40 Federated Learning for Generative Models

Imagine training a diffusion model on everyone's medical records. Now imagine doing it without seeing a single one. This is not a thought experiment-it is the central promise of federated learning for generative models, a discipline born from the collision of two irresistible forces: the insatiable appetite of generative AI for ever-larger training corpora, and the equally inexorable tightening of data privacy law, clinical ethics, and corporate sovereignty across the globe.

In the decade between 2014 and 2024, the default assumption of machine learning shifted from “collect all the data, ship it to a data centre, and train” to something more fraught and more interesting. The Generative Adversarial Network (Goodfellow et al., 2014) required an ImageNet-scale dataset assembled in one place. The original DALL-E (Ramesh et al., 2021) was trained on 250 million image-text pairs scraped from the web. GPT-4 (OpenAI, 2023) consumed, by various estimates, between one and ten trillion tokens, drawn from essentially every freely accessible text document on the internet. The trajectory is unmistakable: generative models grow more capable by consuming more data, and the next frontier of improvement lies in data that cannot be freely assembled-medical records, financial documents, personal communications, industrial sensor streams.

The very moment this data becomes scientifically indispensable, it becomes legally inaccessible. The European Union's General Data Protection Regulation (GDPR, 2018) established the right to erasure, the right to data portability, and strict requirements for lawful processing. The California Consumer Privacy Act (CCPA, 2020) extended analogous protections to the world's fifth-largest economy. The Health Insurance Portability and Accountability Act (HIPAA) in the United States has governed medical data since 1996, and its de-identification requirements make centralised clinical AI training a legal minefield. The EU AI Act (2024), the first comprehensive regulatory framework specifically targeting artificial intelligence, imposes risk-based obligations that make data governance a first-class engineering concern.

The result is a profound paradox: generative models need more data than discriminative models, but data is becoming more restricted. A discriminative model learns a boundary $p(y|𝒙)$; it needs enough examples to trace that boundary. A generative model must learn the full joint distribution $p(𝒙,y)$-or even $p(𝒙)$ alone-and must therefore capture the entire support of the data manifold, including rare modes, tail events, and distributional subgroups that a classifier can safely ignore. This requirement for comprehensive coverage scales badly with the fragmentation of data across organisational, geographic, and jurisdictional boundaries.

Federated learning, proposed in its modern form by McMahan et al. (2017) under the name “communication-efficient learning of deep networks from decentralised data,” offers a principled resolution. The insight is architectural: instead of moving data to the model, move the model to the data. Clients train locally on private data; a central server aggregates their updates; no raw data ever leaves its origin. This chapter develops the theory and practice of applying this paradigm to generative models-a much harder problem than the discriminative setting that motivated the original proposal.

The Privacy Paradox of Generative AI

The Data Hunger of Generative Models

The difference in data requirements between discriminative and generative models is not a matter of degree-it is a matter of kind. To understand why, consider a simple binary image classification problem: given an image $𝒙\in {\mathrm{ℝ}}^d$, predict whether it contains a cat. A classifier needs only to learn a decision boundary that separates cat images from non-cat images. It can, in principle, succeed by memorising a few hundred representative examples from each class. Indeed, transfer learning has made it routine to train effective classifiers on datasets of a few thousand labelled images.

A generative model has no such luxury. It must learn $p(𝒙)$, the full distribution over images. In a $d$-dimensional space with $d=3\times 256\times 256=\mathrm{196,608}$, the support of natural images is a highly curved, low-dimensional manifold embedded in this ambient space. Capturing this manifold faithfully requires training examples that densely sample every region of it-every pose, every lighting condition, every age demographic, every rare anatomical variant in a medical setting.

Quantitatively, the gap is stark. State-of-the-art image classifiers on ImageNet achieve near-human performance trained on 1.2 million examples. The best image generation models require datasets that are two to three orders of magnitude larger: LAION-5B (5 billion image-text pairs), JFT-3B (3 billion images), and CommonCrawl-derived corpora of comparable scale for language models. Every mode of the training distribution that is underrepresented becomes a mode that the model either drops (mode collapse) or distorts.

This distinction becomes critical when we consider specialised domains. In medical imaging, the “rare disease” problem is endemic: some pathologies appear in fewer than one in ten thousand scans. A classifier trained to detect the most common conditions can afford to be weak on rare ones; a generative model that cannot synthesise rare pathologies authentically is useless for data augmentation precisely where augmentation is most needed.

Similarly, in natural language processing, dialect diversity, domain specificity, and linguistic minority languages are precisely the conditions most undersupplied in any centralised web crawl. A generative model trained on majority-dialect text will systematically fail to model minority variants-not because the architecture is flawed, but because the data was never collected in the first place.

The Regulatory Landscape

The same years that witnessed the explosion of data-hungry generative models also saw the construction of a global regulatory apparatus designed to limit their data supply. We survey the major frameworks here not as lawyers but as engineers who must understand the constraints they impose.

General Data Protection Regulation (GDPR, 2018).

The GDPR, effective May 25, 2018, applies to any processing of personal data of EU residents, regardless of where the processing organisation is located. Its key provisions for machine learning practitioners are:

• Lawful basis for processing (Article 6): data may only be processed with explicit consent, for contractual necessity, legal obligation, vital interests, public task, or legitimate interests. Training a generative model on scraped web data satisfies none of these for identifiable individuals.

• Right to erasure (Article 17): individuals may request that their data be deleted. For a trained model, this raises the question of “machine unlearning”-can a specific data point's influence be removed from a trained generative model? (Explored in Chapter 29.)

• Data minimisation (Article 5): only the minimum necessary data should be collected. This principle directly conflicts with the generative model paradigm of “more data is always better.”

• Purpose limitation (Article 5): data collected for one purpose cannot be reused for another. Electronic health records collected for clinical care cannot be freely repurposed for AI training.

Violations carry fines up to 4% of global annual turnover or EUR,20 million, whichever is higher. The GDPR has been enforced: Meta was fined EUR,1.2 billion in 2023 for transferring EU user data to the United States; Amazon was fined EUR,746 million in 2021.

Health Insurance Portability and Accountability Act (HIPAA, 1996/2013).

HIPAA governs Protected Health Information (PHI) in the United States. The HIPAA Privacy Rule (2003) and Security Rule (2005) impose strict access controls on 18 categories of individually identifying health information, including names, geographic identifiers, dates, phone numbers, medical record numbers, and account numbers. The HIPAA de-identification standard (45 CFR 164.514) requires either expert determination (statistical demonstration that re-identification risk is “very small”) or the Safe Harbor method (removal of all 18 identifiers). These requirements make centralised training on electronic health records legally and operationally hazardous.

California Consumer Privacy Act (CCPA, 2020) and CPRA (2023).

The CCPA, enacted in 2020 and strengthened by the California Privacy Rights Act (CPRA) in 2023, grants California residents the right to know what personal information is collected, the right to delete it, and the right to opt out of its sale. California is the world's fifth-largest economy, and compliance with CCPA is effectively mandatory for any technology company with a significant US presence. The CPRA additionally created the California Privacy Protection Agency, the first US data privacy enforcement agency.

EU Artificial Intelligence Act (2024).

The EU AI Act, adopted in March 2024, is the world's first comprehensive regulatory framework specifically targeting AI systems. It establishes a risk-based classification:

• Unacceptable risk (prohibited): AI systems for social scoring by governments, real-time remote biometric identification in public spaces, and AI that subliminally manipulates behaviour.

• High risk: AI systems in critical infrastructure, education, employment, essential services, law enforcement, migration, and administration of justice. These require conformity assessments, data governance measures, and transparency obligations.

• Limited risk: AI systems interacting with humans (chatbots) and those generating synthetic content (deepfakes) must disclose their AI nature.

• Minimal risk: all other AI systems, subject only to voluntary codes of conduct.

Generative models used for medical diagnosis, credit scoring, or facial recognition fall squarely in the high-risk category. Foundation models (GPAI, general-purpose AI) with over ${10}^{25}$ FLOPs of training compute face additional requirements for transparency, adversarial testing, and incident reporting.

Data at the Edge: The IoT Reality

While regulation restricts the centralisation of existing data, a parallel technological trend is ensuring that an enormous fraction of future data will be generated in locations where centralisation was never viable in the first place.

By 2030, estimates suggest there will be 40 billion Internet of Things (IoT) devices in operation worldwide-smartphones, wearables, industrial sensors, connected vehicles, home appliances, and environmental monitors. These devices collectively generate data at rates that defy centralisation on purely physical grounds. The International Data Corporation projects that the global datasphere-the total amount of data created, captured, copied, and consumed-will reach 200 zettabytes by 2030, with over half of it generated at the edge.

Consider the arithmetic. One zettabyte is ${10}^{21}$ bytes. The total capacity of all the world's data centres as of 2023 is approximately 10 zettabytes. Shipping 100 zettabytes of edge-generated data per year to centralised servers would require global network infrastructure two orders of magnitude larger than what exists. It is not merely inadvisable; it is physically impossible.

Data silos exist on multiple scales:

• Device-level silos: each smartphone or wearable holds its owner's personal data. A keyboard app generates personalised language data; a health monitor generates biometric time series; a camera generates face images.

• Institutional silos: hospitals hold patient records; banks hold financial transaction histories; law firms hold privileged communications.

• National silos: data localisation laws in Russia (FZ-242), China (MLPS 2.0), and increasingly other jurisdictions require that personal data on citizens be stored and processed within the country's borders.

• Competitive silos: companies with valuable proprietary datasets refuse to share them with competitors even when collaboration would be mutually beneficial scientifically.

The IoT context introduces a further dimension: the data is not merely siloed-it is non-iid (not independently and identically distributed). Each device generates data from a distribution that reflects its owner's personal behaviour, demographics, location, and device characteristics. User $k$'s smartphone keyboard captures their personal vocabulary, writing style, and the topics they discuss; user $k^{\prime }$'s keyboard captures something qualitatively different. When a generative model trained on such heterogeneous data must capture the full joint distribution, this non-iid structure creates profound challenges that we address throughout this chapter.

Why Centralisation Fails

The naive approach to training generative models on siloed data is to centralise it first and worry about the consequences later. This approach fails on four independent grounds, each sufficient on its own.

Privacy failure.

Once data leaves its origin, the centralising entity becomes liable for its protection. Data breaches are not theoretical: the Anthem breach (2015) exposed 78.8 million health records; the Equifax breach (2017) exposed 147 million financial records; the Yahoo breach (2013–2016) exposed 3 billion user accounts. Even in the absence of external attacks, centralised training creates insider threat vectors: researchers, engineers, and infrastructure providers with access to training data have historically exploited it. Moreover, as demonstrated in Chapter 29, even a model trained on centralised data and then published-without releasing the training data-leaks information about individual training examples through membership inference attacks.

Bandwidth failure.

The raw data volume at the edge simply cannot traverse available network infrastructure. A single hospital's PACS (Picture Archiving and Communication System) generates terabytes of imaging data per month. A manufacturing plant with continuous sensor monitoring generates gigabytes per hour. A fleet of autonomous vehicles captures terabytes per vehicle per day. Aggregating these at a central server is not economically or technically feasible at the required scale.

Legal failure.

Moving data across national borders, across institutional boundaries, or between corporate entities creates legal exposure under data protection law, sector-specific regulation, contractual non-disclosure agreements, and national security rules. The Schrems II ruling (2020) invalidated the EU-US Privacy Shield, making routine transatlantic data flows for AI training legally uncertain until the EU-US Data Privacy Framework (2023) was established-and that framework remains contested. Clinical data sharing between hospitals requires data use agreements, IRB approval, and institutional review processes that can take months to years to complete.

Sovereignty failure.

National AI strategies explicitly frame domestic data as a strategic asset. China's Cybersecurity Law (2017) and Data Security Law (2021) prohibit the cross-border transfer of data deemed important to national security or the public interest without government approval. Russia's Federal Law No. 242-FZ requires personal data of Russian citizens to be processed on servers located in Russia. India's Digital Personal Data Protection Act (2023) includes provisions for cross-border data transfer restrictions. In this environment, building generative AI on centralised, globally assembled datasets is not just technically difficult-it is politically untenable for an increasing fraction of the world's data.

The Federated Learning Solution

Federated learning resolves the centralisation dilemma by inverting the direction of movement: instead of moving data to the model, move the model to the data.

The canonical federated learning algorithm, FedAvg (McMahan et al., 2017), operates as follows:

1. A server initialises a global model with parameters ${𝜽}^{(0)}$.

2. In each communication round $t$: enumerate

3. The server selects a subset ${𝒮}^{(t)}\subseteq [K]$ of $C$ clients, where $C\le K$.

4. Each selected client $k\in {𝒮}^{(t)}$ receives the current global parameters ${𝜽}^{(t)}$, runs $E$ epochs of local stochastic gradient descent on ${𝒟}_k$, and sends back updated parameters ${𝜽}_k^{(t)}$.

5. The server aggregates: (Fedavg)$$\begin{array}{ccc}& {𝜽}^{(t+1)}=\sum _{k\in {𝒮}^{(t)}}\frac{n_k}{{\sum }_{j\in {𝒮}^{(t)}}{n}_j}{𝜽}_k^{(t)}.& \text{<span class="tml-eqn"></span>}\end{array}$$ enumerate

6. The process repeats until convergence.

At no point does any client's raw data ${𝒟}_k$ leave its local storage. The server and other clients observe only parameter vectors ${𝜽}_k^{(t)}$-high-dimensional tensors of floating-point numbers that do not directly encode individual training examples.

A Brief History of Federated Learning

The FL Architecture: No Raw Data Moves

The architecture in fig:fedgen:fl-architecture makes several implicit design choices that carry significant consequences:

1. Parameter transmission, not gradient transmission. FedAvg transmits complete model snapshots after local training, not gradients computed on individual batches. This reduces communication cost (fewer synchronisation rounds) but increases the divergence between local models and the global optimum in heterogeneous settings.

2. Asynchronous vs. synchronous aggregation. The standard protocol is synchronous: the server waits for all selected clients to return before aggregating. Asynchronous variants aggregate as clients return, tolerating stragglers-slow clients that would otherwise bottleneck the round.

3. Partial participation. In practice, only a fraction of clients participate in each round. In cross-device settings (smartphones), participation may be conditioned on device state: charging, connected to WiFi, and idle. In cross-silo settings (hospitals), participation is deterministic and controlled.

Unique Challenges for Federated Generative Models

The original FedAvg paper and the discriminative model literature that followed it identified three core challenges in federated learning: communication efficiency, statistical heterogeneity (non-iid data), and systems heterogeneity (varying client capabilities). When we turn to generative models, these challenges interact with model-specific pathologies in ways that require fundamentally new analysis and new algorithms.

Mode collapse under data heterogeneity.

Consider a GAN trained federally on medical images distributed across $K$ hospitals. Hospital $k$ may have a patient population with a characteristic demographic profile: Hospital A serves predominantly elderly patients with cardiac conditions; Hospital B serves a diverse urban population with higher rates of infectious disease; Hospital C is a paediatric specialist centre. Each client's GAN generator, trained only on local data, will capture its local modality. When the server averages generator parameters in FedAvg style, the averaged generator does not necessarily capture any modality well. This is the mode averaging problem: unlike discriminative models, where averaging parameters produces a model with intermediate decision boundaries, averaging generative model parameters can produce a model whose outputs are interpolations between modes that exist nowhere in the training distribution-blurry, physically implausible images that neither represent the elderly cardiac profile nor the paediatric profile faithfully.

Gradient inversion attacks.

A foundational assumption of federated learning is that parameter updates $\mathrm{\Delta }{𝜽}_k$ do not reveal the training data ${𝒟}_k$. Zhu et al. (2019) demonstrated that this assumption is false: given the gradient update from a single batch, an adversarial server can reconstruct the training images with high fidelity using an optimisation procedure. This vulnerability is significantly worse for generative models. A GAN discriminator's gradient update, computed on a batch of real images, carries structural information about those images' high-frequency details precisely because the GAN training objective requires the discriminator to detect fine-grained distributional differences. A VAE encoder's gradient encodes information about the posterior $q(𝒛|𝒙)$ for each training sample, which in turn encodes information about $𝒙$ itself. The very architectural properties that make generative models powerful make them vulnerable to gradient inversion.

Memorisation and privacy amplification.

Generative models are more susceptible to memorisation than discriminative ones (Chapter 29). When a generative model is trained federally, the server's aggregate model can memorise patterns from specific clients' data even without the server ever seeing that data directly. If Client $k$ has a dataset containing a unique individual (a rare disease patient, a distinctive speaker), the global generative model may generate outputs that effectively reveal this individual's presence. The formal analysis of this phenomenon requires combining membership inference theory with the privacy accounting methods of federated differential privacy.

Heterogeneous architectures and model personalisation.

In cross-device settings, clients may have different computational budgets that prevent them from training the full global model. A smartphone cannot train a 10-billion-parameter diffusion model. This creates the need for model heterogeneous federated learning, where the global model and local models may have different architectures. For discriminative models, split learning and knowledge distillation provide partial solutions. For generative models, the interaction between architecture and the learned distribution is more intimate: changing the model architecture changes the generative manifold, and federated aggregation of models with different manifold structures is not well-defined.

Section Exercises

Why Federated Generative Models?

The case for applying federated learning to generative models rests on three distinct motivations that reinforce each other. The first is privacy-preserving synthesis: the ability to generate realistic synthetic data for downstream tasks without exposing any individual's real data. The second is data augmentation across silos: the ability to use federated training to produce augmented datasets that improve discriminative models in data-scarce domains. The third is collaborative generation: the ability to build generative models whose quality benefits from the aggregate knowledge of all clients, in a way that no single silo could achieve alone. These motivations are not redundant; each points to a different use case and a different set of technical requirements.

Motivation 1: Privacy-Preserving Synthesis

The fundamental idea is simple: if a generative model $p_{\theta }(𝒙)$ faithfully approximates the true data distribution $p(𝒙)$, then samples drawn from $p_{\theta }$ can serve as a privacy-preserving substitute for real data. Downstream users who need data for training classifiers, running statistical analyses, or building risk models can work with synthetic samples $\widetilde{𝒙}\sim p_{\theta }(𝒙)$ instead of real protected data.

The privacy argument is subtle and requires careful qualification. A naive version would claim that synthetic data is always safe because “it's not real.” This claim is false. A generative model trained on a small dataset with rare individuals can produce synthetic samples that effectively reveal the existence and attributes of those individuals. The correct claim, formalised in the differential privacy literature, is that if the generative model is trained with $(ϵ,\delta )$-DP guarantees, then samples from the model provide $(ϵ,\delta )$-DP guarantees for downstream analyses. This relies on the post-processing immunity property of differential privacy: any function of a DP output is also DP with the same parameters.

Federated learning with differential privacy (DP-FL) provides an architecture in which privacy guarantees are baked in at the point of gradient computation rather than applied as a post-hoc anonymisation step. The combination-FedAvg with DP-SGD-is therefore the principled approach to privacy-preserving generative model training.

In healthcare, the implications are transformative. Consider a rare paediatric oncology dataset distributed across 12 specialist children's hospitals worldwide, each with 50–200 patients. No single hospital has enough data to train a useful generative model for data augmentation. Pooling is legally impossible under HIPAA and GDPR. Federated generative training with DP can produce a synthetic dataset of arbitrary size that preserves the distributional characteristics of the real data-tumour morphology, imaging protocols, demographic variation-while providing formal privacy guarantees to each patient.

Motivation 2: Data Augmentation Across Silos

Data augmentation-artificially expanding a training dataset through transformations of existing data-is one of the most reliable tools in the machine learning practitioner's toolkit. In computer vision, random crops, flips, colour jitter, and MixUp reliably improve generalisation. In medical imaging, where datasets are small and costly to annotate, generative augmentation (using a trained generative model to produce additional training samples) has emerged as a powerful supplement to geometric augmentation.

Federated generative augmentation combines the benefits of generative augmentation with the privacy properties of federated training. The protocol is:

1. Train a federated generative model $p_{\theta }$ on the union of all clients' local datasets, using only local gradient computations and aggregated parameter updates.

2. Each client downloads the trained generator and uses it to augment its local training set for a downstream discriminative task: ${𝒟}_k^{\prime }={𝒟}_k\cup {\{{\widetilde{𝒙}}_i\}}_{i=1}^M$, where ${\widetilde{𝒙}}_i\sim p_{\theta }$.

3. Each client trains a local discriminative model on its augmented dataset ${𝒟}_k^{\prime }$.

This protocol is particularly valuable in settings where label imbalance is severe or where rare classes are absent from some clients' datasets. A client whose local data contains no examples of a rare tumour subtype can augment its local dataset with synthetic examples of that subtype generated by the global generative model, which has learned the subtype's characteristics from the clients whose local data contains it.

Motivation 3: Collaborative Generation

The third motivation is the most subtle but perhaps the most profound in the long run. Generative models are increasingly used not merely to synthesise private data but to build shared creative, scientific, and commercial artefacts: a language model that assists researchers across 100 universities; a protein structure predictor used by hundreds of pharmaceutical companies; a code generation model shared among tens of thousands of software teams.

In these settings, the challenge is not primarily privacy but collective intelligence: the aggregate knowledge encoded in all clients' data is greater than the sum of its parts, but no single client can contribute its data to a centralised pool. The competitive, legal, or sovereignty constraints that silo data are real, but so is the scientific or commercial value of a model trained on all of it.

Federated generative models provide the mechanism for this collaboration. A pharmaceutical company's drug-receptor binding model trained on its proprietary compound library can be combined with a competitor's model trained on their library-via federated aggregation of model updates-to produce a superior joint model, without either company revealing its compounds. The resulting model benefits from diversity of chemical space that neither company's library alone could provide.

Formal Definition

This definition encompasses multiple model classes and protocol variants. The privacy guarantee $𝒢$ ranges from no formal guarantee (vanilla FedAvg) through secure aggregation (the server learns only aggregated gradients) to formal $(ϵ,\delta )$-DP (with calibrated noise injection). The quality metric $d$ may be the Fréchet Inception Distance (FID) for image models, perplexity for language models, or domain-specific metrics such as the Structural Similarity Index (SSIM) for medical images.

The Generative Model Zoo in FL Context

The five major families of generative models studied in this book each present different challenges and opportunities in the federated setting. We briefly characterise each here; subsequent sections and chapters develop the theory and algorithms in depth.

Generative Adversarial Networks (GANs).

GANs consist of a generator $G_{\theta }$ and discriminator $D_{\varphi }$ trained in an adversarial minimax game. The federated challenge is immediate: in standard FedAvg, each client trains both $G_{\theta }$ and $D_{\varphi }$ locally on its data. When clients have heterogeneous data distributions, local generators capture local modes while local discriminators are calibrated to local data manifolds. Averaging the parameters of heterogeneous generators produces a “ghost generator” whose outputs may not correspond to any real data mode. The discriminator averaging problem is equally severe: an averaged discriminator may fail to distinguish real from fake for any single client's data distribution, causing the adversarial training signal to collapse. FedGAN (Rajagopal et al., 2021) and MD-GAN (Hardy et al., 2019) address these challenges with server-side discriminator training and distributed generator architectures respectively.

Variational Autoencoders (VAEs).

VAEs optimise the Evidence Lower Bound (ELBO): (ELBO)$$\begin{array}{ccc}& {ℒ}_{\mathrm{VAE}}(𝜽,𝝓;𝒙)={𝔼}_{q_{𝝓}(𝒛|𝒙)}[\log p_{𝜽}(𝒙|𝒛)]-\mathrm{KL}(q_{𝝓}(𝒛|𝒙)\Vert p(𝒛)).& \text{<span class="tml-eqn"></span>}\end{array}$$ In the federated setting, the encoder $q_{𝝓}(𝒛|𝒙)$ maps local client data to a shared latent space. If clients have heterogeneous data, their local posteriors $q_{𝝓}(𝒛|𝒙)$ cluster in different regions of the latent space, creating a fragmented latent manifold. Aggregating encoder and decoder parameters across clients produces a global VAE whose latent space is a mixture of the local ones-an effect analogous to mode averaging in GANs but more analytically tractable due to the VAE's probabilistic formulation. FedVAE protocols exploit the decomposition of the ELBO into a reconstruction term (local, data-dependent) and a KL term (regularisation toward the prior, data-independent) to design aggregation strategies that preserve the shared latent structure.

Diffusion Models.

Diffusion models learn a denoising function ${ϵ}_{𝜽}({𝒙}_t,t)\approx ϵ$ that predicts the noise added to a clean image ${𝒙}_0$ in the forward diffusion process. Their training objective is a weighted sum of denoising mean squared errors: (Diffusion LOSS)$$\begin{array}{ccc}& {ℒ}_{\mathrm{diff}}(𝜽)={𝔼}_{t,{𝒙}_0,ϵ}\left[{\Vert ϵ-{ϵ}_{𝜽}({𝒙}_t,t)\Vert }^2\right].& \text{<span class="tml-eqn"></span>}\end{array}$$ This objective is a simple mean squared error, which makes it unusually compatible with federated averaging: unlike the GAN adversarial objective, there is no generator–discriminator interaction that creates instability under parameter averaging. Federated diffusion training can proceed with standard FedAvg on the denoising network parameters, with the main challenge being the high communication cost of transmitting the large parameter vectors of modern U-Net or Transformer-based denoisers. Personalisation strategies-allowing the denoiser to be partially local-are particularly natural for diffusion models because the text conditioning mechanism in latent diffusion models provides a hook for client-specific style adaptation.

Large Language Models (LLMs).

Federated fine-tuning of large language models is the most active area of current federated generative learning research. Foundation models such as LLaMA, GPT, and PaLM are trained centralised on public data, then fine-tuned federally on private data held by clients (hospitals, law firms, individual users). The primary challenge is the extreme communication cost of transmitting updates to billion-parameter models. Parameter-Efficient Fine-Tuning (PEFT) methods-LoRA, prefix tuning, and adapters-reduce communication cost by updating only a small fraction of parameters. Federated LoRA, for example, updates only the low-rank adapter matrices $𝐀\in {\mathrm{ℝ}}^{r\times d}$ and $𝐁\in {\mathrm{ℝ}}^{d\times r}$ (with $r\ll d$) rather than the full weight matrix $𝐖\in {\mathrm{ℝ}}^{d\times d}$. The privacy challenge is correspondingly more subtle: even gradient updates to low-rank adapters can reveal significant information about the private fine-tuning data.

Normalising Flows.

Normalising flows learn an invertible transformation $f_{\theta }:{\mathrm{ℝ}}^d\to {\mathrm{ℝ}}^d$ that maps a simple base distribution (e.g., Gaussian) to the data distribution via the change-of-variables formula: (FLOW)$$\begin{array}{ccc}& \log p_{\theta }(𝒙)=\log p_z(f_{\theta }^{-1}(𝒙))+\log \left|\det \frac{\partial f_{\theta }^{-1}}{\partial 𝒙}\right|.& \text{<span class="tml-eqn"></span>}\end{array}$$ Flows provide exact likelihood evaluation, which is valuable for membership inference detection (Chapter 29) and for evaluating the quality of federated training. In the federated setting, the log-likelihood objective decomposes exactly across clients, making the federated optimisation problem well-posed and the convergence analysis tractable. The challenge is primarily architectural: the Jacobian determinant computation in ((FLOW)) requires architectures with restricted parameter interactions (e.g., coupling layers in RealNVP, autoregressive flows), which limits expressiveness.

Taxonomy of Federated Generative Model Approaches

Method	Model	Topology	Privacy	Domain	Comm. Cost
FedGAN	GAN	C/S	Agg	Image synthesis	$O(|{\theta }_G|+|{\theta }_D|)$
MD-GAN	GAN	C/S	Agg	Image synthesis	$O(|{\theta }_G|)$
DP-FedGAN	GAN	C/S	DP	Medical imaging	$O(|{\theta }_G|)$
FedVAE	VAE	C/S	Agg	Tabular, image	$O(|{\theta }_E|+|{\theta }_D|)$
FedCVAE	CVAE	C/S	SA	Conditional synthesis	$O(|{\theta }_E|+|{\theta }_D|)$
DP-FedVAE	VAE	C/S	DP	Healthcare	$O(|{\theta }_E|+|{\theta }_D|)$
FedDiff	Diffusion	C/S	Agg	Image, audio	$O(|{\theta }_{ϵ}|)$
PFedDiff	Diffusion	C/S	DP	Medical imaging	$O(|{\theta }_{ϵ}|)$
FedLLM	LLM	C/S	SA	NLP, code	$O(d^2)$
FedLoRA	LLM	C/S	DP	NLP personalisation	$O(rd)$
FedPFT	LLM	Hier	SA	Cross-silo NLP	$O(d^2)$
FedFlow	Flow	C/S	Agg	Tabular, density	$O(|{\theta }_f|)$
D-FedFlow	Flow	P2P	SA	Decentralised density	$O(|{\theta }_f|)$

The taxonomy in Table 1 reveals several structural patterns. First, the GAN family requires the largest communication overhead because both generator and discriminator parameters must be synchronised; MD-GAN addresses this by keeping the discriminator server-side. Second, differential privacy (DP) consistently appears in the medical imaging and healthcare rows, reflecting the stringent privacy requirements of those domains. Third, hierarchical topologies (FedPFT) appear for LLM fine-tuning in cross-silo settings, where a two-level aggregation hierarchy (institution-level, then global) improves communication efficiency.

Visualising the FGM Taxonomy

Cross-Silo vs. Cross-Device Federated Learning

The federated learning literature distinguishes two fundamentally different deployment contexts that impose very different engineering requirements on any federated generative model.

The contrast between cross-silo and cross-device settings has profound implications for federated generative model design. In the cross-silo setting, communication rounds can be expensive (transmitting full model snapshots is acceptable); training can run for many rounds without client dropout; and the number of clients is small enough that advanced coordination protocols (e.g., secure multi-party computation) are feasible. In the cross-device setting, communication must be minimised to kilobytes per round; client dropout must be tolerated gracefully; and the server must aggregate contributions from hundreds or thousands of clients simultaneously.

For generative models specifically:

• Cross-silo: full model training is feasible. Hospitals can train full VAEs, GANs, or diffusion models. Aggregation of complete model parameters is the standard approach. Privacy is ensured through secure aggregation and, where required, differential privacy with strong guarantees ($ϵ\le 1$ in some regulatory contexts).

• Cross-device: only parameter-efficient fine-tuning is feasible. Smartphones cannot train billion-parameter diffusion models. Federated fine-tuning of foundation model adapters (LoRA, prefix vectors) is the dominant approach. Privacy must be ensured with less overhead; lightweight DP mechanisms with looser guarantees ($ϵ\le 8$) are typical.

Connections to Previous Chapters

This chapter builds on and connects to several earlier developments in the book.

Chapter 33: Medical Image Segmentation.

The clinical motivation of Chapter 36 is directly addressed by federated generative learning. The annotation bottleneck-the difficulty of obtaining sufficient expert-labelled medical images-is precisely the problem that federated generative augmentation solves. A federated GAN or diffusion model trained across hospital consortia generates annotated synthetic images that each hospital can use to augment its own small labelled dataset, reducing the annotation burden without violating data sharing agreements. The FedDiff protocol developed in sec:fedgen:algorithms:diffusion is directly applicable to the chest X-ray, MRI, and histopathology settings of Chapter 36.

Chapter 35: Interpretability and Explainability.

The interpretability methods of Chapter 38 acquire new significance in the federated setting. When a model is trained federally, the provenance of any given learned feature is obscured: it may have come from Client 1's data, Client 3's data, or a complex interaction of all clients' contributions. Gradient attribution methods (saliency maps, SHAP, LIME) can in principle be used to assign learned features to client contributions, raising both interpretability and privacy concerns. If a saliency map of the global generative model can be attributed to specific training examples from Client $k$'s private data, this constitutes a privacy leakage. The intersection of interpretability and federated privacy is a rich open research area.

Chapter 36: Membership Inference Attacks.

Chapter 29 established the foundations of membership inference as a formal privacy threat. In the federated setting, membership inference takes on a new dimension: an adversarial server can attempt to perform membership inference on the gradient updates it receives, determining which individual examples contributed to a specific round's gradient. Conversely, the federated training protocol itself can be seen as a privacy amplification mechanism: by training on only a fraction of clients per round and adding noise through partial participation and dropout, the server's per-example information is diluted. This privacy amplification by subsampling is formalised by Balle et al. (2020) and provides a key theoretical tool for DP accounting in federated settings.

Chapter Roadmap

The chapter proceeds as follows. Sections 1–2 (this file, sec_fedgen_a.tex) establish the motivation, formal definitions, and conceptual framework. Section 3 develops the algorithms for federated GAN training in depth: the MD-GAN protocol, convergence analysis under non-iid data, the FedGAN minimax landscape, and DP-FedGAN for medical applications. Section 4 addresses FedVAE and FedFlow: the decomposition of the ELBO under federated training, latent space alignment across clients, and the exact likelihood advantage of flows in federated density estimation. Section 5 covers federated diffusion models: the FedDiff protocol, communication compression for large denoisers, personalised diffusion via local conditioning, and applications to medical image synthesis. Section 6 develops the FedLLM ecosystem: federated fine-tuning with LoRA, prefix tuning, and adapters; the communication-privacy trade-off in FedLoRA; and applications to clinical NLP and code generation. Section 7 provides the formal privacy analysis: $(ϵ,\delta )$-DP for FedAvg with Gaussian noise, privacy amplification by subsampling, Rényi differential privacy accounting, and the privacy-utility Pareto frontier for federated generative models. Section 8 covers evaluation: FID, KID, precision/recall, and domain-specific metrics; benchmark datasets and protocols for federated generative model comparison; and the unique challenges of evaluating models trained on private federated data.

Section Exercises

Federated Learning Fundamentals

Federated learning asks a deceptively simple question: can we train a shared model across $N$ clients who each hold private data, without ever moving that data off-device? The answer is yes, but the price is a cascade of engineering and mathematical challenges, each more subtle than the last. This section develops the core algorithmic machinery starting from the canonical Federated Averaging (FedAvg) algorithm of McMahan et al. (2017), then progresses through the failure modes that motivated a decade of refinements.

Problem Setup and Notation

Let $[N]=\{1,\dots ,N\}$ denote the set of $N$ clients. Client $i$ holds a private dataset ${𝒟}_i={\{({𝒙}_j^{(i)},y_j^{(i)})\}}_{j=1}^{n_i}$ of size $n_i$, drawn from a local distribution ${𝒫}_i$. The total number of samples is $n={\sum }_{i=1}^N{n}_i$. The local objective of client $i$ is (Local OBJ)$$\begin{array}{ccc}& F_i(𝒘)=\frac{1}{n_i}\sum _{j=1}^{n_i}\ell (f_{𝒘}({𝒙}_j^{(i)}),y_j^{(i)}),& \text{<span class="tml-eqn"></span>}\end{array}$$ where $𝒘\in {\mathrm{ℝ}}^d$ are the model parameters and $\ell$ is a per-sample loss. The global objective is the weighted average (Global OBJ)$$\begin{array}{ccc}& F(𝒘)=\sum _{i=1}^N\frac{n_i}{n}{F}_i(𝒘).& \text{<span class="tml-eqn"></span>}\end{array}$$ Centralised training minimises $F(𝒘)$ with full access to all data; federated training must approximate this using only local gradients and periodic communication.

A key quantity is the degree of heterogeneity. Let ${𝒈}^{\ast }=\nabla F({𝒘}^{\ast })$ be the gradient at the global optimum. The client drift at client $i$ is measured by the distance between local and global gradients: (Drift Measure)$$\begin{array}{ccc}& {\delta }_i(𝒘)={\Vert \nabla F_i(𝒘)-\nabla F(𝒘)\Vert }^2.& \text{<span class="tml-eqn"></span>}\end{array}$$ When all ${𝒫}_i$ are identical (IID regime), ${\delta }_i(𝒘)=0$ for all $𝒘$. In the non-IID regime, this term drives the dominant error term in convergence bounds.

The FedAvg Algorithm

The following TikZ figure illustrates one complete communication round of FedAvg.

