Federated Targeted Maximum Likelihood Estimation

1. Introduction.

• The first general federated TMLE targets an arbitrary inferential quantity, loss, and fluctuation family across private datasets.The analysis tracks optimization progress, statistical completion, and communication as each accepted fit changes the working model.Source: §1 · p. 2
• FedTMLE-G aggregates local gradients to reproduce matched centralized targeting, whereas FedTMLE-L averages locally fitted fluctuation parameters in one exchange and may follow a different path.FedTMLE-L permits local computation between exchanges, but its averaged minimizers need not solve the pooled problem, even with sample-size weights.Source: §1 · p. 2
• Differential coding transmits changes in gradients and provides explicit bounds on communication rounds and bits needed to certify targeting accuracy.The protocol does not require local gradients to agree; its savings are in transmitted bits, not synchronization rounds.Source: §1 · p. 2
• The accepted targeting history controls data-dependent fitting and stopping, and finite communication can make numerical targeting error negligible relative to sampling uncertainty.The history need not record every intermediate gradient query; an inner solve may contribute only one accepted update.Source: §1 · p. 2
• Unstable full-record reconstruction does not rule out recovery of a specified sensitive attribute, so keeping records local alone does not guarantee confidentiality.The analysis treats each client's accepted query family as part of the disclosure model.Source: §1 · pp. 2–3
• Personalized local averaging lets clients retain completed local estimates and leave, while the convergence bound charges improvement forfeited through averaging to disagreement among local fits.The bound also exposes sensitivity to small silos under equal institutional weighting; elapsed-time and fixed-communication-budget method orderings can differ.Source: §1 · p. 3

2. Preliminaries.

• A plug-in estimator evaluates a fixed-dimensional, pathwise differentiable target at an initial density estimate, but prediction or density accuracy alone may not suffice for inference.The initial estimate may come from flexible ensemble learners.Source: §2 · p. 3

2.1. The target parameter and its canonical gradient.

• The canonical gradient represents the target's derivative along regular perturbations, is centered and square-integrable, and has covariance at the truth equal to the efficiency bound.Its centering under the true distribution need not hold empirically at the estimated density, creating the discrepancy TMLE targets.Source: §2.1 · pp. 3–4

2.2. The estimating equation and statistical error.

• The statistical decomposition identifies the empirical EIF mean as the plug-in correction; solving it to the required order supports an asymptotically linear estimate when the other remainder terms are controlled.TMLE moves the density and reports its plug-in target, keeping the estimate in the model-implied range.Source: §2.2 · p. 4

2.3. Targeting as a sequence of fluctuation optimizations.

• Iterative TMLE minimizes loss over a targeted fluctuation, updates the density, and rebuilds the next submodel; stationarity within one fit differs from the targeting equation tested at the updated density.A zero fluctuation implies a solved EIF equation, but in a nonconvex problem a zero residual need not identify a global minimizer; exhausting the iteration budget may leave a nonzero residual.Source: §2.3 · pp. 5–6

3.1. FedTMLE-G: gradient aggregation.

• FedTMLE-G distributes gradient evaluation while leaving the centralized inner optimization unchanged, using pooled batches rather than independently sampled silo batches.Independent local batches need not reproduce pooled SGD, even when reweighting makes the gradient unbiased.Source: §3.1 · pp. 6–7
• With matched computation, FedTMLE-G reproduces centralized inner parameters and outer densities, and repartitioning leaves its loss trajectory, EIF residuals, and limiting density unchanged.This equivalence requires matching initialization, fluctuation construction, optimizer and feasibility rules, stopping rules, and realized pooled batches; finite-step optimization matches the corresponding inexact centralized implementation.Source: §3.1 · pp. 7–8
• Each FedTMLE-G inner gradient step requires a synchronized exchange, and each contributing silo uploads a d-dimensional gradient.The full-data EIF check that opens an outer iteration is another exchange, except that full-batch GD can use it as the first inner gradient.Source: §3.1 · p. 8

