PaperlayerView exact revision on arXiv

Source-linked AI summary

Federated Learning for Generalization, Robustness, Fairness: A Survey and Benchmark

Wenke Huang, Mang Ye, Zekun Shi, Guancheng Wan, He Li, Bo Du, Qiang Yang

arXiv:2311.06750v1cs.LGcs.AI

TL;DR

Federated learning must support collaboration over privacy-sensitive, distributed data while addressing generalization, robustness, and fairness challenges. This paper systematically surveys these three areas, organizes methods and datasets, and benchmarks representative solutions. The survey covers more than 100 methods, benchmarks eight federated datasets, and identifies continuing challenges and future directions.

  • Problem

    Privacy-sensitive data is distributed across entities, creating heterogeneous data and malicious-behavior challenges that require systematic analysis across generalization, robustness, and fairness.

  • Method

    The paper conducts a comprehensive survey of methods, task settings, datasets, and evaluation metrics across federated generalization, robustness, and fairness.

  • Results

    The survey summarizes more than 100 federated methods and presents benchmarking results on 8 widely used federated datasets.

  • Takeaways & Limitations

    The review and benchmarks provide insights into open problems and future research directions for federated learning.

  • Takeaways & Limitations

    Vertical federated learning still faces unresolved generalization and fairness challenges, including feature alignment, missing information, and contribution imbalance.

Abstract

from arXiv · show

Federated learning has emerged as a promising paradigm for privacy-preserving collaboration among different parties. Recently, with the popularity of federated learning, an influx of approaches have delivered towards different realistic challenges. In this survey, we provide a systematic overview of the important and recent developments of research on federated learning. Firstly, we introduce the study history and terminology definition of this area. Then, we comprehensively review three basic lines of research: generalization, robustness, and fairness, by introducing their respective background concepts, task settings, and main challenges. We also offer a detailed overview of representative literature on both methods and datasets. We further benchmark the reviewed methods on several well-known datasets. Finally, we point out several open issues in this field and suggest opportunities for further research. We also provide a public website to continuously track developments in this fast advancing field: https://github.com/WenkeHuang/MarsFL.

1 INTRODUCTION

Federated learning addresses privacy-sensitive, distributed data, but faces generalization, robustness, and fairness challenges. This survey reviews these challenges, organizes existing methods by task settings, benchmarks their effectiveness, and identifies future directions.

  • Challenges: Distributed data creates non-IID characteristics and cross-client distribution shifts that challenge federated generalization.The survey identifies cross-client shift as one of the major distribution-shift types caused by heterogeneous client data.
  • Challenges: Malicious participants create Byzantine and backdoor threats, respectively hindering primary-task performance or inducing targeted misbehavior while preserving overall performance.The survey distinguishes data- or model-based Byzantine attacks from targeted backdoor attacks.
  • Research gap: Existing surveys often emphasize conceptual guidance, data heterogeneity, robustness, fairness, or specific applications without providing a balanced, universal treatment.The survey highlights limited universality and relatively scarce empirical exploration across these concerns.
  • Contributions: The paper provides a comprehensive survey focused on generalization, robustness, and fairness in federated learning.Its review covers hundreds of papers in this fast-growing field.
  • Contributions: Existing methods are classified by task settings covering cross-client and out-client shifts, Byzantine and backdoor attacks, and reward conflict and prediction biases.The paper also analyzes the advantages and disadvantages of these methods.
  • Contributions: The study benchmarks federated solutions across scenarios using generalizable performance, defensive degree, and fair level metrics.It additionally discusses future research directions intended to improve federated learning designs for practical settings.

2 BACKGROUND

Federated learning collaboratively trains a global model while keeping client data local, but its decentralized setting introduces distribution shifts, malicious behavior, and conflicts over benefits. The survey organizes these issues around generalization, robustness, and fairness-related objectives.

