--- kind: concept slug: federated-learning title: Federated learning summary: >- Clients train on their own data and a server combines what they send, so raw data stays on devices. What a client sends sets the trade-off: weights (FedMA), class embeddings (FedProto) or distilled predictions (FedDF, FedNTD). FedDyn corrects each client's objective, FedGen trains a data-free generator, Ditto keeps a personal model per device, FairFed reweights for fairness, k-FED clusters once. tags: [federated-learning, privacy, communication-efficiency, non-iid, model-heterogeneity, fairness, personalization, clustering, knowledge-distillation, reinforcement-learning, model-fusion, data-free, transfer-learning, robustness, benchmark, wireless-networks, blockchain, data-poisoning] papers: ["1808.07217", "1907.09173", "1910.13067", "2002.06440", "2006.07242", "2007.13518", "2011.09902", "2012.04221", "2012.10544", "2101.05428", "2101.07511", "2103.00697", "2103.00710", "2103.04628", "2105.00243", "2105.10056", "2106.03097", "2108.00974", "2108.11887", "2109.12273", "2110.00857", "2110.01167", "2111.04263", "2203.11473", "2211.12814"] related: [adversarial-robustness, algorithmic-fairness, backdoor-attack, catastrophic-forgetting, clustered-federated-learning, continual-learning, contrastive-learning, data-poisoning, differential-privacy, digital-twin, domain-adaptation, ensemble-learning, federated-aggregation, federated-reinforcement-learning, hypernetwork, k-means-clustering, knowledge-distillation, local-sgd, model-inversion, model-merging, personalized-federated-learning, prototype-learning, transfer-learning, vertical-federated-learning] status: draft updated_at: 2026-11-01 --- ## Overview In federated learning (FL) many clients train on data they keep locally, and a server combines what they send into a shared result. Two things decide the design: what a client sends, and how the server combines it. A third choice is how the data is split. In horizontal FL the parties share a feature space and differ in samples; in vertical FL they share users and differ in features [arxiv:2211.12814 §2.1] [arxiv:2211.12814 tab. 1]. A survey adds federated transfer learning, where a pre-trained model gains new features, and separates cross-silo settings (few, always-available organisations) from cross-device ones (many devices that need client selection and incentives) [arxiv:2101.05428 §3]. Its generic loop is the same four steps every round: select clients, broadcast the global parameters, train locally, and aggregate [arxiv:2101.05428 §2]. The baseline is FedAvg, which averages weights position by position and assumes every client runs the same architecture [arxiv:2105.00243 eq. 1]. Its averaging step can fail when hidden units are arranged in different orders on different clients [arxiv:2002.06440 §2]. The cards in this wiki answer the question differently. FedMA keeps sending weights but aligns the units first [arxiv:2002.06440 §2.1]. FedProto sends one mean embedding per class instead of weights [arxiv:2105.00243 eq. 3]. FedDyn sends weights but changes each client's local objective, and each client keeps a gradient-sized vector between rounds [arxiv:2111.04263 eq. 1] [alg. 1]. FedProc keeps the local-then-average loop and adds a prototype term to the local loss [arxiv:2109.12273 §3.3]. FairFed keeps the FedAvg update and changes only the server's weights, so each client's share depends on how far its local fairness gap sits from the global one [arxiv:2110.00857 §4.2] [eq. 6]. Hypernetwork-based personalization keeps one server-side network that writes a separate model for each client from a learned client embedding [arxiv:2103.04628 §3.2]. Ditto keeps the shared model and gives each device a personal copy pulled toward it [arxiv:2012.04221 §3.1]. Clustered federated learning averages clients within groups, then across groups, with groups fixed by imaging modality in one medical study [arxiv:2101.07511 §3.1]. FedNTD keeps the averaging loop and changes only the local loss, adding a distillation term over the not-true classes [arxiv:2106.03097 §3]. FedDF leaves client training alone and has the server fuse the clients' predictions by distillation on unlabeled or generated data [arxiv:2006.07242 alg. 1]. FedGen needs no data at all: the server learns a generator from the clients' prediction layers, and the clients train on its samples [arxiv:2105.10056 §3.1] [§3.2]. FedHealth encrypts the weight updates, then each user fine-tunes only its fully connected layers with a CORAL term [arxiv:1907.09173 §3.3] [§3.4]. k-FED does not train a shared model: each device clusters its own data once and sends a few centers, and the server groups them [arxiv:2103.00697 alg. 2]. Some cards carry no new method of their own: FedML is a library and benchmark [arxiv:2007.13518 §1], one survey sorts personalized FL into two strategies [arxiv:2103.00710 §II], a trustworthiness survey lists federated learning under privacy computing, next to secure multi-party computation [arxiv:2110.01167 §3.2.5], an intrusion-detection study compares two aggregation rules on IoT traffic [arxiv:2108.00974 §5], and a reinforcement-learning survey sorts federated RL into two families [arxiv:2108.11887 §4.2] [arxiv:2108.11887 §4.3]. FEDL keeps the averaging loop but has each device minimise a local surrogate that adds a global gradient estimate, solved only to a local accuracy θ [arxiv:1910.13067 §IV] [arxiv:1910.13067 alg. 1]. A digital-twin design places each user's twin on a base station, averages in two levels, and logs model records on a permissioned blockchain [arxiv:2011.09902 §2.2] [§2.3]. A dataset-security survey treats federated learning as both an attack setting and a defense setting [arxiv:2012.10544 §2.7] [§4.5]. One card is data-centre training rather than federated learning. It runs mini-batch SGD first, then lets workers take several local steps between averages, and it lists local SGD under the name federated averaging [arxiv:1808.07217 §1] [§3]. Its goal is communication cost and generalization at large batch sizes, not client privacy [arxiv:1808.07217 §1]. Its runs split one training set across workers and reshuffle it each epoch [arxiv:1808.07217 app. A.4.1], so the non-IID setting above is not tested there. Card: [Don't Use Large Mini-Batches, Use Local SGD](/papers/1808.07217). ## Variants ### Layer-wise weight matching (FedMA) Units in a hidden layer can be reordered without changing the function, so averaging unaligned weights mixes unrelated units [arxiv:2002.06440 §2] [arxiv:2002.06440 eq. 1]. FedMA matches units across clients one layer at a time, using a Bayesian nonparametric assignment solver (BBP-MAP), then averages only the matched units. Unmatched units can open new units in the shared layer, so the global model may grow [arxiv:2002.06440 §2.1] [arxiv:2002.06440 eq. 3]. The same matching is applied to CNN channels and LSTM hidden states [arxiv:2002.06440 §2.2]. After each matched layer, clients retrain the layers above it with that layer frozen, so