Convergence Analysis

We analyse FedAvg convergence under the following standard assumptions.

Under these assumptions, the convergence of FedAvg depends critically on whether data is IID across clients.

FedAvg Variants and Improvements

The convergence analysis of Proposition 1 reveals three levers for improvement: reduce the drift term, stabilise the aggregation step, or employ variance reduction. Each lever has inspired a family of algorithms.

FedProx: Limiting Client Drift via Proximal Regularisation

The simplest fix is to regularise the local objective so that client updates cannot stray too far from the global model. FedProx (Li et al., 2020) modifies the local objective to: (Fedprox OBJ)$$\begin{array}{ccc}& h_i(𝒘;{𝒘}^t)=F_i(𝒘)+\frac{\mu }{2}{\Vert 𝒘-{𝒘}^t\Vert }^2,& \text{<span class="tml-eqn"></span>}\end{array}$$ where $\mu >0$ is a proximal coefficient. The added term acts as a quadratic anchor: the further $𝒘$ departs from ${𝒘}^t$, the greater the penalty. Formally, FedProx produces an $ϵ$-inexact local minimiser: ${𝒘}_i^{t,\tau }$ satisfying $$\Vert \nabla h_i({𝒘}_i^{t,\tau };{𝒘}^t)\Vert \le ϵ\Vert \nabla h_i({𝒘}^t;{𝒘}^t)\Vert .$$ The proximal term reduces the effective gradient dissimilarity from $G^2$ to $G^2/{(1+\mu /L)}^2$, shrinking the drift penalty at the cost of introducing a regularisation bias proportional to $\mu$. In practice, $\mu$ is a cross-validated hyperparameter; too small and drift is unchecked, too large and the model is prevented from learning.

FedAdam: Adaptive Optimisation for the Server Step

FedAvg performs a simple weighted average in the aggregation step ((Aggregation)), which is equivalent to the server taking a vanilla SGD step on the pseudo-gradient ${\bar{\mathrm{\Delta }}}^t={\sum }_i(n_i/n){\mathrm{\Delta }}_i^t/\eta$. Reddi et al. (2021) observed that replacing the server-side SGD with an adaptive optimiser dramatically stabilises training in the non-IID regime. FedAdam applies the Adam update on the server: (Fedadam M)$$\begin{array}{cccc}& {𝒎}^t& ={\beta }_1{𝒎}^{t-1}+(1-{\beta }_1){\bar{\mathrm{\Delta }}}^t,& \text{<span class="tml-eqn"></span>}\\ & {𝒗}^t& ={\beta }_2{𝒗}^{t-1}+(1-{\beta }_2){({\bar{\mathrm{\Delta }}}^t)}^2,& \text{<span class="tml-eqn"></span>}\\ & {𝒘}^{t+1}& ={𝒘}^t+{\eta }_s\frac{{𝒎}^t}{\sqrt{{𝒗}^t}+{ϵ}_s},& \text{<span class="tml-eqn"></span>}\end{array}$$ where ${\eta }_s$ is the server learning rate and operations are element-wise. The adaptive denominator $\sqrt{{𝒗}^t}+{ϵ}_s$ dampens directions where the pseudo-gradient has been historically large (high variance) and amplifies directions where it has been consistently small (informative). Empirically, FedAdam reduces the sensitivity to client heterogeneity, achieving comparable accuracy to FedAvg with $2\times$ fewer communication rounds on standard benchmarks.

SCAFFOLD: Variance Reduction via Control Variates

SCAFFOLD (Karimireddy et al., 2020) provides the most principled solution to client drift by introducing control variates that explicitly correct the bias introduced by local SGD. Each client $i$ maintains a control variate ${𝒄}_i\in {\mathrm{ℝ}}^d$ (initialised to $0$), and the server maintains a global control variate $𝒄\in {\mathrm{ℝ}}^d$.

The SCAFFOLD local update replaces the local gradient with a bias-corrected version: (Scaffold Update)$$\begin{array}{ccc}& {𝒘}_i^{t,k+1}={𝒘}_i^{t,k}-\eta (\tilde{\nabla }{F}_i({𝒘}_i^{t,k})-{𝒄}_i+𝒄),k=0,\dots ,\tau -1.& \text{<span class="tml-eqn"></span>}\end{array}$$ The correction $-{𝒄}_i+𝒄$ acts as an estimate of the local drift: ${𝒄}_i$ approximates $\nabla F_i({𝒘}^{\ast })$ and $𝒄$ approximates $\nabla F({𝒘}^{\ast })$. After the local update, the client computes a new control variate estimate: (Scaffold CV Update)$$\begin{array}{ccc}& {𝒄}_i^{+}={𝒄}_i-𝒄+\frac{1}{\tau \eta }({𝒘}^t-{𝒘}_i^{t,\tau }),& \text{<span class="tml-eqn"></span>}\end{array}$$ and sends both ${\mathrm{\Delta }}_i^t={𝒘}_i^{t,\tau }-{𝒘}^t$ and the control variate update $\mathrm{\Delta }{𝒄}_i={𝒄}_i^{+}-{𝒄}_i$ to the server. The server updates: $$\begin{array}{cccc}& {𝒘}^{t+1}& ={𝒘}^t+\frac{1}{|{𝒮}^t|}\sum _{i\in {𝒮}^t}{\mathrm{\Delta }}_i^t,& \text{<span class="tml-eqn"></span>}\\ & {𝒄}^{+}& =𝒄+\frac{1}{N}\sum _{i\in {𝒮}^t}\mathrm{\Delta }{𝒄}_i.& \text{<span class="tml-eqn"></span>}\end{array}$$

Comparison of FL Optimisation Algorithms

Algorithm	Key idea	Rate	Non-IID robust	Comm. / round
FedSGD	1 gradient step, aggregate	$𝒪(1/\sqrt{T})$	✓	1 vector
FedAvg	$\tau$ local SGD steps	$𝒪(1/\sqrt{\tau T})$	$\times$	1 vector
FedProx	Proximal regularisation	$𝒪(1/\sqrt{T})$	Partial	1 vector
FedAdam	Adaptive server step	$𝒪(1/\sqrt{T})$	Partial	1 vector
SCAFFOLD	Control variates	$𝒪(1/T)$	✓	2 vectors

Communication Rounds, Local Epochs, and the Round-Accuracy Trade-off

A fundamental design question is how many local epochs $E$ to perform before synchronisation. The convergence bound (Convergence Bound) reveals a trilemma:

• Communication cost scales as $T\times N\times d\times 32$ bits. Reducing $T$ (fewer rounds) requires increasing $\tau$ (more local computation per round).

• Convergence speed degrades with $\tau$ in the non-IID regime: each additional local step amplifies drift by $𝒪({\tau }^2{G}^2{\eta }^2)$.

• Wall-clock time per round grows linearly with $\tau$ (synchronous FL) or is bounded by the slowest client (asynchronous FL).

Practitioners typically set $E\in \{1,5,10\}$ local epochs and use learning rate warmup for the first few rounds. The relationship between $T$, $E$, $\eta$, and final test accuracy forms a three-dimensional Pareto surface that must be navigated empirically for each deployment.

Exercises

Communication Efficiency and Compression

Federated learning's promise of privacy-preserving collaboration carries a steep communication price. A modern language model has ${10}^9$ parameters; at 32-bit floating-point precision, each model transmission costs $4\times {10}^9$ bytes - 4 gigabytes per round per client. With 100 communication rounds and 1000 clients, the aggregate bandwidth consumed is $4\times {10}^{14}$ bytes, or 400 terabytes. Even a hospital network with 1 Gbps links would require about $3.2\times {10}^6$ seconds ($\approx 37$ days) for the uploads alone. In mobile cross-device FL, where clients connect over LTE with upload speeds of 5–20 Mbps, a single round takes hours.

This section develops the mathematics of communication-efficient federated learning: how much information must be transmitted, what can be lost without degrading convergence, and how modern compression schemes navigate this boundary.

The Bandwidth Bottleneck: A Quantitative View

The raw numbers underscore the urgency. For GPT-2 (117M parameters), 100 rounds of uncompressed FL require: (Bandwidth CALC)$$\begin{array}{ccc}& B_{\mathrm{total}}=100\times 1000\times 117\times {10}^6\times 32\text{ bits}=3.74\times {10}^{14}\text{ bits}\approx 46\text{ TB.}& \text{<span class="tml-eqn"></span>}\end{array}$$ A factor-32 compression (from 32-bit to 1-bit) would reduce this to 1.44 TB, still substantial but tractable on enterprise links. The goal of communication-efficient FL is to achieve compression ratios $\rho \ll 1$ with minimal accuracy loss.

Gradient Sparsification

The simplest observation is that most gradient coordinates are near zero most of the time. Sparsification exploits this by transmitting only the $K$ largest-magnitude coordinates.

Top-$K$ sparsification. Given a gradient vector $𝒈\in {\mathrm{ℝ}}^d$, define the Top-$K$ mask: (TOPK)$$\begin{array}{ccc}& {\text{Top}}_K{(𝒈)}_j=\{\begin{array}{cc}{g}_j& \text{if }|g_j|\text{ is among the }K\text{ largest in absolute value,}\\ 0& \text{otherwise.}\end{array}& \text{<span class="tml-eqn"></span>}\end{array}$$ The compression ratio is $K/d$ (for the values) plus overhead for transmitting the $K$ indices ($K{\log }_{2}d$ bits). For $K/d=0.01$ (top 1%), only 1% of parameters are communicated, but indices add ${\log }_2({10}^9)\approx 30$ bits per value, so the true savings are moderate unless $K$ is very small.

Top-$K$ with error feedback. Naive Top-$K$ discards the non-transmitted gradient mass, leading to divergence. The error feedback mechanism (Seide et al., 2014; Stich et al., 2018) accumulates the error and adds it to the next round's gradient: (Error Feedback E)$$\begin{array}{cccc}& {𝒆}_i^{t+1}& ={𝒆}_i^t+\nabla F_i({𝒘}^t)-{\text{Top}}_K({𝒆}_i^t+\nabla F_i({𝒘}^t)),& \text{<span class="tml-eqn"></span>}\\ & {𝒈}_i^{t,\text{sent}}& ={\text{Top}}_K({𝒆}_i^t+\nabla F_i({𝒘}^t)).& \text{<span class="tml-eqn"></span>}\end{array}$$ The key property is that ${𝒆}_i^t+\nabla F_i({𝒘}^t)$ is exactly recovered as ${𝒈}_i^{t,\text{sent}}+{𝒆}_i^{t+1}$, so no gradient mass is permanently discarded. Under the contraction property ${\Vert {\text{Top}}_K(𝒈)-𝒈\Vert }^2\le (1-K/d){\Vert 𝒈\Vert }^2$, error feedback guarantees convergence at the same asymptotic rate as full gradient communication.

Quantisation Methods

Quantisation reduces the bit-width used to represent each gradient value. The trade-off is between representation precision and communication cost.

1-Bit SGD

Seide et al. (2014) proposed compressing each gradient to a single bit per coordinate by transmitting only the sign: (1BIT SGD)$$\begin{array}{ccc}& Q_1(𝒈)={\Vert 𝒈\Vert }_1\cdot \mathrm{sign}(𝒈)/d,& \text{<span class="tml-eqn"></span>}\end{array}$$ where $\mathrm{sign}{(𝒈)}_j=+1$ if $g_j\ge 0$ and $-1$ otherwise, and the scalar ${\Vert 𝒈\Vert }_1/d$ normalises the magnitude. The client transmits the $d$-bit sign vector plus a single scalar, achieving $b\approx 1$ bit per parameter. Like Top-$K$, 1-bit SGD requires error feedback to prevent divergence.

Ternary Quantisation

Ternary quantisation maps each gradient value to $\{-\mathrm{\Delta },0,+\mathrm{\Delta }\}$ for some threshold $\mathrm{\Delta }>0$: (Ternary)$$\begin{array}{ccc}& Q_T{(𝒈)}_j=\{\begin{array}{cc}+\mathrm{\Delta }& g_j>\mathrm{\Delta },\\ 0& |g_j|\le \mathrm{\Delta },\\ -\mathrm{\Delta }& g_j<-\mathrm{\Delta }.\end{array}& \text{<span class="tml-eqn"></span>}\end{array}$$ Choosing $\mathrm{\Delta }=\frac{0.7}{d}{\Vert 𝒈\Vert }_1$ (the standard threshold) minimises the expected quantisation error. Each ternary value requires ${\log }_{2}3\approx 1.58$ bits, but since zero values need not be transmitted, effective compression depends on the sparsity of the gradient. Ternary quantisation is particularly relevant for FedDT (see Knowledge Distillation in Federated Learning: FedDT).

SignSGD and Its Convergence Guarantees

Bernstein et al. (2018) proposed SignSGD, which transmits only the sign of each gradient coordinate (like 1-bit SGD without error feedback) and uses majority voting in aggregation: (Signsgd)$$\begin{array}{ccc}& {𝒘}^{t+1}={𝒘}^t-\eta \cdot \mathrm{sign}(\sum _{i\in {𝒮}^t}\mathrm{sign}(\nabla F_i({𝒘}^t))).& \text{<span class="tml-eqn"></span>}\end{array}$$ The majority vote aggregation is interesting: instead of averaging gradient magnitudes, the server takes the coordinate-wise majority of client signs. A coordinate is updated positively (negatively) if more than half the clients report a positive (negative) gradient.

Low-Rank Approximation

For models with large weight matrices (e.g., transformers), gradient matrices $𝐆\in {\mathrm{ℝ}}^{m\times n}$ can be approximated by their rank-$r$ truncated SVD: (SVD Compress)$$\begin{array}{ccc}& {\widehat{𝐆}}_r={𝐔}_r{𝚺}_r{𝐕}_r^{\top },& \text{<span class="tml-eqn"></span>}\end{array}$$ where ${𝐔}_r\in {\mathrm{ℝ}}^{m\times r}$, ${𝚺}_r\in {\mathrm{ℝ}}^{r\times r}$, ${𝐕}_r\in {\mathrm{ℝ}}^{n\times r}$. The compression ratio is $r(m+n+r)/(mn)$, which is advantageous when $r\ll \min (m,n)$. The approximation error is ${\Vert 𝐆-{\widehat{𝐆}}_r\Vert }_F^2={\sum }_{k>r}{\sigma }_k^2$, where ${\sigma }_k$ are the singular values. PowerSGD (Vogels et al., 2019) computes this approximation efficiently using power iteration, avoiding a full SVD.

Knowledge Distillation in Federated Learning: FedDT

Rather than compressing gradients directly, knowledge distillation-based approaches compress the model outputs transmitted between clients and server. FedDT (Federated with Distillation and Ternary compression) combines ternary weight quantisation with dataset distillation-based knowledge transfer.

In FedDT, each client $i$ trains a locally quantised model $f_{{\widehat{𝒘}}_i}$ where ${\widehat{𝒘}}_i\in {\{-{\mathrm{\Delta }}_i,0,+{\mathrm{\Delta }}_i\}}^d$ are ternary weights. Instead of uploading the full model, the client distils its knowledge into soft labels on a small public (proxy) dataset ${𝒟}_{\text{pub}}$: (Feddt Softlabels)$$\begin{array}{ccc}& {𝒔}_i^t={\left\{f_{{\widehat{𝒘}}_i^t}(𝒙)\right\}}_{𝒙\in {𝒟}_{\text{pub}}},& \text{<span class="tml-eqn"></span>}\end{array}$$ and transmits ${𝒔}_i^t\in {\mathrm{ℝ}}^{|{𝒟}_{\text{pub}}|\times C}$ (where $C$ is the number of classes). The server aggregates soft labels: (Feddt Aggregate)$$\begin{array}{ccc}& {\overline{𝒔}}^t=\frac{1}{|{𝒮}^t|}\sum _{i\in {𝒮}^t}{𝒔}_i^t,& \text{<span class="tml-eqn"></span>}\end{array}$$ and each client performs local distillation: (Feddt Distil LOSS)$$\begin{array}{ccc}& {ℒ}_{\text{distil}}(𝒘)=\frac{1}{|{𝒟}_{\text{pub}}|}\sum _{𝒙\in {𝒟}_{\text{pub}}}\mathrm{KL}\left(f_{𝒘}(𝒙)\Vert {\overline{𝒔}}^t(𝒙)\right).& \text{<span class="tml-eqn"></span>}\end{array}$$ The communication cost per round per client is $|{𝒟}_{\text{pub}}|\times C\times 32$ bits (for the soft labels), which is independent of model size $d$. For $|{𝒟}_{\text{pub}}|=1000$ and $C=10$, this is $\mathrm{320,000}$ bits, compared to $d\times 32$ bits for a full model upload with $d={10}^9$ ($32\times {10}^9$ bits).

Empirical results. FedDT achieves a 78% reduction in communication cost compared to full-precision FedAvg, while showing a 7.85% improvement in test accuracy on heterogeneous FL benchmarks. The accuracy improvement is attributed to the regularisation effect of ternary quantisation (which reduces overfitting on small local datasets) combined with the smoothing effect of soft-label distillation (which shares inter-class relationship information across clients).

FedKSeed: Transmitting Random Seeds

The ultimate communication reduction would be to transmit no gradient at all. FedKSeed (Zhu et al., 2023) achieves this for a restricted class of models by framing local training as a random function search: instead of optimising $𝒘$ directly, clients search over a family of random perturbations ${\{𝒘+{ϵ}_k{𝒛}_k\}}_{k=1}^K$ where ${𝒛}_k\sim 𝒩(0,𝐈)$ are random directions generated from a shared seed $s_k$, and ${ϵ}_k$ is a small perturbation scale.

The client evaluates the local loss $F_i(𝒘+{ϵ}_k{𝒛}_k)$ for each candidate direction, selects the direction $k^{\ast }$ with lowest loss, and transmits only the seed $s_{k^{\ast }}$. The server regenerates the direction ${𝒛}_{k^{\ast }}$ from the seed and performs an approximate gradient update: (Fedkseed Update)$$\begin{array}{ccc}& {𝒘}^{t+1}={𝒘}^t-{\eta }_s\cdot \frac{F_i({𝒘}^t+ϵ{𝒛}_{k^{\ast }})-F_i({𝒘}^t)}{ϵ}\cdot {𝒛}_{k^{\ast }}.& \text{<span class="tml-eqn"></span>}\end{array}$$ This is a zeroth-order gradient estimator (the finite difference in direction ${𝒛}_{k^{\ast }}$). The communication cost per round per client is just ${\log }_{2}K$ bits (the index of the best seed), typically 10–20 bits, compared to $d\times 32$ bits for a full gradient. For $d={10}^9$, this is a factor of $1.6\times {10}^9$ compression - from gigabytes to kilobytes per round.

The price is statistical efficiency: zeroth-order methods converge as $𝒪(d/\sqrt{T})$ rather than $𝒪(1/\sqrt{T})$, introducing a factor of $d$ in the iteration complexity. FedKSeed mitigates this by exploiting intrinsic low dimensionality: for fine-tuning pre-trained models, the effective gradient dimension is much smaller than $d$, recovering near-first-order convergence rates.

FedRDMA: Bypassing TCP/IP for Cross-Silo FL

In the cross-silo setting (hospitals, financial institutions, research consortia), clients are connected via high-speed data centre networks rather than mobile links. The bottleneck shifts from raw bandwidth to communication latency: the overhead of TCP/IP handshakes, acknowledgement packets, and kernel context switches adds milliseconds of overhead per message, which accumulates across millions of gradient updates.

FedRDMA (Remote Direct Memory Access) bypasses the kernel networking stack entirely by having the network interface card (NIC) read and write directly into application memory. In the federated context, the server's NIC can pull gradient updates directly from client GPU memory without involving the client's CPU, eliminating serialisation overhead. The resulting system achieves:

• Latency: sub-microsecond message passing (vs. 100–1000 $\mu$s for TCP/IP).

• Throughput: near-line-rate utilisation of 100 Gbps InfiniBand links.

• CPU overhead: near-zero, freeing client CPUs for local gradient computation.

FedRDMA is complementary to gradient compression: compression reduces the number of bytes transmitted, while RDMA reduces the cost of transmitting each byte.

The Compression Pipeline

The Communication–Accuracy Trade-off

We now formalise the fundamental limit of gradient compression.

Practical Compression Taxonomy

Method	Mechanism	Bits/param	Converges?	Overhead
Full precision	None	32	✓	None
Top-$K$ sparse	Magnitude-based selection	$32K/d$	✓ (EF)	$K\log d$ bits
1-bit SGD	Sign compression	1	✓ (EF)	Scale scalar
Ternary	$\{-\mathrm{\Delta },0,+\mathrm{\Delta }\}$	1.58	✓ (EF)	Threshold $\mathrm{\Delta }$
SignSGD	Majority vote signs	1	✓	None
Low-rank (SVD)	Rank-$r$ approximation	$r(m+n)/mn\cdot 32$	✓	None
FedDT	Ternary + soft label distil.	$|{𝒟}_{\text{pub}}|C/d\cdot 32$	✓	Public dataset
FedKSeed	Random seed	$\approx 0$	Partial	${\log }_{2}K$ bits

Asynchronous and Partial Communication

All methods described so far assume synchronous communication: the server waits for all $K$ sampled clients before aggregating. In practice, clients have heterogeneous computation and communication speeds (the straggler problem). If the slowest client takes $10\times$ longer than the average, $90\%$ of the server's time is spent waiting.

Asynchronous FedAvg. The server aggregates as soon as any client submits an update, without waiting for stragglers: (Async Update)$$\begin{array}{ccc}& {𝒘}^{t+1}={𝒘}^t-\eta {\hat{\mathrm{\Delta }}}_i^t,& \text{<span class="tml-eqn"></span>}\end{array}$$ where client $i$ is the first to respond in round $t$. The update ${\hat{\mathrm{\Delta }}}_i^t$ is stale: it was computed based on ${𝒘}^{t-{\tau }_i}$ for some delay ${\tau }_i\ge 0$. Staleness introduces a gradient delay term $\propto {\tau }_i^2$ in the convergence bound, analogous to client drift. Gradient clipping or learning rate scaling by $1/(1+{\tau }_i)$ mitigates staleness effects in practice.

Exercises

Federated GANs

Generative Adversarial Networks are among the most powerful yet most temperamental tools in the deep-learning arsenal. Centrally trained, they already require careful tuning of learning rates, batch sizes, and architectural choices to prevent mode collapse, oscillation, and discriminator saturation. Moving GAN training into the federated setting amplifies each of these instabilities, while simultaneously introducing the additional challenges of data heterogeneity, communication budget, and multi-party coordination.

This section develops the theory and practice of Federated GANs (FedGANs): methods that train the generator and discriminator components of a GAN across multiple clients while keeping each client's data local.

Why Adversarial Training Is Harder in Federated Settings

To understand the challenges, it helps to revisit what makes centralized GAN training difficult in the first place.

Centralized Instabilities

A standard GAN minimizes the minimax objective (OBJ)$$\begin{array}{ccc}& \underset{\theta }{\min }\underset{\varphi }{\max }{𝔼}_{𝒙\sim p_{\mathrm{data}}}[\log D_{\varphi }(𝒙)]+{𝔼}_{𝒛\sim p_z}[\log (1-D_{\varphi }(G_{\theta }(𝒛)))].& \text{<span class="tml-eqn"></span>}\end{array}$$ Three core pathologies afflict this objective:

• Vanishing gradients. When $D_{\varphi }$ is near-perfect, $\log (1-D_{\varphi }(G_{\theta }(𝒛)))\approx 0$, starving $G_{\theta }$ of signal.

• Mode collapse. The generator concentrates its output on a small subset of the data distribution; the discriminator provides no gradient that penalizes this concentration.

• Training oscillation. Generator and discriminator updates do not converge to a Nash equilibrium but instead orbit it indefinitely.

Additional Federated Burdens

The federated setting layers four new difficulties on top:

1. Statistical heterogeneity. Client $k$ holds data from a local distribution $p_k$, which differs from the global distribution $p_{\mathrm{data}}={\sum }_k{w}_k{p}_k$. A local discriminator trained only on $p_k$ becomes an expert on local modes and an ignorant judge of global modes.

2. Gradient mismatch. FedAvg-style aggregation of model updates works well when loss landscapes are similar across clients. For GANs, the adversarial landscape depends on the interplay between $G$ and $D$; because these landscapes differ per client, naive parameter averaging causes conflicting update directions that destabilize training.

3. Aggregation timing. In centralized training, $G$ and $D$ are updated in lockstep. With $K$ clients and $E$ local epochs per round, the generator $G$ may advance $KE$ steps before the discriminator at any individual client catches up, or vice versa.

4. Communication overhead. Transmitting full model parameters for both $G$ and $D$ per round is expensive; selective sharing strategies are needed.

Formal Definition: FedGAN

Architecture Choices: What to Share?

One of the most consequential design decisions in FedGAN is which network parameters to aggregate on the server. Three families of strategies have been studied:

Share Generator Only

The generator $G_{\theta }$ is aggregated via FedAvg: $${\theta }^{(t+1)}\leftarrow \sum _{k=1}^K{w}_k{\theta }_k^{(t)}.$$ Each client maintains its own local discriminator $D_{{\varphi }_k}$ that is never shared.

Advantages.

• The discriminator, which has direct access to raw data representations, is kept private.

• Local discriminators can specialize to local modes and provide strong local training signal.

Disadvantages.

• With $K$ different local discriminators providing feedback, the global generator receives incoherent update signals across rounds.

• The generator may collapse to an average of local modes that does not correspond to any real data distribution.

Share Discriminator Only

The discriminator $D_{\varphi }$ is aggregated: $${\varphi }^{(t+1)}\leftarrow \sum _{k=1}^K{w}_k{\varphi }_k^{(t)}.$$ Each client maintains its own local generator.

Advantages.

• A globally shared discriminator provides a common evaluation standard across all clients.

• Local generators can specialize to local data distributions and produce high-quality local samples.

Disadvantages.

• Aggregating discriminators trained on heterogeneous data can produce a discriminator that is confused about all data distributions rather than expert at any.

• With local generators, there is no single global generative model to evaluate or deploy.

Share Both Generator and Discriminator

Both networks are aggregated each round: $${\theta }^{(t+1)}\leftarrow \sum _k{w}_k{\theta }_k^{(t)},{\varphi }^{(t+1)}\leftarrow \sum _k{w}_k{\varphi }_k^{(t)}.$$

Advantages.

• Produces a single globally consistent GAN.

• Discriminator aggregation pools information about all clients' data distributions.

Disadvantages.

• Highest communication cost.

• Parameter averaging of adversarial networks trained on heterogeneous data is particularly prone to instability.

Mode Collapse in the Federated Setting

Mode collapse-in which the generator produces only a small subset of the modes present in $p_{\mathrm{data}}$-is a well-known failure mode of centralized GANs. In the federated setting, mode collapse takes on a distinctive character driven by local discriminators.

The Local Discriminator Dominance Effect

Consider two clients with disjoint distributions: $p_1=𝒩({\mu }_1,I)$ and $p_2=𝒩({\mu }_2,I)$, with $\Vert {\mu }_1-{\mu }_2{\Vert }_2$ large. If the generator shares weights while discriminators are local:

• $D_{{\varphi }_1}$ is trained on samples from $p_1$; it easily rejects samples near ${\mu }_2$.

• $D_{{\varphi }_2}$ is trained on samples from $p_2$; it easily rejects samples near ${\mu }_1$.

The generator $G_{\theta }$, receiving gradients from both discriminators, faces conflicting signals: to fool $D_{{\varphi }_1}$ it must generate near ${\mu }_1$; to fool $D_{{\varphi }_2}$ it must generate near ${\mu }_2$. This tension leads to one of two failure modes:

1. Global mode collapse: the generator settles on a single mode (say near ${\mu }_1$), pleasing $D_{{\varphi }_1}$ and ignoring $D_{{\varphi }_2}$.

2. Oscillatory collapse: the generator alternates between modes across rounds, producing samples from $p_1$ in odd rounds and $p_2$ in even rounds, never stabilizing.

Client Weighting as a Partial Remedy

One mitigation is to weight client gradients inversely by local mode coverage. If client $k$ produces samples that are already well-classified by its local discriminator, its gradient contribution to $G$ is down-weighted: $$\mathrm{\Delta }\theta \leftarrow \sum _k{\alpha }_k(\theta )\cdot {\nabla }_{\theta }{ℒ}_G^{(k)},$$ where ${\alpha }_k(\theta )\propto 1-{𝔼}_{𝒛}[D_{{\varphi }_k}(G_{\theta }(𝒛))]$ is large when client $k$'s discriminator is not yet fooled. This adaptive weighting encourages the generator to maintain coverage across all clients.

Wasserstein Distance Stabilization for Federated Training

The instabilities of standard GAN training are substantially reduced by replacing the JSD-based objective with the Wasserstein-1 distance (Chapter 10). In the federated setting, the Wasserstein formulation provides additional benefits beyond mere training stability.

Recall that the Wasserstein-1 distance between distributions $P$ and $Q$ admits the Kantorovich–Rubinstein dual representation: $$W_1(P,Q)=\underset{\Vert f{\Vert }_L\le 1}{\sup }[{𝔼}_{𝒙\sim P}[f(𝒙)]-{𝔼}_{𝒙\sim Q}[f(𝒙)]],$$ where the supremum is over all 1-Lipschitz functions $f$. In a WGAN, the discriminator (now called the critic) approximates this 1-Lipschitz function.

Federated WGAN Objective

For client $k$, the local critic objective is (Critic)$$\begin{array}{ccc}& {ℒ}_{\mathrm{critic}}^{(k)}(\varphi ;\theta )={𝔼}_{𝒙\sim p_k}[D_{\varphi }(𝒙)]-{𝔼}_{𝒛\sim p_z}[D_{\varphi }(G_{\theta }(𝒛))],& \text{<span class="tml-eqn"></span>}\end{array}$$ and the local generator objective is (GEN)$$\begin{array}{ccc}& {ℒ}_{\mathrm{gen}}^{(k)}(\theta ;\varphi )=-{𝔼}_{𝒛\sim p_z}[D_{\varphi }(G_{\theta }(𝒛))].& \text{<span class="tml-eqn"></span>}\end{array}$$ The global Wasserstein loss is then $$W_1(p_{\mathrm{data}},p_{G_{\theta }})\le \sum _{k=1}^K{w}_k{W}_1(p_k,p_{G_{\theta }})\approx \sum _{k=1}^K{w}_k{ℒ}_{\mathrm{critic}}^{(k)}(\varphi ;\theta ),$$ with equality only when the client distributions are mutually singular (the accompanying proposition proves the bound). This decomposition shows that the global Wasserstein distance is bounded by the weighted average of local Wasserstein distances, provided the critic is global (shared across clients). This is a key advantage: under Wasserstein geometry, client objectives aggregate gracefully.

WGAN-GP in Federated Learning

The gradient penalty (GP) formulation of the WGAN enforces the 1-Lipschitz constraint on the critic via a soft penalty: $$\lambda {𝔼}_{\widehat{𝒙}\sim {\hat{p}}_k}[(\Vert {\nabla }_{\widehat{𝒙}}{D}_{\varphi }(\widehat{𝒙}){\Vert }_2-1{)}^2],$$ where $\widehat{𝒙}=ϵ𝒙+(1-ϵ)G_{\theta }(𝒛)$, $ϵ\sim \mathrm{Uniform}[\mathrm{0,1}]$, and ${\hat{p}}_k$ is the interpolation distribution between $p_k$ and $p_g$.

In the federated setting, the gradient penalty is computed locally on each client: (Wgangp)$$\begin{array}{ccc}& {ℒ}_{\mathrm{GP}}^{(k)}(\varphi ;\theta )={ℒ}_{\mathrm{critic}}^{(k)}(\varphi ;\theta )+\lambda {𝔼}_{\widehat{𝒙}\sim {\hat{p}}_k}[(\Vert {\nabla }_{\widehat{𝒙}}{D}_{\varphi }(\widehat{𝒙}){\Vert }_2-1{)}^2].& \text{<span class="tml-eqn"></span>}\end{array}$$ Local computation of GP is valid because the interpolation $\widehat{𝒙}$ uses local real samples $𝒙\sim p_k$, ensuring that the Lipschitz constraint is enforced in the region of the data manifold visible to client $k$.

TikZ Figure: FedGAN Architecture

Example: Federated Diabetic Retinopathy Image Generation

HT-Fed-GAN for Tabular Data

Medical and financial datasets are often tabular rather than image-structured. Tabular data has mixed types: some columns are continuous (e.g., blood pressure, income), others are categorical (e.g., diagnosis code, gender), and many have complex marginal distributions with multi-modality or heavy tails.

HT-Fed-GAN (Heterogeneous-Type Federated GAN) addresses the synthesis of mixed-type tabular data across federated clients. Its key innovation is a preprocessing step called Fed-VB-GMM: Federated Variational Bayesian Gaussian Mixture Model.

Fed-VB-GMM Preprocessing

For each continuous column $j$, Fed-VB-GMM fits a Gaussian mixture model $$p^{(j)}(x)=\sum _{m=1}^M{\pi }_m^{(j)}𝒩(x;{\mu }_m^{(j)},({\sigma }_m^{(j)}{)}^2)$$ across clients using federated variational Bayes. Each client $k$ maintains local variational parameters $\{{\pi }_{k,m}^{(j)},{\mu }_{k,m}^{(j)},{\sigma }_{k,m}^{(j)}\}$ and uploads sufficient statistics (not raw data) to the server, which aggregates them into global mixture parameters.

Once the global GMM parameters are learned, each value $x_{ij}$ in continuous column $j$ is transformed to a mode-normalized representation: $${\tilde{x}}_{ij}=\frac{x_{ij}-{\mu }_{m^{\ast }}^{(j)}}{{\sigma }_{m^{\ast }}^{(j)}},{𝒑}_{ij}=\mathrm{softmax}(\log {\pi }^{(j)}+\log 𝒩(x_{ij};{𝝁}^{(j)},({𝝈}^{(j)}{)}^2)),$$ where $m^{\ast }={\mathrm{arg\hspace{0.17em}max}}_m{\pi }_m^{(j)}𝒩(x_{ij};{\mu }_m^{(j)},{({\sigma }_m^{(j)})}^2)$ is the most probable mixture component.

Categorical columns are one-hot encoded. The transformed representation is fed into the GAN.

Training Objective for HT-Fed-GAN

The local training objective at client $k$ combines a GAN adversarial loss with an information maximization term: (Htfedgan)$$\begin{array}{ccc}& {ℒ}^{(k)}={ℒ}_{\mathrm{adv}}^{(k)}+{\lambda }_c{ℒ}_{\mathrm{cond}}^{(k)}+{\lambda }_{\mathrm{info}}{ℒ}_{\mathrm{info}}^{(k)},& \text{<span class="tml-eqn"></span>}\end{array}$$ where:

• ${ℒ}_{\mathrm{adv}}^{(k)}$ is the conditional adversarial loss for real vs. synthetic tabular rows.

• ${ℒ}_{\mathrm{cond}}^{(k)}$ penalizes misclassification of synthetic rows by a local auxiliary classifier (ensuring conditional generation is consistent with labels).

• ${ℒ}_{\mathrm{info}}^{(k)}$ maximizes the mutual information between the generated row and the conditioning label, following InfoGAN.

Handling Class Imbalance with Conditional Federated Generation

Class imbalance is endemic in medical and financial federated datasets. A minority class that is rare globally may be absent from most clients' local data entirely. Standard conditional GAN training fails for absent classes because the local discriminator has no real samples of that class to discriminate against.

Conditional Training Sampler (CTS). HT-Fed-GAN addresses this via a conditional training sampler that re-weights the local training batches. At client $k$, each training mini-batch is constructed by sampling uniformly over classes: $$P(\text{sample class }c\text{ in batch})=\frac{1}{C},$$ regardless of the local class frequencies $p_k(y=c)$. For classes underrepresented locally, the sampler draws synthetic samples from the current generator $G_{\theta }(\cdot ,c)$ to fill the batch.