  • Federated learning lets clients collaboratively construct a global model while keeping private data locally.
  • Non-IID client data creates Cross-Client Shift between participating clients and Out-Client Shift between participating and unseen clients.
  • Byzantine attacks hinder major-task performance, whereas backdoor attacks target selected behaviors while preserving overall performance.
  • Model-based Byzantine attacks manipulate uploaded parameters using strategies including random noise, LIE, Min-Max, and Min-Sum.
  • Backdoor attacks combine trigger patterns with modified samples and may assume independently trained malicious clients using a shared trigger.
  • Federated participation creates reward conflicts because clients differ in contribution, data value, and computational cost; Shapley Value is used to model contribution-based allocation.

3.1 Generalization Metrics

The survey evaluates generalization through Top-1 accuracy on participating-client test distributions and on an unseen out-client distribution. Cross-client performance is averaged across test datasets, while out-client performance is measured directly on the unseen domain.

  • Cross-Client Accuracy AU measures standard Top-1 accuracy across a collection U of participating-client testing datasets.
  • The cross-client metric averages performance across the testing datasets in U.
  • Out-Client Accuracy AO measures Top-1 accuracy on the unseen domain distribution O.

3.2 Cross Calibration

Cross Calibration methods address heterogeneous client objectives by calibrating divergent local optimization directions. The reviewed approaches use global models, extra network architectures, self-driven regularization, data sharing or enhancement, aggregation reweighting, and server-side adaptive optimization.

  • Cross Calibration: Cross-Client Shift makes local objectives inconsistent, causing clients to optimize in divergent directions.
  • Client Regularization: Global Neural Network methods guide local optimization using shared model parameters, variance, or outputs on private data.
  • Client Regularization: Extra network architectures include generative adversarial networks and auxiliary global structures, but restrict compatible network choices and increase communication cost.
  • Client Regularization: Self-Driven Regularization reduces client drift through self-distillation or modified cross-entropy objectives without additional shared signals.
  • Data-Based Calibration: Federated data sharing uses labeled samples for warm-up and unlabeled instances for distillation or pretraining, but suitable datasets may be unavailable under data scarcity.
  • Server Operation: Server Aggregation Reweighting replaces fixed aggregation weights because they can slow convergence and reduce accuracy by failing to calibrate client divergence.
  • Server Operation: Server Adaptive Optimization uses synthesized information for server-side fine-tuning or public-dataset knowledge distillation.

3.3 Unknown Generalization

Unknown Generalization addresses performance drops when federated models encounter deployment domains that differ from training clients. The surveyed approaches include federated domain alignment and disentanglement, while noting practical constraints on target-domain access and model complexity.

  • Domain shift can cause significant performance drops when deployment examples differ from training data.The survey links this risk to neural-network overfitting and over-confident predictions.
  • Federated Domain Adaptation: Federated domain adaptation commonly incorporates unlabeled target-domain data during federated optimization.This setup may be impractical when the target domain is unavailable during training.
  • Federated Domain Adaptation: Federated domain alignment handles shift by aligning and harmonizing multiple domain distributions.
  • Federated Domain Adaptation: Federated domain disentanglement separates domain-invariant knowledge from domain-specific components.Representative methods use adversarial adaptation, specialized classifiers, or mixture-of-experts gating.
  • Federated Domain Generalization: Federated domain generalization trains on heterogeneous sites and directly generalizes to unknown target clients with domain shift.Federated invariant optimization calibrates local training objectives to alleviate domain-shift effects.

4 ROBUST FEDERATED LEARNING

Robust Federated Learning studies defenses against malicious client manipulations, especially Byzantine and backdoor attacks. The survey organizes these defenses and evaluates attack impact through accuracy decline and backdoor attack success rate.

  • Federated learning is vulnerable to malicious manipulations because its distributed operation cannot assume every client is trustworthy.
  • Robust Federated Learning defenses are broadly divided into Byzantine tolerance and backdoor defense.
  • Robustness Metrics: Byzantine attack impact measures the accuracy decline relative to the benign global model.
  • Robustness Metrics: Backdoor effectiveness is measured by the proportion of triggered samples classified as the attacker-selected target labels.