one full pass takes as many communication rounds as the network has layers [arxiv:2002.06440 §2.3] [arxiv:2002.06440 alg. 1]. Author-reported results: a 9-layer CNN on CIFAR-10 with 16 heterogeneous clients reaches 87.53%, against 86.29% for FedAvg and 85.32% for FedProx; its model is 1.11x the baseline size [arxiv:2002.06440 tab. 1]. An LSTM on Shakespeare text with 66 clients reaches 49.07%, against 46.63% and 45.83% [arxiv:2002.06440 tab. 2]. The paper also reports higher accuracy for the same total message size, shown only in a plot [arxiv:2002.06440 fig. 2]. The baselines were run without a shared random initialization [arxiv:2002.06440 app. A]. Costs: each client runs N-1 local retraining jobs per pass [arxiv:2002.06440 alg. 1], and worst-case matching cost is cubic in the number of units across clients [arxiv:2002.06440 app. E]. Batch-norm layers were removed from the CNN, and the paper does not say how their running statistics would be matched [arxiv:2002.06440 §3]. Card: [Federated Learning with Matched Averaging](/papers/2002.06440). ### Class prototype sharing (FedProto) Each client computes, for every class it holds, the mean embedding of its training examples. This mean is the prototype [arxiv:2105.00243 eq. 3]. The server averages the prototypes of each class over the clients that hold that class [arxiv:2105.00243 eq. 6]. A client trains with cross-entropy plus a weighted penalty that pulls each sample's embedding toward the global prototype of its label [arxiv:2105.00243 eq. 7]. The only requirement on architecture is that the embedding dimension matches [arxiv:2105.00243 app. B]. Author-reported results with 20 clients, where each client is scored on its own classes: CIFAR10 with about three classes per client reaches 84.49% ± 1.97, against 81.72% ± 2.77 for FedAvg [arxiv:2105.00243 tab. 1]. On MNIST with the same split it reaches 97.13% ± 0.30, against 95.04% ± 6.48 [arxiv:2105.00243 tab. 1]. Per round, FedProto sends about 4×10³ parameters on MNIST and FEMNIST and about 41×10³ on CIFAR10, while FedAvg sends 430×10³ and 235,000×10³ respectively [arxiv:2105.00243 tab. 1]. Limits: there is no global classifier. Each client keeps its own model, and the reported accuracies are personalized, per-client numbers [arxiv:2105.00243 §Discussion]. The privacy argument is informal and no attack is evaluated [arxiv:2105.00243 §Discussion]. Card: [FedProto: Federated Prototype Learning across Heterogeneous Clients](/papers/2105.00243). ### Prototype-contrastive local loss (FedProc) FedProc keeps the FedAvg loop and changes the local objective. The server keeps one prototype per class, the average of the clients' class means, and sends it to every client with the model at the start of each round [arxiv:2109.12273 alg. 1]. A client adds a contrastive term that pulls each feature toward its own class prototype and away from the others, using cosine similarity [arxiv:2109.12273 eq. 4]. The local loss mixes this term with cross-entropy using α = 1 − t/T, so the contrastive term has full weight in round 0 and the cross-entropy term none [arxiv:2109.12273 eq. 2] [alg. 1 l.21]. After local training, each client recomputes its class means with an extra pass over its data [arxiv:2109.12273 alg. 1 l.26-30]. Author-reported results, with 10 clients, 100 rounds, 10 local epochs and a Dirichlet split at β = 0.5 [arxiv:2109.12273 tab. 1]: top-1 accuracy is 70.7% on CIFAR-10, 74.6% on CIFAR-100 and 35.4% on Tiny-ImageNet. MOON reports 69.1%, 67.5% and 27.5%, and FedAvg 66.3%, 64.5% and 26.2% [arxiv:2109.12273 tab. 2]. At β = 0.1 on CIFAR-100 the values are 68.9% for FedProc and 64.0% for MOON [arxiv:2109.12273 tab. 3]. A fixed α = 0.5 gives 68.9% on CIFAR-100 and a two-stage schedule gives 67.5%, so the schedule carries much of the gain [arxiv:2109.12273 tab. 4]. In the scalability runs on CIFAR-100 with 100 clients, FedProc reaches 70.6% at 500 rounds, against 61.8% for MOON [arxiv:2109.12273 tab. 6]. Costs and limits: on CIFAR-10 a FedProc round takes 11m57s, against 8m34s for FedAvg on the authors' hardware [arxiv:2109.12273 tab. 5]. The authors call the overhead acceptable [arxiv:2109.12273 §4.3]. All three benchmarks are image classification [arxiv:2109.12273 §4.1]. The paper has no official code [arxiv:2109.12273 §Paper vs code]. Card: [FedProc: Prototypical Contrastive Federated Learning on Non-IID data](/papers/2109.12273). ### Dynamic regularisation (FedDyn) Each active client minimises its local loss plus a penalty that is refreshed every round. The penalty has a linear term built from the client's stored gradient and a quadratic pull toward the server model [arxiv:2111.04263 eq. 1]. After solving, the client updates its stored gradient with a first-order identity [arxiv:2111.04263 eq. 2]. The server averages the active models and subtracts a correction state h, scaled by 1/α [arxiv:2111.04263 alg. 1]. Clients that are not selected keep both their model and their stored gradient [arxiv:2111.04263 alg. 1]. The reasoning is that, at a consensus point, the penalty gradient vanishes, so each client's stationary point is the server model [arxiv:2111.04263 §2]. The proof covers strongly convex, convex and non-convex losses, with a fixed number of active clients chosen uniformly at random [arxiv:2111.04263 §2.1]. Author-reported results, with 100 devices, measured as models transmitted to reach a target test accuracy [arxiv:2111.04263 tab. 1]. On IID CIFAR-10 with 10% participation, FedDyn needs 637 units to reach 84.5%, against 1852 for SCAFFOLD, while FedAvg and FedProx do not reach it within 1000 rounds [arxiv:2111.04263 tab. 1]. With full participation on the same data and a target of 85.0%, the SCAFFOLD ratio is 9.4 [arxiv:2111.04263 tab. 2]. On IID MNIST with full participation, the costs are 38 for FedDyn, 72 for SCAFFOLD, 194 for FedAvg and 445 for FedProx [arxiv:2111.04263 tab. 2]. Costs and limits: each client stores a vector the size of the model across rounds, and the paper does not give a memory figure [arxiv:2111.04263 alg. 1]. The experiments run SGD on the penalised objective instead of the exact local solve that the theory assumes [arxiv:2111.04263 §3]. The α value is tuned on a grid, and the chosen CIFAR values are not stated [arxiv:2111.04263 app. Hyperparameters]. Card: [Federated Learning Based on Dynamic Regularization](/papers/2111.04263). ### Global-gradient surrogate over wireless links (FEDL) Each device n solves a surrogate J_n^t. It is the local loss plus a linear term that pushes the local gradient toward the global gradient estimate, scaled by a hyper-learning rate η [arxiv:1910.13067 §IV] [eq. 2]. The device stops when its gradient norm falls below θ times the starting value [arxiv:1910.13067 eq. 3]. The server averages both the returned models and the full local gradients, with weights D_n / D, and sends both back [arxiv:1910.13067 eq. 4] [eq. 5]. Each device therefore uploads two vectors per round, and the authors count both in the wireless cost model [arxiv:1910.13067 §V-A]. Under smoothness