Research map / Federated learning and privacy / Privacy attacks and secure learning
Private federated aggregation
Secure aggregation and encrypted gradients for efficient, fair federated learning.
50 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2021–2026) · an approach in Privacy attacks and secure learning, keyword cluster “preserving · vfl · encryption”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
25 papers in 2023–24 and 19 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic shrank, from 19.1% to 13.4%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2021 · FedRec++: Lossless Federated Recommendation with Explicit Feedback (AAAI 2021 · 124 citations)
- 2022 · Federated Learning for Face Recognition with Gradient Correction (AAAI 2022 · 76 citations)
- 2023 · Securing Secure Aggregation: Mitigating Multi-Round Privacy Leakage in Federated Learning (AAAI 2023 · 63 citations)
- 2024 · No Prejudice! Fair Federated Graph Neural Networks for Personalized Recommendation (AAAI 2024 · 32 citations)
- 2025 · Federated Unlearning with Gradient Descent and Conflict Mitigation (AAAI 2025 · 23 citations)
- 2026 · Collaborative Threshold Watermarking (ICML 2026 · 0 citations)
Earliest papers here
- FedRec++: Lossless Federated Recommendation with Explicit Feedback (AAAI 2021 · 124 citations)
- Federated Learning for Face Recognition with Gradient Correction (AAAI 2022 · 76 citations)
- FLamby: Datasets and Benchmarks for Cross-Silo Federated Learning in Realistic Healthcare Settings (NeurIPS 2022 · 73 citations)
What has been tried
44 papers here report 431 measured changes (a component added, removed or swapped, compared with a baseline): helped 58%, no clear effect 10%, hurt 27%, mixed 4%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Increase fairness budget β | Across datasets · disparity | 9% ∼ 67% | Helped | No Prejudice! Fair Federated Graph Neural Networks for Personalized Recommendation (AAAI 2024 · 32 citations) |
| add UCE instead of using Gradient Ascent on CE | FMNIST after unlearning · R-Acc | .163 -> .806 | Helped | Federated Unlearning with Gradient Descent and Conflict Mitigation (AAAI 2025 · 23 citations) |
| Use CLI to select sensitive layers instead of selecting layers randomly | Cifar10 client unlearning · remaining-data accuracy | Helped | Unlearning through Knowledge Overwriting: Reversible Federated Unlearning via Selective Sparse Adapter (CVPR 2025 · 22 citations) | |
| Increase FedBary support size from S=100 to S=500 | Client evaluation, N=5, N=10, N=50 and N=100 · elapsed time | 1m / 2m; 2m / 4m; 14m / 30m; 21m / 1h | Hurt | Data Valuation and Detections in Federated Learning (CVPR 2024 · 15 citations) |
| Negate the convolution projection layer | Caltech-101 · Avg. Gap | Helped | NoT: Federated Unlearning via Weight Negation (CVPR 2025 · 12 citations) | |
| Use OR rather than the automatically selected AND connector | CUB · model accuracy | 89.49% -> 87.96% | Hurt | LR-XFL: Logical Reasoning-Based Explainable Federated Learning (AAAI 2024 · 12 citations) |
| Add the orthogonal constraint to watermark training | CIFAR-10 · ACC | 95.59 -> 95.68 | Helped | MFL-Owner: Ownership Protection for Multi-modal Federated Learning via Orthogonal Transform Watermark (AAAI 2025 · 10 citations) |
| add local graph transformation with information bottleneck | Cora, 2.6% · MIA AUC (%) | 76.4 -> 53.2 | Helped | Federated Graph Condensation with Information Bottleneck Principles (AAAI 2025 · 7 citations) |
| add semantic loss to the generator | CIFAR10 · classification accuracy | 69.19 -> 70.56 | Helped | PPIDSG: A Privacy-Preserving Image Distribution Sharing Scheme with GAN in Federated Learning (AAAI 2024 · 6 citations) |
| add tokenization | Ulsan Pedal · HR@10 | 2.182% -> 7.329% | Helped | General Commerce Intelligence: Glocally Federated NLP-Based Engine for Privacy-Preserving and Sustainable Personalized Services of Multi-Merchants (AAAI 2024 · 5 citations) |
| Adjust training of the server update g0 | Model convergence experiments · accuracy | Helped | EBS-CFL: Efficient and Byzantine-robust Secure Clustered Federated Learning (AAAI 2025 · 3 citations) | |
| Remove the denominator from the Ferrari feature-sensitivity loss (Non-Lipschitz variant) | Backdoor unlearning · accuracy on retain dataset Dr (%) | Dr accuracy drops below 10% | Hurt | Ferrari: Federated Feature Unlearning via Optimizing Feature Sensitivity (NeurIPS 2024 · 3 citations) |
What reviewers will expect
Datasets and baselines named in the 16 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- CIFAR-10 · 9 of 16 papers
- CIFAR-100 · 6 of 16 papers
- MNIST · 5 of 16 papers
- FashionMNIST · 3 of 16 papers
- Reddit · 2 of 16 papers
Baselines
- FedEraser · 3 of 16 papers
- FedAvg · 2 of 16 papers
- Retraining · 2 of 16 papers
- MoDe · 2 of 16 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 44 papers; from OpenAlex and the papers' affiliations).
- Nanyang Technological University · 6 papers
- National University of Singapore · 3 papers
- Shandong University · 2 papers
- University of California, Berkeley · 2 papers
- Beijing University of Posts and Telecommunications · 2 papers
- Illinois Institute of Technology · 2 papers
- East China Normal University · 2 papers
- The Chinese University of Hong Kong · 2 papers
- University of Illinois, Urbana Champaign · 2 papers
- Carnegie Mellon University · 2 papers
Use it
Download BibTeX of 28 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Encryption-based private learning (105 papers)
- Visual privacy and face de-identification (39 papers)
Elsewhere in the topic
- Defending federated learning against poisoning (76 papers)
- Gradient inversion attacks (47 papers)
- Membership inference and auditing (47 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).