Federated aggregation strategies for credit card fraud detection under differential privacy

Abstract

Context—Card fraud cost the global financial system over $28 billion in 2019, and losses have risen every year since. Banks hold the transaction data needed for collaborative fraud detection, but privacy regulations such as GDPR and KVKK prevent cross-institutional data sharing. Federated Learning keeps raw data local: each institution trains on its own records and sends only model parameters to a shared coordinator. Differentially-Private Stochastic Gradient Descent (DP-SGD) counters gradient inversion attacks by clipping per-sample gradients and adding calibrated noise before parameters leave the client, yielding a record-level (ε, δ) guarantee whose strength depends on the accumulated privacy budget ε. How the aggregation strategy behaves under this noise has not yet been studied.Objective—We compare five aggregation strategies—FedAvg, FedProx, cosine-similarity aggregation, FedAvg-DWA, and FedAdam—across two real-world benchmarks, two heterogeneity levels, four DP-SGD noise multipliers, and 10 random seeds per configuration. We ask whether the relative ranking of strategies survives DP noise, and what DP actually costs in deployed model behavior.Method—510 federated training runs cover five aggregation configurations, two datasets (Kaggle ULB: n = 284807, 0.17% positive rate; IEEE-CIS: n = 590540, 3.50%), two Dirichlet non-IID levels (α ∈ {0.5, 0.1}), and σ ∈ {0.5, 1.0, 1.5, 2.0}. The base learner is a three-layer MLP with LayerNorm. Privacy accounting uses the Opacus RDP accountant at δ = 10⁻⁵. Performance is reported at both the fixed 0.5 threshold and a validation-tuned F₁-maximizing threshold. All pairwise comparisons carry Bonferroni-, Holm-, and Benjamini–Hochberg-corrected p-values, and all 200 realized client-shard partitions are characterized directly.Results—On Kaggle ULB under IID partitioning, federated F₁@best-t (0.801–0.804) matches the centralized baseline (0.799 ± 0.036). Under mild non-IID without DP (α = 0.5), FedAvg-DWA narrowly leads (< 0.015 on F₁@best-t), though neither test survives correction. In the ULB privacy sweep, 7 of 40 Wilcoxon tests show nominal significance but none survive family-wise correction; performance consistently orders with FedAvg-DWA leading and FedAdam trailing. On IEEE-CIS, this ordering amplifies, and the extreme pair remains Holm-significant under DP (adjusted p = 0.020). While AUC holds near 0.95, calibration drift collapses precision at the fixed 0.5 threshold; a validation-tuned threshold recovers F₁ loss without privacy cost. Both calibration effects replicate on IEEE-CIS (ɛ = 8.10 ± 5.30 at σ = 1.0).Conclusion—Aggregation-rule differences under DP-SGD are small and dataset-dependent in magnitude, consistent in direction, and on the ULB sweep none survives correction; outcome differences arise mainly from post-training threshold tuning. We also uncover a previously unreported interaction: Opacus's DP step quietly overrides the standard loss-augmented FedProx setup, making FedProx numerically equivalent to FedAvg, verified by bit-identical per-round global weight trajectories across seeds.