Research map / Federated learning and privacy / Differential privacy
Differentially private federated learning
Apply clipping and noise in federated learning with client-level privacy.
35 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2020–2026) · an approach in Differential privacy, keyword cluster “dp sgd · gradient · clipping”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
5 papers in 2023–24 and 23 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic grew, from 2.3% to 8.6%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2020 · Federated Latent Dirichlet Allocation: A Local Differential Privacy Based Framework (AAAI 2020 · 119 citations)
- 2021 · FLAME: Differentially Private Federated Learning in the Shuffle Model (AAAI 2021 · 102 citations)
- 2022 · Differentially Private Federated Learning With Local Regularization and Sparsification (CVPR 2022 · 117 citations)
- 2023 · Make Landscape Flatter in Differentially Private Federated Learning (CVPR 2023 · 98 citations)
- 2024 · Noise-Aware Algorithm for Heterogeneous Differentially Private Federated Learning (ICML 2024 · 0 citations)
- 2025 · Enabling Differentially Private Federated Learning for Speech Recognition: Benchmarks, Adaptive Optimizers, and Gradient Clipping (NeurIPS 2025 · 5 citations)
- 2026 · Continual Learning With Participation Privacy: An Auditable Buffering-Aggregation Recipe (ICML 2026 · 0 citations)
Earliest papers here
- Federated Latent Dirichlet Allocation: A Local Differential Privacy Based Framework (AAAI 2020 · 119 citations)
- FLAME: Differentially Private Federated Learning in the Shuffle Model (AAAI 2021 · 102 citations)
- Differentially Private Learning with Adaptive Clipping (NeurIPS 2021 · 86 citations)
What has been tried
24 papers here report 226 measured changes (a component added, removed or swapped, compared with a baseline): helped 62%, no clear effect 10%, hurt 23%, mixed 5%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Use dimension-based per-layer clipping instead of uniform per-layer clipping | CV-en test · WER | 21.2 -> 20.4 | Helped | Enabling Differentially Private Federated Learning for Speech Recognition: Benchmarks, Adaptive Optimizers, and Gradient Clipping (NeurIPS 2025 · 5 citations) |
| Set ϑ=1 instead of using ϑ>1 | EMNIST, σ_g=1.0 · testing accuracy | 78.05% -> 77.14% | Hurt | Clients Collaborate: Flexible Differentially Private Federated Learning with Guaranteed Improvement of Utility-Privacy Trade-off (ICML 2025 · 3 citations) |
| add orthonormal rows to periodically reinitialized A | MNLI matched and mismatched, DP ε=6 · accuracy | +0.92/+1.17 pp | Helped | FedSVD: Adaptive Orthogonalization for Private Federated Learning with LoRA (NeurIPS 2025 · 2 citations) |
| Add the residual term to the local prompt | Caltech101 local classes, rank 8, ε=0.4 · accuracy | 90.13±1.19 -> 95.74±0.63 | Helped | Privacy-Preserving Personalized Federated Prompt Learning for Multimodal Large Language Models (ICLR 2025 · 2 citations) |
| Use multiplicative-update steps instead of Lipschitz steps | Goodreads · F1 score | 0.059 -> 0.125 | Helped | Federated Binary Matrix Factorization Using Proximal Optimization (AAAI 2025 · 1 citation) |
| Set over-sketching parameter p from 0 to 128 | MMLU, non-IID α=0.1, ε=3 · score | 45.63 -> 46.06 | No clear effect | Differentially Private Federated Low Rank Adaptation Beyond Fixed-Matrix (NeurIPS 2025 · 1 citation) |
| use Honaker online factorization instead of optimal factorization | Stack Overflow Next Word Prediction and Federated EMNIST · test accuracy | Hurt | DMM: Distributed Matrix Mechanism for Differentially-Private Federated Learning Based on Constant-Overhead Linear Secret Resharing (ICML 2025 · 0 citations) | |
| Replace CAF with coordinate-wise trimmed mean | MNIST and Fashion-MNIST, label flipping and sign flipping · accuracy | Hurt | Towards Trustworthy Federated Learning with Untrusted Participants (ICML 2025 · 0 citations) | |
| Use cosine similarity scoring instead of a nearest-neighbors histogram | bioRxiv · FID | Helped | Private Federated Learning using Preference-Optimized Synthetic Data (ICML 2025 · 0 citations) |
What reviewers will expect
Datasets and baselines named in the 14 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- CIFAR-10 · 2 of 14 papers
- MNIST · 2 of 14 papers
Baselines
- FedAvg · 3 of 14 papers
- DP-FedAvg · 2 of 14 papers
- FFA-LoRA · 2 of 14 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 28 papers; from OpenAlex and the papers' affiliations).
- Apple · 2 papers
Use it
Download BibTeX of 31 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Private training with public data (96 papers)
- Differentially private synthetic data (81 papers)
- DP-SGD refinements (60 papers)
Elsewhere in the topic
- Privacy accounting and mechanisms (127 papers)
- Private online and user-level learning (116 papers)
- Local-DP and private estimation (113 papers)
- Private data analysis frameworks (105 papers)
- Differentially private clustering (41 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).