Research map / Federated learning and privacy / Privacy attacks and secure learning
Federated Behavioural Planes: Explaining the Evolution of Client Behaviour in Federated Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Introduces Federated Behavioural Planes (error and counterfactual behavioural spaces) to visualise and explain client trajectories in federated learning, and Federated Behavioural Shields, a robust aggregation built on them that outperforms Median, Trimmed-mean, Krum and RFA under several attacks.
Problem
Understanding how the evolving behaviour of individual FL clients, beneficial or detrimental, affects the global model's predictive performance and decision-making remains unaddressed; existing anomaly detection and robust aggregation do not track or explain it.
Approach
Combines behavioural spaces (PCA over the server-side error vectors) with counterfactual-based distances (tSNE over Wasserstein distances between client counterfactual distributions, with counterfactual generators trained jointly with the predictor in FL) to form two planes that track client trajectories; the planes' scores weight client models in aggregation.
Key results
- Adding the counterfactual generator to FL leaves predictor accuracy essentially unchanged (e.g., Breast Cancer 98.4% with Predictor+CF vs 97.7% predictor-only).
- Federated Behavioural Shields outperform Krum, Median and Trimmed-mean on Breast, Diabetes and small-MNIST, improving over Median by up to 10 pp under label-flipping on small-MNIST.
- Client-specific counterfactual generators reduce relative proximity by up to 70% on the Synthetic dataset under non-IID conditions.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add a jointly trained counterfactual generator to the FL predictor | FedAvg · Diabetes | accuracy: 74.2 $\pm$ 0.1\% -> 74.7 $\pm$ 0.1\% | No clear effect |
| Add a jointly trained counterfactual generator to the FL predictor | FedAvg · Breast Cancer | accuracy: 97.7 $\pm$ 0.4\% -> 98.4 $\pm$ 0.1\% | Helped |
| Add a jointly trained counterfactual generator to the FL predictor | FedAvg · Synthetic | accuracy: 99.9 $\pm$ 0.1\% -> 99.8 $\pm$ 0.1\% | No clear effect |
| Use FL rather than Local CL to train the predictor and counterfactual generator | Predictor + CF · Diabetes | validity: 87.6 $\pm$ 2.6\% -> 99.9 $\pm$ 0.0\% | Helped |
| Use FL rather than Local CL to train the predictor and counterfactual generator | Predictor + CF · Diabetes | sparsity: 45.4 $\pm$ 2.1 -> 37.1 $\pm$ 1.2 | Hurt |
| Use client-specific adaptation of the counterfactual generator | Federated Behavioural Planes · Synthetic, Breast Cancer, Diabetes | client proximity: up to 70\% | Helped |
| Use Federated Behavioural Shields instead of Median aggregation | Federated learning under Label-flipping · Breast, Diabetes, small-MNIST | accuracy: up to 10 percentage points (pp) | Helped |
| Use Federated Behavioural Shields instead of Median aggregation | Federated learning with no attack · small-MNIST | accuracy: up to 16 pp | Helped |
| Use Trimmed-mean instead of Federated Behavioural Shields | Federated learning under Inverted-gradient attack · small-MNIST | accuracy | Hurt |
| Use only counterfactual information instead of combining counterfactual and predictive-performance descriptors | Federated Behavioural Shields · No-attack conditions | accuracy | Mixed |
| Use CF generator embedding size 64 rather than 128 (ablation) | ResNet-18 counterfactual generator · small-MNIST | accuracy: $86.0\pm0.3\%$ -> $85.6\pm0.4\%$ | Hurt |
| Use CF generator embedding size 32 rather than 128 (ablation) | ResNet-18 counterfactual generator · small-MNIST | accuracy: $86.0\pm0.3\%$ -> $87.6\pm0.5\%$ | Helped |
Surprising findings
- Predictive performance alone does not reliably identify malicious clients in non-IID settings, since honest clients can also show consistently low performance.
- The defense surpasses FedAvg without attackers on Breast Cancer and small-MNIST.
Limitations
- Assumes the server holds a clean validation set for querying client models.
- Counterfactual generators add computational and communication overhead over FedAvg.
Experimental setup
Datasets: Synthetic Breast Cancer Wisconsin Diabetes Health Indicator small-MNIST small-CIFAR-10
Benchmarks: Breast Cancer Wisconsin Diabetes Health Indicator small-MNIST Synthetic
Metrics: accuracy counterfactual validity proximity sparsity
Baselines: Median Trimmed-mean Krum RFA FedAvg VCNet
Builds on: FedAvg semantic spaces behavioural spaces counterfactual explanations CFGen
Closest papers by meaning
- FedAA: A Reinforcement Learning Perspective on Adaptive Aggregation for Fair and Robust Federated Learning (AAAI 2025 · similarity 0.87)
- VFLAIR: A Research Library and Benchmark for Vertical Federated Learning (ICLR 2024 · similarity 0.86)
- FedLMT: Tackling System Heterogeneity of Federated Learning via Low-Rank Model Training with Theoretical Guarantees (ICML 2024 · similarity 0.86)
- FedCross: Intertemporal Federated Learning Under Evolutionary Games (AAAI 2025 · similarity 0.86)
- TRAIL: Trust-Aware Client Scheduling for Semi-Decentralized Federated Learning (AAAI 2025 · similarity 0.86)
- FLUX: Efficient Descriptor-Driven Clustered Federated Learning under Arbitrary Distribution Shifts (NeurIPS 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.