3.2. FedTMLE-L: local averaging.

• FedTMLE-L replaces the pooled inner solve with exact local fits in shared fluctuation coordinates, then averages the fluctuation parameters and updates the shared base density.It averages neither updated densities nor target values, and local computation can proceed without a server response between the EIF evaluation and local fit.Source: §3.2 · pp. 8–9
• Averaged local minimizers need not solve the pooled inner problem or imply pooled descent, even with sample-size weights.The algorithm nevertheless tests the pooled estimating equation for stopping.Source: §3.2 · p. 9
• FedTMLE-L’s averaged update must lie in the admissible fluctuation domain; convexity ensures feasibility, and nonlinear reparameterization changes the average.Local fits being individually admissible does not ensure their average is admissible.Source: §3.2 · p. 9
• Nonzero local fits can cancel, leaving the shared density unchanged with a positive pooled residual; the continuing-participation algorithm stops and reports stagnation.It does not attempt to resolve the cancellation.Source: §3.2 · p. 9
• A zero local fit solves that silo’s estimating equation at the current density, but a later shared update can move the density off that root.A silo seeking Algorithm 3’s common output must keep participating after a zero fit.Source: §3.2 · p. 9

4.1. Assumptions and computational setting.

• The analyses rely on smooth targeting and re-centering conditions for FedTMLE-G, plus exact local-fit and common-law derivative-complexity conditions for personalized FedTMLE-L.The latter conditions allow nonconvex objectives and distinct local minimizers while controlling derivative variation across possible data-dependent trajectories.Source: §4.1 · pp. 10–12

4.2. Communication and statistical accuracy of FedTMLE-G.

• When κ/β is bounded, differential coding has leading bit cost O(Mdβ∆/δ2), amortized over gradient changes and without a precision-logarithm multiplier.It transmits changes between rounded gradients, retains code memory across re-centering, and bounds total cost through loss decrease; savings concern bits, not synchronization rounds.Source: §4.2 · pp. 12, 14, 15
• The accepted-history description controls adaptive selection of the final density without charging for every inner optimization query.With bounded accepted updates, the history can remain short even when inner optimization takes many rounds; a same-sample initialization must be included in its description.Source: §4.1 · p. 11, §4.2 · pp. 15–16
• When δn = o(n^-1/2), finite-communication targeting error is negligible relative to sampling uncertainty, provided the stated statistical conditions hold.The result concerns the estimator actually computed, rounded, and finitely stopped; it does not establish regularity under local alternatives.Source: §4.2 · p. 16

4.3. Record reconstruction and selective disclosure.

• The disclosure analysis treats record reconstruction and recovery of a specified data attribute as separate tasks under bounded transcript uncertainty.The section motivates this distinction by noting that unstable record reconstruction does not itself protect against selective attribute recovery; this part does not supply the analysis's findings.Source: §4.3 · pp. 16–17
• Moment cancellation makes nearby records hard to reconstruct from accepted aggregate queries, but this worst-case obstruction is not a guarantee that sensitive attributes remain hidden.The result concerns worst-case datasets, not typical protection under i.i.d. sampling, and is vacuous at zero response uncertainty.Source: §4.3 · pp. 17–18
• A fixed query block with an affine decoder can approach the attribute-recovery upper bound, while the lower bound applies even to adaptive attacks.When response uncertainty dominates curvature terms, both bounds reduce to ωT(η) to leading order; finding the best query block may be computationally difficult.Source: §4.3 · pp. 18–19
• Selective disclosure arises because reconstructing records requires resolving every direction, whereas recovering a smooth attribute depends only on directions in which its gradient has a component.A thresholded feature is identifiable when it lies farther from the threshold than the recovery error; the analysis is relative to accepted queries, and enlarging that family cannot increase optimal recovery error.Source: §4.3 · p. 19