This creates a self-improving loop:

1. In early rounds, the generator for minority classes is poor.

2. As the generator improves (aided by information from clients where that class is present), the quality of synthetic minority-class samples improves.

3. Better minority-class synthetic samples allow the local discriminator to train on those classes, producing a better training signal for further generator improvement.

The convergence of this loop requires that at least one client holds real samples of each class. Formally, define the class coverage condition:

Under Assumption Assumption 2 and sufficient rounds of federation, the conditional training sampler guarantees that every class receives generator gradient updates with positive probability in every round, preventing generator collapse on unseen classes.

Exercises

Privacy-Preserving Federated GANs

The federated setting provides a first layer of privacy protection by keeping raw data local. However, this protection is incomplete: gradient updates, model parameters, and generated samples can all leak information about training data through inference attacks. This section develops the formal framework of differential privacy, its integration with federated GAN training, and the fundamental tension between privacy guarantees and synthesis quality.

Differential Privacy: Formal Foundations

Differential privacy (DP) provides a rigorous mathematical guarantee that an algorithm's output distribution is nearly the same whether or not any single individual's data is included in the input.

The Gaussian Mechanism

For a real-valued function $f:𝒟\to {\mathrm{ℝ}}^d$, the Gaussian mechanism adds calibrated Gaussian noise: $${ℳ}_{\mathrm{Gauss}}(D)=f(D)+𝒩(0,{\sigma }^2𝐈),$$ where the noise scale is set as $\sigma =\frac{{\mathrm{\Delta }}_{2}f\sqrt{2\ln (1.25/\delta )}}{\epsilon }$ and ${\mathrm{\Delta }}_{2}f={\max }_{D\sim D^{\prime }}\Vert f(D)-f(D^{\prime }){\Vert }_2$ is the ${\ell }_2$-sensitivity of $f$.

DP-SGD: Differentially Private Stochastic Gradient Descent

DP-SGD is the fundamental building block for differentially private deep learning. At each iteration:

1. Per-sample gradient computation. Compute gradient ${𝒈}_i={\nabla }_{\theta }\ell (\theta ;x_i)$ for each sample $x_i$ in the mini-batch.

2. Gradient clipping. Clip each per-sample gradient to have ${\ell }_2$ norm at most $C$: $${\overline{𝒈}}_i={𝒈}_i/\max (1,\Vert {𝒈}_i{\Vert }_2/C).$$

3. Noise addition. Sum clipped gradients and add Gaussian noise: $$\widetilde{𝒈}=\frac{1}{B}(\sum _{i=1}^B{\overline{𝒈}}_i+𝒩(0,{\sigma }^2{C}^2𝐈)).$$

4. Parameter update. $\theta \leftarrow \theta -\eta \widetilde{𝒈}$.

By the moments accountant method, $T$ steps of DP-SGD with mini-batch size $B$ from a dataset of size $n$ satisfies $$(\epsilon ,\delta )\text{-DP}\text{with}\epsilon =O\left(\frac{\sqrt{T\log (1/\delta )}}{n/B}\right).$$

The Privacy–Utility Tradeoff for Generative Models

Differential privacy imposes a fundamental cost on model utility. For generative models, this tradeoff manifests in three ways:

1. Sample quality degradation. DP noise injected into gradients blurs the signal used to train the generator, producing samples of lower fidelity. The FID score (Fréchet Inception Distance) typically increases monotonically as $\epsilon$ decreases.

2. Mode coverage reduction. Minority modes require strong gradient signal to capture; DP noise disproportionately affects these weak signals, leading to systematic undercoverage of rare modes.

3. Training instability amplification. GAN training is already unstable; DP noise further amplifies gradient variance, increasing the probability of discriminator saturation and generator collapse.

Fed-GAN with pHash-KT: Perceptual Hashing for Knowledge Transfer

A key challenge in private federated GAN training is knowledge transfer between clients without sharing raw data or gradients that might leak information. pHash-KT (Perceptual Hash Knowledge Transfer) addresses this by using perceptual hashes as a privacy-preserving proxy for image similarity.

Perceptual Hashing

A perceptual hash $h(𝒙)\in {\{\mathrm{0,1}\}}^b$ is a compact binary fingerprint of an image $𝒙$ that is:

• Robust: similar images produce similar hashes ($\Vert h(𝒙)-h({𝒙}^{\prime }){\Vert }_1$ small if $𝒙\approx {𝒙}^{\prime }$).

• Non-invertible: recovering $𝒙$ from $h(𝒙)$ is computationally infeasible.

Common pHash algorithms include DCT-based hash (dHash) and color moment hash. The $b$-bit hash space has $2^b$ possible values; for $b=64$, the hash cannot encode significant information about individual pixel values.

Knowledge Transfer Protocol

In Fed-GAN with pHash-KT, clients transfer knowledge about their local data distribution through perceptual hashes rather than raw images or model gradients:

1. Local hash collection. Client $k$ computes $h(𝒙)$ for all $𝒙\in {𝒟}_k$ and stores the hash set $H_k=\{h(𝒙):𝒙\in {𝒟}_k\}$.

2. Generator quality assessment. When the server broadcasts a candidate generator $G_{\theta }$, client $k$ generates $N$ synthetic images and computes their hashes ${\hat{H}}_k={\{h(G_{\theta }({𝒛}_i))\}}_{i=1}^N$.

3. Coverage score. Client $k$ reports the coverage score $${\mathrm{cov}}_k(\theta )=\frac{|\{h\in H_k:{\min }_{\hat{h}\in {\hat{H}}_k}\Vert h-\hat{h}{\Vert }_1\le \tau \}|}{|H_k|},$$ measuring the fraction of real images whose nearest synthetic neighbor (in hash space) is within threshold $\tau$.

4. Server guidance. The server aggregates coverage scores and identifies which clients have low coverage, directing extra training rounds for those clients.

The coverage score transmits only a scalar per client per round, providing strong resistance to gradient inversion attacks.

Resistance to Adversarial Clients

A critical desideratum for privacy-preserving federated learning is robustness to adversarial clients that attempt to poison the global model or extract information about other clients.

Empirical evaluations of Fed-GAN with pHash-KT have demonstrated resistance to adversarial client fractions from 10% to 70%. The mechanism of resistance is as follows:

• Adversarial clients that submit malicious gradient updates (to cause mode collapse or model poisoning) are detected via their anomalous coverage scores.

• Coverage scores that are implausibly high (adversarial client claiming perfect coverage to pass through poisoned gradients) or implausibly low (adversarial client claiming poor coverage to demand extra rounds and amplify its gradient influence) are flagged by the server's Byzantine-robust aggregation rule.

• With the perceptual hash protocol replacing raw gradient transmission, adversarial clients have limited ability to craft cover stories: their claimed coverage must be consistent with the known distribution of pHash distances for natural images.

DP Guarantee Propagation through the GAN Generator

A fundamental question is: if the GAN is trained with DP-SGD, does the published generator itself satisfy a DP guarantee?

TikZ Figure: DP-FedGAN Pipeline

Example: Privacy-Preserving Face Generation Across Institutions

Membership Inference Attacks on GANs

A membership inference attack (MIA) against a trained model $ℳ$ attempts to determine, given a data point $𝒙$ and access to $ℳ$, whether $𝒙$ was part of $ℳ$'s training set.

MIA Formulation

Formally, an MIA is a classifier $𝒜:𝒙\times ℳ\to \{0,1\}$ where output 1 means “$𝒙$ was in the training set.” The attack advantage is: $$\mathrm{Adv}(𝒜)=\mathrm{Pr}[𝒜(𝒙,ℳ)=1|𝒙\in D_{\mathrm{train}}]-\mathrm{Pr}[𝒜(𝒙,ℳ)=1|𝒙\notin D_{\mathrm{train}}].$$ A random-guess attacker achieves $\mathrm{Adv}(𝒜)=0$; a perfect attacker achieves $\mathrm{Adv}(𝒜)=1$.

How MIAs Work Against GANs

For generative models, MIAs exploit the fact that generators tend to produce samples more similar to their training data than to held-out data. Several attack strategies have been developed:

1. Discriminator-based attack. Use the GAN's own discriminator to score $𝒙$: if $D_{\varphi }(𝒙)$ is unusually high (the discriminator classifies $𝒙$ as “real” with high confidence), $𝒙$ may have been in the training set. Formally: $𝒜(𝒙,ℳ)=\mathrm{𝟙}[D_{\varphi }(𝒙)>\tau ]$.

2. Nearest-neighbor attack. Generate a large set of synthetic images $\{G_{\theta }({𝒛}_i)\}$ and find the nearest neighbor to $𝒙$ in feature space. If $𝒙$ is unusually close to a synthetic sample, it likely influenced that sample's generation (overfitting signal).

3. GAN-based shadow model attack. Train a shadow GAN on a surrogate dataset from the same distribution. Compare the output statistics of the target GAN vs. the shadow GAN on $𝒙$; a large difference indicates membership.

GANs and Overfitting

Unlike classifiers, generative models have no clear notion of “test loss” to detect overfitting. A GAN that has memorized its training data will produce synthetic samples that are near-copies of training samples, enabling effective MIAs. Memorization is particularly likely when:

• The dataset is small relative to model capacity.

• Training runs for many epochs without regularization.

• Conditional generation is used with very small class sizes.

The Tension Between Mode Coverage and Privacy

Two desiderata of a federated generative model are in fundamental tension:

1. Mode coverage: the generator should synthesize samples from all parts of the data distribution, including rare modes.

2. Privacy: individual training records should not be reconstructible from the generator.

This tension is not merely practical but information-theoretic:

Why Rare Modes Are Privacy-Vulnerable

A rare mode corresponds to a small cluster of training points. To synthesize samples from a rare mode, the generator must “remember” the characteristics of that cluster. But this memory is precisely what a membership inference attack exploits: if the generator can synthesize a rare mode, it has learned something specific about the few individuals in that cluster.

Formally, consider a dataset $D$ where a rare cluster $C_r$ contains $|C_r|=m$ individuals. Capturing this cluster requires the generator's learned distribution to assign significant probability to a region of the data space that is highly specific to those $m$ individuals. The privacy cost of this specificity scales as $O(1/\sqrt{m{\epsilon }^2})$ in the DP framework: clusters with fewer members require higher privacy budget to capture faithfully.

Practical Implications

The mode-coverage–privacy tension has concrete implications for downstream applications:

• Medical imaging: rare diseases are the most clinically important to model but the most privacy-sensitive to generate.

• Financial data: rare fraud patterns are the most useful for augmenting fraud detectors but the most likely to memorize individual records.

• Demographic fairness: underrepresented demographic groups require their modes to be captured for fair downstream model training, but these groups are simultaneously the most vulnerable to reconstruction attacks.

Historical Note: From Dwork et al. to Federated DP-GANs

Exercises

Federated Variational Autoencoders

Generative adversarial networks, examined in earlier sections of this chapter, excel at producing high-fidelity samples but are notoriously difficult to train in federated settings: the discriminator must see data from all clients to be meaningful, yet federated learning forbids such centralised inspection. The Variational Autoencoder (VAE) sidesteps this tension by casting generation as variational inference. The encoder and decoder are separate networks with well-defined, aggregatable parameter sets, the training objective decomposes gracefully across independent data batches, and the latent space itself provides a lingua franca through which clients can share structural knowledge without sharing raw examples.

This section develops the federated VAE in four movements. We first recall the classical VAE to fix notation. We then formalise FedVAE, identify the specific challenge of heterogeneous latent spaces, and introduce the dual-encoder architecture with its personalized gating network as the principled remedy. The section concludes with a worked example on movie recommendation, a discussion of posterior collapse under federation, and practical guidance on $\beta$-VAE scheduling.

VAE Recap: Encoder, Decoder, ELBO, Reparameterisation

A VAE models data $𝒙\in 𝒳$ through a latent variable $𝒛\in {\mathrm{ℝ}}^d$ governed by a standard Gaussian prior $p(𝒛)=𝒩(𝒛;\mathrm{𝟎},𝐈)$. The generative process is (Generative)$$\begin{array}{ccc}& 𝒛\sim p(𝒛),𝒙|𝒛\sim p_{\theta }(𝒙|𝒛),& \text{<span class="tml-eqn"></span>}\end{array}$$ where $p_{\theta }(𝒙|𝒛)$ is a decoder with parameters $\theta$. Given observed data, the posterior $p_{\theta }(𝒛|𝒙)$ is generally intractable, so we introduce an amortised variational posterior (Encoder)$$\begin{array}{ccc}& q_{\varphi }(𝒛|𝒙)=𝒩(𝒛;{𝝁}_{\varphi }(𝒙),\mathrm{diag}\left[{𝝈}_{\varphi }^2(𝒙)\right]),& \text{<span class="tml-eqn"></span>}\end{array}$$ parameterised by an encoder $({𝝁}_{\varphi },\log {𝝈}_{\varphi }^2)$ with parameters $\varphi$.

The KL term in has a closed form for Gaussian $q_{\varphi }$ and Gaussian prior $p$: (KL Closed)$$\begin{array}{ccc}& D_{\mathrm{KL}}\left(𝒩(𝝁,\mathrm{diag}[{𝝈}^2])\Vert 𝒩(\mathrm{𝟎},𝐈)\right)=\frac{1}{2}\sum _{j=1}^d({\mu }_j^2+{\sigma }_j^2-\log {\sigma }_j^2-1).& \text{<span class="tml-eqn"></span>}\end{array}$$

Reparameterisation trick.

The expectation in the reconstruction term requires differentiating through a stochastic sampling step. The reparameterisation trick rewrites the sample as a deterministic function of a noise variable: (Reparam)$$\begin{array}{ccc}& 𝒛={𝝁}_{\varphi }(𝒙)+{𝝈}_{\varphi }(𝒙)\odot 𝝐,𝝐\sim 𝒩(\mathrm{𝟎},𝐈),& \text{<span class="tml-eqn"></span>}\end{array}$$ where $\odot$ denotes elementwise multiplication. The gradient $\partial {ℒ}_{\mathrm{ELBO}}/\partial \varphi$ now passes through ${𝝁}_{\varphi }$ and ${𝝈}_{\varphi }$ unobstructed, enabling end-to-end backpropagation.

For a dataset $𝒟=\{{𝒙}_1,\dots ,{𝒙}_N\}$, the full training objective is (FULL OBJ)$$\begin{array}{ccc}& \underset{\theta ,\varphi }{\max }\frac{1}{N}\sum _{i=1}^N{ℒ}_{\mathrm{ELBO}}(\theta ,\varphi ;{𝒙}_i).& \text{<span class="tml-eqn"></span>}\end{array}$$ Both the encoder $\varphi$ and decoder $\theta$ receive gradient updates from every data point through the reparameterisation.

FedVAE: Formal Definition

Consider $K$ clients, each holding a local dataset ${𝒟}_k=\{{𝒙}_1^{(k)},\dots ,{𝒙}_{n_k}^{(k)}\}$ for $k=1,\dots ,K$. The clients do not share their data; they communicate only via model parameters with a central server.

The Heterogeneous Latent Space Challenge

When clients hold data from different distributions - a scenario called statistical heterogeneity or non-IID data - a naive FedVAE faces a fundamental difficulty that has no analogue in standard federated classification.

The alignment problem.

Suppose client 1 holds images of cats and client 2 holds images of dogs. After local ELBO optimisation:

• Client 1's encoder maps cats to region $A\subset {\mathrm{ℝ}}^d$ of the latent space.

• Client 2's encoder maps dogs to region $B\subset {\mathrm{ℝ}}^d$ disjoint from $A$.

After server aggregation , the global encoder is an average that maps neither cats nor dogs to either $A$ or $B$ reliably. The global decoder, similarly averaged, cannot reconstruct either class well from any region of the latent space.

More formally, let $p_k(𝒛)$ be the aggregate posterior on client $k$, defined as (AGG Posterior)$$\begin{array}{ccc}& p_k(𝒛)=\frac{1}{n_k}\sum _{i=1}^{n_k}{q}_{{\varphi }_k}(𝒛|{𝒙}_i^{(k)}).& \text{<span class="tml-eqn"></span>}\end{array}$$ Heterogeneity implies $p_k(𝒛)\approx ̸p_j(𝒛)$ for $k\ne j$. Averaging the encoder parameters yields a model that approximates none of the individual posteriors.

Why this is worse than the centralised case.

In a centralised VAE trained on heterogeneous data, all data points compete for the same latent space simultaneously, and the KL regulariser forces the aggregate posterior towards the prior. Heterogeneity makes learning harder, but at least all examples see the same encoder during each gradient step.

In FedVAE, clients train independently for $\tau$ steps. The encoder on client $k$ has no gradient signal from client $j\ne k$, so it specialises aggressively to local data. After aggregation, the global encoder is a parameter average of $K$ specialised encoders - a combination that satisfies none of the individual ELBO objectives. The magnitude of the degradation grows with:

• the number of local steps $\tau$ (more drift),

• the Wasserstein distance between the data distributions $p_1(𝒙),\dots ,p_K(𝒙)$ (more heterogeneity), and

• the latent dimensionality $d$ (more room to misalign).

FedCF: Federated Collaborative Filtering with VAEs

Collaborative filtering - the backbone of recommendation systems - is a natural application domain for federated VAEs. Each user (client) holds their own rating history, which is private. A central server wishes to learn a generative model of user preferences that enables personalised recommendations without ever seeing individual ratings.

Setup.

Let there be $K$ users (clients) and $M$ items. User $k$ has rated a subset ${ℐ}_k\subseteq \{1,\dots ,M\}$ of items, producing a sparse rating vector ${𝒙}^{(k)}\in {\mathrm{ℝ}}^M$ with entries (Ratings)$$\begin{array}{ccc}& x_m^{(k)}=\{\begin{array}{cc}{r}_{km}& \text{if user }k\text{ rated item }m,\\ 0& \text{otherwise}.\end{array}& \text{<span class="tml-eqn"></span>}\end{array}$$ The goal is to learn a VAE over rating vectors such that the decoder $p_{\theta }(𝒙|𝒛)$ can impute missing ratings and thus generate personalised recommendations.

Local ELBO for collaborative filtering.

Each client optimises a masked reconstruction loss that evaluates only on observed ratings: (ELBO)$$\begin{array}{ccc}& {ℒ}_k^{\mathrm{CF}}(\theta ,\varphi )={𝔼}_{q_{\varphi }(𝒛|{𝒙}^{(k)})}\left[\sum _{m\in {ℐ}_k}\log p_{\theta }(x_m^{(k)}|𝒛)\right]-D_{\mathrm{KL}}\left(q_{\varphi }(𝒛|{𝒙}^{(k)})\Vert p(𝒛)\right).& \text{<span class="tml-eqn"></span>}\end{array}$$ Crucially, only the mask ${ℐ}_k$ and the aggregated gradients leave the client, never the raw ratings ${𝒙}^{(k)}$.

Sparsity and the prior mismatch.

Rating vectors are extremely sparse (a user rates $O({10}^2)$ of $O({10}^5)$ available items). The encoder therefore sees many zeros during local training, which can push the latent code to a degenerate region of the prior. FedCF addresses this with a dropout-augmented encoder: during training, additional ratings are randomly masked to prevent the encoder from simply memorising the sparsity pattern.

Dual Encoder Architecture

The heterogeneous latent space challenge motivates an architectural solution: equip each client with two encoders that decompose the latent representation into a shared global component and a private local component.

Global knowledge encoder.

The global encoder $E_{\varphi }^{\mathrm{G}}:{\mathrm{ℝ}}^d\to {\mathrm{ℝ}}^{d_z/2}\times {\mathrm{ℝ}}^{d_z/2}$ is shared across all clients and aggregated by the server at every round. Its output $({𝝁}^{\mathrm{G}},{𝝈}^{\mathrm{G}})$ captures shared structure present in all clients' data: coarse semantic features, domain-invariant factors of variation, and patterns that transfer across heterogeneous distributions.

Formally, the global encoder's parameters ${\varphi }^{\mathrm{G}}$ are updated by FedAvg: (Global AGG)$$\begin{array}{ccc}& {({\varphi }^{\mathrm{G}})}^{(r+1)}=\sum _{k=1}^K{w}_k{({\varphi }_k^{\mathrm{G}})}^{(r)},& \text{<span class="tml-eqn"></span>}\end{array}$$ exactly as in standard FedVAE.

Local personalised encoder.

The local encoder $E_{{\varphi }_k}^{\mathrm{L}}:{\mathrm{ℝ}}^d\to {\mathrm{ℝ}}^{d_z/2}\times {\mathrm{ℝ}}^{d_z/2}$ is not shared: its parameters ${\varphi }_k^{\mathrm{L}}$ remain on client $k$ throughout training. It captures client-specific factors: local vocabulary in NLP, local imaging protocol artefacts in medical imaging, or personal taste in recommendation. Because these parameters never leave the client, there is no aggregation-induced misalignment for the local component.

Personalised Gating Network

Having two encoders raises the question of how to combine their outputs. A fixed split (use half the latent dimensions for global, half for local) is inflexible: some inputs may need more global context, others more local specialisation. A personalised gating network resolves this adaptively.

Architecture.

Let the global and local encoders produce means and log-variances: (Global ENC)$$\begin{array}{cccc}& ({𝝁}^{\mathrm{G}},\log {𝝈}^{2,\mathrm{G}})& =E_{\varphi }^{\mathrm{G}}(𝒙),& \text{<span class="tml-eqn"></span>}\\ & ({𝝁}^{\mathrm{L}},\log {𝝈}^{2,\mathrm{L}})& =E_{{\varphi }_k}^{\mathrm{L}}(𝒙).& \text{<span class="tml-eqn"></span>}\end{array}$$ The gating network $G_{{\psi }_k}:{\mathrm{ℝ}}^d\to {[\mathrm{0,1}]}^{d_z}$ produces a per-dimension gate vector: (GATE)$$\begin{array}{ccc}& 𝒈=\sigma (G_{{\psi }_k}(𝒙))\in {[\mathrm{0,1}]}^{d_z},& \text{<span class="tml-eqn"></span>}\end{array}$$ where $\sigma$ is the sigmoid function. The fused latent distribution has parameters: (MEAN)$$\begin{array}{cccc}& 𝝁& =𝒈\odot {𝝁}^{\mathrm{G}}+(\mathrm{𝟏}-𝒈)\odot {𝝁}^{\mathrm{L}},& \text{<span class="tml-eqn"></span>}\\ & \log {𝝈}^2& =𝒈\odot \log {𝝈}^{2,\mathrm{G}}+(\mathrm{𝟏}-𝒈)\odot \log {𝝈}^{2,\mathrm{L}}.& \text{<span class="tml-eqn"></span>}\end{array}$$ The fused sample $𝒛=𝝁+𝝈\odot 𝝐$ is then decoded by the shared decoder $p_{\theta }(𝒙|𝒛)$.

The gating mechanism has an appealing interpretation: when $𝒈\approx \mathrm{𝟏}$, the client defers entirely to the global model (appropriate for common patterns); when $𝒈\approx \mathrm{𝟎}$, the client uses its local model exclusively (appropriate for idiosyncratic local features). In practice, gates settle at intermediate values that vary by latent dimension and input.

Personalised Federated VAE: Formal Definition

We now formalise the complete personalised federated VAE.

TikZ Figure: FedVAE with Dual Encoders and Gating

Example: Federated Movie Recommendation

Posterior Collapse in Federated VAEs

Posterior collapse occurs when the variational posterior $q_{\varphi }(𝒛|𝒙)$ collapses to the prior $p(𝒛)$, rendering the latent code uninformative: (Collapse)$$\begin{array}{ccc}& q_{\varphi }(𝒛|𝒙)\approx p(𝒛)=𝒩(\mathrm{𝟎},𝐈).& \text{<span class="tml-eqn"></span>}\end{array}$$ When this happens, the decoder $p_{\theta }(𝒙|𝒛)$ learns to ignore $𝒛$ entirely and generates samples from the marginal $p_{\theta }(𝒙)=\int p_{\theta }(𝒙|𝒛)p(𝒛)d𝒛$ which, for a sufficiently powerful decoder, may reproduce training examples but fails to provide meaningful latent structure.

Why collapse is worse under federation.

In a centralised VAE, collapse is already a known failure mode when the decoder is too powerful or the KL weight too high. Under federation, three additional forces push towards collapse:

1. Local data scarcity. Each client has $n_k\ll N$ examples. With few data points, the reconstruction term ${\sum }_i𝔼[\log p_{\theta }({𝒙}_i|𝒛)]$ is small in absolute magnitude relative to the KL penalty, tipping the ELBO balance towards collapse.

2. Gradient noise amplification. After $\tau$ local steps, the accumulated gradient contains a component pointing towards collapse for each client (the KL gradient always pushes $q_{\varphi }$ towards $p$). Server averaging reinforces this component across all $K$ clients.

3. Decoder exploitation of heterogeneity. If clients hold different data distributions, the decoder learns to generate plausible samples for each distribution from nearby latent regions. A decoder that “fills in” heterogeneous data without using $𝒛$ achieves low reconstruction loss, rewarding collapse.

Diagnostic.

The active units metric $A_u$ counts dimensions $j$ for which the variance of the posterior mean is non-negligible: (Active Units)$$\begin{array}{ccc}& A_u=\left|\{j:{\mathrm{Var}}_{𝒙\in 𝒟}\left[{({\mu }_{\varphi }(𝒙))}_j\right]>{ϵ}_u\}\right|,& \text{<span class="tml-eqn"></span>}\end{array}$$ for a small threshold ${ϵ}_u>0$. A collapsed VAE has $A_u\approx 0$. Federated training commonly reduces $A_u$ by 30–60% compared to centralised training on the same total data.

Beta-VAE Scheduling in the Federated Context

The $\beta$-VAE modifies the ELBO by up-weighting the KL term: (Betavae)$$\begin{array}{ccc}& {ℒ}_{\beta }(\theta ,\varphi ;𝒙)={𝔼}_{q_{\varphi }(𝒛|𝒙)}\left[\log p_{\theta }(𝒙|𝒛)\right]-\beta D_{\mathrm{KL}}\left(q_{\varphi }(𝒛|𝒙)\Vert p(𝒛)\right),& \text{<span class="tml-eqn"></span>}\end{array}$$ with $\beta \ge 1$ encouraging a more disentangled, better-regularised latent space at the cost of some reconstruction quality.

In the federated context, a fixed $\beta >1$ exacerbates collapse: the KL penalty already wins on small local datasets, and multiplying it by $\beta$ makes collapse even more attractive. Conversely, $\beta <1$ risks memorisation of local data with no information sharing through the latent space.

Warm-up schedule.

A standard remedy is a linear warm-up: begin training with ${\beta }_0=0$ (pure reconstruction) and anneal to the target ${\beta }_T$ over $T$ rounds: (BETA Schedule)$$\begin{array}{ccc}& {\beta }^{(r)}=\min ({\beta }_T,\frac{r}{T}{\beta }_T).& \text{<span class="tml-eqn"></span>}\end{array}$$ In the federated setting, this schedule must be applied at the server level to remain consistent across clients. If each client independently anneals $\beta$, the annealing may proceed at different rates due to partial participation (not every client participates in every round), creating inconsistent $\beta$ values at aggregation time.

Federated cyclical annealing.

An alternative is cyclical annealing: $\beta$ follows a sawtooth schedule that periodically returns to $0$. Each cycle allows the decoder to exploit the reconstruction signal without KL pressure, while the subsequent rise of $\beta$ forces the encoder to re-regularise. Cyclical annealing has been shown empirically to reduce collapse in both centralised and federated settings compared to monotone annealing.

Exercises

VAEs as Privacy Shields

Federated learning was designed with privacy in mind: by keeping raw data on-device and transmitting only model updates, it avoids the most obvious privacy risk of centralised machine learning. Yet in 2019, Zhu et al. demonstrated that model gradients can be inverted to reconstruct training data with pixel-level fidelity. This gradient inversion attack shattered the assumption that gradient communication is inherently private.

In response, researchers proposed VAEFL: using the VAE's stochastic latent encoding as a principled privacy defense. Rather than applying statistical noise (as in differential privacy) or cryptographic machinery (as in homomorphic encryption), VAEFL exploits the VAE's inherent randomness to obfuscate the data geometry visible in transmitted gradients. The key insight is:

This section develops the attack model, formalises the defense, proves a lower bound on reconstruction error under VAEFL, and compares it to competing privacy mechanisms.

Deep Leakage from Gradients

The Deep Leakage from Gradients (DLG) attack demonstrates that a client's private training data can be reconstructed from the gradients it transmits to the server.

Setup.

Client $k$ holds a batch $\{{𝒙}_1^{(k)},\dots ,{𝒙}_B^{(k)}\}$ of $B$ data points (images, in the canonical formulation). It computes gradients ${\nabla }_{\theta }\ell (\theta ;{ℬ}_k)$ of a loss $\ell$ with respect to model parameters $\theta$, and transmits these gradients to the server.

The DLG attacker - who controls the server - has access to $\theta$ (the current model) and the transmitted gradients $\widehat{𝒈}={\nabla }_{\theta }\ell (\theta ;{ℬ}_k)$. They do not have access to ${ℬ}_k$.

Attack procedure.

The attacker initialises a dummy batch ${ℬ}^{\prime }=\{{𝒙}_1^{\prime },\dots ,{𝒙}_B^{\prime }\}$ of random images and a dummy label set $\{y_1^{\prime },\dots ,y_B^{\prime }\}$, and minimises the gradient matching loss: (Attack)$$\begin{array}{ccc}& {ℬ}^{\ast }={\mathrm{arg\hspace{0.17em}min}}_{{ℬ}^{\prime }}{\Vert {\nabla }_{\theta }\ell (\theta ;{ℬ}^{\prime })-\widehat{𝒈}\Vert }_2^2.& \text{<span class="tml-eqn"></span>}\end{array}$$ This optimisation is solved by gradient descent on the dummy images, treating them as free variables. Under favourable conditions (small batch size, smooth loss landscape, sufficient gradient signal), the dummy batch converges to a close approximation of ${ℬ}_k$.

Why DLG works.

The gradient of a cross-entropy loss with respect to the final linear layer encodes exactly the activation pattern of the penultimate layer for each training example. For image classifiers, this activation pattern is a high-fidelity representation of the image. Inverting it through the network is a well-posed optimisation problem with a unique solution in the low-batch regime.

Severity.

DLG reconstructs individual images with near-perfect visual fidelity for $B=1$. Extensions (R-GAP, iDLG, GradInversion) scale to batches of $B=8$–$32$ with high success rates. The attack works equally well against convolutional and transformer architectures.

VAEFL: VAE Latent Sampling as Privacy Defense

VAEFL (VAE Federated Learning) interposes a VAE encoder between the raw data and the rest of the model. Rather than computing gradients with respect to the original input $𝒙$, clients first encode $𝒙$ to a stochastic latent code $𝒛$ and train the downstream model on $𝒛$.

Architecture.

The client model in VAEFL has two components:

1. A VAE module $(E_{\varphi },D_{\theta })$ that maps inputs $𝒙\to 𝒛\to \widehat{𝒙}$. This module is optionally pre-trained (on public data or via federated VAE training) and then frozen during the downstream task.

2. A downstream model $f_{\omega }:{\mathrm{ℝ}}^{d_z}\to 𝒴$ (e.g., a classifier) trained on the latent codes.

Communication protocol.

1. Client $k$ samples a mini-batch ${ℬ}_k$ from ${𝒟}_k$.

2. For each $𝒙\in {ℬ}_k$, draw $𝒛={𝝁}_{\varphi }(𝒙)+{𝝈}_{\varphi }(𝒙)\odot 𝝐$ with $𝝐\sim 𝒩(\mathrm{𝟎},𝐈)$.

3. Compute the downstream loss ${\ell }_k=\ell (f_{\omega }(𝒛),y)$ and transmit gradients ${\widehat{𝒈}}_k={\nabla }_{\omega }{\ell }_k$ to the server.

The server never sees $𝒙$ and never sees the mean ${𝝁}_{\varphi }(𝒙)$ or variance ${𝝈}_{\varphi }(𝒙)$ - only the loss gradient with respect to $\omega$. Because $𝒛$ is a stochastic function of $𝒙$, reconstructing $𝒙$ from ${\widehat{𝒈}}_k$ requires inverting both the downstream model and the stochastic encoding.

Obfuscation of data geometry.

In the standard (non-VAE) gradient inversion, the reconstruction succeeds because the gradient ${\nabla }_{\omega }\ell$ encodes a deterministic, invertible representation of $𝒙$. Under VAEFL:

• The latent code $𝒛$ is a lossy compression of $𝒙$: fine-grained spatial details discarded by the encoder cannot be recovered from $𝒛$.

• The sampling step adds stochastic noise: $𝒛={𝝁}_{\varphi }(𝒙)+{𝝈}_{\varphi }(𝒙)\odot 𝝐$ with $𝝐$ drawn fresh at inference time. Even if the attacker recovers $𝒛$, they see the noise-perturbed code, not ${𝝁}_{\varphi }(𝒙)$.

• The KL regularisation ensures that the aggregate posterior over many inputs is close to $𝒩(\mathrm{𝟎},𝐈)$, so individual codes are difficult to distinguish from prior samples.

Reconstruction Error Lower Bound under VAEFL Defense

We now establish a formal lower bound on the reconstruction error any gradient inversion attack can achieve when VAEFL is deployed.

TikZ Figure: DLG Attack vs VAEFL Defense

Computational Advantage over Competing Privacy Methods

VAEFL is not the first proposed defense against gradient leakage. We compare it against three established alternatives: differential privacy (DP), secure multi-party computation (SMPC), and homomorphic encryption (HE).

Differential privacy.

DP defends against gradient inversion by adding calibrated Gaussian or Laplace noise to the transmitted gradients: (DP Noise)$$\begin{array}{ccc}& {\widehat{𝒈}}_{\mathrm{DP}}={\nabla }_{\omega }\ell +𝒩(\mathrm{𝟎},{\sigma }_{\mathrm{DP}}^2𝐈).& \text{<span class="tml-eqn"></span>}\end{array}$$ The privacy guarantee is $(\epsilon ,\delta )$-DP: the probability that an adversary can distinguish whether a particular data point was included in training is bounded by $e^{\epsilon }$ with failure probability $\delta$.

The principal cost is utility: for strong privacy ($\epsilon \le 1$), the noise variance ${\sigma }_{\mathrm{DP}}^2$ must be large relative to the gradient magnitude, significantly degrading model accuracy. The noise also scales with the model dimensionality $|\omega |$, making DP expensive for large models.

Secure multi-party computation.

SMPC allows $K$ parties to jointly compute a function of their private inputs without revealing those inputs to each other. In the FL context, SMPC enables secure aggregation: the server learns only the sum of gradients ${\sum }_k{\widehat{𝒈}}_k$, not individual ${\widehat{𝒈}}_k$.

SMPC provides strong cryptographic privacy guarantees but has high communication overhead: each pair of clients must exchange cryptographic masks, scaling as $O(K^2|\omega |)$ per round. Computational overhead at each client is also significant.

Homomorphic encryption.

HE allows computation on encrypted data: clients encrypt their gradients before transmission, the server aggregates ciphertexts, and the result is decrypted by the clients. This guarantees that the server never sees plaintext gradients.

HE provides the strongest cryptographic guarantees but incurs massive computational overhead. State-of-the-art HE schemes (BFV, CKKS) add a factor of ${10}^3$–${10}^6\times$ to computation and communication compared to plaintext operations. Deployment on resource-constrained devices is currently infeasible.

VAEFL advantages.

VAEFL uses the VAE's inherent stochasticity and lossy compression as the privacy mechanism, with no additional computation beyond running the frozen encoder. The latent space naturally satisfies a soft privacy property: the transmitted gradients carry information about the prior, not the individual data point.