and strong convexity the authors prove a linear rate Θ, which depends on η, θ and the condition number ρ [arxiv:1910.13067 eq. 10] [eq. 11]. Θ must lie in (0, 1) for the bound to hold, and a large η can push it out of that range [arxiv:1910.13067 §IV remark 3]. The number of local gradient steps K_l that meets the accuracy test is set by a lemma with unstated constants [arxiv:1910.13067 lemma 1] [eq. 9]. The wireless part allocates CPU frequency, uplink time shares and transmit power to minimise time and energy, and the resulting problem is non-convex, so the solution is a stationary point [arxiv:1910.13067 §V-C] [theorem 2]. Author-reported results, with N = 100 devices and S = 10 sampled per round on MNIST with three labels per device [arxiv:1910.13067 §VI]. Read from the figure, the test accuracy against FedAvg is about 0.7 to 1.3 points higher at batch sizes 20 and 40, and about 0.8 points higher at full batch [arxiv:1910.13067 fig. 4]. The paper calls the gap to the exact global solution negligible on synthetic data, without a number [arxiv:1910.13067 fig. 3]. The text calls the gap to FedAvg significant on MNIST and FEMNIST when local rounds range from 10 to 40, without a number [arxiv:1910.13067 fig. 5]. The FedAvg learning rate is tuned by a grid search that the paper does not report [arxiv:1910.13067 §VI]. Costs and limits: the convergence theory covers full-batch gradient descent, full participation and smooth, strongly convex losses [arxiv:1910.13067 §IV remark 5]. The experiments use mini-batches, partial participation and a one-hidden-layer network, which the theory does not cover [arxiv:1910.13067 §VI]. Choosing η and θ needs L and β, which the paper does not show how to estimate [arxiv:1910.13067 §IV]. Card: [Federated Learning over Wireless Networks: Convergence Analysis and Resource Allocation](/papers/1910.13067). ### Not-true distillation (FedNTD) Each client trains on cross-entropy plus a distillation term that is computed over the wrong classes only. The targets come from a frozen copy of the global model at the start of the round. The true-class logit is removed from both softmaxes, so the term gives it no gradient [arxiv:2106.03097 §3]. The authors argue that non-IID training makes the shared model forget what it knew about classes a client does not hold. They use the forgetting measure as a diagnostic and do not prove the causal link [arxiv:2106.03097 §1] [§2]. The weight β sets how strongly that knowledge is kept. The paper fixes β and τ at 1 without a search [arxiv:2106.03097 app. Algorithm Implementation Details]. The paper states that the method adds no communication [arxiv:2106.03097 §4.2]. Author-reported results, on four datasets with 100 clients (200 for CINIC-10) and two partition schemes [arxiv:2106.03097 §4.1]. The method has the highest accuracy in 10 of the 14 settings. SCAFFOLD is higher in the other four, by at most 1.3 points [arxiv:2106.03097 tab. 1]. On CIFAR-10 with two shards per client it reaches 52.61%, against 40.14% for FedAvg [arxiv:2106.03097 tab. 1]. On MNIST with sharding it reaches 84.44%, against 81.05% for SCAFFOLD and 78.63% for FedAvg [arxiv:2106.03097 tab. 1]. Costs and limits: the paper does not report compute cost. The released code runs the frozen global model forward on every batch, so local compute roughly doubles in the forward pass [code: algorithms/fedntd/ClientTrainer.py#L40]. A small τ lowers accuracy noticeably, while β is less sensitive [arxiv:2106.03097 app. Effect of FedNTD Hyperparameters]. Card: [Preservation of the Global Knowledge by Not-True Distillation in Federated Learning](/papers/2106.03097). ### Server-side ensemble distillation (FedDF) Each round the server forms a data-size-weighted average of the returned client weights and starts from it [arxiv:2006.07242 alg. 1]. It then runs N distillation steps. In each step a batch of unlabeled or generated data passes through every sampled client model, and the student is trained to match the softmax of the mean client logits with a KL loss [arxiv:2006.07242 eq. 1] [§3]. That target is an unweighted mean, so the starting point and the target use different weightings [arxiv:2006.07242 app. B]. Because the server only needs predictions, client models may differ in architecture, size or precision. The server keeps one prototype model per group, and all prototypes are distilled from the same ensemble [arxiv:2006.07242 §3] [app. B]. Clients still send only weights, not input data [arxiv:2006.07242 app. A]. Author-reported results, on CIFAR-10 with ResNet-8 and 20 clients [arxiv:2006.07242 tab. 1]. With 40 local epochs and 40% participation, FedDF needs 20 ± 4 rounds to reach 80% top-1, against 104 ± 52 for FedAvg. At α = 0.1 the figures are 39 ± 10 and 325 ± 82, with a lower target of 75%. With batch normalization at α = 1, FedDF reaches 80.69% against 76.01% for FedAvg [arxiv:2006.07242 tab. 2]. For a binarized ResNet-8 at 80 local epochs it reaches 70.27%, against 65.99% for FedAvg with group normalization [arxiv:2006.07242 tab. 4]. The mixed-architecture results appear only as curves [arxiv:2006.07242 fig. 4]. Costs and limits: each distillation step runs every sampled client model on the batch [arxiv:2006.07242 eq. 1], so server compute grows with participants, and the paper does not measure it [§5]. Labels are still needed on the server, because validation accuracy drives early stopping and the drop-worst rule [arxiv:2006.07242 §4.1] [§4.2]. Random noise as distillation data causes a clear drop, and the paper gives no rule for choosing the domain [arxiv:2006.07242 §5] [fig. 5]. The paper does not say how the logit average works when clients have different label sets [arxiv:2006.07242 app. B]. Card: [Ensemble Distillation for Robust Model Fusion in Federated Learning](/papers/2006.07242). ### Generator-based data-free distillation (FedGen) The server needs no data and no proxy set. From the clients' prediction layers it trains a small generator, conditioned on a label, whose samples the ensemble of clients would classify as that label [arxiv:2105.10056 §3.1] [eq. 4]. Only predictor parameters are needed [§3.1]. The generator is sent to the clients, and each client adds a term to its local loss so that generated samples are classified correctly by its own predictor [arxiv:2105.10056 eq. 5] [§3.2]. The paper argues this term is equivalent to a KL divergence between the generator's and the client's conditional distributions [arxiv:2105.10056 eq. 6] [app. §8.2]. The authors call the generated samples an inductive bias for local training [§4.1]. As an extension, each client can share only its prediction layer and keep the rest local [arxiv:2105.10056 §3.3] [alg. 2]. Author-reported results, with 20 users, 200 rounds and 20 local steps [arxiv:2105.10056 tab. 1]. On MNIST with Dirichlet α = 0.05, FedGen reaches 91.30% ± 0.74, against 87.70% for FedAvg and 90.02% for FedDFusion, a proxy-data distillation baseline [arxiv:2105.10056 tab. 1]. On EMNIST at α = 0.1 it reaches 72.15%, against 70.94% for