4.4. Personalized targeting with client retirement.

• FedTMLE-LR lets a client freeze its density, targeting state, and estimate after an exact local fit reaches zero, then retire while other clients continue.Its retained estimate includes shared updates accepted before retirement, and the retirement certificate is evaluated on that client’s observations.Source: §4.4 · p. 19
• A zero local targeting gap certifies that local minimization is complete, whereas a zero first-order equation alone need not do so in a nonconvex problem.For retired clients, both the local gap and local empirical EIF mean are zero at the retained density.Source: §4.4 · pp. 19–21
• The nonconvex convergence bound charges improvement forfeited through averaging to disagreement among local fits, with no additional term for changes in the active set.Uniform weights give clients equal influence but make the penalty more sensitive to small silos; sample-size weights reduce small-client contributions to both the penalty and criterion. The result imposes no decay law on disagreement, and does not guarantee finite retirement for every client.Source: §4.4 · pp. 21–22

• The comparison uses n = 10,000 observations from Gaussian or curved mixtures, random or spatial partitions, and unequal client sizes with an approximately 5:1 largest-to-smallest ratio.It evaluates a three-dimensional entropy-regularized optimal-transport target with four fixed destinations; Figure 3 varies client count at a fixed 1.5-reference-unit budget.Source: §5 · pp. 22–23, Figure 3 · p. 24
• Comparable final losses follow different transients: local averaging progresses faster initially on the Gaussian mixture, while FedTMLE-G leads early on the curved mixture.Spatial partitioning brings a clearer middle-stage slowdown for local averaging, including a small pooled-loss rebound under uniform weights; EIF residuals distinguish targeting progress even when losses are close.Source: Figure 1 · p. 22, §5 · p. 23, Figure 2 · p. 23
• Elapsed-time and communication-budget rankings can differ because gradient synchronization competes with complete local solves, whose cost depends on conditioning and the slowest client.Unequal client sizes distinguish averaging rules, while spatial heterogeneity changes local gradients and curvature; sample-size weighting therefore does not generally recover the pooled minimizer.Source: §5 · p. 25
• At 200 communication rounds, FedTMLE-G retains higher loss, while uniform weighting becomes less favorable as more clients divide the sample, particularly under spatial heterogeneity.FedTMLE-G requires several pooled gradient and step-selection queries per update, whereas FedTMLE-L communicates after a complete local solve; this budget-specific comparison does not imply slower targeting in elapsed time.Source: Figure 4 · p. 24, §5 · p. 25

• FedTMLE-G distributes gradient evaluation along a matched centralized trajectory, while FedTMLE-L exchanges locally fitted fluctuation parameters and changes the targeting path.The conclusion distinguishes numerical targeting accuracy from the additional statistical conditions needed for inference.Source: §6 · p. 25
• For FedTMLE-G, differential coding controls bit cost for an EIF certificate, while accepted-history description length controls statistical adaptivity separately from the full gradient transcript.For local averaging, FedTMLE-LR lets completed clients retain locally TMLE-stable estimates, and its bound quantifies improvement lost through averaging using weights, sample sizes, and fit disagreement.Source: §6 · p. 25
• Local data storage is not itself a privacy guarantee, because unstable record reconstruction can coexist with accurate recovery of a specified attribute.The authors identify extensions for different silo populations, inexact local solves, tolerance-based retirement, adaptive synchronization, and joint study of communication, disclosure protection, and inference.Source: §6 · p. 25

• The supplement lists D योग्य Li, Fei Wang, and Kyra Gan as authors.Source: SUPPLEMENT TO “FEDERATED TARGETED… · p. 28

• The paper presents its algorithms as the first general-purpose federated methods for standard iterative TMLE, federating targeting across target functionals rather than prescribing a particular causal estimand.Source: §S.1 · p. 28
• Related methods address transportability, influence-function-based survival estimation, or surrogate nuisance fits rather than the successive fluctuation problems of standard TMLE.Han, Shen and Zubizarreta (2023), Liu et al. (2026), and Tong et al. (2025) are described as addressing those distinct tasks; Phillips (2023) addresses the broader intersection of federated and targeted learning.Source: §S.1 · p. 28
• Beclin and Vo (2026) specialize federated TMLE to survival mediation, using sequential structure to avoid repeated global iterations; this paper instead repeatedly rebuilds and optimizes the targeting submodel.The section characterizes the distinction as algorithmic, not merely a difference in application domain.Source: §S.1 · p. 28
• Federated averaging supplies a communication pattern, not a TMLE targeting rule, and multi-gradient methods target Pareto stationarity rather than influence-function calibration of a plug-in estimator.FedTMLE-L averaging need not preserve centralized targeting, and FedTMLE-LR additionally lets completed clients retain local estimates.Source: §S.1 · p. 28