Comparison Table: VAEFL vs. DP vs. SMPC vs. HE

Method	Compute	Communication	Utility	Privacy type	IoT-feasible?
Vanilla FL	$1\times$	$1\times$	high	none	yes
DP (Gaussian)	$1.1\times$	$1\times$	medium–low${}^{†}$	$(\epsilon ,\delta )$-DP	yes
SMPC	$2\times$–$10\times$	$O(K^2)$	high	cryptographic	no
HE	${10}^3\times$–${10}^6\times$	$10\times$–$100\times$	high	cryptographic	no
VAEFL	$1.2\times$–$2\times$	$1\times$	medium–high	IT (informal)	yes
${}^{†}$ Utility drop of DP grows with $|\omega |$ (model size); large transformers require $\epsilon >10$ for acceptable accuracy.

IoT Deployment: VAEFL on Resource-Constrained Devices

A compelling application domain for VAEFL is the Internet of Things (IoT): sensor networks, wearable health monitors, smart-home devices, and industrial edge nodes. These devices are characterised by:

• Limited compute: microcontrollers with $<1$ GFLOP/s, no GPU, often no floating-point unit.

• Limited memory: $64$–$512$ KB RAM, $1$–$16$ MB flash.

• Constrained communication: duty-cycled radio with low bandwidth ($<1$ Mbit/s) and high latency.

• High privacy sensitivity: health data, location trajectories, personal activity patterns.

SMPC and HE are entirely infeasible on such devices. DP is feasible but degrades model utility severely at the small batch sizes available on IoT devices (a wearable may have only $B=1$–$4$ samples per training step). VAEFL is uniquely compatible with the IoT setting for the following reasons.

Encoder compression.

The VAE encoder used in VAEFL can be heavily compressed without losing privacy properties. A $d_z=16$-dimensional latent space with an encoder implemented as a $3$-layer MLP with $\{64,32,16\}$ hidden units requires fewer than ${10}^4$ parameters and fits comfortably in $40$ KB of flash memory. For sensor data (accelerometer, ECG, temperature), such a network captures sufficient structure for the downstream task.

One-time encoder training.

The encoder need not be trained on-device. It can be trained centrally on a public proxy dataset (or via federated VAE training on a powerful subset of clients), then deployed frozen to all IoT devices. Each device runs only a forward pass through the encoder - a few hundred multiplications - before transmitting gradients.

Quantisation compatibility.

Integer quantisation (8-bit or 4-bit weights and activations) is standard for IoT deployment. The stochastic sampling step $𝒛=𝝁+𝝈\odot 𝝐$ remains valid after quantisation: $𝝐$ can be drawn from a uniform distribution approximating the Gaussian (which requires only a pseudorandom number generator, available on all microcontrollers) and $𝝁$, $𝝈$ are stored as quantised tensors. The privacy guarantee degrades gracefully with quantisation precision.

Example: federated activity recognition.

Consider $N={10}^4$ smartwatches, each holding $<100$ labelled activity samples (walking, running, sleeping). Each watch runs a frozen 3-layer MLP encoder on raw 3-axis accelerometer windows of length $128$ samples, producing a $16$-dimensional latent code per window. A lightweight classifier $f_{\omega }:{\mathrm{ℝ}}^{16}\to \{1,\dots ,5\}$ is trained federatedly on these codes. Gradient transmission per round requires $|\omega |\approx 500$ floats, well within the radio bandwidth. The frozen encoder prevents DLG from inverting the gradient back to raw accelerometer readings, protecting the user's health data.

Summary Insight

Exercises

Federated Continuous Diffusion Models

Diffusion models have displaced GANs as the dominant paradigm for high-fidelity image synthesis, reaching state-of-the-art quality on benchmarks from natural photographs to medical scans. Their success rests on a deceptively simple idea: gradually corrupt data with Gaussian noise across $T$ timesteps, then train a neural network to reverse that process. Yet this simplicity conceals two formidable challenges when applied in a federated setting.

First, parameter scale. Modern denoising networks, typically U-Nets with attention or transformer-based denoisers, carry hundreds of millions to billions of parameters. Transmitting full model updates at every round imposes bandwidth costs that overwhelm many federated deployments. Second, denoising trajectory divergence. Every client executes a Markov chain ${𝒙}_T\to {𝒙}_{T-1}\to \cdots \to {𝒙}_0$ whose statistical structure depends on the local data distribution. Under severe statistical heterogeneity (non-IID data), these trajectories diverge: a client that sees only portrait photographs will learn a denoiser tuned to faces, while a client with landscape photographs learns an orthogonal denoiser. When the server aggregates these via FedAvg-style averaging, the resulting global model satisfies neither client's trajectory.

This section develops the mathematics of federated diffusion and presents three landmark systems that address the twin challenges: FedDifRC (ICCV 2025) with its text-driven contrastive regularisation and noise-driven consistency; HyFLM with multidimensional trajectory optimisation for personalised federated diffusion; and the FedDDPM family, which turns the diffusion model's own generative capacity into a remedy for data heterogeneity.

The Federated Diffusion Challenge

We begin by quantifying exactly how non-IID data damages a federated diffusion model. Let there be $N$ clients, each holding a local dataset ${𝒟}_k$ drawn from distribution $p_k({𝒙}_0)$. The global distribution is the mixture $p({𝒙}_0)=\frac{1}{N}{\sum }_{k=1}^N{p}_k({𝒙}_0)$, but no client observes this mixture directly.

Denoising Score Matching and Its Federated Analogue

A diffusion model defines a forward process (Forward PROC)$$\begin{array}{ccc}& q({𝒙}_t|{𝒙}_0)=𝒩({𝒙}_t;\sqrt{{\bar{\alpha }}_t}{𝒙}_0,(1-{\bar{\alpha }}_t)𝐈),& \text{<span class="tml-eqn"></span>}\end{array}$$ where ${\bar{\alpha }}_t={\prod }_{s=1}^t(1-{\beta }_s)$ and ${\{{\beta }_t\}}_{t=1}^T$ is a variance schedule. The reverse process is learned by minimising the denoising score matching (DSM) objective (DSM)$$\begin{array}{ccc}& {ℒ}_{\mathrm{DSM}}(𝜽)={𝔼}_{t,{𝒙}_0,𝝐}\left[{\Vert 𝝐-{𝝐}_{𝜽}({𝒙}_t,t)\Vert }^2\right],& \text{<span class="tml-eqn"></span>}\end{array}$$ where $𝝐\sim 𝒩(\mathrm{𝟎},𝐈)$, ${𝒙}_t=\sqrt{{\bar{\alpha }}_t}{𝒙}_0+\sqrt{1-{\bar{\alpha }}_t}𝝐$, and ${𝝐}_{𝜽}$ is the denoising network.

In a centralised setting, all data are pooled and (DSM) is minimised directly. In a federated setting, client $k$ minimises its local analogue (DSM Local)$$\begin{array}{ccc}& {ℒ}_k(𝜽)={𝔼}_{t,{𝒙}_0\sim p_k,𝝐}\left[{\Vert 𝝐-{𝝐}_{𝜽}({𝒙}_t,t)\Vert }^2\right].& \text{<span class="tml-eqn"></span>}\end{array}$$

Why Non-IID Data Is Catastrophic for Diffusion

The harm caused by data heterogeneity in federated diffusion goes beyond the gradient divergence familiar from discriminative models. In diffusion, each training example contributes a trajectory of $T$ denoising problems, one per timestep. When client $k$'s distribution $p_k$ concentrates on a subset of the semantic space, its local model ${𝝐}_{{𝜽}_k}$ specialises to that subset at every timestep.

To formalise this, define the denoising trajectory for client $k$ as the sequence of conditional distributions (TRAJ)$$\begin{array}{ccc}& {𝒯}_k=\{p_k({𝒙}_{t-1}|{𝒙}_t){\}}_{t=1}^T.& \text{<span class="tml-eqn"></span>}\end{array}$$ After federated aggregation, the global model implicitly assumes the averaged trajectory $\overline{𝒯}=\frac{1}{N}{\sum }_k{𝒯}_k$. The mismatch between $\overline{𝒯}$ and any individual ${𝒯}_k$ can be quantified by the expected KL divergence

(TRAJ Mismatch)$$\begin{array}{ccc}& {\mathrm{\Delta }}_{\mathrm{traj}}=\frac{1}{N}\sum _{k=1}^N\frac{1}{T}\sum _{t=1}^T\mathrm{KL}(p_k({𝒙}_{t-1}|{𝒙}_t)\Vert \bar{p}({𝒙}_{t-1}|{𝒙}_t)).& \text{<span class="tml-eqn"></span>}\end{array}$$

FedDifRC: Text-Driven Contrasting and Noise Consistency

FedDifRC (Federated Diffusion with Regularisation and Consistency, ICCV 2025) addresses trajectory divergence through two synergistic mechanisms applied during local training: (i) text-driven diffusion contrasting, which exploits pre-trained vision–language semantics to pull semantically similar representations together across clients; and (ii) noise-driven consistency regularisation, which aligns each client's denoising path to a global reference trajectory.

Text-Driven Diffusion Contrasting

The key insight is that although raw images differ dramatically across clients, their textual semantic embeddings are comparatively stable. A pre-trained text encoder $f_{\mathrm{txt}}$ (e.g. CLIP) maps class labels or captions to a semantic space that is largely domain-invariant.

The TDDC loss achieves two goals simultaneously. Within a client, it encourages samples of the same class to cluster in the semantic space regardless of their noise level $t$. Across clients, because the text encoder is frozen and shared, it creates a common semantic coordinate system: two clients that hold different image styles but share class labels will produce compatible semantic embeddings, enabling meaningful model aggregation at the server.

Noise-Driven Consistency Regularisation

The second component aligns local denoising instances to a global reference. After each communication round, the server broadcasts the global model ${𝝐}_{{𝜽}^g}$. During local training at client $k$, each noisy sample ${𝒙}_t$ is passed through both the local model ${𝝐}_{{𝜽}_k}$ and the frozen global model, producing a global denoising representation ${𝒓}^g({𝒙}_t,t)={\psi }_{{𝜽}^g}({𝒙}_t,t)$, where $\psi$ is a projection of the network's intermediate features.

The NDC loss acts as a knowledge distillation objective at the representation level: local models are prevented from drifting too far from the global trajectory even while adapting to local data. Crucially, it operates on noisy samples ${𝒙}_t$ rather than clean images ${𝒙}_0$, so it regularises behaviour at every point in the denoising chain.

FedDifRC Training Objective and Algorithm

The complete FedDifRC local objective at client $k$ combines the standard DSM loss with both regularisation terms:

(Feddifrc OBJ)$$\begin{array}{ccc}& {ℒ}_k^{\mathrm{FedDifRC}}({𝜽}_k)={ℒ}_{\mathrm{DSM}}({𝜽}_k)+{\lambda }_1{ℒ}_{\mathrm{TDDC}}({𝜽}_k)+{\lambda }_2{ℒ}_{\mathrm{NDC}}({𝜽}_k),& \text{<span class="tml-eqn"></span>}\end{array}$$ where ${\lambda }_1,{\lambda }_2\ge 0$ are balancing hyperparameters. Setting ${\lambda }_1={\lambda }_2=0$ recovers vanilla FedAvg applied to the diffusion model.

Architecture: The FedDifRC System

Figure fig:fedgen:feddifrc-arch gives an overview of the FedDifRC system. Each client runs a denoising U-Net augmented with (i) a lightweight semantic projection head $\varphi$ fed by the frozen text encoder and (ii) a feature projection $\psi$ that exposes intermediate U-Net features to the NDC objective. Gradients from all three loss terms update only the U-Net parameters and the projection heads; the text encoder is never modified.

HyFLM: Personalised FL with Multidimensional Trajectory Optimisation

FedDifRC improves the global model. HyFLM (Hybrid Federated Large Model) instead embraces heterogeneity as a feature: it learns a family of personalised diffusion models, one per client, each optimised to its own distribution while sharing a common global backbone. The core innovation is a multidimensional trajectory optimisation that simultaneously controls the diffusion trajectory, the noise schedule, and a low-rank personalisation adapter.

Personalisation via Trajectory Hypernetworks

HyFLM assigns each client a learnable trajectory vector ${𝜸}_k\in {\mathrm{ℝ}}^m$ that encodes the client's distributional identity. A lightweight hypernetwork $h_{𝝓}$, shared across clients, maps trajectory vectors to personalised noise schedule adjustments: (Hyflm Sched)$$\begin{array}{ccc}& {\hat{\beta }}_t^{(k)}=\sigma (h_{𝝓}({𝜸}_k,t)),t=1,\dots ,T,& \text{<span class="tml-eqn"></span>}\end{array}$$ where $\sigma$ is the sigmoid function ensuring ${\hat{\beta }}_t^{(k)}\in (\mathrm{0,1})$. Each client therefore runs a distinct forward process calibrated to its own data, but the hypernetwork parameters $𝝓$ are aggregated globally, encoding the space of all client trajectories.

Low-Rank Personalisation Adapters

In addition to personalised noise schedules, HyFLM attaches LoRA-style low-rank adapters to the global denoising network. Each client $k$ maintains adapter matrices ${𝐀}_k\in {\mathrm{ℝ}}^{d\times r}$ and ${𝐁}_k\in {\mathrm{ℝ}}^{r\times d}$ (rank $r\ll d$) that modify the weight matrices of the U-Net attention layers: (Hyflm LORA)$$\begin{array}{ccc}& {𝐖}_k={𝐖}^g+{𝐀}_k{𝐁}_k,& \text{<span class="tml-eqn"></span>}\end{array}$$ where ${𝐖}^g$ is the globally shared weight and ${𝐀}_k{𝐁}_k$ is the client-specific residual. Only ${𝐖}^g$ and $𝝓$ are communicated; the adapters ${𝐀}_k,{𝐁}_k$ remain on-device.

FedDDPM and FedDDPM${}^{+}$+: Synthetic Data as a Remedy

A recurring theme in federated learning is the use of a small public dataset at the server to regularise aggregation. The FedDDPM family inverts this idea: instead of requiring a pre-collected public dataset, it generates one using the federated diffusion model itself.

The Self-Correcting Data Heterogeneity Mechanism

The core observation is that a federated diffusion model, even one partially damaged by non-IID training, can still generate approximately diverse samples by sampling from different random seeds. These generated samples, while imperfect, capture a broader mixture distribution than any single client's local data.

FedDDPM: Basic Protocol

In the basic FedDDPM protocol, each client augments its local dataset with a copy of ${\widehat{𝒟}}^{(r)}$ before running local diffusion training. The combined objective is

(Fedddpm OBJ)$$\begin{array}{ccc}& {ℒ}_k^{\mathrm{FedDDPM}}({𝜽}_k)=(1-\mu ){ℒ}_k({𝜽}_k)+\mu {ℒ}_{{\widehat{𝒟}}^{(r)}}({𝜽}_k),& \text{<span class="tml-eqn"></span>}\end{array}$$ where ${ℒ}_{{\widehat{𝒟}}^{(r)}}$ is the DSM loss evaluated on synthetic data and $\mu \in [\mathrm{0,1}]$ is a mixing coefficient. Training on ${\widehat{𝒟}}^{(r)}$ acts as a coverage corrective: clients learn to denoise images from distributions they do not hold locally, reducing the specialisation that causes aggregation misalignment.

FedDDPM${}^{+}$: Iterative Refinement

FedDDPM${}^{+}$ iterates the synthetic data mechanism more aggressively. At round $r$, rather than simply mixing synthetic data into local training, the server runs a distillation pass: the global model is fine-tuned on ${\widehat{𝒟}}^{(r)}$ for $E_s$ steps before broadcasting, ensuring that the broadcast model is already biased toward the mixture distribution.

Example: Federated Text-to-Image Generation Across Art Studios

Summary and Key Idea

Exercises

Discrete Diffusion for Federated Text Generation

The preceding section treated diffusion in its classical continuous-space form: noise is Gaussian, the data space is ${\mathrm{ℝ}}^d$, and the denoising network operates on real-valued latent representations. This formulation is powerful for image synthesis but sits awkwardly with natural language. Text is fundamentally discrete: tokens drawn from a finite vocabulary $𝒱$. Injecting Gaussian noise into token embeddings is possible but severs the tight correspondence between the forward process and the data modality.

This section develops the discrete masked diffusion paradigm, exemplified by LLaDA (Large Language Diffusion with Masking, NeurIPS 2025), which replaces Gaussian noise with random token masking. We then study why discrete diffusion is particularly advantageous for federated text generation: it avoids sequential token exposure, enables full bidirectional context, and provides stronger privacy guarantees than autoregressive alternatives. The section closes with a treatment of the hybrid CON-PREDIFF model that combines discrete and continuous diffusion backbones.

From Autoregressive to Discrete Masked Diffusion

A standard large language model (LLM) is an autoregressive (AR) model: it factorises the probability of a sequence $𝒙=(x_1,\dots ,x_L)$ as

(AR Factorisation)$$\begin{array}{ccc}& p_{𝜽}(𝒙)=\prod _{\ell =1}^L{p}_{𝜽}(x_{\ell }|x_1,\dots ,x_{\ell -1}).& \text{<span class="tml-eqn"></span>}\end{array}$$

This left-to-right factorisation has two consequences that are particularly problematic in a federated text generation setting.

Sequential token exposure.

During training, the loss at position $\ell$ requires the model to process the prefix $x_1,\dots ,x_{\ell -1}$. Even when training is distributed, gradient computation necessarily involves the full token sequence. In a federated setup where clients hold private text corpora (e.g. clinical notes, legal documents, personal messages), every training forward pass exposes the entire sequence to the model, increasing membership inference attack surface.

Unidirectional context.

The factorisation (AR Factorisation) means that predictions at position $\ell$ are conditioned only on the left context. This limits the model's ability to perform backward generation (generating text given the end of a sequence), infilling (completing a gap in the middle of a sequence), and reasoning tasks that require bidirectional context before committing to any token.

Discrete masked diffusion addresses both limitations by replacing the sequential factorisation with a global masking-and-recovery process.

LLaDA: Large Language Diffusion with Masking

LLaDA defines two processes over token sequences: a forward masking process that randomly corrupts the sequence, and a reverse demasking process learned by the model.

Forward Process: Random Token Masking

Let ${𝒙}_0=(x_1^0,\dots ,x_L^0)\in {𝒱}^L$ be a clean token sequence of length $L$. The forward process at masking ratio $\alpha \in [\mathrm{0,1}]$ independently replaces each token with a special [MASK] token with probability $\alpha$:

(Llada Forward)$$\begin{array}{ccc}& q({𝒙}_{\alpha }|{𝒙}_0)=\prod _{\ell =1}^{L}q(x_{\ell }^{\alpha }|x_{\ell }^0),& \text{<span class="tml-eqn"></span>}\end{array}$$ where (Llada Token MASK)$$\begin{array}{ccc}& q(x_{\ell }^{\alpha }|x_{\ell }^0)=\{\begin{array}{cc}\text{[𝙼𝙰𝚂𝙺]}& \text{with probability }\alpha ,\\ x_{\ell }^0& \text{with probability }1-\alpha .\end{array}& \text{<span class="tml-eqn"></span>}\end{array}$$

This is the absorbing state diffusion process in token space: tokens transition irreversibly to [MASK], and the masking ratio $\alpha$ plays the role of noise level in continuous diffusion. At $\alpha =0$ the sequence is clean; at $\alpha =1$ all tokens are masked.

Reverse Process: Simultaneous Token Recovery

The key departure from autoregressive generation is that the reverse process recovers all masked tokens simultaneously, not one at a time. Given a masked sequence ${𝒙}_{\alpha }$, the model $p_{𝜽}$ predicts the full clean sequence:

(Llada Reverse)$$\begin{array}{ccc}& p_{𝜽}({𝒙}_0|{𝒙}_{\alpha })=\prod _{\ell :x_{\ell }^{\alpha }=\text{[𝙼𝙰𝚂𝙺]}}{p}_{𝜽}(x_{\ell }^0|{𝒙}_{\alpha }).& \text{<span class="tml-eqn"></span>}\end{array}$$

Note that each position is conditioned on the entire masked sequence ${𝒙}_{\alpha }$ (including unmasked tokens), enabling full bidirectional attention. The model architecture is a standard bidirectional transformer (without causal masking in the attention layers), a direct replacement for the unidirectional transformers used in autoregressive LLMs.

Inference: Iterative Demasking

At inference, LLaDA starts from a fully masked sequence ${𝒙}_{{\alpha }_1}=(\text{[𝙼𝙰𝚂𝙺]},\dots ,\text{[𝙼𝙰𝚂𝙺]})$ and iteratively demasks using a schedule ${\alpha }_1>{\alpha }_2>\cdots >{\alpha }_S=0$:

1. Given the current sequence ${𝒙}_{{\alpha }_s}$, run the bidirectional transformer to obtain $p_{𝜽}(x_{\ell }^0|{𝒙}_{{\alpha }_s})$ for all masked positions $\ell$.

2. Sample token predictions from this distribution.

3. Re-mask a proportion ${\alpha }_{s+1}/{\alpha }_s$ of the newly predicted tokens (keeping the most confident predictions unmasked).

4. Repeat until ${\alpha }_S=0$ (no masked positions remain).

This iterative refinement allows the model to revise its initial token predictions in light of context revealed by other positions, a form of global coherence correction impossible in autoregressive generation.

Performance: Matching GPT-4 Forward, Surpassing AR on Backward

LLaDA at 8B parameters achieves performance on standard forward-generation benchmarks (GSM8K, MATH, HumanEval) comparable to GPT-4-level autoregressive baselines, demonstrating that non-autoregressive generation does not sacrifice forward capability. On backward-generation tasks, where the model must generate a sequence given only its ending, LLaDA achieves 42% accuracy versus 32% for autoregressive models, a 31% relative improvement. This advantage arises directly from bidirectional context: LLaDA can reason from the end constraint forward (and from the beginning backward) simultaneously.

The Discrete Diffusion Forward and Reverse Processes

Figure fig:fedgen:disc-diff-proc illustrates the discrete diffusion pipeline.

Why Discrete Diffusion Is Advantageous for Federated Learning

The discrete masked diffusion paradigm offers three structural advantages over autoregressive models in federated text generation.

No Sequential Token Exposure

In an autoregressive model, computing the loss at position $\ell$ requires feeding the prefix $x_1,\dots ,x_{\ell -1}$ through the model. Intermediate activations correlate with the prefix tokens. Gradient-based membership inference attacks can reconstruct significant portions of the training text from model updates.

In LLaDA, each training example contributes a loss term ${\sum }_{\ell :x_{\ell }^{\alpha }=\text{[𝙼𝙰𝚂𝙺]}}\log p_{𝜽}(x_{\ell }^0|{𝒙}_{\alpha })$. The unmasked tokens in ${𝒙}_{\alpha }$ appear as context, but they constitute only a fraction $(1-\alpha )$ of the sequence, and the masking ratio $\alpha$ is sampled uniformly, so no single ordering of tokens is ever presented to the model. This disrupts the prefix structure that sequential gradient reconstruction exploits.

Full Bidirectional Context

In federated settings where clients generate completions from partial contexts (e.g. a medical assistant completing a clinical note, or a legal model completing a contract clause), the ability to condition on both left and right context is critical. LLaDA's bidirectional attention over the masked sequence provides this naturally without any architectural modifications to the federated protocol.

Communication-Efficient Federated Training

Because LLaDA is trained with a single forward pass per example (predicting all masked positions simultaneously), the gradient complexity per training step is $O(L^2)$ (dominated by attention), identical to a standard transformer. There is no need for teacher forcing, scheduled sampling, or special treatment of prefix gradients. This makes the local training loop at each federated client identical to standard transformer fine-tuning, facilitating plug-and-play integration with existing federated optimisers (FedProx, SCAFFOLD, FedNova).

Federated Training with Discrete Diffusion

We now describe how LLaDA-style discrete diffusion is adapted to the federated setting.

Federated Masked Diffusion Protocol

Each client $k$ holds a private text corpus ${𝒟}_k$ and trains a local denoising model $p_{{𝜽}_k}$ using the masked diffusion loss (Llada LOSS). Gradients are aggregated at a central server using FedAvg or a privacy-amplified variant.

Handling Non-IID Text Corpora

Non-IID corpora in text generation manifest as vocabulary skew (different clients use different rare words) and syntactic style skew (different sentence structures). Under discrete diffusion, vocabulary skew affects the prediction distribution for masked tokens. Averaging model weights across clients with different vocabulary distributions can produce a global model that is competent at no client's vocabulary.

A natural remedy is mask-rate personalisation: each client learns a personalised masking schedule ${\alpha }_s^{(k)}$ while sharing the denoising transformer. This is the discrete analogue of HyFLM's noise schedule personalisation (HyFLM: Personalised FL with Multidimensional Trajectory Optimisation).

(DISC PERS Sched)$$\begin{array}{ccc}& {\alpha }_s^{(k)}=\sigma (g_{𝝓}({𝜸}_k,s)),s=1,\dots ,S,& \text{<span class="tml-eqn"></span>}\end{array}$$ where $g_{𝝓}$ is a shared lightweight schedule network, ${𝜸}_k$ is a client-specific trajectory vector, and $\sigma$ ensures values in $(\mathrm{0,1})$. The schedule network $g_{𝝓}$ is aggregated globally; ${𝜸}_k$ remains on-device.

Privacy-Preserving Federated Text Generation

CON-PREDIFF: Hybrid Discrete-Continuous Diffusion

LLaDA operates purely in token space. A complementary line of work recognises that language has both discrete structure (token identities) and continuous structure (semantic embeddings, syntactic parse trees, prosodic features). CON-PREDIFF (Context-Aware Pre-Diffusion) hybridises discrete and continuous diffusion into a single backbone.

Architecture

CON-PREDIFF operates in two stages:

1. Context encoding. A bidirectional context encoder ${\mathrm{Enc}}_{𝝓}$ maps the unmasked tokens ${𝒙}_{\alpha }\setminus \{\text{[𝙼𝙰𝚂𝙺]}\}$ to a continuous context representation $𝒄={\mathrm{Enc}}_{𝝓}({𝒙}_{\alpha })\in {\mathrm{ℝ}}^{L\times d}$.

2. Continuous diffusion over masked positions. A continuous-space denoising network ${𝝐}_{𝜽}$ operates on the embedding vectors of the masked positions, conditioned on $𝒄$: (Conprediff Denoise)$$\begin{array}{ccc}& {𝝐}_{𝜽}({𝒆}_{\alpha },t,𝒄),& \text{<span class="tml-eqn"></span>}\end{array}$$ where ${𝒆}_{\alpha }\in {\mathrm{ℝ}}^{\alpha L\times d}$ is the Gaussian-noised embedding of the masked tokens, and $t$ is the continuous diffusion timestep. After the continuous denoising step, a softmax projection head maps recovered embeddings back to token distributions.

The combined loss is (Conprediff LOSS)$$\begin{array}{ccc}& {ℒ}^{\mathrm{C}\mathrm{O}\mathrm{N}\text{-}\mathrm{P}\mathrm{R}\mathrm{E}\mathrm{D}\mathrm{I}\mathrm{F}\mathrm{F}}={ℒ}_{\mathrm{MDiff}}(𝝓,𝜽)+\lambda {ℒ}_{\mathrm{DSM}}(𝜽),& \text{<span class="tml-eqn"></span>}\end{array}$$ where ${ℒ}_{\mathrm{MDiff}}$ acts on the discrete token reconstruction and ${ℒ}_{\mathrm{DSM}}$ acts on the continuous embedding denoising.

CON-PREDIFF in Federated Settings

The hybrid architecture is particularly suited for federated deployment because:

• The context encoder ${\mathrm{Enc}}_{𝝓}$ captures client-specific discourse structure and can be personalised via LoRA adapters analogous to those in HyFLM (HyFLM: Personalised FL with Multidimensional Trajectory Optimisation).

• The continuous denoising head ${𝝐}_{𝜽}$ operates in embedding space and is shared globally, benefiting from cross-client diversity.

• The two-stage architecture allows staged aggregation: the context encoder can be fine-tuned locally for more rounds while the continuous head is aggregated every round, reflecting their different sensitivities to data heterogeneity.

Comparison: Discrete vs. Autoregressive Federated Text Generation

Table Table 5 summarises the key distinctions between autoregressive and discrete diffusion approaches to federated text generation.

Property	Autoregressive (AR)	Discrete Diffusion
Context	Unidirectional (left only)	Bidirectional (full)
Token exposure	Sequential prefix exposed	Random subset masked
Backward gen. accuracy	32%	42%
Gradient sensitivity	$O(L)$ positions/sequence	$O(\alpha L)$, avg. $O(L/2)$
Infilling	Requires retraining	Native capability
Inference speed	$O(L)$ sequential steps	$O(S)$ parallel steps
FL aggregation	Standard FedAvg	Standard FedAvg
Non-IID remedy	FedProx, SCAFFOLD	Mask-rate personalisation
Model scale	7B–175B+ typical	1B–8B current SOTA
Training stability	High (causal mask)	Moderate (schedule tuning)

Example: Federated Clinical Note Generation

Summary and Insight

Exercises

Federated Large Language Models

Large language models have transformed the landscape of natural language processing. A model with 70 billion parameters can perform clinical reasoning, draft legal documents, and write executable code, all from a single checkpoint. Yet the very scale that makes these models remarkable renders them nearly incompatible with the federated learning paradigm as we have studied it so far. FedAvg was designed for models whose gradients can be sent over a hospital's internet connection in seconds. Sending the gradients of a 70B model would require transmitting roughly 280 gigabytes of floating-point data per round, assuming 32-bit precision. Across hundreds of communication rounds and dozens of clients, the cumulative bandwidth cost reaches petabytes.

This section confronts that mismatch directly. We develop the theory and practice of federated fine-tuning for large language models, with parameter-efficient adapters as the central tool. By transmitting only a tiny fraction of a model's parameters, we recover the original promise of federated learning: privacy-preserving collaboration without prohibitive communication cost.

The Scale Challenge

To appreciate the scale mismatch, consider the three fundamental resources that federated learning must manage: communication bandwidth, client memory, and compute. For modern LLMs, each resource presents a distinct obstacle.

Communication bandwidth.

Standard FedAvg uploads the full gradient (or model delta) at every round. For a model with $P$ parameters stored in 16-bit precision, each upload requires $2P$ bytes. The table below shows how this scales:

Model	Parameters	Upload size	Time at 10 Mb/s
BERT-base	110M	220 MB	3 min
GPT-2	1.5B	3.0 GB	41 min
LLaMA-7B	7B	14 GB	3.2 h
LLaMA-13B	13B	26 GB	5.9 h
LLaMA-70B	70B	140 GB	31.5 h
GPT-4 class	$\sim$100B+	$>$200 GB	$>$44 h

A federated learning system running 100 communication rounds with LLaMA-7B would require each client to upload 1.4 TB per training run, taking over 13 days of continuous transmission. For a 70B model, the numbers are simply not viable on any realistic deployment infrastructure.

Client memory.

Standard fine-tuning requires storing the model weights, optimizer states (two momentum vectors for Adam, each the same size as the model), and gradient activations. For a 7B model with Adam, this amounts to roughly $4\times 28\text{GB}=112\text{GB}$ in 32-bit (the 14 GB figure above is the 16-bit model), or $\approx 56\text{GB}$ in 16-bit mixed precision, exceeding the memory of any consumer GPU and straining professional-grade hardware.

Local compute.

A single forward-backward pass through a 7B transformer on a consumer GPU may take tens of seconds. Multiplied by hundreds of local steps per round and dozens of rounds, local training cost becomes prohibitive on the edge devices and hospital workstations that federated learning targets.

Why Full-Model FedAvg Is Impossible

Let us be precise about why naively applying FedAvg to LLMs fails. Recall that FedAvg aggregates client model deltas: $${𝜽}^{(t+1)}=\sum _{k=1}^K\frac{n_k}{n}{𝜽}_k^{(t)},$$ where ${𝜽}_k^{(t)}$ is the model returned by client $k$ after local fine-tuning. Three compounding issues arise.

Communication. Even with gradient compression (e.g., top-$k$ sparsification), transmitting 0.1% of a 7B model's gradients requires 14 MB per client per round. Scaling to 100 clients and 500 rounds gives 700 GB of aggregate traffic. For a 70B model, even 0.1% is 140 MB per client per round.

Heterogeneous memory. A hospital may deploy the federated client on a workstation with a single 16 GB GPU. Full fine-tuning of a 7B model simply does not fit. Memory-efficient fine-tuning techniques (gradient checkpointing, 8-bit quantization) help but do not close the gap.

Statistical divergence. Fine-tuning a large model for many local steps on non-IID data causes severe client drift: the local models diverge from each other, and their average no longer represents a coherent model. This is the standard problem of client drift in FedAvg, now amplified by the expressiveness of the model.

Parameter-Efficient Fine-Tuning as the Solution

Parameter-efficient fine-tuning (PEFT) methods fine-tune a large model by introducing a small number of new or modified parameters while leaving the vast majority of the original weights frozen. This is beneficial in the centralized setting for memory and storage reasons; in the federated setting it is additionally transformative for communication and privacy.

The family of PEFT methods includes:

• Adapter layers (Houlsby et al., 2019): small bottleneck layers inserted between transformer sublayers.

• Prefix tuning (Li and Liang, 2021): learnable vectors prepended to key-value sequences in each attention layer.

• Prompt tuning: soft prompt tokens appended to the input embedding.

• Low-Rank Adaptation (LoRA) (Hu et al., 2022): the weight update is constrained to a low-rank matrix product.

• IA${}^3$ (Liu et al., 2022): element-wise rescaling of activations with few learned vectors.

Among these, LoRA has become the dominant approach in federated settings, for reasons we now develop in detail.

LoRA: Low-Rank Adaptation

LoRA, introduced by Hu et al. (2022), is a surprisingly elegant solution to the fine-tuning efficiency problem. Its core observation is that the change in model weights during fine-tuning has low intrinsic rank. Rather than learning a full $d_{\mathrm{out}}\times d_{\mathrm{in}}$ weight update, we can learn two small matrices whose product approximates the update.

The number of trainable parameters per layer is $r(d_{\mathrm{in}}+d_{\mathrm{out}})$, compared to $d_{\mathrm{in}}{d}_{\mathrm{out}}$ for a full update. For a typical transformer attention projection with $d_{\mathrm{in}}=d_{\mathrm{out}}=4096$ and $r=8$, this is $8\times 8192=\mathrm{65,536}$ versus $\mathrm{16,777,216}$: a compression factor of 256.

Why low rank suffices.

The empirical observation supporting LoRA is that the weight matrices in transformer models lie near a low-dimensional subspace throughout training. This intrinsic dimensionality hypothesis, supported by analysis of the singular values of weight updates, suggests that fine-tuning moves models along a manifold of far lower dimension than the full parameter space. LoRA leverages this by restricting the update to an explicit rank-$r$ subspace.

The scaling factor $\alpha /r$.

The choice to scale by $\alpha /r$ (rather than simply learning the magnitude within $𝐁𝐀$) decouples the rank from the effective learning rate. When $r$ is doubled, the scaling factor halves, keeping the effective step size constant. A common choice is $\alpha =2r$, giving a scaling of 2, though $\alpha =r$ (scaling 1) is also used.

Which layers to adapt?

LoRA is typically applied to the query (${𝐖}_Q$), key (${𝐖}_K$), value (${𝐖}_V$), and output (${𝐖}_O$) projection matrices of each attention head, and sometimes to the feed-forward layers (${𝐖}_{\mathrm{up}}$, ${𝐖}_{\mathrm{down}}$). The choice of which layers to adapt significantly affects downstream performance: attention layers tend to capture task-specific reasoning, while feed-forward layers encode factual knowledge.

LoRA in the Federated Setting

In the federated setting, each client $k$ holds frozen ${𝐖}_0$ (the global pre-trained model, distributed once) and trains its own adapter matrices $({𝐀}_k,{𝐁}_k)$. At the end of local training, the client uploads only $({𝐀}_k,{𝐁}_k)$, and the server aggregates: $${\overline{𝐀}}^{(t+1)}=\sum _{k=1}^K\frac{n_k}{n}{𝐀}_k^{(t)},{\overline{𝐁}}^{(t+1)}=\sum _{k=1}^K\frac{n_k}{n}{𝐁}_k^{(t)}.$$

The communication savings are dramatic. For LLaMA-7B with LoRA rank $r=16$ applied to attention projections in all 32 layers:

• Number of adapted parameters: $32\times 4\times 16\times (4096+4096)=\mathrm{16,777,216}\approx 16.8$M.