FedDFusion. The learning curves show fewer rounds to a given accuracy [arxiv:2105.10056 fig. 6]. On EMNIST at α = 0.1 the local time per round is 57.20 to 60.06 ms for generator batch sizes 8 to 128, against 47.66 ms for FedAvg [arxiv:2105.10056 tab. 3]. Costs and limits: the generator is downloaded by clients every round, and its size is not reported [arxiv:2105.10056 §6.2]. The paper says the latent generator can ease privacy concerns, but it gives no privacy analysis [arxiv:2105.10056 §3.1]. The generator's loss weights, diversity weight and weight decay are not stated in the paper [§3] [§6.1], so the implementer must choose them, and the outcome depends on them. The theory assumes binary classification with 0-1 loss [arxiv:2105.10056 app. §8.1], and the paper does not test its bound [arxiv:2105.10056 §4.3]. The official repository departs from the paper's Algorithm 1 and loss in several places and has no license file, so read the card's Paper vs code section before implementing. Card: [Data-Free Knowledge Distillation for Heterogeneous Federated Learning](/papers/2105.10056). ### Encrypted sharing with transfer fine-tuning (FedHealth) FedHealth has two stages. In the first, a cloud CNN is trained on the server's data and sent to each user under additively homomorphic encryption. Each user retrains it on its own data and uploads the encrypted model, and the server aligns its model with the uploads [arxiv:1907.09173 §3.3] [alg. 1]. The paper describes this alignment in words only, with no formula, weighting or schedule beyond a periodic update [arxiv:1907.09173 §3.3]. In the second stage, each user freezes the convolution and pooling layers and fine-tunes the fully connected layers [arxiv:1907.09173 §3.4] [§4.2]. The loss adds a CORAL term, which compares covariance matrices, weighted by η = 0.01 [arxiv:1907.09173 eq. 5] [eq. 6] [§4.2]. The paper does not say exactly which tensors give those matrices [arxiv:1907.09173 §3.4]. Author-reported results, on UCI Smartphone activity recognition. The cloud model is trained on 25 subjects and five isolated subjects are the test users [arxiv:1907.09173 §4.1]. FedHealth averages 99.4%, against 94.1% for the cloud model without transfer [arxiv:1907.09173 tab. 2]. Per-subject gains range from 3.9 to 7.4 points [arxiv:1907.09173 tab. 2]. The numbers come from five averaged runs, with no spread reported [arxiv:1907.09173 §4.2]. The paper says transfer beats no transfer by 4% on average, and that fine-tuning and MMD variants also help, with their values only in a figure [arxiv:1907.09173 §4.4] [fig. 4]. Costs and limits: the encryption scheme, key size and number encoding are not stated beyond the additive property, so the federated part cannot be rebuilt from the text [arxiv:1907.09173 §3.3]. The paper does not say whether the reported accuracies include the encrypted steps [arxiv:1907.09173 §4.2]. Section 3.4 describes two fully connected layers with an alignment layer in place of one, while Section 4.2 describes three [arxiv:1907.09173 §3.4] [§4.2]. The test-set split is not stated, and the study uses one dataset with five test subjects [arxiv:1907.09173 §4.1]. Card: [FedHealth: A Federated Transfer Learning Framework for Wearable Healthcare](/papers/1907.09173). ### Clustered aggregation by imaging modality In one medical study, each client holds chest X-ray or lung ultrasound images. Clients train locally, the server averages within each modality cluster, and then averages across the clusters, so that each cluster counts once in the global model [arxiv:2101.07511 §3.1] [arxiv:2101.07511 alg. 1]. The clusters are fixed by the known modality; they are not learned from the data [arxiv:2101.07511 §3.1]. For the general method, see [clustered federated learning](/concepts/clustered-federated-learning). Author-reported results, on two small binary COVID-19 datasets, with one model evaluated on a merged test set [arxiv:2101.07511 §3.2.1]. For X-ray COVID-19 the F1 is 0.76 for the clustered model, 0.77 for a model trained on X-ray alone and 0.41 for conventional federated learning with one multi-modal model [arxiv:2101.07511 tab. 3]. For ultrasound COVID-19 the F1 values are 0.94, 0.97 and 0.84 in the same order [arxiv:2101.07511 tab. 3]. The abstract reports overall F1 gains of 16% and 11% over conventional federated learning on X-ray and ultrasound [arxiv:2101.07511 §Abstract]. The test sets are small: 44 X-ray COVID-19 images [arxiv:2101.07511 tab. 1]. The experiments are simulated, and the claims about privacy and bandwidth are not measured [arxiv:2101.07511 §4.1]. Card: [Collaborative FL for COVID-19 imaging](/papers/2101.07511). ### One-shot clustering across devices (k-FED) This variant clusters rather than trains. Each device runs a local k-means once and sends only its few local centers. The server seeds k groups with a farthest-point rule over those centers, then makes one nearest-seed assignment [arxiv:2103.00697 alg. 2]. Each point takes the group of its device's center [arxiv:2103.00697 §3.2]. The server also returns cluster identities to each device, so the exchange is two messages per device [arxiv:2103.00697 §3.2]. The analysis is a heterogeneity result. When each device holds at most √k clusters, two clusters that never share a device need separation of about k^(1/4), where centralized clustering needs about √k [arxiv:2103.00697 §3.2]. Author-reported results. On synthetic mixtures built to meet the separation conditions, clustering accuracy is between 98.40% and 100.00% across five settings with k from 16 to 100 [arxiv:2103.00697 tab. 1]. On rotated MNIST, used as a personalization test, k-FED is level with or above IFCA in all four rows of the table. The metric's scale is not stated [arxiv:2103.00697 tab. 2]. On FEMNIST and Shakespeare, the real-data results are qualitative. The paper reports that structured partitions give a k-means cost closer to the oracle than random ones, and that one-shot k-FED gives similar cost to multi-round distributed k-means [arxiv:2103.00697 §4.2] [fig. 2] [fig. 3]. Costs and limits: k, each device's cluster count and the constant m0 are assumed known, and the paper does not say how to pick them in general [arxiv:2103.00697 §3.2]. The guarantees depend on the unknown true clustering, so they cannot be checked from data [arxiv:2103.00697 §3.1]. The gain depends on the heterogeneity: when each device holds nearly k clusters, the separation requirement is stricter than the centralized one [arxiv:2103.00697 §3.2]. Card: [Heterogeneity for the Win: One-Shot Federated Clustering](/papers/2103.00697). ### Aggregation rule under non-IID IoT traffic (Fed+) An intrusion-detection study splits the CIC-ToN-IoT flows into 10 clients. In the basic setting each client is one destination IP address. The study adds a balanced and a mixed setting [arxiv:2108.00974 §4.2]. Each client trains multinomial logistic regression for 300 rounds, and the server combines the models with FedAvg or Fed+ [arxiv:2108.00974 §5]. Fed+ gives the higher mean client