Federated Averaging (FedAvg)

The core computational work is pushed to the clients (e.g., mobile devices, hospital servers). Each client initializes with the global model and performs multiple steps of stochastic gradient descent on its local, private dataset. This contrasts with traditional distributed training, which relies on a central dataset. The number of local epochs is a critical hyperparameter; more local computation reduces communication rounds but can lead to client drift if local datasets are highly non-IID.

The server's primary role is aggregation, not training. It collects the updated model weights from a subset of participating clients and computes a new global model by performing a weighted average. The standard weighting scheme is proportional to the size of each client's local dataset (n_k / n), ensuring that clients with more data have a proportionally greater influence on the global model. This simple averaging step is what gives the algorithm its name.

FedAvg operates in discrete communication rounds. In each round:

• The server selects a fraction (C) of available clients.
• The server sends the current global model weights to these selected clients.
• Clients train locally and send back only their model updates (gradients or delta weights).
• The server aggregates these updates to form a new global model. This structure decouples training computation from data centralization, with raw data never leaving the client device.

A defining challenge for FedAvg is statistical heterogeneity, where local datasets are not independent and identically distributed (non-IID). A client's local data may represent a skewed distribution of labels or features. While FedAvg is empirically robust to moderate non-IIDness, severe skew can cause client drift, where local models diverge from each other and the global optimum, slowing convergence. This has spurred research into proximal terms (FedProx) and variance reduction techniques.

FedAvg provides a foundational layer of data minimization by ensuring raw data never leaves the client. However, the transmitted model updates are not inherently private; gradient leakage attacks can reconstruct training data from them. Therefore, FedAvg is typically combined with explicit privacy mechanisms like secure aggregation (to hide individual updates from the server) and differential privacy (to add calibrated noise to updates, bounding information leakage).

The hyperparameter C controls the fraction of clients selected per round. With C=1.0, all clients participate, which is ideal but often impractical due to device availability. Lower values introduce stochasticity that can act as implicit regularization. Client selection strategies range from random uniform sampling to more sophisticated methods that prioritize clients with fresher data, better connectivity, or higher loss, directly impacting convergence speed and final model accuracy.

The overarching decentralized training paradigm that FedAvg implements. Instead of centralizing raw transaction logs, a global fraud model is distributed to participating banks. Each institution trains locally on its sensitive data, and only encrypted model updates—never the data itself—are transmitted back. This architecture is fundamental for consortium-based anti-money laundering initiatives where data sharing is legally prohibited.

A cryptographic protocol that ensures the central server in a FedAvg round can only compute the weighted sum of model updates without ever inspecting an individual bank's gradient vector. This prevents gradient leakage attacks where an adversary could reconstruct transaction details from raw updates. Secure aggregation is the privacy bedrock that transforms FedAvg from a distributed averaging trick into a provably private protocol.

A mathematical guarantee that complements FedAvg by adding calibrated noise to model updates before aggregation. This ensures that the final fraud detection model does not inadvertently memorize a single high-value transaction. Key parameters include:

• Epsilon (ε): The privacy budget controlling the noise scale
• Delta (δ): The probability of catastrophic privacy failure
• Clipping: Bounding individual update norms to limit sensitivity

Standard FedAvg uses a weighted arithmetic mean, which is vulnerable to a single malicious participant sending a corrupted update to poison the global fraud model. Byzantine-robust aggregators replace the mean with statistically resilient alternatives:

• Krum: Selects the update closest to a majority cluster
• Trimmed Mean: Discards extreme coordinate values before averaging
• Median: Uses coordinate-wise median instead of mean This is critical when onboarding untrusted parties into a fraud consortium.

The primary threat vector that FedAvg's companion protocols must mitigate. In a naive implementation, raw gradients shared by a client can be inverted via optimization to reconstruct private training inputs. For financial fraud detection, this could expose account balances, merchant identities, or transaction timestamps. Defenses include gradient compression, secure aggregation, and differential privacy noise injection applied before transmission.

A cryptographic scheme that allows the aggregation server to perform the weighted averaging operation directly on ciphertexts. The server computes Enc(w1*Δ1 + w2*Δ2) without ever decrypting the individual model updates Δi. When combined with FedAvg, this provides a defense-in-depth approach where even a compromised server cannot access plaintext gradients, ensuring end-to-end confidentiality for participating financial institutions.