• Fraction of total parameters: $16.8\text{M}/7\text{B}\approx 0.24\%$.

• Upload size per client per round (16-bit): $\approx 33.5$ MB.

• Time at 10 Mb/s: $\approx 26$ seconds.

Compare this to 14 GB and 3.2 hours for full-model FedAvg.

LoRA Variants for Federated Settings

The basic FedLoRA scheme has several known weaknesses that motivated a family of variants:

SLoRA (Sparse LoRA).

SLoRA combines LoRA with sparse masking. Each client learns not only the low-rank matrices $(𝐀,𝐁)$ but also a binary mask $𝐌$ identifying which entries of $𝐁𝐀$ to activate. The effective update is $\frac{\alpha }{r}(𝐌\odot 𝐁𝐀)$. By sharing masks across clients (e.g., through a lottery-ticket style pre-selection), SLoRA concentrates capacity in the most informative directions and resists overfitting on small local datasets.

FlexLoRA (Heterogeneous Ranks).

In cross-device federated learning, clients have heterogeneous computational capabilities. A powerful workstation may afford rank $r=64$, while a mobile device is limited to $r=4$. FlexLoRA allows each client to choose its own rank $r_k$ and resolves the aggregation mismatch by projecting all client adapters into a common rank-$r_{\max }$ space before averaging: $$\overline{𝐁}\overline{𝐀}=\frac{1}{K}\sum _{k=1}^K{\mathrm{Proj}}_{r_{\max }}({𝐁}_k{𝐀}_k).$$ This requires a singular value decomposition at the server but adds no overhead at the clients.

FFA-LoRA (Frozen-A Low-Rank Adaptation).

In standard LoRA, both $𝐀$ and $𝐁$ are trainable. FFA-LoRA (Frozen-A LoRA) fixes $𝐀$ to its random initialization and trains only $𝐁$. The matrix $𝐀$ acts as a fixed random projection of the weight space, and $𝐁$ learns to combine these projections. This has two advantages in the federated setting: (i) clients do not need to transmit $𝐀$ at all, halving communication; and (ii) the server can pre-share a common fixed $𝐀$ initialization, so that all clients' updates live in the same subspace and aggregate coherently.

Federated Prompt Tuning

Prompt tuning is an even more parameter-efficient approach. Rather than modifying weight matrices, prompt tuning prepends a small set of learned soft prompt vectors to the input embedding sequence. These vectors are not discrete tokens; they are continuous embeddings optimized by gradient descent.

The number of trainable parameters for prompt tuning is just $s\times d$. For $s=100$ and $d=4096$ (LLaMA-7B), this is $\mathrm{409,600}$ parameters, or about $0.006\%$ of the full model. The upload cost per round is under 0.8 MB. At 10 Mb/s, this is under one second.

Prompt tuning achieves performance close to full fine-tuning when models are large enough (above $\sim$10B parameters) but degrades significantly on smaller models or tasks requiring structural changes to the model's reasoning. In federated settings, the extreme parameter efficiency makes it attractive for communication-constrained environments.

TikZ: LoRA Injection into Transformer Layers

Example: Federated Instruction Tuning for Clinical NLP

Exercises for Section Federated Large Language Models

Optimization for Federated LLMs

Even with LoRA reducing the number of transmitted parameters by a factor of 100 or more, federated LLM training faces a second barrier: the cost of backpropagation itself. Computing gradients through a billion-parameter transformer requires storing intermediate activations at every layer, consuming memory proportional to the model depth, sequence length, and batch size. On a device with 16 GB of GPU memory, this often exceeds capacity even when the model itself fits.

This section develops a family of optimization algorithms that attack this problem at its root by eliminating or radically restructuring the computation of gradients. We begin with zeroth-order optimization, which estimates gradient directions from loss values alone, and show how it reduces memory from $O(P)$ to $O(1)$ additional storage. We then study FedKSeed, which takes communication efficiency to an extreme by transmitting only a random seed and a scalar. Finally, we examine infrastructure-level solutions (RDMA) and personalized fine-tuning.

FedMeZO: Zeroth-Order Optimization Without Backpropagation

The key insight behind zeroth-order (ZO) methods is: we can estimate the gradient of a loss function without computing a gradient at all, using only function evaluations. The price we pay is statistical efficiency: ZO gradient estimates are noisier than exact gradients. The reward is dramatic: no backpropagation means no activation storage, reducing memory overhead from $O(P)$ to $O(1)$ beyond the model itself.

The MeZO algorithm.

MeZO (Memory-Efficient Zeroth-Order, Zhang et al., 2024) applies zeroth-order gradient estimation directly to the model parameters using a simultaneous perturbation stochastic approximation (SPSA)-style estimator.

MeZO implementation.

The MeZO algorithm exploits a key trick to avoid storing the perturbation vector $𝒛$ explicitly, which would itself require $O(P)$ memory. By resetting a pseudo-random number generator (PRNG) to a stored seed $s$ before each perturbation, the same $𝒛$ can be regenerated on demand. Only the seed $s$ and two scalar loss values ${ℒ}_{+},{ℒ}_{-}$ need to be retained.

Note that the update $𝜽\leftarrow 𝜽-\eta \hat{g}𝒛$ modifies all parameters. When combined with LoRA, the perturbation is applied only to the adapter matrices $(𝐀,𝐁)$, further reducing the scope of computation.

FedMeZO.

FedMeZO integrates MeZO into the federated learning loop. Each client runs MeZO locally for several steps and then uploads the delta of its adapter parameters. The server aggregates and distributes the updated adapter.

Memory Analysis of FedMeZO

Method	Adapter memory	Activation mem.	Comm./round	Conv.
Full FedAvg	14 GB (full)	$\sim$40 GB	14 GB	Yes
FedLoRA (standard)	32 MB (adapter)	$\sim$8 GB	32 MB	Yes
FedLoRA + FFA	16 MB (adapter)	$\sim$8 GB	16 MB	Partial
FedMeZO	32 MB (adapter)	$\sim$0 GB	32 MB	Yes (ZO)
FedKSeed	32 MB (adapter)	$\sim$0 GB	$<$1 KB	Yes (ZO)
FedP2EFT	32 MB (personal)	$\sim$8 GB	32 MB	Yes

FedKSeed: Transmitting Seeds Instead of Gradients

FedKSeed (Xu et al., 2024) pushes the communication efficiency of zeroth-order methods to its logical extreme. In MeZO, the client updates its parameters locally and transmits the delta. FedKSeed observes that because the update direction is entirely determined by the PRNG seed and the scalar gradient signal, the client need not transmit the parameter delta at all. Instead, it transmits just:

1. The PRNG seed $s$ used in each step (4 bytes each).

2. The scalar gradient signal $\hat{g}=({ℒ}_{+}-{ℒ}_{-})/(2ϵ)$ for each step (4 bytes each).

For $\tau$ local steps, the total transmission is $8\tau$ bytes. With $\tau =100$ steps, this is 800 bytes, or under 1 KB.

Security considerations.

Because FedKSeed transmits scalar loss values rather than parameter deltas, it offers a qualitatively different privacy surface. A scalar loss value reveals far less about the local dataset than a gradient vector. However, the server can still reconstruct the full parameter update from $(s_i,{\hat{g}}_i)$, so the effective information leakage is the same as transmitting the delta. The privacy advantage is in communication interception: an eavesdropper who intercepts the client's transmission learns only scalars, not gradients.

TikZ: FedMeZO vs. Standard Backpropagation

Convergence of Zeroth-Order Methods

Zeroth-order methods pay a convergence penalty compared to first-order gradient descent. The following proposition quantifies this tradeoff precisely.

FedRDMA: Infrastructure for Cross-Silo LLM Training

For cross-silo federated LLM training (e.g., between a small number of large institutions each with substantial compute), the bottleneck shifts from per-parameter communication cost to the latency and throughput of the communication infrastructure. Standard TCP/IP communication incurs significant CPU overhead and memory copies at each hop; for large tensors, this overhead dominates end-to-end training time.

FedRDMA addresses this by replacing TCP/IP with Remote Direct Memory Access (RDMA), a hardware-level communication primitive that allows a remote machine to directly read from or write to local GPU memory without involving the CPU. RDMA reduces per-byte latency by $5$–$10\times$ and can achieve near-peak network bandwidth (e.g., 100 Gb/s on InfiniBand).

In the FedRDMA architecture, the server maintains a parameter server in GPU memory, and clients use RDMA PUT/GET operations to exchange adapter parameters. The gradient aggregation step is pipelined with local computation: while one batch is being processed locally, the previous round's gradients are being aggregated via RDMA. This overlap reduces the per-round wall-clock time significantly.

FedP2EFT: Personalized Parameter-Efficient Fine-Tuning

A fundamental limitation of standard FedLoRA is that all clients share a single global adapter. When client data distributions are highly heterogeneous, a single adapter cannot optimally serve all clients. FedP2EFT (Personalized Parameter-Efficient Fine-Tuning), introduced at AAAI 2025, decomposes the adapter into a shared global component and a client-specific personal component.

The global adapter captures the shared knowledge that benefits all clients (common medical terminology, general language understanding), while the personal adapter captures client-specific patterns (local clinical conventions, institution-specific abbreviations).

The alternating optimization in FedP2EFT proceeds as follows: at each local step, gradients are computed with respect to both ${𝜽}^g$ and ${𝜽}_k^p$. The personal adapter update uses the standard Adam optimizer with a higher learning rate (since it need not converge to a global consensus), while the global adapter is updated with a lower learning rate to avoid over-specializing to the local data.

A Unified View

The methods developed in this section can be viewed through a common lens: each method occupies a distinct point in the memory-communication-convergence tradeoff space.

• FedLoRA (standard): low communication, moderate memory (activation storage for backprop on adapters), strong convergence guarantees. The default choice when clients have adequate GPU memory.

• FedMeZO: low communication, minimal memory (no activations), slower convergence by dimension factor $P$. Preferred when client memory is severely constrained.

• FedKSeed: essentially zero upload cost, minimal memory, same convergence as MeZO but requires the server to reconstruct client updates. Preferred in extreme upload-bandwidth-constrained settings.

• FedP2EFT: standard communication (global adapter only), standard memory, best task performance due to personalization. Preferred when client heterogeneity is high.

• FedRDMA: reduces latency in cross-silo settings with high-speed interconnects. Not applicable to edge devices.

Exercises for Section Optimization for Federated LLMs

The Pathology of Non-IID Data

Federated learning was conceived around a beautifully simple idea: train a model across many devices without centralising data. The theoretical analysis that blessed this idea with convergence guarantees, however, rested on an assumption that is violated in virtually every real deployment-that each client's data is an independent and identically distributed draw from a common global distribution. Strip away this assumption and the landscape changes profoundly. Local models diverge. Global aggregation averages gradients that point in fundamentally different directions. And generative models, whose very purpose is to learn the global data distribution, suffer the most acutely of all.

This section characterises the heterogeneity problem with mathematical precision, analyses how it interacts with generative learning objectives, and presents the first systematic solutions for FL-specific non-IID correction.

A Taxonomy of Heterogeneity

Non-IID conditions in federated learning are not monolithic. The literature has converged on five distinct types of distributional mismatch, each requiring different treatment.

Distribution Skew

The broadest form of heterogeneity arises when the marginal distributions $p_k(𝒙)$ differ across clients $k=1,\dots ,K$. Let $p^{\ast }(𝒙)$ denote the desired global distribution. A client $k$ observes data sampled from its local marginal $p_k$, which may concentrate on a different region of $𝒳$ entirely.

Distribution skew subsumes all other types; the remaining four refine the origin of the divergence.

Label Skew

Label skew (also called label distribution skew) arises when different clients hold data from different class distributions. Let $𝒴=\{1,\dots ,C\}$ be the label space. Client $k$ draws $n_k$ samples, and the empirical class frequency for client $k$ at class $c$ is ${\pi }_k^c=|\{i:y_i^{(k)}=c\}|/n_k$.

The Dirichlet parameterisation from Definition 30 has become the standard benchmark for evaluating FL algorithms under label skew. In practice $\alpha \in \{0.1,0.5,1.0\}$ is used to simulate increasingly severe heterogeneity.

Feature Skew

Feature skew captures sensor, modality, or domain differences that change the conditional distribution of features given the label. While labels may be shared, the pixel intensities, noise levels, or acquisition protocols differ:

Feature skew is endemic to medical imaging federations: different hospital scanners produce different image textures for the same pathology. A model trained only on scanner-$i$ data learns representations that fail to transfer to scanner-$j$ patients.

Quality Skew

Quality skew arises when the noise level or label quality varies by client. Let ${\tilde{y}}_i^{(k)}$ denote the observed (possibly noisy) label and $y_i^{(k)}$ the true label. If the confusion matrix $P(\tilde{y}=c^{\prime }|y=c)$ depends on client $k$, the system exhibits quality skew. Clients with poor annotation quality effectively inject a systematic bias into the global objective.

Quantity Skew

The simplest form of heterogeneity is unequal dataset sizes. Let $n_k$ denote the number of training samples at client $k$. If $n_k$ varies substantially, naive FedAvg over-represents large clients and under-represents small ones in the aggregated gradient.

Formal Definition of Non-IID Data in FL

Having catalogued the sources of heterogeneity, we can now state a precise, unified definition.

The quantity $\mathrm{\Delta }(ℱ)$ is the weighted average KL divergence from each client's distribution to the global mixture-equivalently, the mutual information $I(k;(𝒙,y))$ when we view the client identity $k$ and data $(𝒙,y)$ as jointly drawn from $p(k,𝒙,y)=w_k{p}_k(𝒙,y)$. Large $\mathrm{\Delta }$ signals that knowing which client produced a sample gives substantial information about its distribution.

Why Non-IID is Worse for Generative Models

Discriminative models-classifiers, regressors-suffer from non-IID data primarily through convergence degradation: local gradients point toward local optima and slow or derail convergence to the global optimum. Generative models face an additional, qualitatively different failure mode: mode collapse amplification.

To understand why, recall the objective of a generative model trained under FedAvg. Each client $k$ minimises a local generative loss (e.g., the ELBO for a VAE, the GAN minimax objective, or the denoising score matching loss for a diffusion model) with respect to its local data ${𝒟}_k$. The aggregated global model inherits the average of the local generators' parameters, not the global optimum.

This proposition explains empirical observations that FedGAN and naive federated VAE training produce blurry, low-diversity outputs even when the local models are sharp and high-fidelity. The aggregation step destroys the multimodal structure of the global distribution by averaging parameter vectors that encode incompatible generative manifolds.

Client Drift: Local Models Diverge

The formal counterpart to mode collapse amplification in the optimisation landscape is client drift-the tendency of local model updates to move toward local optima that are distant from the global optimum.

After $E$ local gradient steps starting from a shared initialisation ${𝜽}^{(t)}$, client $k$ produces an update ${\mathrm{\Delta }}_k={𝜽}_k^{(t,E)}-{𝜽}^{(t)}$ that approximates the direction ${𝜽}_k^{\ast }-{𝜽}^{(t)}$ rather than ${𝜽}^{\ast }-{𝜽}^{(t)}$. FedAvg computes ${𝜽}^{(t+1)}={𝜽}^{(t)}+{\sum }_k{w}_k{\mathrm{\Delta }}_k$, which moves toward the centroid of the local optima rather than toward ${𝜽}^{\ast }$.

Mathematical Analysis: Divergence Between Local and Global Optima

We now quantify how non-IID-ness translates into suboptimality of FedAvg's output.

Theorem 3 reveals the fundamental non-IID trade-off: increasing $E$ accelerates initial convergence (reduces the first term) but amplifies the drift error (increases the second term). No value of $E$ eliminates both simultaneously when ${\sigma }_g^2>0$.

TikZ: Client Drift Visualisation

FedDDPM: Diffusion as a Non-IID Self-Corrector

The observation that generative models are most harmed by non-IID data suggests a striking inversion: could generative models be used to cure non-IID problems? FedDDPM (Federated Denoising Diffusion Probabilistic Models) exploits exactly this idea.

Core Architecture

In FedDDPM, each client $k$ trains a local DDPM ${ϵ}_{{𝜽}_k}({𝒙}_t,t)$ on its local dataset ${𝒟}_k$. After local training, clients share only the model parameters (not the data), and the server aggregates via FedAvg to produce a global diffusion model ${ϵ}_{\overline{𝜽}}$.

The key insight is that the server then queries its own global diffusion model to generate a synthetic auxiliary dataset ${\widetilde{𝒟}}_{\mathrm{server}}$ that approximates the global distribution $p^{\ast }(𝒙)$. This synthetic dataset is broadcast to all clients, who incorporate it into their next round of local training.

Why Synthetic Augmentation Reduces Drift

The synthetic data $\widetilde{𝒟}$ drawn from the global model approximates the global distribution $p^{\ast }$. When client $k$ trains on ${\widehat{𝒟}}_k={𝒟}_k\cup \widetilde{𝒟}$, its effective local distribution becomes a mixture:

(Synthetic Mixture)$$\begin{array}{ccc}& {\hat{p}}_k(𝒙,y)=\frac{n_k}{n_k+N_s}{p}_k(𝒙,y)+\frac{N_s}{n_k+N_s}\tilde{p}(𝒙,y),& \text{<span class="tml-eqn"></span>}\end{array}$$ where $\tilde{p}\approx p^{\ast }$. As $N_s\to \infty$, ${\hat{p}}_k\to p^{\ast }$ regardless of $p_k$, completely eliminating distributional heterogeneity. For finite $N_s$, the effective heterogeneity measure becomes:

FedDDPM+: One-Shot Correction for Slow Learners

FedDDPM has a known vulnerability: in early rounds, the global model is poorly trained, so the synthetic data $\widetilde{𝒟}$ approximates $p^{\ast }$ poorly-or not at all. If weak clients (slow learners with limited data or compute) receive poor synthetic data in early rounds, their local models may converge to incorrect modes before the global model improves.

FedDDPM+ addresses this with a one-shot correction step: after the initial round, the server generates a large synthetic dataset ${\widetilde{𝒟}}_{\mathrm{full}}$ from a separately trained teacher diffusion model (trained on data accessible to the server, e.g. public data or a held-out calibration set) and broadcasts it once to all clients. This “bootstraps” all clients to a common starting point before the federated training loop begins.

(Feddpmplus INIT)$$\begin{array}{ccc}& {\widehat{𝒟}}_k^{(0)}={𝒟}_k\cup {\widetilde{𝒟}}_{\mathrm{full}}\text{(initialisation step of FedDDPM+)}.& \text{<span class="tml-eqn"></span>}\end{array}$$

The one-shot initialisation does not require additional communication overhead per round; the teacher's synthetic data is broadcast once and cached locally.

Example: Five Hospitals with Different Disease Prevalence

The Dual Role of Generative Models in Non-IID FL

The analysis of this section culminates in a striking duality that distinguishes the study of generative models in federated learning from all other federated learning problems.

Exercises

Device and Architecture Heterogeneity

The preceding section addressed data heterogeneity: the fact that different clients hold data from different distributions. This section addresses a complementary and equally pervasive challenge: device and model heterogeneity. In any real-world federated deployment, clients are not homogeneous computing nodes. They range from resource-constrained edge devices-smartphones with limited RAM, no GPU, and strict battery budgets-to high-performance GPU servers capable of training billion-parameter models. Designing a federated system that accommodates this spectrum is, as we shall see, a fundamentally different mathematical problem from the standard assumption of homogeneous clients.

The Heterogeneous Device Landscape

A production federated learning system at planetary scale-such as those deployed for keyboard prediction, health monitoring, or financial fraud detection-must operate across device categories spanning at least four orders of magnitude in computational capability.

Hardware Heterogeneity: Compute, Memory, Battery, Network

The four dimensions of hardware heterogeneity interact in ways that make the design space complex:

• Compute heterogeneity: Clients with fewer FLOPs require smaller models or fewer local epochs. If all clients must run the same model, the model size is capped by the weakest client.

• Memory heterogeneity: The activation memory required for backpropagation grows with model width and batch size. Clients with little RAM cannot run large batches or wide networks.

• Battery heterogeneity: Mobile clients participate in FL only when charging or above a battery threshold. Forced participation during low-battery conditions degrades user experience and device longevity.

• Network heterogeneity: Clients on slow or metered connections cannot afford to upload and download large model updates every round. A 100 MB model update at 1 Mbps takes 800 seconds-an unacceptable round latency for a system targeting sub-minute communication.

The Straggler Problem

In synchronous FedAvg, the server must wait for all $K$ selected clients to complete their local training and return their updates before proceeding to the aggregation step. This creates the straggler problem: the wall-clock time per round is determined by the slowest participating client.

Let $T_k$ be the time required for client $k$ to complete one round of local training (including forward passes, backward passes, and communication). The round time is: (Round TIME SYNC)$$\begin{array}{ccc}& T_{\mathrm{round}}=\underset{k\in {𝒮}_r}{\max }{T}_k,& \text{<span class="tml-eqn"></span>}\end{array}$$ where ${𝒮}_r$ is the set of clients selected in round $r$. If one client has $T_k=100\times T_j$ for all other clients $j$, the entire system is bottlenecked at $100\times$ the median round time.

Asynchronous Federated Learning

The synchronous bottleneck motivates asynchronous FL: the server does not wait for all clients to complete, but instead updates the global model as soon as any client returns an update.

Asynchronous FL eliminates the straggler bottleneck but introduces staleness bias: updates computed from old model versions may move the global model in directions that are no longer beneficial. The staleness $s_k$ is the primary measure of this bias.

FedDT: Knowledge Distillation with Ternary Compression

FedDT (Federated Deep Transfer) addresses device heterogeneity from a different angle: rather than forcing all clients to run the same model, it adopts a teacher-student framework where heterogeneous local models (teachers) train a uniform, lightweight global student.

Teacher-Student Framework

In FedDT, each client $k$ trains a local teacher model $f_k$ of size $d_k$, chosen to match its hardware capabilities. A powerful GPU client might use a ViT-Large; a smartphone might use a MobileNet. The global student $g_{𝜽}$ is a fixed, lightweight architecture shared across all clients.

The distillation objective for client $k$ is:

(Feddt LOSS)$$\begin{array}{ccc}& {ℒ}_k^{\mathrm{FedDT}}(𝜽)=\alpha {ℒ}_{\mathrm{task}}(g_{𝜽};{𝒟}_k)+(1-\alpha ){ℒ}_{\mathrm{KD}}(g_{𝜽},f_k;{𝒟}_k),& \text{<span class="tml-eqn"></span>}\end{array}$$ where ${ℒ}_{\mathrm{task}}$ is the standard task loss (e.g. cross-entropy) and ${ℒ}_{\mathrm{KD}}$ is the knowledge distillation loss: (KD LOSS)$$\begin{array}{ccc}& {ℒ}_{\mathrm{KD}}(g,f;𝒟)=\frac{1}{|𝒟|}\sum _{(𝒙,y)\in 𝒟}{D}_{\mathrm{KL}}\left(\sigma (f(𝒙)/T)\Vert \sigma (g(𝒙)/T)\right),& \text{<span class="tml-eqn"></span>}\end{array}$$ with temperature $T>1$ softening the teacher's output distribution to produce informative soft labels.

Two-Level Compression: Ternary Quantisation

The student model $g_{𝜽}$ is communicated between server and clients every round. To reduce communication costs further, FedDT quantises the student's weights to ternary values $\{-1,0,+1\}$, the coarsest quantisation that preserves signed gradient information.

With ternary quantisation, each weight requires only ${\log }_2(3)\approx 1.585$ bits, compared to 32 bits for float32-a theoretical compression ratio of approximately $32/1.585\approx 20\times$. In practice, after entropy coding the ternary values (which have a natural sparsity from the zero-class), FedDT achieves a 78% communication reduction over standard FedAvg while maintaining competitive accuracy.

Empirical Results

On a federated image classification benchmark (CIFAR-100, $K=100$ clients, Dirichlet($\alpha =0.5$) label skew), FedDT achieves:

The 7.85% accuracy improvement of FedDT (ternary) over FedAvg comes from two sources: (1) heterogeneous teachers transmit richer, class-diverse knowledge via soft labels, and (2) ternary quantisation acts as a regulariser that prevents overfitting on small local datasets.

Formal Definition of Model Heterogeneity

Strong model heterogeneity is the central challenge: FedAvg requires that all clients share the same parameter space, so that ${𝜽}^{(r)}={\sum }_k{w}_k{𝜽}_k^{(r)}$ is well-defined. When clients use different architectures, this sum is undefined.

Heterogeneous Model Aggregation: FedMD and FedDF

Two landmark methods tackle strong model heterogeneity by shifting from parameter space aggregation to prediction space aggregation.

FedMD: Model Distillation via Public Data

FedMD (Federated Learning with Model Distillation) exploits a small public dataset ${𝒟}_{\mathrm{pub}}$ accessible to both the server and clients. The aggregation protocol operates in logit space: each client computes class logits (or soft predictions) on ${𝒟}_{\mathrm{pub}}$ and sends them to the server; the server averages the logit vectors across clients and broadcasts the averaged logits back as distillation targets.

FedMD requires only $O(|{𝒟}_{\mathrm{pub}}|\cdot C)$ communication per round (logit vectors), independent of model size, making it asymptotically communication-efficient under growing model sizes.

FedDF: Ensemble Distillation at the Server

FedDF (Federated Distillation with Dataset-Free ensemble) extends FedMD by performing the distillation step at the server rather than at the clients. The server trains a global student $g_{𝜽}$ by minimising the KL divergence from the ensemble of local models: (Feddf)$$\begin{array}{ccc}& \underset{𝜽}{\min }{𝔼}_{𝒙\sim {𝒟}_{\mathrm{pub}}}\left[D_{\mathrm{KL}}(\frac{1}{K}\sum _k\sigma \left(\frac{f_k(𝒙)}{T}\right)\Vert \sigma \left(\frac{g_{𝜽}(𝒙)}{T}\right))\right].& \text{<span class="tml-eqn"></span>}\end{array}$$

By distilling from the ensemble rather than the average logits, FedDF benefits from ensemble diversity: the combined predictions of $K$ heterogeneous models are more calibrated and accurate than any individual model, and the distilled student inherits this collective knowledge.

TikZ: Heterogeneous FL System

FlexLoRA: Heterogeneous Rank for Heterogeneous Devices

When the shared global model is a large language model and clients fine-tune it via LoRA (Low-Rank Adaptation), model heterogeneity manifests as rank heterogeneity: different clients can afford different LoRA ranks depending on their memory budget.

Recall from the alignment chapter that LoRA parameterises the weight update as $\mathrm{\Delta }𝐖=𝐁𝐀$ where $𝐁\in {\mathrm{ℝ}}^{d\times r}$, $𝐀\in {\mathrm{ℝ}}^{r\times d^{\prime }}$, and $r\ll \min (d,d^{\prime })$ is the rank. The memory cost of storing and backpropagating through the LoRA adapter is $O(r\cdot (d+d^{\prime }))$, making rank $r$ the primary knob for memory control.

The aggregation challenge with heterogeneous ranks is that ${𝐁}_k\in {\mathrm{ℝ}}^{d\times r_k}$ and ${𝐁}_j\in {\mathrm{ℝ}}^{d\times r_j}$ have different shapes when $r_k\ne r_j$, precluding direct averaging.

FlexLoRA Aggregation Protocol

FlexLoRA resolves the shape mismatch via singular value truncation: each client's LoRA update $\mathrm{\Delta }{𝐖}_k={𝐁}_k{𝐀}_k$ is first computed as a full weight-update matrix (of shape $d\times d^{\prime }$), then projected onto a common rank-$r_{\min }$ subspace via SVD before aggregation.

The SVD truncation ensures that the aggregated update captures the directions of maximum weight change (highest singular values), discarding the lower-rank components that contribute least to task performance.

FlexLoRA Communication Analysis

Each client uploads $\mathrm{\Delta }{𝐖}_k\in {\mathrm{ℝ}}^{d\times d^{\prime }}$ (materialised), which at float16 requires $2d{d}^{\prime }$ bytes. However, since $r_k\ll d$, this is dominated by the cost of communicating ${𝐁}_k$ and ${𝐀}_k$ separately, at $2(d{r}_k+r_k{d}^{\prime })$ bytes. For a representative GPT-2 layer with $d=d^{\prime }=768$ and $r_k\in \{4,8,16,32,64,128\}$:

FlexLoRA thus achieves a natural communication-capability proportionality: more capable devices upload larger updates that capture finer-grained knowledge, while constrained devices upload compact updates that encode the most essential direction.

Connecting Device and Data Heterogeneity

Device heterogeneity and data heterogeneity are intertwined in practice. Resource-constrained devices (smartphones, wearables) are often deployed in specific geographic or demographic contexts, making their data distributions systematically different from those of powerful server-grade clients. This correlation means that solutions to device heterogeneity (e.g. FlexLoRA) can inadvertently reduce data heterogeneity (smaller-rank updates from constrained clients contribute less to local overfitting), and vice versa.

Exercises

m I

Privacy Attacks on Federated Generative Models

Federated learning was introduced with a compelling promise: by keeping raw data resident on client devices and sharing only model updates, the privacy of every participant would be protected. The server never sees a patient's MRI, a bank's transaction records, or a hospital's clinical notes. This promise sounds mathematically obvious - if the data never moves, the data cannot be stolen.

The promise is broken.

Over the last five years, a succession of attacks has demonstrated that model updates - gradients, weight deltas, mask patterns, and generated samples - carry rich information about the private training data from which they were computed. The situation is particularly acute for generative federated models: unlike discriminative classifiers, which compress data into a decision boundary, generative models (GANs, VAEs, diffusion models) are explicitly trained to remember the fine-grained structure of their training distribution. That capacity for high-fidelity memorisation is precisely the threat.

This section develops the threat model in increasing order of severity: from the classical gradient inversion attack that reconstructs inputs from a single gradient observation, through membership inference attacks that reveal who contributed to training, to the most destructive known attack - memorization-guided data stealing (ICLR 2026) - which allows a malicious participant to extract over 30% of the private training data of other clients using the jointly trained generative model itself as an oracle.

The Broken Promise: Keeping Data Local Does Not Keep Data Private

The foundational assumption of federated learning can be stated precisely. Let ${𝒟}_k={\{({𝒙}_i,y_i)\}}_{i\in {ℐ}_k}$ denote the private dataset of client $k$. In a standard federated round, client $k$ computes a local gradient ${𝒈}_k={\nabla }_{𝜽}ℒ(𝜽;{𝒟}_k)$ and transmits ${𝒈}_k$ to the server. The assumption is that ${𝒈}_k$ reveals nothing about any individual sample ${𝒙}_i\in {𝒟}_k$.

This assumption fails for at least three distinct reasons:

1. Analytical invertibility. For overparameterised networks and small local batches, the mapping $𝒙\mapsto {\nabla }_{𝜽}ℒ(𝜽;\{𝒙\})$ is nearly injective near many gradient values. An adversary who knows ${𝒈}_k$ and $𝜽$ can solve an optimisation problem to approximately recover $𝒙$.

2. Generative memorisation. Generative models - particularly diffusion models and high-capacity GANs - routinely memorise individual training examples verbatim. These examples live inside the model weights and can be extracted through crafted sampling procedures, even after training has concluded.

3. Implicit statistical leakage. Even without full reconstruction, observing a sequence of gradient updates allows statistical inference about whether a particular example was used in training (membership inference). For small federated cohorts - common in medical imaging - this risk is practically significant.

The following subsections develop each threat in detail.

Gradient Inversion Attacks

Formal Setup

Let $f_{𝜽}:𝒳\to 𝒴$ be a neural network with parameters $𝜽\in {\mathrm{ℝ}}^P$. Let $\ell :𝒴\times 𝒴\to {\mathrm{ℝ}}_{\ge 0}$ be a loss function. A client holds a private batch $ℬ={\{({𝒙}_j,y_j)\}}_{j=1}^B$ and computes the gradient: $$𝒈=\frac{1}{B}\sum _{j=1}^B{\nabla }_{𝜽}\ell (f_{𝜽}({𝒙}_j),y_j).$$ The adversary (server or eavesdropper) observes $(𝒈,𝜽)$.

The key insight is that ${\nabla }_{𝜽}\ell (f_{𝜽}({𝒙}^{\prime }),y^{\prime })$ is differentiable with respect to ${𝒙}^{\prime }$ via the chain rule, so the objective in can be minimised by standard gradient-based optimisers. The attack is thus a nested optimisation: an outer loop over ${𝒙}^{\prime }$ adjusting the reconstruction to match the observed gradient, with an inner evaluation of the network $f_{𝜽}$.

DLG: Deep Leakage from Gradients

The seminal gradient inversion attack, Deep Leakage from Gradients (DLG), was introduced by Zhu et al. (2019) and demonstrated that high-fidelity image reconstruction is achievable from a single shared gradient in a federated round.

The DLG procedure operates as follows. Given observed gradient $𝒈$, initialise dummy data $({𝒙}^{\prime },y^{\prime })$ from a standard normal distribution. Iteratively minimise: (DLG)$$\begin{array}{ccc}& {ℒ}_{\mathrm{DLG}}({𝒙}^{\prime },y^{\prime })={\Vert {\nabla }_{𝜽}{ℒ}_{\mathrm{CE}}(f_{𝜽}({𝒙}^{\prime }),y^{\prime })-𝒈\Vert }_2^2,& \text{<span class="tml-eqn"></span>}\end{array}$$ using L-BFGS with cosine learning rate decay. After convergence, the dummy data $({𝒙}^{\prime },y^{\prime })$ closely approximates the true private sample $(𝒙,y)$.

The original paper reported pixel-accurate reconstructions on CIFAR-10, MNIST, and even higher-resolution images, triggering a major re-evaluation of federated learning's privacy properties.

Several improvements followed DLG:

• iDLG (Zhao et al., 2020): analytically recovers the ground-truth label from the sign pattern of the gradient before optimising for the input, improving stability.

• GradInversion (Yin et al., 2021): adds group consistency regularisation to handle batch sizes $B>1$ and recovers multiple images simultaneously.

• R-GAP (Zhu & Blaschko, 2021): exploits the recursive structure of the gradient to solve the inversion problem analytically (without iterative optimisation) for fully-connected layers.

GIDM: Gradient Inversion for Federated Diffusion Models

Standard gradient inversion attacks were developed for discriminative classifiers. Applying them directly to diffusion models is non-trivial: diffusion models are trained on noise-corrupted images at multiple noise levels, and the loss function involves a UNet-style denoiser ${ϵ}_{𝜽}({𝒙}_t,t)$ that predicts the noise $ϵ$ added to a clean image ${𝒙}_0$. The gradient with respect to ${𝒙}_0$ is therefore indirect, passing through the noise-corruption process.

GIDM (Gradient Inversion for Diffusion Models) adapts the inversion framework to this setting. Let ${𝒙}_t=\sqrt{{\bar{\alpha }}_t}{𝒙}_0+\sqrt{1-{\bar{\alpha }}_t}ϵ$ denote the noisy image at timestep $t$, with ${\bar{\alpha }}_t$ the standard diffusion noise schedule. The denoising loss is: $${ℒ}_{\mathrm{diff}}(𝜽;{𝒙}_0)={𝔼}_{t,ϵ}[\Vert {ϵ}_{𝜽}({𝒙}_t,t)-ϵ{\Vert }_2^2].$$ The gradient with respect to $𝜽$ is: $${𝒈}_{\mathrm{diff}}={\nabla }_{𝜽}{ℒ}_{\mathrm{diff}}(𝜽;{𝒙}_0).$$

GIDM solves: (GIDM)$$\begin{array}{ccc}& {\widehat{𝒙}}_0^{\ast }={\mathrm{arg\hspace{0.17em}min}}_{{\widehat{𝒙}}_0\in [\mathrm{0,1}{]}^d}\sum _{t\in 𝒯}{w}_t\cdot {\Vert {𝔼}_{ϵ}[{\nabla }_{𝜽}{ℒ}_{\mathrm{diff}}(𝜽;{\widehat{𝒙}}_0,t)]-{𝒈}_{\mathrm{diff}}^{(t)}\Vert }_2^2+{\lambda }_{\mathrm{TV}}{ℛ}_{\mathrm{TV}}({\widehat{𝒙}}_0),& \text{<span class="tml-eqn"></span>}\end{array}$$ where $𝒯$ is a set of sampled timesteps, $w_t$ are timestep weights (higher for small $t$ which encode fine-grained structure), and ${ℛ}_{\mathrm{TV}}$ is the total variation penalty.