accuracy in all three federated settings [arxiv:2108.00974 §5.4]. In the mixed setting, the final values are 0.8869 for Fed+ and 0.8423 for FedAvg, while a distributed run, where each client trains alone, gives 0.877 [arxiv:2108.00974 §5.4]. So FedAvg ends below local-only training in that setting. The paper does not give Fed+'s update rule, its distance term or its weights. It refers to a separate paper for them [arxiv:2108.00974 §4.4], which has no card in this wiki, so this variant cannot be implemented from this card. The results are single runs, with no variance [arxiv:2108.00974 §5]. Card: [Federated IoT intrusion detection](/papers/2108.00974). ### Hierarchical aggregation over base stations with blockchain (digital twins) Each user has a digital twin, a model of the device with its data and state, hosted on a nearby base station (BS) and kept in sync with the device [arxiv:2011.09902 §2] [§2.1]. Each twin is linked to at most one BS, and the link depends on data size, BS compute and transmission rate [arxiv:2011.09902 §2.1] [eq. 1]. Each BS averages the models of its twins, and a macro base station averages the BS models [arxiv:2011.09902 eq. 4] [eq. 5]. The paper names FedAvg and FedSGD as the client algorithms, with gradient descent or SGD at a fixed learning rate [arxiv:2011.09902 §2.2]. The BSs are also nodes of a permissioned blockchain. Each BS broadcasts its model as a transaction, other BSs verify it, and a delegated proof-of-stake vote picks the block producers, with coins rewarded to models that pass verification [arxiv:2011.09902 §2.3] [eq. 6]. The authors say the block interval should span several local training periods, because validation is costly [arxiv:2011.09902 §2.3]. Association, batch size and bandwidth are chosen by one DDPG agent per BS, which shares a time-based reward [arxiv:2011.09902 §4.1] [eq. 19]. The paper states the goal as minimising total training time at a target accuracy [arxiv:2011.09902 eq. 18]. Author-reported results appear only as figures, on CIFAR-10 with 100 users and 5 BSs under an IID split [arxiv:2011.09902 §5]. The authors say the method "significantly reduces" time cost against random and average edge association [arxiv:2011.09902 fig. 5]. Its learning loss is said to be comparable to full-data FL and lower than under random association [arxiv:2011.09902 fig. 6]. A discount factor of 0.9 converges fastest in their runs [arxiv:2011.09902 fig. 7]. The text gives no numbers, and the paper reports no repeated runs and no measured blockchain overhead [arxiv:2011.09902 §5]. The paper has no official code. Card: [Low-latency Federated Learning and Blockchain for Edge Association in Digital Twin empowered 6G Networks](/papers/2011.09902). ### Fairness-aware server weighting (FairFed) A model trained by FedAvg can be unfair to one group even when each client's local model looks fair. Fixing this with a global debiasing step needs clients to reveal per-group information, which the paper treats as the problem [arxiv:2110.00857 §1] [arxiv:2110.00857 §2]. FairFed keeps the client-side training and changes only the aggregation weights. Each round the server gets the global equal-opportunity gap and the mean accuracy through secure aggregation [arxiv:2110.00857 §4.3] [alg. 1]. Each client then measures the gap between its own fairness value and the global one, or an accuracy gap when its local equal-opportunity gap is undefined, and moves its weight against that gap relative to the mean gap [arxiv:2110.00857 §4.2] [eq. 6]. Setting the fairness budget β to zero recovers FedAvg [arxiv:2110.00857 §4.2]. The local debiasing method is free: the paper uses reweighting, FairRep and FairBatch [arxiv:2110.00857 §5.1.4]. Author-reported results, averaged over 20 seeds, on Adult with five clients and Dirichlet heterogeneity α = 0.1: the equal-opportunity difference moves from −0.174 for FedAvg to −0.017 for FairFed with reweighting, and accuracy from 0.835 to 0.830 [arxiv:2110.00857 tab. 1]. At α = 5000 the same method gives 0.013 [arxiv:2110.00857 tab. 1]. With FairRep as the local method, the value ranges from 0.023 at α = 0.1 to −0.187 at α = 5000, so the local choice matters [arxiv:2110.00857 tab. 1]. On a case study with three occupation groups, the authors report an equal-opportunity difference of 0.004 against −0.199 for FedAvg, with accuracy falling from 0.567 to 0.556 [arxiv:2110.00857 tab. 3] [arxiv:2110.00857 §6.2.1]. Costs and limits: the metrics need an extra secure-aggregation step each round. The experiments use logistic regression on tabular data [arxiv:2110.00857 §5.1.5], with five clients in the synthetic runs [arxiv:2110.00857 §5.1.3]. The paper lists regression and NLP as future work [arxiv:2110.00857 §7]. Card: [FairFed: Enabling Group Fairness in Federated Learning](/papers/2110.00857). ### Hypernetwork-generated personal models (pFedHN) Each client gets a trainable embedding, and one server-side hypernetwork turns that embedding into the client's full network weights [arxiv:2103.04628 §3.2]. The server sends those weights to the client. The client runs several local steps and returns only the weight difference, and the server backpropagates that difference through the hypernetwork [arxiv:2103.04628 §3.2] [arxiv:2103.04628 alg. 1]. The hypernetwork is never transmitted, and the paper states that per-round traffic depends on the target network size, not on the hypernetwork [arxiv:2103.04628 §3.2]. A variant (pFedHN-PC) keeps each client's output layer local, for clients that solve different tasks [arxiv:2103.04628 §3.3] [eq. 4]. A new client can be added by freezing the hypernetwork and fitting only its embedding [arxiv:2103.04628 §5.3]. Author-reported results, with three seeds and federated accuracy [arxiv:2103.04628 §5] [arxiv:2103.04628 tab. 1]. On CIFAR10 with 10 clients, pFedHN reaches 90.83% ± 1.56, against 89.11% for LG-FedAvg and 87.27% for FedPer. On CIFAR100 with 10 clients it reaches 65.74%, against 55.76% for FedPer and 51.97% for pFedMe [arxiv:2103.04628 tab. 1]. On Omniglot with 50 clients it reaches 72.03%, below 76.46% for Per-FedAvg [arxiv:2103.04628 tab. 1]. The same card also gives the computational-budget run, where pFedHN again leads on CIFAR10 and CIFAR100 with three model sizes [arxiv:2103.04628 tab. 2]. Costs and limits: the authors use K = 50 local steps per round, and report that several local steps beat a single one [arxiv:2103.04628 app. C]. The Omniglot setup is not in the released code [arxiv:2103.04628 §Paper vs code]. Card: [Personalized Federated Learning using Hypernetworks](/papers/2103.04628). ### Personal models pulled toward the global model (Ditto) Ditto keeps the shared model and adds one personal model v_k per device. The personal model minimises the device's local loss plus an L2 pull toward the global model, with the pull weighted by λ [arxiv:2012.04221 §3.1]. The global model is trained by any federated solver, FedAvg in most experiments [arxiv:2012.04221 §3.2] [alg. 1]. Each round a selected device updates the global