FedDecouple: Mitigating Noise Accumulation in Differentially Private Federated Learning via Phase Decoupling

SNR-Guided Model Sizing for Differentially Private Federated Learning with LiRA Privacy Auditing

Federated Learning (FL) enables distributed training while keeping data local, but exchanged model updates can leak information through membership inference attacks. Differential privacy mitigates this risk via noise injection; however, aggressive DP regimes with strong noise can destabilize large models. An SNR-guided framework is introduced to select model dimensionality based on the signal-to-noise ratio imposed by the privacy budget. Three optimizers, DP-FedAvg, DP-FedAvgM, and DP-FedAdam, are evaluated across six domains, including image, clinical, IoT, and network security tasks. Privacy leakage is assessed using both loss-based membership inference and the likelihood-ratio attack LiRA. DP-FedAvgM achieves 98.10% accuracy on MNIST at ε =200 with LiRA AUC near random guessing (0.491). SNR-guided models reduce communication cost by up to 66×. Sensitivity calibration experiments further show that incorrect noise allocation can reduce accuracy by up to 1.36 percentage points. These results highlight the importance of model sizing and noise calibration for reliable privacy-preserving FL under strong DP constraints.

An Adaptive Gradient Clipping and Noise Injection Mechanism for Differentially Private Federated Learning

It is demonstrated that round-wise, layer-wise adaptation can improve the privacy-accuracy-efficiency trade-off of differentially private federated learning.

FedDyna: Privacy-Preserving Federated Learning with Dynamic Noise Adaptation and Structural Bias Alignment for Non-IID Environments

Efficient and Differentially Private Federated LLM Fine-Tuning on Heterogeneous Clients

Federated low-rank adaptation (FedLoRA) allows multiple clients to collaboratively fine-tune large language models (LLMs) on downstream tasks without exposing their private data. To mitigate privacy leakage during aggregation, differential privacy (DP) is widely used to clip and perturb local model updates with noise, yet it can compromise model accuracy due to the inherent privacy-utility trade-off. The performance degradation becomes worse under the FedLoRA setting with the amplified DP noise impact and client heterogeneity in both model structure and data distribution. In this work, we propose iP-FedLoRA, a privacy-preserving federated fine-tuning framework for heterogeneous clients that strikes a good privacy-utility balance. Specifically, to fully utilize clients' heterogeneous resources, we customize LoRA modules based on their available resources. iP-FedLoRA employs matrix-wise differentially private local fine-tuning with sensitivity-aware noise allocation and rank-compensated LoRA regularization, which effectively alleviates noise impact of low-rank modules and enhances training efficiency. By leveraging noise-resilient knowledge distillation, iP-FedLoRA facilitates heterogeneous LoRA aggregation that selectively prioritizes high-confidence knowledge to filter DP-induced noise, thereby achieving robust knowledge transfer. Through rigorous privacy analysis and extensive experiments, we show that iP-FedLoRA provides privacy guarantees, improves model accuracy by up to 3.8%, and expedites training by 1.37-2.23×.

Aggregate-Only Observability for Privacy–Utility Tradeoffs in Federated Learning

Federated Learning (FL) avoids centralizing raw data, but server-side access to per-client updates still creates a significant privacy risk because gradients can leak sensitive information through inversion and related attacks. A common defense is client-level Differential Privacy (DP), which reduces attack fidelity by perturbing individual updates, but often at the cost of degraded predictive utility, especially in heterogeneous settings. In this paper, we study a different design choice: aggregate-only observability, where the server learns only an aggregate update rather than the individual client contributions that compose it. We develop a unified evaluation framework comparing baseline FL, client-level DP-FL, an idealized sum-only aggregation mechanism (hide_sum), and a quantum-inspired aggregate-observation primitive (qsum) based on finite-shot GHZ-style phase estimation. Experiments on Texas PUDF and MIMIC-IV show that the aggregate-only regimes preserve competitive predictive utility relative to baseline FL while removing the direct per-client observation channel used by standard server-side inversion attacks. We also analyze utility sensitivity to shot budgets and the resource scaling of the quantum-inspired primitive. The results suggest that privacy–utility tradeoffs in FL depend not only on how updates are perturbed, but also on what the server is allowed to observe. Aggregate-only observability therefore provides a useful mechanism-level complement to noise-based privacy defenses, while also motivating hybrid designs to address residual leakage from aggregate updates.

D3em: A Dual-Layer Dynamic Debiasing Evaluation Mechanism for Client Contribution in Federated Learning

Accurate client contribution evaluation is critical for sustainable federated learning and incentive design, yet existing methods face a trade-off between trust, complexity, and robustness. We show that validation-free, similarity-based metrics can suffer from a federated noise coupling effect, where historical low-quality updates become entangled with the global trajectory, causing evaluation noise to accumulate and manifest as systematic bias across rounds. We propose D3em, a dual-layer dynamic debiasing mechanism built on a parallel local–federated dual-model training framework. D3em extracts a noise-decoupled independent value from the local branch and a collaborative value from the federated branch, and fuses them via a phase-aware weighting schedule to stabilize contribution scores throughout training. Experiments on CIFAR-10, Fashion-MNIST, and SST-5 under diverse heterogeneous partitions show that D3em improves global accuracy by 6.15 percentage points on average over representative baselines, and achieves an average fairness of 97.08% when coupled with incentive schemes. Meanwhile, D3em achieves comparable or even better end-to-end overhead in terms of total communication and total latency. The code is available at https://anonymous.4open.science/r/D_3AM-8A70