Federated Learning

The foundational principle of federated learning is that raw data never leaves the device or local server. Only model updates—such as gradient vectors or weight deltas—are transmitted to the central aggregation server. This architecture is critical for compliance with data residency laws and data minimization principles, as it drastically reduces the attack surface for membership inference attacks. By keeping sensitive information local, organizations can train on proprietary or personally identifiable information without exposing the underlying records.

Real-world federated networks are non-IID (not independently and identically distributed). Client devices vary wildly in:

• Compute Capability: From powerful GPUs to low-power TinyML microcontrollers.
• Network Reliability: Dropped connections and high latency are common in edge environments.
• Data Distribution: Local data is often skewed, reflecting the specific user's behavior rather than the population average. Robust frameworks must handle stragglers (slow clients) and implement secure aggregation protocols that are resilient to clients dropping out mid-round.

While federated learning prevents raw data sharing, model updates can still leak information through gradient leakage attacks. To mitigate this, federated systems often integrate differential privacy by clipping gradient norms and injecting calibrated Gaussian noise into the updates before aggregation. This provides a formal mathematical guarantee that the contribution of any single data point is indistinguishable, protecting against sophisticated reconstruction attacks from the central server or honest-but-curious intermediaries.

Federated learning architectures are categorized by the scale and reliability of participants:

• Cross-Device: Involves millions of unreliable, low-power edge devices (smartphones, IoT sensors). Clients are anonymous and participate sporadically.
• Cross-Silo: Involves a small number (2-100) of highly reliable institutional participants (hospitals, banks). Each silo holds a massive, curated dataset and possesses significant compute resources. Cross-silo is the dominant paradigm for healthcare federated learning and financial consortia.

To prevent the central server from inspecting individual client updates, federated learning employs secure multi-party computation (SMPC). A common protocol involves:

• Secret Sharing: Each client masks its update with random noise and shares cryptographic keys with a subset of peers.
• Dropout Robustness: The protocol is designed so that the server can still decrypt the sum of the surviving clients' updates even if a fraction of devices disconnect, but cannot decrypt any individual vector. This ensures the server only sees the aggregated result, not the individual contributions.

A cryptographic protocol that allows a central server to compute the sum of model updates from multiple devices without inspecting any individual contribution in plaintext.

• Uses secret sharing and masking to ensure a device's update is hidden unless a threshold of participants drops out.
• Protects against an honest-but-curious server attempting to reconstruct private training examples from gradient updates.
• Essential for preventing gradient leakage attacks that can reconstruct original images or text from raw updates.

A cryptographic method enabling computation directly on encrypted data. In federated learning, the server can aggregate encrypted model updates without ever decrypting them.

• Partially Homomorphic Encryption (PHE): Supports only addition or multiplication, sufficient for basic gradient aggregation.
• Fully Homomorphic Encryption (FHE): Supports arbitrary computation but incurs significant computational overhead.
• Eliminates the need for trust in the aggregation server entirely, as the raw updates remain opaque.

The legal concept that data is subject to the laws of the nation where it is collected. Federated learning enforces data residency by design, as raw data never leaves the originating device or jurisdiction.

• Critical for compliance with GDPR and Schrems II rulings restricting transatlantic data transfers.
• Enables multinational corporations to train a global model without centralizing sensitive data in a single cloud region.
• Contrasts with traditional data lake architectures that require cross-border data movement.

The technical process of removing the influence of a specific subset of training data from a model without full retraining. In federated systems, this enables compliance with the Right to Erasure.

• Exact unlearning: Retraining the global model from scratch excluding the deleted client's data, computationally prohibitive.
• Approximate unlearning: Using techniques like Newton step removal or influence functions to scrub data influence efficiently.
• Federated unlearning requires the server to reverse the contribution of a specific client's historical updates from the aggregated model.

Adversarial attacks where malicious clients inject corrupted updates to degrade the global model or implant backdoors. Federated learning requires robust defenses due to its open participation model.

• Byzantine-robust aggregation: Algorithms like Krum or trimmed mean that discard outlier updates before averaging.
• Norm clipping: Bounding the L2 norm of client updates to limit the influence of any single participant.
• Differential privacy auditing: Monitoring the privacy budget consumption to detect anomalous update patterns indicative of poisoning.