model, then takes its personal steps toward the round's starting global model, and sends back only its global update. Personal models never leave the device [arxiv:2012.04221 §3.2] [alg. 1]. λ is the one knob: λ = 0 gives purely local models, and a large λ makes every device use the global model [arxiv:2012.04221 §3.1]. The paper argues that an intermediate λ gives accuracy, fairness and robustness together, where methods built for only one of these do not [arxiv:2012.04221 §1]. Author-reported results. Fairness is measured as the spread of accuracy across devices, and robustness as the mean accuracy on benign devices under attack [arxiv:2012.04221 §2]. Ditto has about 10% lower spread than the fair baseline TERM, with about 5% higher clean accuracy [arxiv:2012.04221 §4.2]. Against the strongest robust baseline it has about 6 points higher mean benign accuracy, averaged over datasets and attacks [arxiv:2012.04221 §4.1] [app. D.4]. On FEMNIST clean data, Table 2 gives 83.6% for Ditto against 81.1% for APFL, 82.7% for Per-FedAvg and 80.4% for the global model [arxiv:2012.04221 tab. 2]. On Fashion MNIST under 50% model-replacement attackers, Ditto reaches 87.3% against 27.5% for the global model and 13.1% for TERM [arxiv:2012.04221 tab. 1]. Table 3 adds robust aggregators: clipping combined with Ditto is best in five of six FEMNIST columns [arxiv:2012.04221 tab. 3]. Costs and limits: each device stores its personal model between the rounds it is selected in, and a rarely selected device uses a stale model [arxiv:2012.04221 §3.2]. Choosing λ takes per-device validation data [arxiv:2012.04221 app. D.2]. The closed-form λ* for linear regression needs τ and σ, which a device does not know [arxiv:2012.04221 §3.3]. The paper's convergence result covers strongly convex problems only [arxiv:2012.04221 app. B]. Card: [Ditto: Fair and Robust Federated Learning Through Personalization](/papers/2012.04221). ### Vertical federated learning (VFL) In VFL, the parties hold different features of the same users, and only the active party holds the labels [arxiv:2211.12814 §2.1]. Parties first align their sample IDs with private set intersection. Then, for each mini-batch, every party sends its local output to the active party, which returns the gradient for each output [arxiv:2211.12814 §2.2] [arxiv:2211.12814 alg. 1]. Homomorphic encryption, secure multi-party computation or a trusted execution environment can protect those messages, but the algorithm sends the gradients in the clear and the encrypted path is described only in prose [arxiv:2211.12814 §2.2] [alg. 1]. The survey covers honest-but-curious and malicious threat models, with label inference, feature inference and backdoor attacks [arxiv:2211.12814 §5]. It proposes VFLow, a meta-objective with privacy, efficiency and bias constraints, but gives no measure or threshold for them [arxiv:2211.12814 §7]. It reports no experiments and no official code [arxiv:2211.12814 §Paper vs code]. Use it as a map of the design space. Card: [Vertical Federated Learning: Concepts, Advances and Challenges](/papers/2211.12814). ### Federated reinforcement learning (survey) This card is a survey of federated reinforcement learning (FRL), not a method. It splits FRL into two families. In horizontal FRL the agents share a state and action space but act in different environments, and a coordinator averages their encrypted parameters [arxiv:2108.11887 §4.2]. In vertical FRL the agents act in one environment and each sees part of the state. Decision agents act and receive rewards, while support agents only observe, and the agents exchange encrypted intermediate products [arxiv:2108.11887 §4.3]. The survey reports no experiments of its own. Its figures come from cited works with different setups, such as an 80% gain in downlink throughput over standard actor-critic in one communication study [arxiv:2108.11887 §5.2]. Open issues include non-identical environments, communication cost, attacks and agents joining or leaving [arxiv:2108.11887 §6.1] [§6.3] [§6.4] [§6.5]. Card: [Federated Reinforcement Learning: Techniques, Applications, and Open Challenges](/papers/2108.11887). For the RL-side concept, see [federated reinforcement learning](/concepts/federated-reinforcement-learning). ### Class-incremental learning with a proxy server (GLFC) Here new classes arrive over time on different clients, and the shared model must keep the old ones [arxiv:2203.11473 §1] [§3]. Each client keeps a small exemplar memory of 2,000 samples in the authors' setting [arxiv:2203.11473 §5.1]. GLFC reweights each client's classification loss by a class-aware gradient measure, so that new and old classes contribute comparably, and adds a relation distillation term against the stored previous model [arxiv:2203.11473 §4.1] [eq. 4] [eq. 5]. A client treats a rise of at least 1.2 in the average entropy of the global model over its data as a new task [arxiv:2203.11473 §4.1] [eq. 7]. For new classes the clients send gradients of prototype samples, and a proxy server rebuilds inputs from those gradients, scores the global model on them and keeps the best earlier model [arxiv:2203.11473 §4.2] [eq. 8] [eq. 9]. The author-reported gains are 4.4 to 15.1 points of average accuracy over class-incremental methods adapted to FL [arxiv:2203.11473 tab. 1] [tab. 2]. The released code departs from the paper in several named places, so reimplement from the Paper vs code section, not from the paper alone [arxiv:2203.11473 §Paper vs code]. Card: [Federated Class-Incremental Learning](/papers/2203.11473). ### Library and benchmark (FedML) FedML is an open library and benchmark, not a new method. Its core is a worker-oriented API: each worker defines the messages it sends and handles the ones it receives, and the messages can carry payloads beyond gradients and models [arxiv:2007.13518 §3]. The topology manager lets a trainer query its neighbours, which covers vertical FL, split learning, decentralized FL and hierarchical FL [arxiv:2007.13518 §3]. It runs on three paradigms: on-device, MPI distributed and single-machine simulation, and ships reference implementations of FedAvg, decentralized FL, vertical FL, split learning, FedNAS and Turbo-Aggregate [arxiv:2007.13518 §4.1] [app. B.1]. The benchmark fixes datasets, models and non-IID partitions in three tiers: linear models, shallow networks and deep networks [arxiv:2007.13518 §4.2] [tab. 2] [tab. 3] [tab. 4]. The author-reported FedAvg results with 10 workers show a drop from IID to LDA non-IID of 1.6 to 9.1 points, for example ResNet-56 on CIFAR-10 going from 93.19 to 87.12 [arxiv:2007.13518 tab. 5]. The paper states no training hyperparameters for those runs, and its example configs use a different client count [arxiv:2007.13518 §5] [code: python/examples/federate/simulation/sp_fedavg_datasets_and_models_example/configs/cifar10_resnet56_config.yaml#L17-L18]. Card: [FedML: A Research Library and Benchmark for Federated Machine Learning](/papers/2007.13518). ### Surveys of personalized FL and of trust