GIDM was shown to reconstruct medical images (chest X-rays, brain MRIs) from gradients shared during federated diffusion model training with SSIM scores exceeding 0.75, substantially outperforming naive gradient inversion baselines.

Memorization-Guided Data Stealing (ICLR 2026)

The gradient inversion attacks described above require observing the gradient at a specific round and work best for small batches. A qualitatively more severe threat was introduced at ICLR 2026: Memorization-Guided Data Stealing (MGDS). This attack exploits a deep property of diffusion models - their tendency to memorise individual training examples - and does not require access to any gradients. The attacker participates in the federation, receives a copy of the trained model, and then uses that model as an oracle to extract private training data from other clients.

Diffusion Model Memorisation

Large diffusion models have been shown to memorise a fraction of their training data verbatim: when prompted with appropriate conditioning (or even unconditionally), they regenerate near-pixel-perfect copies of training images. The memorisation rate depends on image duplication frequency in the dataset, model capacity, and training duration. In federated settings, memorisation is particularly problematic: each client contributes a relatively small, semantically coherent dataset (e.g., images from a single hospital), which the global model may memorise more aggressively than it would memorise diverse large-scale data.

The MGDS Attack Mechanism

MGDS operates in two phases, each exploiting a distinct guidance mechanism.

Phase 1: Memorization-Focused Guidance (MFG).

In the first phase, the attacker identifies prompts or latent directions that cause the model to generate memorised images. Let $p_{\theta }(𝒙)$ denote the density implicitly defined by the trained diffusion model. Memorised images correspond to sharp local maxima of $p_{\theta }$ that also coincide with training samples. The MFG procedure maximises the memorisation score: (MFG)$$\begin{array}{ccc}& s_{\mathrm{mem}}(𝒛)=\log p_{\theta }(D_{\theta }(𝒛))-\beta \cdot \mathscr{H}(D_{\theta }(𝒛)),& \text{<span class="tml-eqn"></span>}\end{array}$$ where $𝒛$ is the latent noise vector, $D_{\theta }$ is the reverse diffusion operator (mapping noise to image), $\log p_{\theta }$ is estimated via a score-matching proxy, and $\mathscr{H}$ is the entropy of the generated image distribution (low entropy favours deterministic, verbatim outputs). Maximising $s_{\mathrm{mem}}(𝒛)$ over $𝒛$ drives the sampler towards modes corresponding to memorised images.

Phase 2: Threat-Focused Guidance (TFG).

Phase 1 identifies memorised images but does not attribute them to specific victim clients. Phase 2, Threat-Focused Guidance, refines the search by conditioning on target-client-specific signals. If the attacker has auxiliary knowledge about the victim (e.g., knowledge that client $k$ contributes chest radiographs from a specific patient cohort), a target-attribute classifier $c_{\varphi }$ can be trained on publicly available data with similar attributes. TFG augments the sampling objective with a classifier guidance term: (TFG)$$\begin{array}{ccc}& {\widehat{𝒛}}^{\ast }={\mathrm{arg\hspace{0.17em}max}}_{𝒛}{s}_{\mathrm{mem}}(𝒛)+\gamma \cdot \log c_{\varphi }(D_{\theta }(𝒛)),& \text{<span class="tml-eqn"></span>}\end{array}$$ where $\gamma$ is the guidance strength. The combined guidance directs sampling toward memorised images that also exhibit the victim's data attributes.

Attack Pipeline

Figure fig:fedgen:mgds-pipeline illustrates the full MGDS attack pipeline. Benign federated training produces a shared diffusion model $G_{\theta }$. The attacker then enters the post-training exploitation phase, applying MFG to discover memorised modes, followed by TFG to target specific victim clients. The extracted images are near-pixel-perfect copies of private training data.

Experimental Evidence

MGDS was evaluated on three federated settings:

1. Chest X-ray federation (CheXpert + NIH ChestX-ray14): 10 simulated clients, each holding $\sim$3,000 images. MGDS recovered 32.4% of victim images at SSIM $>0.85$.

2. Retinal fundus federation (REFUGE + ORIGA): 8 clients, $\sim$400 images each. Recovery rate 38.7%; small datasets memorised more aggressively.

3. Dermatology federation (ISIC archive): 15 clients, mixed lesion types. Recovery rate 27.1%.

The attack is significantly more effective against small, homogeneous client datasets - exactly the regime typical of federated medical imaging, where each hospital contributes data from a narrow patient population.

Membership Inference Attacks on Federated GANs

Membership inference attacks (MIAs) address a weaker but still practically important question: given a data point $𝒙$ and a trained model $G_{\theta }$, was $𝒙$ used to train $G_{\theta }$? For generative models, this corresponds to asking whether the model has “seen” a particular individual's data.

The Shadow Model Attack

The canonical MIA against generative models, introduced by Hayes et al. (2019), uses a collection of shadow models:

1. Train $M$ shadow GAN models on datasets that either include or exclude a target point $𝒙$.

2. Train a binary membership classifier $h_{\varphi }$ on features extracted from these shadow models, using the inclusion status as the label.

3. Apply $h_{\varphi }$ to the target model $G_{\theta }$ to infer membership of $𝒙$.

For federated GANs, the attack is particularly powerful because:

• The adversary can be a co-participant and thus has access to the model at every round, enabling longitudinal MIA across the training trajectory.

• Small federated datasets lead to high per-example memorisation probability, increasing the discriminative power of the membership classifier.

• The discriminator $D_{\theta }$ in a GAN often exhibits a measurable prediction gap between members and non-members.

GAN Membership via Discriminator Statistics

A simpler but effective MIA specific to GANs exploits the discriminator score directly. For a well-trained GAN, the discriminator assigns high scores to real training images and low scores to generated (fake) images. The discriminator gap for a candidate $𝒙$ is: $$\delta (𝒙)=D_{\theta }(𝒙)-{\mu }_{\mathrm{fake}},$$ where ${\mu }_{\mathrm{fake}}={𝔼}_{𝒛}[D_{\theta }(G_{\theta }(𝒛))]$ is the expected discriminator score on generated images. Empirically, training members exhibit $\delta (𝒙)>0$ with high probability.

This attack requires no shadow models, making it practical for adversaries with a single query to the discriminator. Against federated GANs trained on medical data, it achieves member/non-member AUC values of 0.82–0.91 in reported experiments.

Example: Extracting Medical Images from a Federated Diffusion Model

Exercises

Privacy Defenses and Federated Unlearning

The attacks surveyed in Section Privacy Attacks on Federated Generative Models expose a stark gap between the informal privacy guarantee of federated learning - “your data stays local” - and the formal guarantee required by modern privacy regulation: meaningful protection against inference from model outputs, gradients, and the trained model itself.

Closing this gap requires defenses that operate at multiple levels of the federated pipeline. In this section we examine three families of approaches:

1. Gradient-level defenses: protect against gradient inversion by obfuscating the information content of shared updates. We examine PRISM (ICLR 2025), which replaces gradient transmission with binary mask transmission, and compare it against differential privacy, secure multi-party computation, and homomorphic encryption.

2. Aggregation-level defenses: protect against Byzantine attacks and amplify privacy guarantees at the server side. PRISM's MADA aggregation rule is analysed in detail.

3. Post-hoc model editing: address the right to be forgotten by removing the influence of specific data points from an already-trained generative model. We examine FedDUL and the formal guarantees of federated unlearning.

PRISM: Privacy-Preserving Improved Stochastic Masking

PRISM (Privacy-Preserving Improved Stochastic Masking) was introduced at ICLR 2025 as a defense specifically designed for federated generative models. Its central insight is architectural: instead of training a random network and sharing its weights, PRISM searches for a binary mask over a fixed random network that achieves the desired generation quality. Only the mask - a sequence of 0/1 values - is transmitted to the server, not the underlying weights.

The Strong Lottery Ticket Hypothesis

PRISM builds on the strong lottery ticket hypothesis (SLTH):

Experimentally, the SLTH has been validated across convolutional networks, transformers, and diffusion model UNets: a sufficiently wide random network contains a subnetwork (defined by a mask) that matches the accuracy of an optimised network without any weight updates.

PRISM Architecture

The PRISM federated protocol proceeds as follows:

1. Server initialisation. The server samples a random network $f(\cdot ;{𝒘}_0)$ once, where ${𝒘}_0\sim 𝒩(0,{\sigma }_{\mathrm{init}}^2𝐈)$, and broadcasts ${𝒘}_0$ to all clients. The weights ${𝒘}_0$ are fixed forever and never updated.

2. Local mask search. Each client $k$ solves a binary mask search problem over the fixed network to minimise its local generation loss: (Prism MASK Search)$$\begin{array}{ccc}& {𝒎}_k^{\ast }={\mathrm{arg\hspace{0.17em}min}}_{𝒎\in \{\mathrm{0,1}{\}}^{|{𝒘}_0|}}{ℒ}_k(f(\cdot ;𝒎\odot {𝒘}_0))+\mu \Vert 𝒎{\Vert }_1,& \text{<span class="tml-eqn"></span>}\end{array}$$ where ${ℒ}_k$ is the local training loss (e.g., diffusion denoising loss on ${𝒟}_k$) and the ${\ell }_1$ penalty controls mask sparsity. The binary constraint is relaxed to $[\mathrm{0,1}]$ and thresholded during optimisation (straight-through estimator).

3. Mask transmission. Client $k$ transmits only ${𝒎}_k^{\ast }\in {\{\mathrm{0,1}\}}^{|{𝒘}_0|}$ to the server. No weight values are ever sent.

4. MADA aggregation. The server aggregates client masks using the Majority-vote Aggregation with Distribution Alignment (MADA) rule.

5. Broadcast global mask. The server broadcasts the aggregated global mask ${𝒎}_{\mathrm{global}}$ to all clients for the next round.

Why Gradient Inversion Becomes Intractable

Gradient inversion attacks (Section Gradient Inversion Attacks) require computing ${\nabla }_{{𝒙}^{\prime }}\Vert {\nabla }_{𝜽}ℒ(f_{𝜽}({𝒙}^{\prime }))-𝒈{\Vert }_2^2$. Under PRISM, the transmitted quantity is not a gradient at all: it is a binary mask ${𝒎}_k\in {\{\mathrm{0,1}\}}^{|{𝒘}_0|}$. Reconstructing ${𝒟}_k$ from ${𝒎}_k$ and ${𝒘}_0$ would require solving: (Prism Inversion)$$\begin{array}{ccc}& {𝒙}^{\ast }={\mathrm{arg\hspace{0.17em}min}}_{{𝒙}^{\prime }\in 𝒳}{\Vert {\mathrm{arg\hspace{0.17em}min}}_{𝒎\in [\mathrm{0,1}{]}^{|{𝒘}_0|}}{ℒ}_{\mathrm{gen}}(f(\cdot ;𝒎\odot {𝒘}_0);\{{𝒙}^{\prime }\})-{𝒎}_k\Vert }_2^2,& \text{<span class="tml-eqn"></span>}\end{array}$$ which involves an inner loop of combinatorial mask optimisation inside the outer input reconstruction loop. This double-level optimisation is computationally intractable for any known algorithm.

MADA Aggregation and MMD Loss

The MADA aggregation rule is designed to handle heterogeneous client distributions while providing robustness against Byzantine clients. Let ${\{{𝒎}_k\}}_{k=1}^K$ be the client masks. MADA proceeds in two stages:

Stage 1: Byzantine-robust majority vote.

For each weight index $i\in \{1,\dots ,|{𝒘}_0|\}$, compute the weighted majority vote: $${[{𝒎}_{\mathrm{maj}}]}_i=\mathrm{𝟏}[\sum _{k=1}^K{r}_k{[{𝒎}_k]}_i\ge \frac{1}{2}],$$ where $r_k$ is a robustness weight that downweights masks that deviate strongly from the median.

Stage 2: Distribution alignment via MMD.

The majority-voted mask ${𝒎}_{\mathrm{maj}}$ may not align well with the global data distribution when client distributions are heterogeneous. MADA refines the mask by minimising the Maximum Mean Discrepancy (MMD) between the distribution of samples generated by $f(\cdot ;𝒎\odot {𝒘}_0)$ and a target distribution estimated from all clients' mask-implied statistics: (MADA MMD)$$\begin{array}{ccc}& {𝒎}_{\mathrm{global}}={\mathrm{arg\hspace{0.17em}min}}_{𝒎\in \{\mathrm{0,1}{\}}^{|{𝒘}_0|}}{\mathrm{MMD}}^2({\hat{p}}_{𝒎},{\hat{p}}_{\mathrm{target}})+{\lambda }_{\mathrm{maj}}\Vert 𝒎-{𝒎}_{\mathrm{maj}}{\Vert }_1,& \text{<span class="tml-eqn"></span>}\end{array}$$ where ${\hat{p}}_{𝒎}$ is the empirical generated distribution and ${\hat{p}}_{\mathrm{target}}=K^{-1}{\sum }_k{\hat{p}}_{{𝒎}_k}$.

The MMD kernel is chosen as the mixture of RBF kernels: $k(𝒙,{𝒙}^{\prime })={\sum }_j\exp (-\Vert 𝒙-{𝒙}^{\prime }{\Vert }^2/(2{\sigma }_j^2))$ with ${\sigma }_j\in \{0.1,0.5,1,2,10\}$, providing sensitivity at multiple spatial scales.

Comparing Privacy Defense Mechanisms

Four major families of privacy defenses for federated learning are compared in Table Table 8:

1. Differential Privacy with SGD (DP-SGD): clips gradients, adds calibrated Gaussian noise.

2. Secure Multi-Party Computation (SMPC): uses secret sharing so that no single party sees any other party's gradient.

3. Homomorphic Encryption (HE): encrypts gradients before transmission; the server aggregates in encrypted space.

4. PRISM: transmits only binary masks over a fixed random network.

Defense	Compute	Communication	Generation	Grad. Inv.	Mem. Extr.	Formal
	overhead	overhead	utility	resistance	resistance	guarantee
None (FedAvg)	$1\times$	$1\times$	High	None	None	None
DP-SGD	$2$–$3\times$	$1\times$	Medium	Partial	None	$\epsilon$-DP
SMPC	$10$–$100\times$	$10$–$50\times$	High	High	None	Crypto
HE	$>1000\times$	$5$–$20\times$	High	High	None	Crypto
PRISM	$3$–$5\times$	$0.3$–$1\times$	Medium-High	Very High	Partial	SLTH

Federated Unlearning: The Right to be Forgotten

Privacy regulation increasingly grants individuals the right to erasure: upon request, an organisation must delete all records of that individual and eliminate the effects of their data from any model trained on it. In centralised learning, this is achieved by retraining the model from scratch on the remaining data - expensive, but well-defined. In federated learning, the problem is harder: the model is a global aggregate of contributions from all clients, and retraining from scratch requires re-coordinating all clients, which may be infeasible.

FedDUL: Attention-Based Local Forgetting with Global Filtering

FedDUL (Federated Diffusion Unlearning with Local attention-based forgetting) addresses the federated unlearning problem through a two-stage procedure that operates locally at the client level and globally at the server level.

Stage 1: Attention-Based Local Forgetting

The key observation is that in a diffusion UNet, attention maps at intermediate layers are highly sensitive to specific training examples. Features that encode memorised examples can be localised in the attention space.

Let ${𝐀}_l(𝒙)\in {\mathrm{ℝ}}^{N_l\times N_l}$ denote the attention matrix at layer $l$ when the network processes image $𝒙$. For a forget sample ${𝒙}_f\in {𝒟}_{\mathrm{forget}}$, the forget attention signature is: $${\varphi }_f=(\mathrm{vec}({𝐀}_1({𝒙}_f)),\dots ,\mathrm{vec}({𝐀}_L({𝒙}_f)))\in {\mathrm{ℝ}}^{{\sum }_l{N}_l^2}.$$ FedDUL constructs a forget direction in parameter space: (Feddull Local)$$\begin{array}{ccc}& {𝒅}_{\mathrm{forget}}={\nabla }_{𝜽}\sum _{{𝒙}_f\in {𝒟}_{\mathrm{forget}}}\sum _{l=1}^L\Vert {𝐀}_l^{(𝜽)}({𝒙}_f)-{\overline{𝐀}}_l^{(\mathrm{rand})}{\Vert }_F^2,& \text{<span class="tml-eqn"></span>}\end{array}$$ where ${\overline{𝐀}}_l^{(\mathrm{rand})}$ is the average attention matrix computed on random Gaussian noise (the “null” attention pattern of the network). Taking a gradient step in direction $-{𝒅}_{\mathrm{forget}}$ causes the network to respond to forget samples with noise-like attention, reducing memorisation.

The local update is: (Feddull Update)$$\begin{array}{ccc}& {𝜽}^{\prime }=𝜽-{\eta }_f{𝒅}_{\mathrm{forget}}+{\eta }_r{\nabla }_{𝜽}{ℒ}_{\mathrm{gen}}(𝜽;{𝒟}_{\mathrm{retain}}^{(k)}),& \text{<span class="tml-eqn"></span>}\end{array}$$ where ${\eta }_f$ is the forgetting step size, ${\eta }_r$ is the retention step size, and ${𝒟}_{\mathrm{retain}}^{(k)}$ is the client's retained data. The two terms create a constructive interference: forgetting drives attention away from ${𝒟}_{\mathrm{forget}}$ while retention prevents collapse of generation quality.

Stage 2: Global Filtering

After local forgetting updates are performed at client $k$, the resulting parameter delta $\mathrm{\Delta }𝜽={𝜽}^{\prime }-𝜽$ is transmitted to the server. The server applies a global filter to prevent the forgetting update from inadvertently degrading other clients' representation:

(Feddull Filter)$$\begin{array}{ccc}& \mathrm{\Delta }{𝜽}_{\mathrm{filtered}}={\mathrm{\Pi }}_{{𝒞}_{\mathrm{retain}}}\left(\mathrm{\Delta }𝜽\right),& \text{<span class="tml-eqn"></span>}\end{array}$$ where ${\mathrm{\Pi }}_{{𝒞}_{\mathrm{retain}}}$ is a projection onto the cone ${𝒞}_{\mathrm{retain}}$ of parameter directions that do not reduce loss on the global retained dataset (approximated by server-side validation data or aggregated retain gradients).

In practice, the projection is implemented via cosine similarity filtering: components of $\mathrm{\Delta }𝜽$ that have negative cosine similarity with the average retain gradient are zeroed out. This ensures that the forgetting update only modifies subspaces that are not important for retained data.

Verifying Unlearning via Membership Inference

After applying a federated unlearning procedure, one must verify that the model no longer retains information about ${𝒟}_{\mathrm{forget}}$. The standard verification protocol uses membership inference as a proxy:

1. Baseline MIA. Train a membership inference adversary $h_{\varphi }$ on the original model $G_{\theta }$, using ${𝒟}_{\mathrm{forget}}$ as members and held-out samples as non-members. Measure baseline AUC${}_{\mathrm{base}}$.

2. Post-unlearning MIA. Apply the same adversary $h_{\varphi }$ (or retrain it) to the unlearned model $G_{{\theta }^{\prime }}$. Measure AUC${}_{\mathrm{unlearn}}$.

3. Retrain baseline. Train a reference model $G_{{\theta }_{\mathrm{retrain}}}$ from scratch on ${𝒟}_{\mathrm{retain}}$ only. Measure AUC${}_{\mathrm{retrain}}$.

4. Verification criterion. Unlearning is accepted if $|{\text{AUC}}_{\mathrm{unlearn}}-{\text{AUC}}_{\mathrm{retrain}}|\le \delta$ for a tolerance $\delta$ (typically 0.05).

This protocol provides an empirical, adversarial certificate of forgetting. It does not provide a formal mathematical guarantee - a more capable membership inference adversary might still succeed. However, it is the most operationally practical verification approach in current literature.

Efficiency of Federated Unlearning vs. Full Retraining

Summary: A Taxonomy of Federated Privacy Threats and Defenses

The interactions between attacks and defenses surveyed in Sections Privacy Attacks on Federated Generative Models–Privacy Defenses and Federated Unlearning form a complex adversarial landscape. Table Table 9 summarises which defenses are effective against which attacks.

Defense $╲$ Attack	Grad. Inv.	MGDS	MIA (GAN)	Unlearning
DP-SGD	$\sim$	$\times$	$\sim$	$\times$
SMPC	✓	$\times$	$\times$	$\times$
HE	✓	$\times$	$\times$	$\times$
PRISM	✓	$\sim$	$\sim$	$\times$
FedDUL	$\times$	$\sim$	$\sim$	✓

The table reveals a critical gap: no single defense simultaneously addresses gradient inversion, memorisation extraction, membership inference, and provides unlearning capability. A complete privacy solution for federated generative models requires layering multiple defenses:

• PRISM (or DP-SGD) for gradient-level protection during training;

• Output perturbation for inference-time memorisation extraction resistance;

• FedDUL for post-hoc data erasure upon client request.

Exercises

Healthcare and Medical Imaging

The union of three properties-data that is siloed, data that is sensitive, and data that is scarce-creates what epidemiologists have begun calling the perfect storm for machine learning in medicine. Each property alone is a serious obstacle. Together they form a trifecta that has, until recently, made large-scale generative modelling of clinical imagery essentially impossible outside a handful of elite academic medical centres with dedicated data-science teams, institutional review boards that move at geological speeds, and legal budgets measured in millions.

Siloed. The electronic health record systems of two hospitals in the same city routinely speak different data dialects: one runs Epic, the other Cerner; one encodes imaging in DICOM 3.0, the other in a proprietary variant; one uses ICD-10 coding, the other a locally extended schema. Even when regulatory barriers are absent, raw data sharing across institutions requires months of data-use agreements, de-identification validation, format harmonisation, and network engineering. The practical result is that a radiologist at Hospital A develops clinical intuitions across, say, 3,000 chest CTs per year; a model trained only on Hospital A's data inherits exactly those intuitions-and exactly those blind spots.

Sensitive. Medical images are not merely photographs. A high-resolution brain MRI contains, encoded in the cortical morphology, probabilistic information about a patient's ethnicity, sex, age, neurological diagnoses, and, increasingly, predicted future disease trajectory. CT scans of the thorax reveal cardiac anatomy, pulmonary lesions, incidental findings that may have profound insurance and employment consequences. The Health Insurance Portability and Accountability Act (HIPAA) in the United States, the General Data Protection Regulation (GDPR) in Europe, and dozens of national-level health data statutes globally impose strict requirements on cross-institutional data movement, requirements that carry criminal penalties for wilful violation.

Scarce. Rare diseases are, by definition, rare. Niemann-Pick disease type C affects roughly 1 in 150,000 live births. Anti-NMDA receptor encephalitis, the condition at the centre of Susannah Cahalan's memoir Brain on Fire, was not formally recognised until 2007; a single centre may see two or three confirmed cases per year. Posterior cortical atrophy, a variant of Alzheimer's disease affecting visual processing, accounts for fewer than 5% of all Alzheimer's presentations. For any of these conditions, a traditional supervised learning dataset-requiring perhaps hundreds of annotated examples to achieve clinically useful performance-is simply not constructible at a single institution on any reasonable timescale.

Federated learning cuts through all three barriers simultaneously. By keeping patient data at each institution's secure perimeter, it dissolves the privacy barrier without dissolving collaboration. By allowing a shared generative model to accumulate knowledge from hundreds of hospitals without any single institution contributing raw images to a central repository, it transforms scarce local data into a collectively rich resource. This section traces the mathematics, the architectures, and the empirical evidence for federated generative modelling in medicine, from routine imaging modalities to the frontier of rare-disease augmentation.

Cross-Hospital Federated Image Synthesis

Modern diagnostic medicine depends on four principal imaging modalities, each with distinct physics, clinical utility, and federation challenges.

Magnetic Resonance Imaging (MRI).

MRI acquires images by measuring the relaxation of hydrogen nuclei in a magnetic field. Its primary virtues are superb soft-tissue contrast and freedom from ionising radiation; its primary vice is acquisition time (a typical brain protocol runs 45–60 minutes) and scanner-to-scanner variability. Field strength (1.5 T vs. 3.0 T vs. 7.0 T), scanner vendor (Siemens, GE, Philips), and pulse sequence parameters all introduce systematic appearance shifts-domain gaps-that confound naive centralised training. Federated diffusion models that share denoising score functions across hospitals while maintaining site-specific normalisation layers have been shown to close roughly 70% of the cross-site domain gap without sacrificing local data privacy.

Computed Tomography (CT).

CT uses X-ray projections to reconstruct three-dimensional density maps. Unlike MRI, CT produces images with well-standardised Hounsfield units (HU), making cross-site calibration relatively tractable. The main barrier to federation is not technical but legal: CT scans of the chest, abdomen, and pelvis contain highly identifying anatomical structures (cardiac silhouette, vertebral morphology) that re-identification researchers have exploited with alarming success. Federated generation of paired low-dose/high-dose CT pairs-a common denoising task-reduces radiation exposure by 30–60% while distributing the training burden across institutions.

X-Ray Radiography.

Chest X-ray is the most widely performed imaging study in the world: roughly 2 billion chest radiographs are acquired annually. Federation is particularly attractive here because small community hospitals, lacking subspecialty radiologists, produce large volumes of plain films that go unreported for extended periods. Federated conditional GANs have been trained to synthesise pathology-specific chest X-rays (pneumonia, pneumothorax, pleural effusion) from text conditioning on radiology report keywords, enabling downstream classifiers to achieve AUC gains of 0.03–0.07 in rare-pathology detection without centralising any images.

Positron Emission Tomography (PET).

PET images metabolic activity by detecting gamma rays from positron- emitting radiotracers. Because PET requires administration of radioactive tracers, it carries regulatory, ethical, and cost barriers that limit dataset sizes to the low hundreds in most research centres. Federated GANs trained to synthesise PET from structural MRI (a task sometimes called MRI-to-PET translation) allow neurological research consortia to effectively pool synthetic PET information without requiring each site to acquire independent PET data.

Definition: Federated Medical Image Synthesis

Multi-Hospital Federated Brain Tumour MRI Generation

MD Anderson Case Study: Federated Spatiotemporal Diffusion for 4D Cardiac CT

Among the most technically demanding problems in medical imaging is the synthesis of four-dimensional cardiac computed tomography (4D-CCT): a time-resolved volumetric sequence capturing the full cardiac cycle across systole and diastole. Standard 4D-CCT acquisition requires ECG gating, retrospective reconstruction from 8–10 cardiac phases, and a radiation dose substantially higher than a single-phase study. The clinical utility is significant-4D-CCT enables assessment of valvular function, myocardial wall motion, and congenital abnormalities that are invisible on static images-but the requirement for high-radiation multi-phase acquisition limits its deployment in paediatric and radiation-sensitive populations.

The MD Anderson Cancer Center, in collaboration with four partner institutions (the Cleveland Clinic, Massachusetts General Hospital, the Mayo Clinic, and University College London Hospitals), undertook a federated synthesis programme targeting precisely this problem. Each institution contributed a local repository of 4D-CCT studies, but owing to HIPAA restrictions and each institution's distinct data governance framework, no raw imaging data could be transferred.

Architecture: Federated Spatiotemporal Diffusion

The generative backbone is a spatiotemporal diffusion model with a hybrid 3D-UNet + temporal transformer architecture. Let ${𝐱}_{0:T_c}$ denote a 4D cardiac volume sequence with $T_c=10$ cardiac phases, each phase being a $256\times 256\times 160$ voxel volume at 0.5 mm isotropic resolution. The forward diffusion process adds noise independently across phases: (4DCT Forward)$$\begin{array}{ccc}& q({𝐱}_{1:T_c}^{(\tau )}|{𝐱}_{1:T_c}^{(0)})=\prod _{t=1}^{T_c}𝒩({𝐱}_t^{(\tau )};\sqrt{{\bar{\alpha }}_{\tau }}{𝐱}_t^{(0)},(1-{\bar{\alpha }}_{\tau })𝐈),& \text{<span class="tml-eqn"></span>}\end{array}$$ where $\tau$ indexes diffusion time steps (not cardiac phases) and ${\bar{\alpha }}_{\tau }={\prod }_{s=1}^{\tau }(1-{\beta }_s)$ is the cumulative noise schedule. The reverse denoising network ${ϵ}_{\theta }({𝐱}_{1:T_c}^{(\tau )},\tau ,𝐜)$ jointly denoises all cardiac phases simultaneously, with inter-phase attention blocks enforcing temporal coherence: (4DCT LOSS)$$\begin{array}{ccc}& {ℒ}_{\mathrm{simple}}(\theta )={𝔼}_{\tau ,{𝐱}^{(0)},𝝐}[\Vert 𝝐-{ϵ}_{\theta }(\sqrt{{\bar{\alpha }}_{\tau }}{𝐱}^{(0)}+\sqrt{1-{\bar{\alpha }}_{\tau }}𝝐,\tau ,𝐜\left){\Vert }_2^2\right].& \text{<span class="tml-eqn"></span>}\end{array}$$ The conditioning signal $𝐜$ encodes programmed cardiac pathology: ejection fraction target, wall motion abnormality type and location (anterior/lateral/inferior/septal hypokinesis or akinesis), valvular regurgitation severity (grade 1–4), and arrhythmia type (normal sinus, atrial fibrillation, ventricular tachycardia).

Federation uses a hierarchical FedProx scheme: (Fedprox)$$\begin{array}{ccc}& \underset{\theta }{\min }\sum _{k=1}^5\frac{n_k}{N}[{ℒ}_k({\theta }_k)+\frac{\mu }{2}\Vert {\theta }_k-\theta {\Vert }^2],N=\sum _{k=1}^5{n}_k,& \text{<span class="tml-eqn"></span>}\end{array}$$ with proximal coefficient $\mu =0.01$ empirically tuned to balance local adaptation against global coherence.

Results: 28,000 Synthetic 4D Heart Cycles

Over six months of training (300 communication rounds, 5 local epochs per round, A100 GPUs at each site), the federated model generated a corpus of 28,000 synthetic 4D heart cycles with programmable pathology labels, the largest annotated synthetic cardiac CT dataset in existence at time of generation.

Configuration	FID$\downarrow$	SSIM$\uparrow$	MOS$\uparrow$	F1 (pathology)$\uparrow$
Centralised (oracle)	18.4	0.912	4.63	0.91
Federated (proposed)	22.7	0.893	4.59	0.89
Local only (MD Anderson)	41.2	0.847	4.21	0.74
No federation baseline	55.6	0.801	3.84	0.67

Table Table 10 summarises the headline results. The federated model achieves 92% clinical plausibility (MOS $=4.59/5.00$), an F1 score of 0.89 on pathology classification from synthetic data, versus 0.91 for the centralised oracle-a gap of less than 2% at the cost of zero patient data transfer. The gap between federated and local-only training (0.89 vs. 0.74) quantifies the concrete benefit of federation for the smallest participating site.

Privacy auditing used a k-anonymity analysis of synthetic images against a database of 50,000 real cardiac CTs, measuring the minimum number of real images within a normalised feature-space ${\ell }_2$-ball of radius $r=0.05$. The synthetic corpus achieved a mean $k\ge 127$-effectively indistinguishable from the threshold $k\to \infty$ (no near-neighbour in the real dataset), confirming near-zero re-identification risk.

Legal and compliance teams at all five institutions reviewed 100 randomly selected synthetic studies to assess their regulatory status under HIPAA. The consensus finding was that synthetic images generated without any raw patient data at the server constituted non-patient information under the HIPAA Safe Harbour method, reducing legal review time by 83% compared with the data-use-agreement process required for sharing real imaging.

Federated Rare Disease Augmentation

Rare diseases occupy a unique position in the landscape of medical machine learning. By epidemiological convention (EU definition: $<5$ per 10,000; US definition: $<\mathrm{200,000}\text{ total cases}$), there are more than 7,000 recognised rare diseases, and fewer than 5% have approved treatments. The diagnostic pathway for a rare disease patient averages 4–8 years, during which the patient typically receives several incorrect diagnoses. Much of this delay is attributable to the inability of individual clinicians-or individual AI systems-to accumulate sufficient experience with any single rare condition.

The Sub-Hundred Regime

Generative models operating in what we term the sub-hundred regime-conditions with fewer than 100 globally known imaging cases-face a qualitatively different challenge from standard medical image synthesis. Standard diffusion model training requires tens of thousands of examples to learn the score function ${\nabla }_{𝐱}\log p(𝐱)$ reliably; few-shot generative modelling from 50–100 examples requires fundamentally different strategies.

Three approaches have shown promise in the federated rare-disease setting:

Federated Prototype Augmentation (FPA).

Each hospital contributes the gradient of a local variational objective with respect to a shared prototype latent code ${𝐳}_{\mathrm{proto}}$. The server aggregates these gradients to refine the prototype, which is then used to condition a pre-trained generative model (typically a large-scale diffusion model trained on a common-disease corpus) toward the rare pathology. This effectively performs a distributed, privacy-preserving fine-tuning of a pre-trained prior toward a target rare disease.

Federated Transfer with Domain Adaptation (FTDA).

A backbone generative model is pre-trained on abundant common-disease data at the server (or on public data such as the NIH ChestXray14 or BraTS corpora), then each rare-disease site contributes a local domain-adaptation gradient that shifts the model's output distribution toward the rare disease's characteristic appearance. Since rare-disease sites may contribute only 3–10 patients' worth of gradients per round, the aggregation uses inverse-variance weighting to prevent well-represented common diseases from dominating.

Federated Conditional Synthesis with Label Propagation (FCSLP).

When the rare disease shares morphological features with better- represented conditions (as many rare genetic disorders do with common metabolic diseases), a conditional generative model can be trained on the common-disease federation and then queried with rare-disease conditioning labels. The resulting synthetic images are imperfect approximations but are sufficient to bootstrap a classifier that achieves meaningful sensitivity on a held-out real test set.

Privacy-Preserving Clinical Trial Data Sharing

Clinical trials represent the gold standard for assessing medical interventions, yet they suffer from three structural deficiencies that federated generative AI is positioned to address.

Participant scarcity. Phase III oncology trials routinely take 5–10 years to enrol sufficient participants, because the target patient population is small, geographically dispersed, and subject to strict inclusion/exclusion criteria. Federated synthesis can generate synthetic control arm data that mirrors the characteristics of patients enrolled at partner institutions, reducing the number of patients needed in the placebo arm by up to 30% (a regulatory framework sometimes called synthetic control arms or SCAs).

Data pooling barriers. Sharing patient-level trial data across national borders triggers a complex web of data residency laws (GDPR Article 46, China PIPL, India DPDP Act 2023) that can stall international multi-site trials for months. Federated generative models trained within national boundaries can synthesise statistically representative patient trajectories that are legally non-personal data and freely shareable.

Underrepresented subgroups. The NIH Revitalization Act of 1993 mandated inclusion of women and minorities in clinical research, yet underrepresentation persists in many disease areas. Federated generation conditioned on demographic subgroup labels can produce synthetic trial participants that augment underrepresented groups, enabling subgroup analyses that would otherwise lack statistical power.

Connection to Medical Segmentation and Epilepsy Chapters

The methods developed in this section connect directly to two companion chapters in this volume.