• The communication proof holds the observed sample fixed.Source: §S.2 · p. 28
• Statistical probabilities refer to the original i.i.d. targeting sample, with independent-initialization conditioning only where explicitly stated.Source: §S.2 · p. 28
• Transcript uncertainty is analyzed deterministically with public information held fixed.Source: §S.2 · p. 28

S.2.1. Proof of Theorem 4.1.

• The per-round rounding error is bounded without accumulating across transmitted differences, and the pooled objective inherits Assumption 4.1 under sample-size weighting.Source: §S.2.1 · p. 30
• Rounding preserves a fixed fraction of communicated-gradient descent, and summed loss decreases need no stationarity condition at inner minimizers.Accepting an inner fit preserves the empirical-loss value when the submodel is re-centered.Source: §S.2.1 · p. 31
• The protocol terminates after finitely many rounds, with its round and step count bounded by the number of descent steps.The proof gives (Tk + 1) + 1 = S + K + 1 ≤ 2S + 1 ≤ 1 + 64β∆.Source: §S.2.1 · p. 32
• The proof derives the across-submodel gradient-variation bound from the two Lipschitz assumptions, without a separate bound on successive-submodel differences.Source: §S.2.1 · p. 34
• The communication bound uses C = 256 as a valid universal constant and counts the final certificate round.It excludes initial model transfer, transport headers, and security mechanisms.Source: §S.2.1 · p. 36

S.2.2. Proof of Theorem 4.2.

• The accepted fluctuations reconstruct the terminal density without encoding inner stopping times, intermediate gradients, server accumulators, or rejected parameters.Source: §S.2.2 · p. 37
• The description-length bound holds deterministically for the realized history and uses neither a probability argument nor a complexity assumption.Source: §S.2.2 · p. 37
• The realized output can be substituted into a simultaneous concentration bound covering every decoded density, without a deterministic bound on the stopping index.The proof allocates failure probabilities across descriptions and coordinates.Source: §S.2.2 · p. 41
• The nonlinear remainder is a separate term whose order requires statistical analysis of the terminal density; neither the EIF residual nor code length bounds it.Source: §S.2.2 · p. 42

S.2.3. Proof of Corollary 4.1.

• When K = OP(1), Hinit = 0, and log an = o(log n), the stated right-hand side is OP(log n).Source: §S.2.3 · p. 42
• The central limit conclusion is pointwise at p0 and does not require nonsingular canonical-gradient covariance.Source: §S.2.3 · p. 43
• Regularity under local alternatives does not follow from the communication or coding bounds and requires a separate argument.Source: §S.2.3 · p. 43

S.2.4. Proof of Theorem 4.3.

• Polynomial cancellation leaves a remainder controlled through divided differences; vector-norm integration avoids an additional bound factor depending on dimension d.The cancellation applies to polynomials of degree less than s.Source: §S.2.4 · pp. 45–46
• Compatible datasets can produce the same adaptive-query transcript, forcing a common decoder output and yielding a minimax reconstruction lower bound.The argument constructs matching transcripts inductively and applies the triangle inequality to the decoder error.Source: §S.2.4 · pp. 46–47
• At η = 0, the stated minimax bound gives only nonnegativity, not a positive lower bound for exact real-valued responses without further structure.The proof notes that its midpoint transcript is admissible under bounded uncertainty but need not arise from a particular nearest-grid quantizer.Source: §S.2.4 · p. 47
• The related fixed-query-block conditioning argument uses derivatives, but the adaptive reconstruction lower bound does not differentiate the query-selection rule.The fixed-block argument chooses a nullspace direction and applies Taylor's formula.Source: §S.2.4 · pp. 47–48

S.2.5. Proof of Theorem 4.4.