4.2 Byzantine Tolerance

Byzantine tolerance methods primarily use robust aggregation to identify or reduce malicious client updates. The survey covers update comparison, statistical criteria, and proxy-data evaluation, while highlighting sensitivity to heterogeneous data and prior assumptions.

  • Robust aggregation is an effective paradigm for combating Byzantine attackers.
  • Update Comparison: Update-comparison methods treat client updates far from the overall direction as malicious and exclude or downweight them.Multi Krum selects a gradient closest to neighboring clients, while FoolsGold uses cosine similarity for weighting.
  • Statistical Distribution Tolerance: Statistical methods use criteria such as geometric medians or trimmed medians to select or aggregate client updates.RFA uses geometric-median minimization, and Bulyan applies trimmed median in a two-step meta-aggregation procedure.
  • Statistical Distribution Tolerance: These statistical aggregation methods are sensitive to data heterogeneity and generally assume client data lies within a prescribed range.Their statistical assumptions create a strong prior limitation for realistic applications.
  • Proxy-Data Evaluation: Proxy-data methods evaluate client updates using clean datasets assumed to share a similar or constant semantic space with private data.

4.3 Backdoor Defense

Backdoor defenses operate by refining the global model, filtering malicious signals during aggregation, or providing certified robustness guarantees. The surveyed methods face practical limitations involving proxy data, heterogeneous client distributions, and defense guarantees.

  • Backdoor defenses are classified into global-model refinement, aggregation-stage filtering, and certified robustness methods.
  • Model Refinement Defense: Model refinement uses fine-tuning, logits distillation, or Bayesian learning to erase possible backdoors from the aggregated model.
  • Model Refinement Defense: Model refinement requires a high-scale proxy dataset and does not guarantee the degree of backdoor erasure.Without additional regularization, it also requires careful hyper-parameter configuration to avoid severe overfitting.
  • Robust Aggregation Defense: Aggregation-stage defenses exclude malicious weights or gradients using anomaly detection and dynamic weight allocation.Dim-Krum examines dimensions with stronger backdoor signals, while RLR adjusts server learning rates using client-update signs.
  • Robust Aggregation Defense: Aggregation-stage defenses typically assume independent and identically distributed client data, unlike heterogeneous federated learning.
  • Certified Robustness: Certified methods aim to ensure that each prediction remains unchanged under constrained modifications to malicious clients’ local training features.

5 FAIR FEDERATED LEARNING

Fair federated learning addresses conflicts over client rewards and unequal model performance in multiparty collaboration. The survey organizes existing methods around collaboration fairness and performance fairness, while noting practical limitations in current approaches.

  • Reward Conflict: Clients incur computation and communication costs, while their data contributions differ, creating conflicts over fair compensation.Contribution evaluation is intended to motivate participation by assessing differing client contributions in a privacy-friendly manner.
  • Collaboration Fairness: Collaboration fairness measures whether interest allocation reflects each client’s contribution to federated performance.The contribution-match degree E compares performance drop after removing a client with its aggregation weight.
  • Performance Fairness: Performance fairness seeks high average accuracy alongside uniform accuracy across testing distributions.Performance deviation V is measured by standard deviation; larger V indicates more biased federated performance.
  • Performance Fairness: Existing performance-fairness methods modify local objectives or aggregation to reduce biased performance across clients and protected groups.Min-max objectives can improve the worst client’s performance but may reduce overall model utility, while aggregation methods use gradients or predictive risk.
  • Limitations: Prediction-based aggregation methods require additional validation data, creating a practical data requirement for deployment.Gradient-based methods may also rely on previous-round estimates that do not synchronize with the latest updates.

6 SETUP

The benchmark setup groups datasets by data heterogeneity and evaluates federated methods under label, domain, and out-client shifts. It standardizes augmentation, optimization, architecture, and malicious-client settings across scenarios.