36 (Chapter 33, Medical Image Segmentation) develops the supervised learning architectures-U-Net variants, transformer- based segmentation models, and uncertainty-aware prediction-that serve as the downstream consumers of federated synthetic training data. The synthetic MRI and CT volumes produced by federated diffusion models, when paired with propagated segmentation labels (generated by the same conditional model or by a separately trained label synthesiser), can be used to pre-train segmentation models at sites lacking annotated local data. The federated augmentation loop thus creates a virtuous cycle: better segmentation models produce more accurate annotations on real data; better annotations improve the quality of the conditional generative model's training signal.

37 (Chapter 34, Generative AI in Epilepsy Research) provides a deep case study in one of the most data-scarce and privacy-sensitive neurological conditions. The federated MRI synthesis framework developed in that chapter (Sections 5–7 of 37) is a direct instantiation of the FMIS definition (Definition 44) in the neurological domain, and the privacy analysis carried out there (particularly the MRI re-identification risk analysis) informs the $k$-anonymity bounds cited in the MD Anderson case study above.

TikZ Figure: Multi-Hospital Federated Synthesis Pipeline

Exercises

Edge AI, IoT, and Personalized Content

The smartphone in a user's pocket is a supercomputer by the standards of any decade before 2010: 6–8 CPU cores, a neural processing unit (NPU) capable of 10–38 TOPS, 8–16 GB of RAM, and a persistent local filesystem. The industrial sensor network on a factory floor runs microcontrollers executing real-time inference on 128 KB of SRAM. The 5G base station coordinating hundreds of devices simultaneously runs a software-defined radio stack with embedded machine learning accelerators. Across these three scales-personal device, embedded sensor, network infrastructure-a common challenge emerges: the data that characterises this device, this user, this environment is precisely the data that is too sensitive, too voluminous, or too latency-constrained to upload to a central cloud.

Federated learning was, from its inception at Google in 2016, an answer to exactly this challenge. But the early focus was on discriminative models-keyboard prediction, content ranking, spam detection. The extension to generative models at the edge opens a qualitatively richer design space: devices can not only predict and classify but create-synthesising training data, generating personalised content, producing realistic sensor readings, and operating as autonomous generative agents with device-local memory.

VAE-HGB for IoT Anomaly Detection

The industrial Internet of Things (IIoT) generates sensor streams of extraordinary diversity: vibration signatures from rotating machinery, thermal profiles from power electronics, acoustic emissions from structural components, current and voltage waveforms from motor drives. Anomaly detection across this heterogeneous device population-identifying the onset of bearing failure, insulation breakdown, or cyber-physical attack-is a canonical federated learning problem: each device type has domain-specific normal behaviour that cannot be learned by observing other device types, yet a shared understanding of “what anomaly looks like in general” is transferable across domains.

VAE-HGB (Variational Autoencoder with Heterogeneous Gradient Boosting) is a federated anomaly detection architecture that achieves this balance.

Architecture

At each device type $k\in \{1,\dots ,K\}$, a local VAE encoder $q_{{\varphi }_k}(𝐳|𝐱)$ maps device-type-specific time-series windows $𝐱\in {ℝ}^{T\times d_k}$ to a shared latent space ${ℝ}^{d_z}$. The generative decoder $p_{\theta }(𝐱|𝐳)$ is shared across device types (federated), while the encoder is local: (VAE HGB)$$\begin{array}{ccc}& {ℒ}_{\mathrm{V}\mathrm{A}\mathrm{E}\text{-}\mathrm{H}\mathrm{G}\mathrm{B}}(\theta ,{\varphi }_k)=-{𝔼}_{q_{{\varphi }_k}}[\log p_{\theta }(𝐱|𝐳)]+\beta \cdot D_{\mathrm{KL}}(q_{{\varphi }_k}(𝐳|𝐱)\Vert p(𝐳)).& \text{<span class="tml-eqn"></span>}\end{array}$$ Anomaly scoring uses the reconstruction probability: (Anomaly Score)$$\begin{array}{ccc}& a(𝐱)=-\log p_{\theta }(𝐱)\approx \Vert 𝐱-\widehat{𝐱}{\Vert }^2+D_{\mathrm{KL}}(q_{{\varphi }_k}(𝐳|𝐱)\Vert p(𝐳)),& \text{<span class="tml-eqn"></span>}\end{array}$$ where $\widehat{𝐱}=p_{\theta }({\mu }_{{\varphi }_k}(𝐱))$ is the decoded mean. The gradient boosting (HGB) component adds a residual anomaly predictor trained on server-aggregated latent statistics, correcting for distribution shift between device types.

Performance: 99.14% Accuracy

On a benchmark spanning 11 device categories (HVAC units, industrial motors, smart meters, network switches, medical monitors, autonomous vehicle LIDAR, smart grid sensors, wearable health trackers, building security cameras, agricultural soil sensors, and maritime navigation equipment), VAE-HGB achieves:

The 0.17% gap relative to the centralised oracle is attributable to the absence of cross-device pair-wise anomaly patterns that require observing two device types simultaneously-a phenomenon that federated architectures cannot capture without additional cross-device correlation modelling.

Federated Generative Models in 5G/6G Networks

Next-generation wireless networks (5G NR, 6G) face a security challenge that is, at its core, a generative modelling problem: physical-layer authentication (PLA). Every wireless transceiver has a unique radio frequency fingerprint-minute hardware imperfections in oscillators, power amplifiers, and digital-to-analogue converters that imprint device-specific signatures on transmitted waveforms. Authenticating a device by its RF fingerprint, rather than by cryptographic keys that can be stolen, provides a fundamentally different security primitive that cannot be trivially compromised by key extraction attacks.

The challenge for machine learning is that RF fingerprints drift with temperature, aging, and channel conditions, and that the space of possible legitimate and attack waveforms is vast. A federated generative approach-training a conditional diffusion model to synthesise realistic RF fingerprints conditioned on device identity and channel state-enables three applications:

1. Data augmentation for PLA classifiers: Each base station contributes local RF measurements to a federated model that synthesises additional fingerprint examples, improving classifier accuracy from 94.3% to 97.8% on a 64-device authentication task (Chen et al., 2024).

2. Attack simulation: The same generative model, conditioned on a target device's fingerprint template, synthesises plausible adversarial waveforms (replay attacks, signal injection), enabling security analysts to probe classifier robustness without requiring a real attacker.

3. Anomaly-triggered handover: A federated autoencoder monitoring incoming waveforms at each base station triggers a security alert when the reconstruction error exceeds a threshold calibrated across the federation, accounting for channel-specific normal variation.

Federated 6G Beamforming Synthesis

Beyond authentication, 6G massive MIMO systems require beamforming codebooks tailored to the local propagation environment. Standard codebooks are designed for statistical average channels; site-specific codebooks require local channel measurements that are expensive to acquire and change with building modifications and seasonal vegetation. A federated conditional GAN trained to synthesise realistic channel impulse responses (CIRs) conditioned on site geometry allows each base station to generate a rich synthetic CIR dataset for codebook optimisation without sharing proprietary site-survey data.

Formally, let $𝐇\in {ℂ}^{N_r\times N_t}$ be a MIMO channel matrix between $N_t$ transmit and $N_r$ receive antennas. The federated GAN synthesises $\widehat{𝐇}\sim G_{\theta }(𝐳,{𝐜}_{\mathrm{site}})$ conditioned on site-geometry features ${𝐜}_{\mathrm{site}}$, and the discriminator $D_{\psi }$ is trained via: (MIMO GAN)$$\begin{array}{cccc}& \underset{\psi }{\max }\underset{\theta }{\min }& {𝔼}_{𝐇\sim p_k}[\log D_{\psi }(𝐇)]+{𝔼}_{𝐳\sim p(𝐳)}[\log (1-D_{\psi }(G_{\theta }(𝐳)))]& \\ & & +{\lambda }_{\mathrm{fed}}\sum _{k=1}^K\frac{n_k}{N}\Vert {\nabla }_{\theta }{ℒ}_k-{\nabla }_{\theta }ℒ{\Vert }^2,& \text{<span class="tml-eqn"></span>}\end{array}$$ where the last term penalises gradient variance across sites.

Smart City Infrastructure

Urban infrastructure generates data at scales that overwhelm centralised processing: a modern smart city deploys tens of thousands of sensors monitoring traffic flow, energy consumption, air quality, noise levels, and pedestrian density. Three domains illustrate the distinct roles of federated generative models in smart city operation.

Traffic Flow Synthesis.

Traffic networks exhibit strong spatio-temporal correlations: congestion at one intersection propagates in predictable directions that depend on network topology, signal timing, and time of day. A federated spatiotemporal GAN trained on loop-detector and camera data from a metropolitan traffic management centre generates synthetic traffic scenarios (including rare events such as accidents, special events, and weather disruptions) that serve as training data for adaptive signal control algorithms. Critically, individual intersection camera feeds-which may capture identifiable pedestrians and vehicles-never leave the local traffic controller; only gradient summaries of the local GAN loss are transmitted.

Energy Consumption Generation.

Smart grid operators need to plan for load scenarios that include rare but consequential events: heat waves triggering simultaneous air-conditioner loads across a city block, electric vehicle charging surges, industrial demand spikes. A federated conditional diffusion model trained on smart meter data synthesises load profiles conditioned on weather, time-of-week, and geographic zone, enabling grid operators to stress-test dispatch algorithms against a broad distribution of synthetic demand scenarios. By keeping individual smart meter readings local (individual consumption patterns are legally personal data in the EU under GDPR recital 30), the federated approach achieves legal compliance while producing aggregate synthetic load profiles of high fidelity.

Federated Surveillance Anomaly Detection.

Urban surveillance cameras generate video streams that simultaneously serve public safety objectives and create significant civil liberties risks. Federated generative models allow each camera to maintain a local model of “normal scene appearance” (trained on local footage) and synthesise counterfactual “normal” frames for comparison with live observations. The anomaly score is computed locally; only aggregate statistics (not individual frames) are transmitted to the control centre. This architecture, sometimes called privacy-by-design surveillance, achieves 91.4% anomaly detection accuracy on a benchmark of 10,000 staged anomaly events while releasing zero identifiable imagery outside the local camera perimeter.

Definition: Federated Edge Generation

Gboard and BLT-DP-FTRL

Google's Gboard represents the largest-scale deployed instance of federated generative modelling in existence. The keyboard prediction system serves over one billion Android users across more than 100 languages, learning next-word and next-phrase predictions without any keystrokes leaving the device.

The Privacy Challenge at Keyboard Scale

Keyboard data is among the most sensitive categories of personal information: it captures passwords, health queries, financial discussions, and intimate communications. Standard DP-SGD (differentially private stochastic gradient descent) achieves privacy guarantees that degrade gracefully with the number of training rounds, but its per-step noise addition scales with $\sigma /\sqrt{B}$ where $B$ is the batch size-for small on-device batches (typically 64–256 sequences), the noise is substantial and degrades model quality.

BLT-DP-FTRL (Band-Limited Tree differentially-private Follow-The-Regularised-Leader) addresses this challenge through a tree-aggregation protocol that distributes the privacy noise across rounds rather than concentrating it within each step.

BLT-DP-FTRL Algorithm

Let ${\ell }_t(\theta )=\ell (\theta ;{\xi }_t)$ be the per-device loss at round $t$ on local mini-batch ${\xi }_t$. Standard FTRL selects: (FTRL)$$\begin{array}{ccc}& {\theta }_{t+1}={\mathrm{arg\hspace{0.17em}min}}_{\theta }\{\sum _{s=1}^t⟨g_s,\theta ⟩+\frac{\rho }{2}\Vert \theta {\Vert }^2\},& \text{<span class="tml-eqn"></span>}\end{array}$$ where $g_s={\nabla }_{\theta }{\ell }_s({\theta }_s)$. DP-FTRL replaces the gradient sum with a privatised sum using a binary tree mechanism: (DP FTRL SUM)$$\begin{array}{ccc}& {\tilde{G}}_t=\sum _{s=1}^t{g}_s+\sum _{v\in \mathrm{path}(t)}{\xi }_v,{\xi }_v\sim 𝒩(0,{\sigma }_{\mathrm{tree}}^2𝐈),& \text{<span class="tml-eqn"></span>}\end{array}$$ where $\mathrm{path}(t)$ is the set of nodes on the binary tree path from root to leaf $t$. The key property is that each leaf (round) is covered by $𝒪(\log T)$ tree nodes, so the total noise variance accumulated over $T$ rounds is $𝒪({\sigma }_{\mathrm{tree}}^2\log T)$ rather than the $𝒪({\sigma }_{\mathrm{SGD}}^{2}T)$ of naïve DP-SGD, achieving the same $(\epsilon ,\delta )$-DP guarantee with ${\sigma }_{\mathrm{tree}}=𝒪({\sigma }_{\mathrm{SGD}}/\sqrt{T/\log T})$ noise per node.

BLT (Band-Limited Tree) further reduces communication cost by applying a frequency-domain projection to the gradient tree, transmitting only the low-frequency components that carry most of the signal energy for language model parameters: (BLT)$$\begin{array}{ccc}& {\hat{g}}_t={𝐅}_{d_{\mathrm{BLT}}}{𝐅}_d^{\top }{g}_t,& \text{<span class="tml-eqn"></span>}\end{array}$$ where ${𝐅}_d$ is the DCT matrix and $d_{\mathrm{BLT}}\ll d$ is the bandwidth parameter. Gradient communication is reduced by a factor of $d/d_{\mathrm{BLT}}\approx 4$–$8\times$ with $<1\%$ degradation in model quality.

The resulting deployed system on Gboard achieves: $(\epsilon =2.85,\delta ={10}^{-9})$-DP over the lifetime of training, with keyboard prediction quality (measured by word-level perplexity) within 3.2% of a non-private centralised baseline.

LLM Synthetic Data Pipeline for On-Device Personalisation

The emergence of large language models (LLMs) as general-purpose generative engines creates a new architecture for federated personalisation that was not feasible in the DP-SGD era. The pipeline proceeds in three stages:

Stage 1: Server-Side LLM Synthetic Data Generation.

A large server-resident LLM (e.g. a 70B parameter model that is too large for on-device deployment) generates a corpus of synthetic task demonstrations conditioned on a coarse user profile: ${\widehat{𝒟}}_{\mathrm{syn}}={\{({\widehat{𝐱}}_i,{\hat{y}}_i)\}}_{i=1}^M$ where the conditioning signal is a privacy-safe aggregate user profile (e.g. language, region, device type, usage time-of-day distribution) that does not reveal individual query content.

Stage 2: Local Fine-Tuning on Device.

Each device receives ${\widehat{𝒟}}_{\mathrm{syn}}$ (a publicly-generated synthetic dataset, carrying no privacy risk) and uses it as a starting point for fine-tuning a local small language model $G_{{\theta }_k}$ (e.g. 1B–7B parameters, on-device) on the device's actual private interaction history. This local fine-tuning is performed with quantised LoRA adapters ${\delta }_k=\{A_k,B_k\}$ where $A_k\in {ℝ}^{r\times d}$, $B_k\in {ℝ}^{d\times r}$, $r\ll d$: (LORA)$$\begin{array}{ccc}& \delta W_k=B_k{A}_k,{\theta }_k=\theta +\delta W_k.& \text{<span class="tml-eqn"></span>}\end{array}$$

Stage 3: Federated Aggregation of Adapter Gradients.

The LoRA adapter gradients ${\nabla }_{A_k,B_k}{ℒ}_k({\theta }_k)$ are transmitted to the server with DP noise addition, and aggregated to update the global adapter baseline: (LORA Fedavg)$$\begin{array}{ccc}& \bar{A}\leftarrow \bar{A}-\eta \sum _{k\in {𝒮}_t}\frac{n_k}{N_t}\mathrm{clip}({\nabla }_{A_k}{ℒ}_k,C)+𝒩(0,{\sigma }^2{C}^2𝐈),& \text{<span class="tml-eqn"></span>}\end{array}$$ and similarly for $\bar{B}$. The updated global adapter $(\bar{A},\bar{B})$ is broadcast to all devices, providing a better initialisation for the next round of local fine-tuning.

This three-stage pipeline separates the privacy concern (Stage 2, local, no transmission) from the learning concern (Stage 3, federated, with DP), and uses the server LLM's generative capability (Stage 1) to bootstrap personalisation without requiring any private data at the server.

Personalized Content Creation

The LLM synthetic data pipeline of the preceding subsection generalises beyond keyboard prediction to three domains of growing commercial and social significance.

Personalised News and Articles.

A federated language model trained on a user's local reading history can generate personalised article summaries, daily digests, and topic deep-dives calibrated to the user's demonstrated interests, reading level, and preferred narrative style-without the media platform receiving a record of which articles the user actually read. The model operates entirely on-device, with federated aggregation updating the global style priors from aggregate (privatised) style statistics.

Federated Marketing Personalisation.

E-commerce platforms traditionally personalise recommendations by uploading purchase histories to a central recommendation engine. Federated generative personalisation inverts this: a local generative model on the user's device synthesises a “personalised catalogue” tailored to the user's local preference profile, which is then queried against the platform's inventory without transmitting the preference profile. This architecture is compliant with emerging data minimisation requirements under GDPR Article 5(1)(c) and does not require explicit user consent for cross-device purchase history aggregation.

Federated Education Curriculum Generation.

Adaptive learning systems that generate personalised exercises, explanations, and assessments for individual students face a fundamental tension: the most valuable data (which concepts a student struggles with, which explanations resonate, which problem types cause repeated errors) is also the most sensitive, particularly for minors under COPPA (US) and the UK GDPR. A federated generative approach keeps all individual student interaction data on the local device (or school server), federates only aggregate pedagogical effectiveness gradients, and uses a shared global curriculum generator to produce tailored exercises on demand. Pilot studies in three UK secondary school networks showed a 14–19% improvement in mathematics assessment scores compared with static curriculum delivery, with no student data leaving school servers.

WaveStitch: Federated Time-Series Generation

WaveStitch is a federated time-series generation framework presented at SIGMOD 2026, addressing a gap in the federated generative modelling literature: most work focuses on image or text domains, but the dominant data type in industrial IoT, finance, healthcare monitoring, and environmental sensing is the multivariate time series.

Architecture

WaveStitch decomposes time-series generation into three components:

1. Wavelet Encoder (local): At each device, a multi-resolution wavelet decomposition $W:{ℝ}^T\to {ℝ}^{J\times T/2^J}$ separates the time series into $J$ frequency bands. The decomposition is computed locally and only the mid-frequency band coefficients (capturing domain-specific cyclical patterns) are transmitted to the server. High-frequency (private, device-specific noise) and low-frequency (global trend, already public information) bands are not transmitted.

2. Federated Diffusion Core (server): A score-based diffusion model $s_{\theta }({𝐜}_{\omega },\tau )$ learns the score function over mid-frequency wavelet coefficients ${𝐜}_{\omega }$, receiving gradients from all participating devices via FedAvg. The server model captures the universal generative structure of time-series behaviour at intermediate scales.

3. Wavelet Decoder (local): Generated mid-frequency coefficients from the server model are combined with locally synthesised high-frequency noise (from a local light-weight GAN) and public low-frequency trends to reconstruct full-bandwidth synthetic time series.

The key theoretical insight of WaveStitch is that the wavelet decomposition provides a natural privacy partition: the frequency bands that carry the most identifying information about individual device behaviour (high-frequency idiosyncratic noise) are precisely the bands that carry the least cross-device generative structure, and hence are the bands most appropriately kept local.

Performance

On a benchmark spanning five domains (industrial vibration, financial tick data, hospital ECG, smart grid load, and agricultural humidity), WaveStitch achieves:

Context-FID measures the Fréchet distance between real and synthetic time-series embeddings in a pre-trained context encoder; CRPS (Continuous Ranked Probability Score) measures probabilistic forecast calibration; Discriminative AUC measures how easily a classifier can distinguish real from synthetic (0.5 = indistinguishable).

Notably, WaveStitch achieves lower Context-FID than the centralised TimeGAN baseline, demonstrating that the wavelet privacy partition also acts as a form of regularisation that improves generalisation.

TikZ Figure: Edge-to-Cloud Federated Generation Architecture

Federated Generative Agents

The synthesis of federated generative modelling with the agentic AI paradigm developed in 27 yields federated generative agents: autonomous AI systems that maintain device-local episodic memory, use local generative models to synthesise environmental context and plan action sequences, and participate in federation to update their shared world model without revealing private experiences.

Device-Level Memory Architecture

A federated generative agent at device $D_k$ maintains:

1. A local episodic store ${ℳ}_k$: a vector database of past interactions, observations, and decisions, stored in compressed latent form using the local encoder $E_{{\varphi }_k}$.

2. A local world model $G_{{\theta }_k}^{\mathrm{local}}$: a generative model that simulates environmental dynamics and synthesises plausible continuations of past trajectories, enabling model-based planning without environmental interaction.

3. A retrieval-augmented generation (RAG) index over ${ℳ}_k$: the agent queries its past experiences in latent space when faced with a new task, synthesising a contextualised action plan using the local world model.

Federation allows the global world model parameters $\theta$ to be updated from aggregate experiences across all devices, giving each agent access to a richer prior over environmental dynamics than any single device could accumulate. The personalisation offset ${\delta }_k$ retains device-specific behavioural patterns.

Federated Generative Planning

At inference time, the agent at device $D_k$ uses the local world model to execute $H$-step lookahead planning via model-predictive control (MPC): (MPC)$$\begin{array}{ccc}& {𝐚}_{t:t+H}^{\ast }={\mathrm{arg\hspace{0.17em}max}}_{{𝐚}_{t:t+H}}\sum _{h=0}^H{\gamma }^{h}r({\widehat{𝐬}}_{t+h},a_{t+h}),& \text{<span class="tml-eqn"></span>}\end{array}$$ where ${\widehat{𝐬}}_{t+h}\sim G_{{\theta }_k}^{\mathrm{local}}({\widehat{𝐬}}_{t+h-1},a_{t+h-1})$ is the synthesised future state. The generative world model thus replaces the need for repeated environmental interaction during planning, enabling efficient on-device lookahead in battery- and latency-constrained settings.

Federated Financial Time-Series Synthesis

Exercises

One-Shot Federated Learning, Flow Matching, and Emerging Paradigms

The dominant narrative of federated learning is one of rounds: clients compute local gradients, aggregate them at a server, update the global model, and repeat. This narrative implicitly treats communication as cheap and trustworthy-an assumption that collapses under real-world constraints. Hospitals exchange data under strict data-use agreements that permit only a single information release. Satellite constellations connect to ground stations for minutes per orbit. Edge devices operating on battery power cannot afford the energy expenditure of sustained uplink. Regulatory frameworks such as GDPR's Article 5(1)(c) impose data minimisation obligations that push engineers toward the absolute minimum of transmitted information.

The logical limit of this pressure is one-shot federated learning: a paradigm in which the entire federated training procedure-client local processing and server aggregation-is completed in a single communication round. Each client sends one message; the server processes all messages and never contacts the clients again. This is not a relaxation of multi-round FL; it is a fundamentally different computational model that demands new generative architectures.

Formal Definition of One-Shot Federated Learning

Why One-Shot Matters: Communication, Privacy, and Attack Surface

The benefits of one-shot FL are interconnected across the dimensions of efficiency, privacy, and security.

Communication efficiency. Standard multi-round federated learning with $T$ rounds and $K$ clients incurs a total uplink cost of $𝒪(TK|\theta |)$ bits, where $|\theta |$ is the model size. One-shot protocols reduce this to $𝒪(K|\theta |)$ or, when clients transmit compact encodings rather than full model weights, to $𝒪(K\cdot B)$ for some communication budget $B\ll |\theta |$. In settings such as cross-silo federated analytics, where $K$ may be hundreds of hospital sites and $|\theta |$ may be billions of parameters, this reduction is not merely convenient-it is necessary for the system to be deployable at all.

Privacy amplification. Every communication round in multi-round FL is an opportunity for a reconstruction attack: an adversarial server can attempt to infer private data from the transmitted gradients. Gradient inversion attacks have demonstrated near-perfect pixel-level reconstruction of training images from a single gradient update, even under differential-privacy noise at moderate levels. In one-shot FL, clients transmit once and terminate their participation. There is no iterative sequence of queries-no opportunity for an adversary to construct a sequence of adaptive probes that triangulate individual data points. The privacy guarantee is structural rather than algorithmic: the absence of rounds provides an attack surface reduction that no amount of noise injection can match.

Minimal attack surface. Federated systems are vulnerable to Byzantine attacks-malicious clients injecting poisoned updates to degrade global model performance. In multi-round protocols, a Byzantine client can adapt its attack over time, learning from server responses to craft maximally effective poison. In one-shot protocols, the attacker has a single shot as well: they cannot adapt based on the server's reaction to previous rounds. This structural limitation significantly constrains the power of adaptive Byzantine adversaries.

OSI-FL: One-Shot Federated Learning via Vision-Language Encodings

The key challenge in one-shot FL is the encoding step: what should each client transmit that is (a) compact, (b) privacy-preserving, and (c) sufficient for the server to train a high-quality generative model? A natural answer, motivated by the success of vision-language models (VLMs), is to transmit a semantic summary of the local dataset-a compact representation in the joint embedding space of a pretrained VLM.

OSI-FL architecture. OSI-FL (One-Shot Federated Learning via VLM Encodings and Classifier-Free Diffusion) operates as follows:

1. Local VLM encoding. Client $k$ passes each sample $𝐱\in {𝒟}_k$ through a frozen VLM encoder $\varphi :𝒳\to {ℝ}^d$ (e.g., the image encoder of CLIP) to obtain embeddings ${\{\varphi (𝐱)\}}_{𝐱\in {𝒟}_k}$. Client $k$ then computes a compressed representation $m_k$ of these embeddings-typically a Gaussian mixture model or a set of prototype vectors-and transmits $m_k$ to the server.

2. Server synthesis via classifier-free diffusion. The server aggregates the client messages to estimate the global embedding distribution $\hat{p}(𝐳)$ in VLM space. It then trains a classifier-free guidance (CFG) diffusion model ${ϵ}_{\theta }({𝐱}_t,t,𝐜)$ conditioned on embedding context $𝐜\sim \hat{p}(𝐳)$. The conditioning allows the server model to generate samples that match the semantic distribution of any specified client without accessing raw data.

3. Synthetic dataset creation. The server generates a synthetic dataset by sampling $𝐜\sim \hat{p}(𝐳)$ and running the reverse diffusion process: $${𝐱}_0\sim \int {ϵ}_{\theta }^{-1}(\cdot |𝐜)d\hat{p}(𝐜).$$ This synthetic dataset can be shared with downstream consumers without privacy risk, since it contains no raw client data.

Privacy analysis. The transmitted message $m_k$ is a compressed representation of VLM embeddings, not raw data. Because VLM encoders map images to a semantic space that discards pixel-level detail, embedding-based messages are significantly harder to invert than raw pixel gradients. Under a formal differential privacy analysis, one can show that adding Gaussian noise $𝒩(0,{\sigma }^{2}I)$ to the prototype vectors before transmission achieves $(ϵ,\delta )$-DP with $$ϵ=\frac{{\mathrm{\Delta }}_2{(m_k)}^2}{2{\sigma }^2}\log \left(\frac{1}{\delta }\right)+\frac{{\mathrm{\Delta }}_2(m_k)\sqrt{2\log (1/\delta )}}{\sigma },$$ where ${\mathrm{\Delta }}_2(m_k)$ is the ${\ell }_2$-sensitivity of the encoding function. Because VLM embeddings are normalised to the unit hypersphere, this sensitivity is bounded by ${\mathrm{\Delta }}_2\le 2$, giving strong DP guarantees at modest noise levels.

TikZ: One-Shot FL Pipeline

Federated Flow Matching: An Alternative to Diffusion

Diffusion models dominate the federated generative literature, but they carry an inherent inefficiency: the reverse process requires hundreds of neural function evaluations (NFEs) per sample, each corresponding to a denoising step along a stochastic trajectory. Flow matching offers an alternative generative paradigm that constructs a direct vector field $v_{\theta }:{ℝ}^d\times [\mathrm{0,1}]\to {ℝ}^d$ transporting a simple source distribution $p_0=𝒩(0,I)$ to the data distribution $p_1=p_{\mathrm{data}}$ along straighter paths.

The key structural advantage over diffusion is that the optimal flow for a Gaussian source and any data distribution is a straight line in expectation-meaning that a single Euler step provides a useful approximation, and a small number of steps (typically 4–10, versus 100–1000 for diffusion) yields high-quality samples.

FFM-LOT: Local Optimal Transport for Straighter Flows

The conditional flow matching objective of Definition Definition 47 matches each noise sample ${𝐱}_0$ to a data sample ${𝐱}_1$ independently and uniformly at random. This independent coupling produces curved trajectories in expectation, because the average path from ${𝐱}_0$ to ${𝐱}_1$ over all pairings is far from straight. FFM-LOT (Federated Flow Matching with Local Optimal Transport) replaces the independent coupling with an optimal transport coupling computed locally at each client.

Local OT coupling. For client $k$, let ${\hat{p}}_0^{(k)}$ and ${\hat{p}}_1^{(k)}$ denote empirical distributions over noise samples and data samples. The local OT coupling ${\pi }_k^{\star }$ solves the Kantorovich problem which can be computed via the Sinkhorn algorithm in $𝒪(n^2)$ time for a minibatch of size $n$. The resulting coupling minimises the expected squared transport distance, yielding the straightest possible conditional paths for this client.

FFM-LOT objective. The federated objective becomes $${ℒ}_{\mathrm{F}\mathrm{F}\mathrm{M}-\mathrm{L}\mathrm{O}\mathrm{T}}(\theta )=\sum _{k=1}^K{w}_k{𝔼}_{t,({𝐱}_0,{𝐱}_1)\sim {\pi }_k^{\star }}[\Vert v_{\theta }({𝐱}_t,t)-({𝐱}_1-{𝐱}_0){\Vert }^2].$$ Because ${\pi }_k^{\star }$ pairs each noise sample with its nearest data counterpart in squared distance, the conditional velocity targets ${𝐱}_1-{𝐱}_0$ have smaller variance than under independent coupling, reducing gradient noise during training and improving convergence rate.

FFM-GOT: Global Optimal Transport for Inter-Client Consistency

Local OT couplings improve intra-client trajectory straightness but do not address a fundamental tension in heterogeneous FL: different clients may have very different data distributions, causing the learned vector field to “average” incompatible directions. FFM-GOT (Federated Flow Matching with Global Optimal Transport) introduces a server-side coordination step that aligns client distributions before computing OT couplings.

Global barycenter computation. Let ${\hat{p}}_1^{(1)},\dots ,{\hat{p}}_1^{(K)}$ denote the client data distributions (represented as empirical measures). The server computes the Wasserstein barycenter which is the Fréchet mean in Wasserstein-2 space. This barycenter ${\hat{p}}_1^{\star }$ represents the “average shape” of the data distribution across all clients.

Transport plans to the barycenter. Each client $k$ computes the OT map $T_k^{\star }$ transporting its local distribution to the barycenter: The FFM-GOT objective trains the flow vector field on the barycenter-transported data: $${ℒ}_{\mathrm{F}\mathrm{F}\mathrm{M}-\mathrm{G}\mathrm{O}\mathrm{T}}(\theta )=\sum _{k=1}^K{w}_k{𝔼}_{t,{𝐱}_0\sim p_0,{𝐱}_1\sim {\hat{p}}_1^{(k)}}[\Vert v_{\theta }({𝐱}_t^{\star },t)-(T_k^{\star }({𝐱}_1)-{𝐱}_0){\Vert }^2],$$ where ${𝐱}_t^{\star }=(1-t){𝐱}_0+t{T}_k^{\star }({𝐱}_1)$. This global alignment ensures that the vector field is consistent across clients: all clients are, in effect, teaching the server to generate from the same barycenter distribution, even when their local data distributions differ significantly.

Advantages of Federated Flow Matching over Federated Diffusion

Federated flow matching holds three structural advantages over federated diffusion models that make it increasingly attractive as the default paradigm for distributed generative modelling.

Fewer sampling steps. Diffusion models learn to reverse a fixed noising process $q({𝐱}_t|{𝐱}_0)=𝒩(\sqrt{{\bar{\alpha }}_t}{𝐱}_0,(1-{\bar{\alpha }}_t)I)$ that is designed to make denoising tractable step-by-step, not to produce straight sample paths. Empirically, high-fidelity samples require 100–1000 function evaluations (NFEs). Flow matching, by contrast, learns a vector field that is a gradient of a convex potential for the linear interpolant, and the optimal field for Gaussian-to-data transport is exactly straight, requiring only one NFE in theory. In practice, 4–8 NFEs suffice for competitive image quality-a 10$\times$–100$\times$ speedup over diffusion.

Simpler training objective. The conditional flow matching loss is a simple mean-squared-error regression against deterministic velocity targets. There is no signal-to-noise schedule to tune, no score function estimation, and no stochastic differential equation to discretise. In a federated context, simpler objectives are easier to analyse theoretically-convergence proofs for FFM require only standard stochastic optimisation results, while federated score matching requires careful analysis of the SDE discretisation errors compounded over rounds.

Smoother transport paths. Flow matching paths, especially under OT coupling, interpolate smoothly between distributions. This is beneficial in federated settings because the server model interpolates between client distributions-and smooth interpolation is geometrically natural in Wasserstein space. Diffusion paths, being constrained to the noising-denoising trajectory, do not have this geometric interpretation and can produce artefacts when client distributions are far apart in Wasserstein distance.

GenEPS: Generative Superensemble with Unconditional Diffusion Prior

The connection between federated learning and numerical weather prediction (NWP) is deeper than a mere analogy. Modern ensemble prediction systems (EPS) aggregate forecasts from multiple NWP models-each run with a different initial condition perturbation-to produce a probabilistic forecast. The spread of the ensemble encodes forecast uncertainty. GenEPS (Generative Ensemble Prediction System) reimagines this framework by replacing hand-crafted ensemble perturbations with unconditional diffusion priors trained in a federated manner across meteorological agencies.

System architecture. GenEPS operates as follows:

1. Each participating meteorological agency $k$ (e.g., ECMWF, NCEP, MetOffice, CMA) trains a local unconditional diffusion model $D_k$ on its own reanalysis dataset ${𝒟}_k$, capturing the climatological distribution of atmospheric states.

2. Federated aggregation produces a global prior model $D_{\mathrm{global}}=\mathrm{FedAvg}(D_1,\dots ,D_K)$ that combines the meteorological knowledge of all participating agencies without sharing raw reanalysis data.

3. At forecast time, $D_{\mathrm{global}}$ is used as the prior distribution for a conditional score-based inference: given observations $𝐲$ (radiosonde measurements, satellite radiances, surface station data), the posterior atmospheric state is $$p(𝐱|𝐲)\propto p(𝐲|𝐱)\cdot p_{D_{\mathrm{global}}}(𝐱),$$ sampled via diffusion posterior sampling (DPS) or guidance.

4. Multiple independent samples from $p(𝐱|𝐲)$ constitute the generative ensemble, whose spread provides a calibrated uncertainty estimate of the atmospheric state.

Connection to Chapter 36 (Weather Generative Models). GenEPS provides a direct technical bridge to the weather chapter of this book. The diffusion priors trained in GenEPS are precisely the score-based generative models for atmospheric states developed in Chapter 36, but trained federally across agencies rather than centralised. The federated training protocol addresses the primary obstacle to global NWP collaboration: meteorological agencies operate under national sovereignty constraints that prevent sharing of raw reanalysis data, yet the quality of weather forecasts improves monotonically with the diversity and volume of training data. GenEPS resolves this tension by federating the training while keeping data local.

Hybrid Systems: Combining NWP and Federated Diffusion

A recurring theme in operational meteorology is the superiority of hybrid forecasting systems over pure data-driven or pure physics-based approaches. The dominant paradigm in 2024 combines physics-based NWP (which is interpretable, conserves physical quantities, and handles edge cases reliably) with data-driven corrections (which can capture statistical biases that physics-based models systematically miss).