Towards Personalized Federated Learning is a survey, not a method. It splits personalized FL (PFL), where each client gets a model suited to its own non-IID data, into two strategies. Strategy I keeps one global model and personalizes it per client, with data-based and model-based approaches. Strategy II learns a personalized model per client, with architecture-based and similarity-based approaches [arxiv:2103.00710 §II] [fig. 1]. The survey writes formulas for the FedAvg-style objectives and a few methods, and names others, such as FedProx, SCAFFOLD and MOON, without formulas [arxiv:2103.00710 §III-B] [eq. 4]. It notes that most PFL work tests only one type of non-IID skew [arxiv:2103.00710 §V] [tab. III]. It runs no experiments of its own [arxiv:2103.00710 §Results]. Card: [Towards Personalized Federated Learning](/papers/2103.00710). The trustworthiness survey lists federated learning under privacy computing, next to secure multi-party computation [arxiv:2110.01167 §3.2.5]. It gives no method detail for federated learning. Card: [Trustworthy AI: From Principles to Practices](/papers/2110.01167). The dataset-security survey places federated learning on both sides of its taxonomy. As an attack setting, federated poisoning lets a client shape the shared model [arxiv:2012.10544 §2.7], and federated backdoors are covered in [arxiv:2012.10544 §3.3.4]. As a defense setting, the survey splits federated defenses into robust aggregation, robust training and post-training repair [arxiv:2012.10544 §4.5]. It reports no experiments of its own. Card: [Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses](/papers/2012.10544). ## When to use which Choose by what your clients can send and store, and what the server can hold. The rows name the constraint that decides, and the cited results are the author-reported ones above. | Situation | Use | Why | |---|---|---| | Client models differ in architecture or precision, and the server can hold unlabeled inputs | [FedDF](/papers/2006.07242) | Fuses predictions, so weights need not match [arxiv:2006.07242 §3]. Server cost grows with participants [arxiv:2006.07242 eq. 1]. | | Architectures differ, only the embedding size must match, and no server data exists | [FedProto](/papers/2105.00243) | Clients share class means only [arxiv:2105.00243 eq. 3] [app. B]. There is no global classifier [arxiv:2105.00243 §Discussion]. | | No shared public data, and clients have skewed labels | [FedGen](/papers/2105.10056) | Builds a server generator from the clients' predictors [arxiv:2105.10056 §3.1]. A proxy-data baseline still led on one EMNIST setting [arxiv:2105.10056 tab. 1]. | | Hidden units may be permuted across clients, and extra retraining passes are affordable | [FedMA](/papers/2002.06440) | Matches units before averaging [arxiv:2002.06440 §2.1]. A pass takes as many rounds as layers, with N-1 retraining jobs per client [arxiv:2002.06440 alg. 1]. | | Non-IID clients drift, and each client can keep a model-sized vector | [FedDyn](/papers/2111.04263) | Corrects each client's objective [arxiv:2111.04263 eq. 1]. Each client stores a vector the size of the model [arxiv:2111.04263 alg. 1]. | | Non-IID clients, and extra local compute is acceptable | [FedProc](/papers/2109.12273) | Adds a prototype contrastive term to the local loss [arxiv:2109.12273 eq. 2]. A CIFAR-10 round took 11m57s, against 8m34s for FedAvg [arxiv:2109.12273 tab. 5]. | | Non-IID clients, and communication must not grow | [FedNTD](/papers/2106.03097) | The paper states no added communication [arxiv:2106.03097 §4.2]. Compute cost is not reported [arxiv:2106.03097 §4.2]. | | Each user needs its own model from one server network | [Hypernetwork personalization](/papers/2103.04628) | The server network writes a model per client from a learned embedding [arxiv:2103.04628 §3.2]. | | Each device needs a personal model, and robustness or fairness matter as well as accuracy | [Ditto](/papers/2012.04221) | The personal model is pulled toward the global one by λ [arxiv:2012.04221 §3.1]. Personal models stay on devices [arxiv:2012.04221 §3.2]. Reported gains are on the authors' benchmarks [arxiv:2012.04221 §4]. | | Per-user personalization from a cloud model, with encrypted sharing | [FedHealth](/papers/1907.09173) | Fine-tunes only the fully connected layers [arxiv:1907.09173 §3.4]. Tested on one dataset and five subjects [arxiv:1907.09173 §4.1]. | | Fairness across client groups matters, and the server can reweight | [FairFed](/papers/2110.00857) | Changes only the server's weights [arxiv:2110.00857 §4.2] [eq. 6]. | | Client groups are known in advance, such as imaging modality | [Clustered averaging](/papers/2101.07511) | Averages within each known group, then across groups [arxiv:2101.07511 §3.1]. Groups are not learned [arxiv:2101.07511 §3.1]. | | Devices must group themselves once, with a few messages | [k-FED](/papers/2103.00697) | Two messages per device [arxiv:2103.00697 §3.2]. Needs k and each device's cluster count to be known [arxiv:2103.00697 §3.2]. | | Workers in one data centre share a training set, and synchronization per step is the bottleneck | [Post-local SGD](/papers/1808.07217) | Runs mini-batch SGD until the first learning-rate decay, then takes H local steps between averages [arxiv:1808.07217 §3]. The first phase still synchronizes every step [arxiv:1808.07217 §3]. The speed-ups are on an 8×2 GPU cluster with 10 Gbps Ethernet [arxiv:1808.07217 app. C.3]. | | Parties share users but hold different features | [VFL survey](/papers/2211.12814) | Aligns sample IDs first, then exchanges outputs per batch [arxiv:2211.12814 §2.2]. Survey, no experiments. | | Reinforcement-learning agents must learn jointly | [FRL survey](/papers/2108.11887) | Splits the field into horizontal and vertical families [arxiv:2108.11887 §4.2] [§4.3]. Survey, no own experiments. | | You want a broad map of FL setups, applications, attacks and defences before choosing a method | [FL survey (Mammen)](/papers/2101.05428) | Covers horizontal, vertical and transfer FL, the four-step loop, and membership, poisoning and backdoor attacks with defences [arxiv:2101.05428 §2] [§3] [§6]. It reports no experiments [arxiv:2101.05428 §8]. | | You need a simulator or benchmark to prototype or compare FL algorithms | [FedML](/papers/2007.13518) | Ships FedAvg and other reference implementations, and fixed non-IID benchmark splits [arxiv:2007.13518 §4.1] [§4.2]. Training recipes are not stated [arxiv:2007.13518 §5]. | | You want a map of personalization families before choosing a method | [PFL survey](/papers/2103.00710) | Sorts methods into two strategies [arxiv:2103.00710 §II]. No experiments, and most methods get one sentence [arxiv:2103.00710 §III-B]. | | You need one shared model, and every client runs the same architecture | FedMA, if you can afford matching and one pass per layer | Highest reported accuracy among the compared methods with a single global model, on the authors' CNN and LSTM [arxiv:2002.06440 tab. 1] [arxiv:2002.06440 tab. 2]. Costs are