging or user profiles.
- Privacy Accounting for Empirical Denoisersraises · addresses
- Privacy-Preserving Personalized Federated Learning (PPP-FL) for Medical Imagingraises · addresses
- Guided Diffusion for Trustworthy Synthetic Text Generationraises · addresses
- Profile-DP: Differential Privacy for User-Controlled Profile Release in Personalized LLM Inferenceraises · addresses
- Privacy-preserving inference on hosted models: a learned input-embedding transform for frozen Qwen3.8-27Baddresses
Heterogeneous preferences and gradient conflicts in federated alignment2 papers raise it · 2 address it
Diverse user preferences and competing objectives cause instability in collaborative training, degrading personalization and adaptation.
- Collaborative Personalized Preference Alignment for LLMs under Data Deficiencyraises · addresses
- Communication-Efficient Federated Domain Generalization in Edge Networks via Dynamic Prototype Regulationraises · addresses
Secure aggregation with user dropouts and communication constraints1 paper raises it · 1 addresses it
Existing secure aggregation schemes struggle with dynamic dropouts and high communication costs, limiting scalability in real-world FL.
- Fundamental Limits of Information-Theoretic Secure Aggregation with User Dropouts in Federated Learningraises · addresses
Byzantine-robust client selection without parameter access1 paper raises it · 1 addresses it
Secure aggregation hides client updates, making it hard to detect malicious clients without exposing sensitive data.
- LiBRA: Logit Fingerprints for Byzantine-Robust Client Selection in Federated Learningraises · addresses
Decentralized inference-time collaboration in federated learning1 paper raises it · 1 addresses it
Exploiting distributed expertise without central coordination is difficult, especially under graph constraints and limited budgets.
- Learning to Refer: Inference-Time Collaboration in Decentralized Federated Learningraises · addresses

Named by an AI from these papers' abstracts.