• The support problem's convex duality applies only to norm constraints and a linear observation map, not to the TMLE loss or fluctuation objective.The proof also handles zero uncertainty and rank-deficient designs.Source: §S.2.5 · pp. 48–49
• The upper risk bound uses accepted query blocks and weights approaching the design infimum, without requiring an optimal design or weights to exist.The bound holds whether the uncertainty η is below or above bT.Source: §S.2.5 · p. 51
• Adaptive policies can yield identical state changes and stopping decisions for two compatible candidate datasets, supporting a lower risk bound through the attribute modulus.The candidates are constructed to reproduce the same reference-query history.Source: §S.2.5 · pp. 51–52
• The relative-error interpretation excludes ωT(η) = 0, where a second-order attribute error may remain bounded by bφ.The passage gives c = 0 as an example.Source: §S.2.5 · p. 52
• In ordinary record coordinates, the mean-gradient smoothness constant is Cobs/Nm; rescaling averages to raw sums rescales signal and uncertainty, so normalization alone provides no privacy.A nonlinear coordinate chart may add derivative terms that require control.Source: §S.2.5 · pp. 52–53
• Attribute error depends on alignment with the specified attribute direction: small-eigenvalue directions contribute nothing when the corresponding c_j is zero, unlike full-coordinate reconstruction.The threshold interpretation uses an error bound rather than exact attribute recovery.Source: §S.2.5 · p. 53

S.2.6. Proof of Lemma 4.6.

• A single uniform event controls cross-client gradient and Hessian differences across the entire fitted trajectory, including states selected using the targeting sample.The proof fixes the function cover before fitting and applies it to both weighting modes.Source: §S.2.6 · p. 55

S.2.7. Proof of Lemma 4.7.

• Averaging error is bounded through cross-client derivative differences and local-fit disagreement, without requiring positive curvature along segments between local minima.The weighted local directions cancel any gradient component common to all clients, preserving the sample-size factor.Source: §S.2.7 · pp. 58–59

S.2.8. Proof of Theorem 4.8.

• The theorem bounds accumulated targeting gaps by clientwise loss decreases plus averaging error, and retired clients retain constant local outputs.The fixed client weights make loss differences telescope across changing active sets; the finite-sum argument also holds at adaptive retirement times.Source: §S.2.8 · pp. 62–63
• The sampling-coefficient ratio for sample-size versus uniform weights is the arithmetic mean of active sample sizes divided by their harmonic mean, with equality only when sizes are equal.Extracting an individual guarantee costs a factor M under uniform weights and n/Nm under sample-size weights.Source: §S.2.8 · p. 64

S.3.1. Optimization-defined target and fluctuation.

• The benchmark targets a three-coordinate entropy-regularized optimal-transport assignment for positive densities on R2, with a pooled solve providing an endpoint check.It uses four fixed destinations with equal capacities and a normalized logistic density fluctuation.Source: §S.3.1 · pp. 65–66

S.3.2. Data-generating distributions.

• The benchmark uses two distinct distributions: a three-component bivariate Gaussian mixture and a curved distribution with location-dependent conditional spread.The targeting sample has n = 10,000; for M ∈ {5,10,20,40}, client proportions increase linearly and random and spatial partitions use identical client counts.Source: §S.3.2 · p. 66

S.3.3. Client partitions and common initialization.

• Random partitions permute indices into client-sized blocks, while spatial partitions bias 20% of each client’s positions by noisy standardized scores, preserving sizes but violating Assumption 4.5.The spatially biased subset is selected uniformly without replacement; remaining observations are randomly allocated.Source: §S.3.3 · p. 66
• A Gaussian KDE p0 uses an independent 2,000-observation pilot and Scott’s dimension-two covariance rule; pilot fitting and common-representation distribution are setup costs.The pilot sample, p0, and numerical integration settings are held fixed across methods, partitions, and client counts.Source: §S.3.3 · p. 66