  • Dataset Organization: Benchmark datasets are divided according to different forms of data heterogeneity.The setup distinguishes label-skew and domain-related scenarios, including out-client evaluation.
  • Label Skew: Dir(β) simulates label skew, with smaller β producing greater imbalance between local and global class distributions.Cifar-10 contains 50,000 training images and 10,000 validation images across 10 categories.
  • Domain Shift: Out-Client Shift evaluates leave-one-domain-out generalization by treating one domain as unseen and the remaining domains as source clients.Domain Skew and Out-Client Shift both involve feature shifts across domains, but only Out-Client Shift holds out a domain during evaluation.
  • Data Augmentation: The setup uses RandomCrop, RandomHorizontalFlip with p = 0.5, and image normalization for local data augmentation.These augmentations follow previously used strategies and are specified in PyTorch notation.
  • Malicious Setting: Malicious-client experiments set the attacker ratio Υ ∈ {0.2, 0.4}; Data-Based Byzantine Attack experiments use default noise rate ϵ = 0.5.The configuration covers both Byzantine and backdoor attacker scales.

7 BENCHMARK

The benchmark compares federated methods across generalization, robustness, and fairness scenarios using reproduced results and task-specific metrics. Results show competitive methods for domain and out-client shifts, Byzantine and backdoor defenses, while also exposing reproducibility, computational, and multi-objective gaps.

  • Benchmark Scope: Reproduced benchmark comparisons are not completely fair because methods use different code bases, optimization levels, and sometimes unavailable implementations.The study therefore reports performance gathered from reproduced results while acknowledging comparison constraints.
  • Evaluation Metrics: Cross-Client Accuracy AU evaluates label and domain skew, while Out-Client Accuracy AO evaluates out-client generalization.These metrics distinguish performance on participating-client distributions from performance on unseen-client distributions.
  • Generalization Results: 67.16 accuracy is achieved by KD3A on the Office Caltech scenario under Out-Client Shift.Federated Domain Adaptation uses unlabeled unknown-domain data during training and is reported to improve Out-Client Accuracy.
  • Robustness Results: DnC performs relatively satisfyingly across Byzantine attacks, while proxy-dataset tolerance has the disadvantage of requiring an additional proxy dataset.The benchmark covers data-based and model-based Byzantine attacks across four datasets.
  • Robustness Results: RFA and CRFL achieve satisfying defensive performance against the evaluated backdoor attack forms.The backdoor evaluation considers Bac and Sem Bac and reports accuracy and attack success rate.
  • Fairness Results: Few evaluated federated optimizers include Collaboration Fairness in their objectives, and fairness is impeded by large local distribution diversity.Global network utilization and server adaptive optimization are reported to alleviate imbalanced performance across multiple domains.
  • Discussion: The benchmark identifies a reproducibility dilemma because experimental setups, source code, datasets, and backbone models vary across methods.It also notes that execution-time and memory-cost information is often missing despite their importance in realistic federation.

8 OUTLOOK

The outlook identifies tensions among generalization, robustness, and fairness, while highlighting cooperation between robustness and fairness and unresolved challenges for vertical FL and LLM-based federated learning.

  • Generalization and Robustness Dilemma: Generalization and robustness can conflict because heterogeneous benign clients may be misclassified as malicious and rejected.This rejection restricts federated performance by excluding some benign clients.
  • Generalization and Fairness Trade-Off: Generalization can conflict with fairness because fitting the major client distribution may ignore minority groups and produce non-uniform performance.Fairness instead requires more uniform performance across testing distributions.
  • Robustness and Fairness Cooperation: Robustness and fairness can cooperate: contribution measurement supports malicious-client detection, while reliable robustness improves interest allocation among benign participants.The survey presents accurate contribution measurement as relevant to collaboration fairness.
  • Vertical FL meets Generalization, Robustness, Fairness: Vertical FL still requires solutions for feature alignment, missing features, de-biasing, data-inference attacks, and fairness-sensitive feature identification.The cited outlook calls for collaborative bias-mitigation algorithms and stronger defenses against label and feature inference.
  • Conclusion: The survey comprehensively reviews more than 100 federated methods and benchmarks them on 8 widely used datasets while identifying open problems.It frames these results as evidence of notable progress alongside challenges that remain.
Loading 2311.06750v1…