Research map / Federated learning and privacy / Differential privacy

Certifiably Robust Model Evaluation in Federated Learning under Meta-Distributional Shifts

ICML 2025 · Federated learning and privacy › Differential privacy · approach: Private online and user-level learning · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Certifies performance of a federated model on unseen networks under f-divergence or Wasserstein meta-distributional shifts, using only server-side queries of local (robust) losses and a robust DKW inequality.

Problem

Certifying a federated learning model's average loss and risk CDF on an unseen target network whose client-distribution meta-distribution differs from the source by a bounded f-divergence or Wasserstein shift, without accessing client data.

Approach

Extends the DKW inequality and Glivenko-Cantelli theorem to adversarial (meta-distributionally robust) settings by reweighting client loss values with coefficients constrained near uniform for f-divergence shifts, and by querying local Wasserstein-adversarial losses with per-client radii for Wasserstein shifts; bounds are convex/quasi-convex server-side programs with vanishing gaps.

Key results

• Non-robust risk CDF bounds hold for unseen clients drawn from the population in simulated federated networks of 1000 nodes with 1000 samples each.
• f-divergence (chi-square and KL) robust CDF certificates tightly capture the risk CDF of the shifted target meta-distribution on CIFAR-10 resolution and color shifts.
• Bounds have vanishing generalization gaps of order sqrt(log K / K) and 1/sqrt(min n_k) as K and n_k grow, and are claimed asymptotically minimax optimal.

Measured effects reported in the paper

Limitations

• Wasserstein shifts give guarantees only for average loss, not the full risk CDF.
• Empirical evaluation is simulated with synthetic affine shifts and a single CNN.
• Differential privacy guarantees are not provided.

Experimental setup

Datasets: CIFAR-10 SVHN EMNIST ImageNet

Benchmarks: CIFAR-10 SVHN EMNIST ImageNet

Metrics: risk CDF bound tightness average loss bound

Baselines: MMD-based bound vanilla DKW bound

Builds on: DKW inequality Glivenko-Cantelli theorem distributionally robust optimization McDiarmid inequality

Closest papers by meaning

• Towards Trustworthy Federated Learning with Untrusted Participants (ICML 2025 · similarity 0.88)
• Towards the Robustness of Differentially Private Federated Learning (AAAI 2024 · similarity 0.88)
• Noise-Aware Algorithm for Heterogeneous Differentially Private Federated Learning (ICML 2024 · similarity 0.88)
• Efficient Federated Learning against Byzantine Attacks and Data Heterogeneity via Aggregating Normalized Gradients (NeurIPS 2025 · similarity 0.86)
• Generalization in Federated Learning: A Conditional Mutual Information Framework (ICML 2025 · similarity 0.86)
• One-shot Empirical Privacy Estimation for Federated Learning (ICLR 2024 · similarity 0.86)