Federated diffusion models are uniquely suited to the data-driven correction role in hybrid NWP systems:

• NWP residual correction. Let ${\widehat{𝐱}}_{\mathrm{NWP}}$ denote the deterministic NWP forecast. The residual $𝐫={𝐱}_{\mathrm{obs}}-{\widehat{𝐱}}_{\mathrm{NWP}}$ has a complex, non-Gaussian distribution that depends on geographic location, season, and atmospheric regime. A federated diffusion model trained on residuals across multiple agencies produces a probabilistic correction that is far more accurate than deterministic post-processing.

• Physically-constrained generation. The reverse diffusion process can be guided by physical constraints (conservation of mass, energy, and momentum) via projected Langevin sampling-adding a projection step after each denoising step to enforce physical laws. This ensures that federated generative corrections do not violate atmospheric physics.

• Uncertainty quantification. The spread of the diffusion ensemble provides a calibrated uncertainty estimate that is consistent with the CRPS (continuous ranked probability score) minimisation objective used to evaluate operational EPS.

The connection to Chapter 36 (Weather Generative Models) is direct: the techniques for score-based atmospheric modelling developed there apply directly in the federated setting, with the federated training protocol replacing centralised training while preserving the same generative inference procedures.

Personalized Federated Diffusion with Privacy Guarantees

One-shot FL and flow matching address the global generative model quality. But many federated applications require personalisation: a model that captures the idiosyncrasies of each client's local distribution, not just the global average. Personalized federated diffusion (PFD) achieves this by decomposing the generative model into a shared global backbone and client-specific adaptation layers.

Architecture. PFD parameterises the noise prediction network as $${ϵ}_{\theta }({𝐱}_t,t)=f_{{\theta }_{\mathrm{global}}}({𝐱}_t,t)+{\alpha }_k\cdot g_{{\varphi }_k}({𝐱}_t,t),$$ where ${\theta }_{\mathrm{global}}$ are the globally shared parameters trained via federated averaging, ${\varphi }_k$ are client-specific adapter parameters (e.g., LoRA matrices or lightweight residual blocks), and ${\alpha }_k>0$ is a personalisation strength hyperparameter.

Privacy mechanism. Global parameters ${\theta }_{\mathrm{global}}$ are trained under $({ϵ}_g,{\delta }_g)$-DP via DP-FedAvg (gradient clipping + Gaussian noise). Client-specific adapters ${\varphi }_k$ are trained locally and never transmitted-they are truly private, with no privacy budget expenditure. The personalisation step therefore adds no privacy cost beyond the global training budget.

Privacy–personalisation trade-off. Let ${ℒ}_k(\theta ,{\varphi }_k)$ denote the local diffusion loss for client $k$. The total PFD objective is $$\underset{{\theta }_{\mathrm{global}},\{{\varphi }_k\}}{\min }\sum _{k=1}^K{w}_k[{ℒ}_k({\theta }_{\mathrm{global}},{\varphi }_k)+\lambda \Vert {\varphi }_k{\Vert }_F^2]\text{s.t.}{\theta }_{\mathrm{global}}\in {\mathrm{\Theta }}_{{ϵ}_g,{\delta }_g},$$ where ${\mathrm{\Theta }}_{{ϵ}_g,{\delta }_g}$ is the set of models achievable under the specified global DP budget, and $\lambda$ is a regularisation parameter controlling adapter complexity. Larger $\lambda$ favours the global model (better privacy, less personalisation); smaller $\lambda$ allows more expressive local adaptation.

Exercises

Federated Generative AI Governance and Ethics

The preceding sections have developed the technical machinery of federated generative AI with precision: objectives, convergence guarantees, privacy analyses, and architectural innovations. This final section steps back from the machinery to ask the questions that will ultimately determine whether federated generative AI is deployed beneficially: Who owns the outputs? Who bears responsibility for harms? How can oversight be maintained without centralisation? And what happens when federated systems operate across national borders with incompatible legal frameworks?

These are not soft questions relegated to philosophy departments. They are engineering constraints. A federated system that violates GDPR may be shut down regardless of its technical quality. A generative model that amplifies biases across clients may cause systematic discrimination at scale. A deepfake generated by a federated system that operates across jurisdictions may be simultaneously legal and illegal depending on which court examines the case. Governance is not an afterthought to federated generative AI; it is part of the system specification.

Regulatory Landscape: GDPR, CCPA, and the EU AI Act

Federated generative AI operates at the intersection of three major regulatory frameworks, each of which imposes distinct constraints on system design, data handling, and deployment.

GDPR Article 17: The Right to Erasure. GDPR Article 17 (“the right to be forgotten”) grants EU data subjects the right to have their personal data erased upon request. In centralised AI systems, erasure is implemented by removing the individual's records from the training dataset and retraining or fine-tuning the model. In federated generative AI, erasure presents a fundamentally different challenge: if a data subject's records were used to train a local model, and that local model's parameters influenced the global generative model via federated aggregation, then the global model encodes information about the data subject-but there is no mechanism to excise that information without full retraining.

Machine unlearning for federated generative models is an active research problem. Proposed approaches include:

• Federated SISA (Sharded, Isolated, Sliced, and Aggregated) training: partition each client's dataset into shards such that removing one shard requires retraining only a fraction of the model;

• Influence function approximation: estimate the effect of removing a data point on model parameters using second-order Taylor expansion, then apply a parameter correction without full retraining;

• Differential privacy as approximate unlearning: argue that under $(ϵ,\delta )$-DP, the model's parameters are already approximately independent of any individual's data, so formal unlearning is not required beyond a specified privacy budget.

None of these approaches fully satisfies the GDPR Article 17 requirement as currently interpreted by EU data protection authorities. This remains a legal and technical open problem.

CCPA: Consumer Data Rights. The California Consumer Privacy Act (CCPA) grants California residents the right to know what personal information is collected, the right to delete it, and the right to opt out of its sale. For federated generative AI, the “sale” of model outputs (synthetic data derived from federated training) raises novel questions: does sharing a synthetic dataset derived from user data constitute a sale of personal information, even if the synthetic data contains no direct identifiers? The CCPA's definition of “personal information” includes any data that “could reasonably be linked” to an individual, and there is evidence that synthetic data generated without formal privacy guarantees can be re-linked to its source individuals at significant rates. The CCPA therefore effectively mandates differential privacy or equivalent formal guarantees for commercially deployed federated generative systems in California.

EU AI Act. The EU AI Act (2024) classifies AI systems by risk tier and imposes conformity obligations accordingly. Federated generative models potentially fall into multiple risk categories:

• High risk (Article 6): if used in healthcare diagnosis, employment decisions, or critical infrastructure-typical federated generative use cases;

• General purpose AI models (GPAI) (Articles 51–55): large generative models with broad applicability must publish technical documentation, comply with copyright law, and publish summaries of training data;

• Unacceptable risk (Article 5): real-time biometric identification from synthetic data derived from federated learning may trigger the prohibition on certain types of biometric surveillance.

The EU AI Act's conformity obligations are designed for centralised systems where a single legal entity can be identified as the provider. Federated systems distribute responsibility across clients and servers, making conformity assessment structurally more complex.

Synthetic Data as a Legal Entity

When a federated generative model produces synthetic data, a cascade of legal questions arises that existing intellectual property frameworks are ill-equipped to answer.

Who owns federated synthetic outputs? Consider a federated system where 100 hospitals jointly train a generative model and the server generates 100,000 synthetic patient records for sharing with pharmaceutical researchers. Who owns these records?

• The server operator, who ran the generation process;

• The participating hospitals, whose data implicitly shaped the generative model;

• The patients, whose records were in the training data;

• No one, if synthetic data without human authorship lacks copyright protection under existing law.

In the United States, the Copyright Office has held that AI-generated works without human creative input are not copyrightable. Synthetic records generated by a federated diffusion model likely fall into this category, creating a situation where the outputs are in the public domain regardless of the investment required to produce them. This has implications for commercialisation: a pharmaceutical company cannot protect its investment in federated synthetic data generation through copyright, necessitating alternative legal mechanisms such as trade secret protection or contractual restrictions.

Privacy status of synthetic data. The legal question of whether synthetic data constitutes “personal data” under GDPR depends on whether it is truly anonymous. Recital 26 of GDPR holds that anonymised data falls outside the regulation's scope, but empirical research has demonstrated that synthetic data generated without formal DP guarantees can be re-identified at non-negligible rates using membership inference attacks. From a regulatory standpoint, synthetic data generated by a federated model without formal privacy guarantees should be treated as pseudonymous rather than anonymous-and therefore remains subject to GDPR.

Fairness in Federated Generation: Bias Amplification

Standard machine learning fairness concerns-demographic parity, equalised odds, individual fairness-are complicated in federated settings by heterogeneity: different clients may have systematically different demographic compositions, different labelling practices, and different historical biases. Federated aggregation can amplify these local biases rather than averaging them out.

Sources of bias amplification. Federated generative models amplify bias through three distinct mechanisms:

1. Weighted aggregation bias. FedAvg weights client contributions by dataset size $|{𝒟}_k|$. Larger clients (which may be wealthier institutions with more historically biased data collection practices) exert disproportionate influence on the global model.

2. Mode collapse under heterogeneity. When client distributions are very different, federated GAN training may collapse to generating samples from the dominant client distribution, effectively erasing minority groups represented only in small clients.

3. Differential privacy noise disproportionality. Adding DP noise of fixed magnitude affects rare sub-populations more than majority groups, because the signal-to-noise ratio for minority groups is lower. A federated model trained with DP may achieve strong aggregate FID while failing catastrophically to model under-represented groups.

Mitigation strategies. Several technical interventions can reduce bias amplification:

• Fair federated aggregation: replace FedAvg with a minimax aggregation scheme that minimises the worst-case client loss rather than the average;

• Fairness-regularised generative training: add a fairness penalty to the generative loss that penalises demographic parity gaps in downstream tasks;

• Oversampling of minority clients: increase the communication round participation probability for underrepresented clients, compensating for dataset size imbalance.

Auditing Federated Generative Models

Auditing a centralised AI model is already technically challenging. Auditing a federated generative model-without centralised access to training data, without the ability to retrain the model with controlled perturbations, and without knowledge of individual client contributions-is substantially harder.

What auditing means in a federated context. An audit of a generative model answers questions of the form: does the model generate discriminatory outputs? Does it memorise training data? Does it reproduce copyrighted material? Each of these questions requires access to the model's internal representations and, ideally, to samples of the training data-neither of which is directly available in a federated system.

Black-box auditing via query protocols. The most immediately deployable approach is query-based auditing: the auditor is given API access to the global generative model $G$ (i.e., the ability to sample from $G$ and to evaluate the model's probability assignments) but has no access to training data or intermediate computations. The auditor then:

1. Samples a large synthetic dataset $\widehat{𝒟}\sim G$;

2. Applies standard bias metrics to $\widehat{𝒟}$ to measure demographic parity, representation balance, and output diversity;

3. Applies membership inference attacks to test whether $G$ memorises specific training records;

4. Applies copyright detection pipelines to check for verbatim reproduction of text or near-duplicate reproduction of images.

This approach is limited because a model can pass all black-box tests while still exhibiting biases that are not detectable without knowledge of the training data composition.

Federated auditing protocols. A more principled approach distributes the auditing process itself federally:

• An auditing party $𝒜$ is introduced as a trusted-but-curious third party that can query clients without accessing their raw data;

• Each client $k$ runs a local auditing procedure on ${𝒟}_k$ (e.g., a local membership inference attack) and reports a summary statistic $s_k$ (e.g., a p-value or AUC score) to $𝒜$ under DP;

• $𝒜$ aggregates $\{s_k\}$ using a secure aggregation protocol and reports a global audit verdict without learning any individual client's result.

This approach enables privacy-preserving auditing at the cost of reduced statistical power: the aggregate summary statistics may not be sufficient to detect subtle biases that are visible only at the individual client level.

Model Cards for Federated Generative Models

Model cards, introduced by Mitchell et al. (2019), are structured documentation artifacts that accompany machine learning models and disclose their intended use cases, performance characteristics, and limitations. For federated generative models, the standard model card framework requires significant extension to capture the distributed nature of training and the heterogeneity of participating clients.

Federated model card components. A federated generative model card should include:

1. Federation topology: the number of clients $K$, the aggregation protocol (FedAvg, SecAgg, etc.), the number of communication rounds, and the participation rate per round;

2. Client data characterisation: aggregate statistics of client dataset sizes, geographic distribution, and demographic composition-disclosed at the level of precision permitted by client privacy requirements;

3. Privacy budget: the global $(ϵ,\delta )$-DP guarantee achieved by the training procedure, the per-client noise mechanism, and the privacy accounting method (Rényi DP, GDP, etc.);

4. Per-client fairness metrics: a breakdown of generation quality and fairness metrics by client subgroup, at whatever granularity is disclosed by the auditing protocol;

5. Environmental disclosure: the total compute hours consumed across all clients, the estimated carbon footprint, and whether renewable energy sources were used;

6. Intended deployment context: downstream tasks for which the model has been validated, jurisdictions in which its outputs are legally permissible, and limitations of synthetic data use.

The challenge of model card completion in federated settings is that clients may be unwilling or unable to provide the information needed to fill each section. Federated model cards should therefore distinguish between verified disclosures (confirmed by the server or an auditing party) and self-reported disclosures (provided by clients without independent verification).

Environmental Cost of Federated Training

The environmental cost of AI training has attracted significant scrutiny, with estimates placing the carbon footprint of training a single large language model at hundreds of tonnes of CO${}_2$ equivalent. Federated training introduces a distinctive energy consumption profile that differs from centralised training in both magnitude and distribution.

Energy components of federated training. The total energy consumed by a federated generative training run decomposes as $$E_{\mathrm{total}}=E_{\mathrm{compute}}+E_{\mathrm{comm}}+E_{\mathrm{server}},$$ where:

• $E_{\mathrm{compute}}={\sum }_{k=1}^{K}T\cdot {\tau }_k\cdot P_k$ is the total compute energy across $K$ clients, $T$ rounds, local training time ${\tau }_k$, and device power draw $P_k$;

• $E_{\mathrm{comm}}={\sum }_{k=1}^{K}T\cdot b_k/r_k\cdot P_k^{\mathrm{comm}}$ is the communication energy, where $b_k$ is the per-round communication budget and $r_k$ is the transmission rate;

• $E_{\mathrm{server}}$ is the server compute energy for model aggregation and sampling.

Distributed vs. centralised comparison. In principle, federated training could be more energy-efficient than centralised training if client devices are more energy-efficient than data centre GPUs. In practice, this benefit is often reversed because: (a) $T$ rounds of communication multiply the compute cost; (b) client devices typically have lower compute throughput per watt than modern accelerators; and (c) communication energy in mobile networks can dominate the total budget.

One-shot FL and flow matching directly address the energy cost problem. One-shot FL eliminates the $T$ multiplier in the communication energy term. Flow matching reduces the per-sample generation cost by 10$\times$–100$\times$ relative to diffusion, reducing both $E_{\mathrm{server}}$ and the effective energy cost of downstream synthetic data users.

TikZ: Federated Governance Framework

The Dual-Use Problem: Federated Deepfakes

The most acute governance challenge for federated generative AI is the dual-use problem: the same technical capabilities that enable legitimate applications-privacy-preserving medical image synthesis, federated satellite data augmentation, cross-hospital rare disease modelling-also enable harmful applications at scale. Federated deepfake generation is the canonical example.

Why federation amplifies the deepfake threat. Centralised deepfake generation is already a serious concern, with detection arms races between generators and discriminators ongoing since 2018. Federation significantly worsens the threat landscape for three reasons:

1. Distributed training evades detection. Centralised training of a large generative model requires significant compute infrastructure that can be identified and monitored. Federated training across hundreds of edge devices is indistinguishable from legitimate federated learning, making detection and interdiction extremely difficult.

2. No single point of attribution. Law enforcement actions against centralised deepfake operations can target the server operator. In a federated system, the server may be a coordinator with no access to the harmful content, while the clients are anonymous participants. Attribution is computationally hard when clients use privacy-preserving aggregation protocols.

3. Personalisation enables targeted attacks. Personalized federated generation (Section Personalized Federated Diffusion with Privacy Guarantees) allows fine-grained targeting: a federated deepfake system could produce personalised synthetic content targeting specific individuals by training client adapters on small amounts of target imagery, without needing centralised coordination.

Technical countermeasures. The cryptographic and watermarking communities have proposed several countermeasures that can be deployed in federated generative systems:

• Federated watermarking: embed invisible watermarks in all outputs of a federated generative model by training the generator to produce a covert signal detectable by a shared detection key. The watermark key is distributed to all clients via secure key agreement, and detection requires access to the key-providing attribution even without access to the training infrastructure;

• Provenance attestation: use trusted execution environments (TEEs) at each client to generate cryptographic attestations that training was conducted according to an approved protocol. Aggregation is refused for clients that cannot provide valid attestations;

• Content provenance standards: adopt the C2PA (Coalition for Content Provenance and Authenticity) standard for attaching cryptographic provenance metadata to generated content, enabling downstream systems to verify the origin of synthetic media.

None of these countermeasures is foolproof. Watermarks can be removed by adversarial post-processing; TEEs can be compromised; provenance metadata can be stripped. The dual-use problem admits no purely technical solution and requires a combination of technical, legal, and social countermeasures.

International Collaboration: Cross-Border FL for Global Challenges

Despite the dual-use risks and regulatory complexity, cross-border federated learning represents one of the most promising frameworks for addressing global challenges that require data from multiple jurisdictions.

Climate science. Climate modelling requires integration of atmospheric, oceanic, and cryospheric data collected by national agencies under national sovereignty. Federated generative models trained across agencies from the EU, US, China, India, and the roughly 195 signatories to the Paris Agreement could produce substantially better probabilistic climate projections than models trained on any single nation's data. The GenEPS system (Section GenEPS: Generative Superensemble with Unconditional Diffusion Prior) is a prototype of this vision.

Pandemic preparedness. The COVID-19 pandemic illustrated the catastrophic cost of data fragmentation in global health emergencies. Federated generative models for pathogen sequence synthesis, clinical outcome modelling, and vaccine efficacy prediction could be trained across health agencies from multiple countries without sharing individual patient records. The WHO's Health Data Collaborative has identified federated learning as a priority architecture for pandemic preparedness data sharing.

Scientific collaboration. Large-scale physics experiments (CERN, LIGO, the Square Kilometre Array) already generate data at volumes that require distributed processing. Federated generative models trained on scientific data from multiple institutions could produce synthetic datasets that enable computationally intensive analyses to be performed on distributed infrastructure, reducing the centralisation bottleneck in scientific computing.

Governance frameworks for cross-border FL. Realising these applications requires governance frameworks that operate above the national level:

• International data spaces: treaty-level agreements establishing shared technical standards and legal frameworks for cross-border data access (the EU Data Spaces framework is an early example);

• Mutual recognition of privacy certifications: bilateral or multilateral agreements recognising each other's DP standards as equivalent (analogous to the EU-US Data Privacy Framework);

• Federated audit authorities: international bodies authorised to conduct privacy and fairness audits of cross-border federated systems, with access to summary statistics from all participating jurisdictions;

• Benefit-sharing mechanisms: protocols ensuring that the scientific and economic benefits of federated models are distributed equitably across participating nations, preventing wealthy nations from extracting value from data collected in lower-income settings.

Exercises

Open Problems and Future Directions

Federated generative modelling stands at a crossroads. The past five years have demonstrated that it is possible to train powerful generative models-GANs, VAEs, diffusion models, and large language models-without ever centralising sensitive data. Yet the gap between proof-of-concept research and robust, production-grade systems remains enormous. This section catalogues the most pressing open problems that must be solved before federated generative AI becomes a mature engineering discipline, rather than an aspirational research direction.

We organise the problems roughly in order of theoretical depth, from those that are primarily engineering challenges to those that require fundamentally new mathematical frameworks. For each problem we describe the state of the art, articulate precisely what is unknown, and sketch what a solution might look like. We close the section with a bold conjecture about the long-term trajectory of the field, and a vision of how federated learning, generative modelling, and foundation models are converging toward a single unified paradigm.

Open Problem 1: Scaling Federated Diffusion to Billion-Parameter Models

Denoising diffusion probabilistic models trained on centralised datasets have scaled remarkably: models with one to twelve billion parameters now generate photorealistic images, coherent videos, and fluent text with state-of-the-art fidelity. The federated analogue, however, remains stuck at orders of magnitude smaller. The largest federated diffusion experiments reported in the literature involve models in the hundreds-of-millions-of-parameters regime, trained on tens to hundreds of clients. Bridging this gap to billion-parameter models trained across thousands or millions of clients is a fundamental open problem.

The core tension is between model capacity and communication efficiency. Gradient compression methods such as top-$k$ sparsification and low-rank approximation can reduce the transmitted payload by factors of 100 to 1000, but introduce compression error that accumulates across rounds. For large models, this error can overwhelm the learning signal. Federated parameter-efficient fine-tuning (FedPEFT) approaches such as FedLoRA transmit only a small number of adapter parameters, but they presuppose a strong pre-trained initialisation that may itself be proprietary or unavailable in certain domains.

A plausible path forward combines three ideas: (a) pre-training a strong backbone on publicly available data centrally, followed by federated fine-tuning of only the adapter parameters; (b) using structured communication compression-such as Kronecker-factored gradient approximations-that exploit the tensor structure of diffusion U-Nets; and (c) asynchronous federated protocols that allow slow clients with large local compute to contribute full gradient information over multiple rounds without stalling fast clients.

Scaling laws for centralised diffusion models suggest that model performance improves predictably with model size, data volume, and compute. No analogous scaling laws exist for federated diffusion models. Establishing such laws-relating client count, data heterogeneity, communication budget, and model quality-would be a major theoretical contribution.

Open Problem 2: Provably Private Federated Generation Beyond Differential Privacy

Differential privacy is the gold standard for privacy in machine learning, and for good reason: it provides a mathematically rigorous, worst-case guarantee about the information that an adversary can extract about any individual training example. Yet differential privacy has important limitations in the context of federated generative models. The $(\epsilon ,\delta )$ accounting framework becomes difficult to interpret when applied to a generative model that produces synthetic data; the privacy guarantee applies to the model parameters, not directly to the synthetic outputs. Moreover, the noise required to achieve strong differential privacy guarantees often degrades sample quality to the point of practical uselessness, particularly for high-dimensional generation tasks such as image synthesis.

Several alternative privacy frameworks have been proposed, each with partial success. Pufferfish privacy generalises differential privacy by specifying which pairs of secrets should be indistinguishable, allowing domain-specific privacy definitions that may be weaker on non-sensitive attributes. Information-theoretic privacy bounds the mutual information between the model and individual records, but tends to produce bounds that are vacuous for high-capacity models. Attribute inference protection focuses on preventing the reconstruction of specific sensitive attributes rather than individual records, which may be sufficient for many applications.

A promising direction is to combine differential privacy with semantic privacy guarantees. Rather than protecting individual records at the bit level, one could aim to ensure that the synthetic data preserves population-level statistics while revealing nothing about individuals beyond what can be inferred from aggregate data. This connects federated generative modelling to the rich literature on statistical disclosure limitation, a field with decades of practical experience in releasing synthetic public-use microdata.

Open Problem 3: Federated Continual Generative Learning

Real-world federated systems are not static. Clients join and leave the federation over time, new data distributions emerge, and old data becomes stale or irrelevant. Centralised continual learning addresses the problem of learning new tasks without forgetting old ones, but the federated setting introduces unique challenges: clients arrive and depart asynchronously, each client may specialise in a narrow distribution, and the server has no persistent memory of past data.

The catastrophic forgetting problem is already severe in centralised continual learning; in the federated setting it is compounded by the fact that replaying past data is not possible without violating the privacy guarantees of clients who have departed. Generative replay, in which the current model generates synthetic examples of past tasks to interleave with new training, is a natural approach but creates a circular dependency: the quality of generative replay depends on the quality of the model, which is the very thing being trained.

Open Problem 4: Cross-Modal Federated Generation

Modern generative AI is increasingly multimodal. Large models such as GPT-4V, Gemini, and Stable Diffusion XL jointly model images and text, while audio-visual models extend this to speech and video. The federated analogue-training cross-modal generative models across clients whose data is inherently heterogeneous not only in distribution but in modality-is almost entirely unexplored.

This problem connects to the unsupervised cross-modal alignment literature, where shared latent spaces are learned from unpaired data. In the federated setting, even the unpaired data is distributed, and clients cannot share intermediate representations without risking privacy leakage through the shared latent space.

A potential approach is to learn modality-specific encoders locally on each client, then federate only the shared latent space parameters. Privacy analysis of this approach is non-trivial: the shared latent space is trained on gradients computed from private data, and the standard DP-SGD analysis applies to each modality separately, but the joint privacy guarantee for the cross-modal model requires careful composition.

Open Problem 5: Federated Unlearning at Scale

The right to be forgotten, enshrined in regulations such as GDPR, has spawned a large literature on machine unlearning: the problem of removing the influence of specific training examples from a trained model without retraining from scratch. For federated generative models, unlearning is both more urgent and more difficult. It is more urgent because the distributed data includes sensitive personal information across many clients. It is more difficult because the server has no direct access to the data that must be unlearned.

The verifiability requirement is particularly challenging. Standard membership inference attacks can serve as a post-hoc check, but they are probabilistic and may fail to detect subtle residual memorisation. Cryptographic approaches, such as commitment schemes or zero-knowledge proofs of unlearning, offer stronger guarantees but are computationally expensive at the scale of large generative models.

A compounding difficulty is the generative nature of the model. For discriminative models, unlearning is well-defined as removing a data point's influence on the model's predictions. For generative models, unlearning means ensuring the model cannot generate samples that are close to the removed training examples in some semantic sense. This is a much richer and less well-defined criterion.

Open Problem 6: Verification of Federated Synthetic Data Quality Without Centralised Access

A federated generative model produces synthetic data that clients or third parties intend to use for downstream tasks: training classifiers, performing statistical analyses, or publishing public-use datasets. Before using synthetic data, one naturally wants to verify that it is of high quality-that it faithfully represents the underlying population distribution, does not introduce systematic biases, and does not memorise sensitive training examples.

The verification problem becomes subtle in the federated setting because there is no central repository of real data against which to compare the synthetic data.

One approach is to compute local FID scores at each client using the client's own real data as the reference set, then aggregate these scores using a secure aggregation protocol. However, local FID scores are only meaningful if the client's local dataset is a representative sample from the population distribution, which is precisely the assumption that fails under severe data heterogeneity.

An alternative is to use trusted held-out data at the server-a small public validation set that does not belong to any client-as the reference for quality evaluation. This is pragmatic but introduces a dependency on the availability of representative public data, which may not exist in highly specialised domains such as medical imaging or financial transaction data.

Open Problem 7: Federated Generative Models for Scientific Discovery

Some of the most impactful applications of generative AI lie in scientific domains where data is inherently federated: pharmaceutical companies each hold proprietary assay data, hospitals each hold patient outcome records, climate research institutes each maintain regional measurement databases. In each case, the data is sensitive, the distributions are heterogeneous, and the scientific value of a model trained on the union would be immense.

Molecular generation is particularly challenging because the molecular space is discrete (graphs, SMILES strings) rather than continuous, which complicates the application of standard diffusion and VAE frameworks. Graph-based generative models such as GDSS and MolDiff handle molecular structure but have not been adapted to the federated setting. Energy-based models may offer an attractive alternative due to their modularity and composability, which may translate well to federated training.

For materials discovery, federated generation must produce crystal structures or amorphous materials with specified electronic, thermal, or mechanical properties. The evaluation of generated materials typically requires quantum-mechanical calculations (DFT or higher), which are orders of magnitude more expensive than standard image quality metrics. Incorporating such expensive evaluations into the federated training loop is itself an open problem.

Open Problem 8: Real-Time Federated Generation for Edge Applications

Applications such as autonomous driving, augmented reality, and real-time video processing require generative models that run at inference time on edge devices with constrained compute, memory, and power budgets. The federated training of such models must not only produce models of high quality but models that are efficient enough to run on the very devices that trained them.

Autonomous driving is a particularly compelling case study. Each vehicle generates a continuous stream of sensor data-LiDAR, camera, GPS, IMU-and uses generative models for sensor simulation, data augmentation, world modelling, and trajectory prediction. Federating these models across a fleet of vehicles has obvious privacy benefits (no raw sensor data leaves the vehicle) and obvious commercial value (the fleet collectively learns a better world model than any single vehicle could). Yet the requirements are extreme: inference must occur in milliseconds, the model must be robust to distribution shift (weather, geography, traffic patterns), and the federation must tolerate vehicles dropping in and out at arbitrary times.

Real-time augmented reality applications add the further constraint that the generative model must be personalised to the individual user-their appearance, environment, and preferences-using data that is highly sensitive and should never leave the device. Federated meta-learning offers a partial solution, but the communication overhead of meta-gradient aggregation is still too high for many edge deployments.

The Privacy-Utility-Communication Trilemma

Underlying all of the open problems above is a fundamental tension that we articulate here as a conjecture.

This conjecture is consistent with all known lower bounds for private distributed optimisation, and with the empirical observation that existing federated generative protocols trade off these three properties in predictable ways. However, a formal proof remains elusive, partly because the conjecture requires a unified measure of utility that applies across generative model classes (GANs, VAEs, diffusion models), which are evaluated by fundamentally different metrics.

A weaker version of the conjecture-that no single protocol is uniformly optimal on all three axes-can likely be proved using existing information-theoretic tools. The stronger version, which asserts that the tradeoffs are quantitatively large and unavoidable, would require new lower-bound techniques.

Research Challenge Boxes

We now present three structured research challenge boxes that synthesise multiple open problems and point toward concrete intermediate milestones.

[ enhanced, breakable, colback=exonavybg, colframe=exonavyfg, boxrule=1pt, arc=4pt, title= Research Challenge A: The Federated Diffusion Scaling Benchmark, coltitle=exonavyfg!20!white, fonttitle=, top=10pt, bottom=10pt, left=10pt, right=10pt, before skip=12pt, after skip=12pt ] Goal: Establish the first rigorous scaling benchmark for federated diffusion models, analogous to the scaling laws established for centralised language models.

Methodology:

1. Train federated DDPM models with parameter counts ranging from ${10}^7$ to ${10}^9$, across $K\in \{10,100,1000,10000\}$ clients.

2. Vary the data heterogeneity using a Dirichlet partition with $\alpha \in \{0.01,0.1,1.0,\infty \}$.

3. Vary the communication budget $B\in \{{10}^4,{10}^5,{10}^6,{10}^7\}$ bits per round.

4. Measure generation quality (FID), training efficiency (rounds to target FID), and communication cost (total bits transmitted).

Hypothesised scaling law: $$\text{FID}(N,K,\alpha ,B)\approx c_0\cdot N^{-a}\cdot K^{-b}\cdot B^{-c}\cdot f(\alpha )$$ for constants $c_0,a,b,c>0$ and a heterogeneity penalty function $f(\alpha )$ satisfying $f(\infty )=1$ and $f(\alpha )\to \infty$ as $\alpha \to 0$.

Expected deliverable: A benchmark suite, baseline implementations of FedAvg-DDPM, FedProx-DDPM, and FedLoRA-DDPM, and an empirical characterisation of the scaling law coefficients.

[ enhanced, breakable, colback=exogreenbg, colframe=exogreenfg, boxrule=1pt, arc=4pt, title= Research Challenge B: Private Federated Molecular Generation for Drug Discovery, coltitle=exogreenfg!20!white, fonttitle=, top=10pt, bottom=10pt, left=10pt, right=10pt, before skip=12pt, after skip=12pt ] Goal: Demonstrate that a federated molecular generative model trained with differential privacy can discover novel drug candidates that outperform models trained on individual client datasets.

Setup: Partition the ChEMBL database into $K=20$ federated clients, each simulating a pharmaceutical company with expertise in a different target class (kinases, GPCRs, ion channels, etc.). Train a federated graph diffusion model with $(\epsilon ,{10}^{-5})$-DP for $\epsilon \in \{1,5,10,50\}$.

Evaluation metrics:

• Validity: fraction of generated SMILES strings that correspond to valid molecules.

• Uniqueness: fraction of valid generated molecules not in the training set.

• Novelty: fraction of unique molecules not in any client's training set.

• Bioactivity: predicted activity against held-out targets using a separately trained QSAR model.

• Privacy: membership inference attack AUC against the final model.

Privacy-utility Pareto frontier: Map the tradeoff between $\epsilon$ and the bioactivity score. The scientific hypothesis is that the federated model achieves higher bioactivity for a given $\epsilon$ than any single-client model, because federation provides access to a more diverse chemical space.

[ enhanced, breakable, colback=exopurplebg, colframe=exopurplefg, boxrule=1pt, arc=4pt, title= Research Challenge C: Verifiable Federated Unlearning for Generative Models, coltitle=exopurplefg!20!white, fonttitle=, top=10pt, bottom=10pt, left=10pt, right=10pt, before skip=12pt, after skip=12pt ] Goal: Design and implement a cryptographically verifiable unlearning protocol for federated diffusion models that satisfies the trilemma requirements: completeness, efficiency, and verifiability.

Protocol sketch:

1. During training, the server maintains a cryptographic commitment $𝙲𝚘𝚖({𝜽}_t,D_{𝚝𝚛𝚊𝚒𝚗})$ at each round $t$.

2. Upon receiving an unlearning request from client $k$, the server computes the gradient of the training loss with respect to $D_k$ using influence functions, and subtracts this influence from $𝜽$.

3. The server produces a zero-knowledge proof $\pi$ that the updated parameters $\widetilde{𝜽}$ are consistent with having never trained on $D_k$.

4. The proof $\pi$ is published so that any third party can verify the unlearning without accessing $D_k$.

Key challenge: Influence function computation for large diffusion models is currently $O(|𝜽{|}^2)$, which is infeasible. The research question is whether block-diagonal or low-rank approximations of the Hessian suffice for accurate influence estimation, and whether the resulting approximation errors invalidate the verifiability guarantee.

Evaluation: Test on CelebA-HQ (face generation) with unlearning requests targeting specific identities. Verify using membership inference attacks and identity recognition classifiers.

The Convergence Thesis: FL + Generative + Foundation Models

We close Section Open Problems and Future Directions with a forward-looking synthesis. The three threads of modern AI-federated learning, generative modelling, and foundation models-are not evolving in isolation. They are converging.

Federated learning provides a principled framework for training on distributed, privacy-sensitive data. Generative modelling provides the capacity to learn rich data distributions and to synthesise new examples, serving as both an end goal and a tool for data augmentation. Foundation models provide a powerful, transferable initialisation that dramatically reduces the data and compute requirements for fine-tuning on any specific task or domain.

This convergence is already visible in early systems. Gboard uses federated learning to update language models on mobile devices. Apple's Neural Engine runs local diffusion models for image enhancement and on-device personalisation. Healthcare consortia use federated learning to train diagnostic models across hospital networks. The synthesis of all three paradigms-federated, generative, and foundation-is the natural next step.

The open problems articulated in this section are not obstacles that will prevent this convergence; they are the research agenda that will make it rigorous and safe. Solving them will require not only new algorithms and theoretical frameworks, but new infrastructure, institutional models, and governance mechanisms. The mathematics and the engineering are ready to begin. The open problems are hard, but they are not intractable.

Comprehensive Exercises and Research Challenges

The following exercises and research challenges are designed to consolidate understanding of the material in this chapter and to push the reader toward independent contribution. The exercises range from mathematical derivations to software implementation, and the research challenges constitute genuine open-ended research projects suitable for a graduate seminar or research internship.

For the exercises, detailed solutions or solution sketches are available in the supplementary material. For the research challenges, there are no predetermined correct answers: the value lies in the process of formulating the problem precisely, implementing a prototype, and interpreting the results.

Exercises

Research Challenges

The following five research challenges require original implementation, experimental design, and scientific writing. Each challenge is suitable as a course project or research internship deliverable.

Chapter Summary

This chapter has provided a comprehensive tour of federated generative modelling: the mathematical foundations, the principal algorithms, the privacy and communication tradeoffs, and the open frontiers. We close with two summary boxes that crystallise the chapter's most important insights.