the per-layer rounds [arxiv:2002.06440 §2.3] and matching [arxiv:2002.06440 app. E]. | | Clients run different architectures or hold different label sets | FedProto | Only the embedding dimension must match [arxiv:2105.00243 app. B]. Results with heterogeneous architectures (FedProto-mh) are in the main table [arxiv:2105.00243 tab. 1]. | | Upload size per round is the binding limit | FedProto | About 4×10³ to 41×10³ parameters per round, against 430×10³ and 235,000×10³ for FedAvg [arxiv:2105.00243 tab. 1]. | | Clients are non-IID, can store one model-sized vector each, and the number of models sent is the cost that matters | FedDyn | Reported 637 against 1852 models for SCAFFOLD on IID CIFAR-10 with 10% participation [arxiv:2111.04263 tab. 1]. The stored vector must persist across rounds, including for unselected clients [arxiv:2111.04263 alg. 1]. | | Clients share one architecture, label skew is strong, and an extra pass over local data per round is affordable | FedProc | Reported 1.6 to 7.9 points above MOON on three image datasets [arxiv:2109.12273 tab. 2]. The extra pass is in [arxiv:2109.12273 alg. 1 l.26-30]. No non-image results are reported [arxiv:2109.12273 §4.1]. | | Clients fall into known groups whose data differ, and one model must serve all groups | Clustered aggregation by group | On X-ray COVID-19, F1 0.76 against 0.41 for conventional federated learning [arxiv:2101.07511 tab. 3]. Groups must be known in advance [arxiv:2101.07511 §3.1]. | | Parties hold different features of the same users | VFL, as a design guide | No experiments or code, so no performance claim can be taken from it [arxiv:2211.12814 §Paper vs code] [arxiv:2211.12814 §7]. | | IoT clients are skewed, and you can implement Fed+ from its own paper | Fed+ | Higher mean accuracy than FedAvg in all three federated settings [arxiv:2108.00974 §5.4]. This card does not give its update rule [arxiv:2108.00974 §4.4]. | | Group fairness is the target, the server can run secure aggregation, and each client can debias locally | FairFed | On Adult at α = 0.1, EOD moves from −0.174 to −0.017 with accuracy from 0.835 to 0.830 [arxiv:2110.00857 tab. 1]. With FairRep as the local method the result varies widely with heterogeneity [arxiv:2110.00857 tab. 1]. Each round needs a metrics step [arxiv:2110.00857 §4.3]. | | Each client needs its own model and the server can hold one network that writes them | pFedHN | Reported 90.83% on CIFAR10 with 10 clients, the highest baseline-comparison value in its column [arxiv:2103.04628 tab. 1]. On Omniglot with 50 clients it is below Per-FedAvg [arxiv:2103.04628 tab. 1]. A new client needs only an embedding fit [arxiv:2103.04628 §5.3]. | | Devices each hold a few groups, you need one clustering of all the data, and one clustering round is the budget | k-FED | With at most √k clusters per device, the paper's bound needs less separation for pairs that never share a device [arxiv:2103.00697 §3.2]. The 98.40% to 100.00% accuracy is on synthetic data built to meet the conditions [arxiv:2103.00697 tab. 1] [§4.1]. | | Clients are non-IID, forgetting of classes a client does not hold is the suspected problem, extra local compute is affordable, and no extra upload is allowed | FedNTD | Highest accuracy in 10 of 14 settings on the authors' tables, with SCAFFOLD ahead in the rest [arxiv:2106.03097 tab. 1]. No extra communication [arxiv:2106.03097 §4.2]. One extra forward pass of the global model per batch [code: algorithms/fedntd/ClientTrainer.py#L40]. | | Agents must learn from different environments, or from one shared environment where each sees part of the state | Federated RL survey, as a map | No tested recipe, and the open issues include non-identical environments, communication cost and attacks [arxiv:2108.11887 §6.1] [§6.3] [§6.4]. | | You must serve one global classifier | FedMA | FedMA produces one shared model [arxiv:2002.06440 §2.1]. FedProto keeps no global classifier, and each client keeps its own model [arxiv:2105.00243 §Discussion]. | | The score that matters is accuracy on each client's own classes | FedProto | Reported higher accuracy and lower spread across clients on MNIST and FEMNIST [arxiv:2105.00243 tab. 1]. | | A formal privacy guarantee is required | None of these as published | FedProto's privacy argument is informal [arxiv:2105.00243 §Discussion]. The clustered study measures no privacy [arxiv:2101.07511 §4.1]. For a guarantee, see [differential privacy](/concepts/differential-privacy). | | A convergence proof to plan rounds from | FedDyn, with caveats | Proofs cover strongly convex, convex and non-convex losses [arxiv:2111.04263 §2.1]. The experiments use SGD and random participation, not the exact solve and fixed count the theory assumes [arxiv:2111.04263 §3] [arxiv:2111.04263 §Paper vs code]. FedProto's bounds give no usable step size or λ [arxiv:2105.00243 app. B]. | | Devices share a wireless uplink, time and energy per round matter, and the data are strongly convex and smooth | FEDL, with full-batch caveats | A linear rate under those assumptions [arxiv:1910.13067 eq. 10] [§IV]. Each device uploads its model and its full gradient [arxiv:1910.13067 alg. 1]. Gains over FedAvg are read from figures at about 0.7 to 1.3 points [arxiv:1910.13067 fig. 4]. | | Base stations host the users' digital twins, and model updates must be auditable | Digital-twin edge design, as a systems reference | Two-level aggregation and a blockchain ledger [arxiv:2011.09902 §2.2] [§2.3]. Time-cost gains are only in figures [arxiv:2011.09902 fig. 5]. The paper has no official code. | | Clients receive new classes over time, each may keep only a small exemplar memory, and the server may rebuild samples from shared gradients | GLFC | Reported gains over FL-adapted baselines on three image benchmarks [arxiv:2203.11473 tab. 1] [tab. 2]. Each round every client runs a forward pass and exemplar selection, and the proxy runs 200 optimiser iterations per received gradient [arxiv:2203.11473 app. B] [§4.2] [app. A.2]. | | You need a map of poisoning and backdoor threats in federated training | Dataset-security survey | Covers federated attacks and defenses in one taxonomy [arxiv:2012.10544 §2.7] [§4.5]. No experiments, so no ranking [arxiv:2012.10544 §5]. | ## Implementation sketch The loop is the same for every variant. The variants differ in what `update` holds and in how `server.combine` uses it. ```pseudocode # Common federated loop. Variants differ in what each client sends and # how the server combines it. def federated_training(clients, server, rounds): # the server starts from its own global state global_state = server.initial_state() for _ in range(rounds): # each client trains on its own data; raw data stays local # [arxiv:2105.00243 §Methodology] updates = [c.local_train(global_state) for c in clients] # FedMA: layer weights, matched layer by layer before averaging # [arxiv:2002.06440 §2.3] # FedProto: per-class mean embeddings, averaged per class # [arxiv:2105.00243 eq. 6] global_state = server.combine(updates) return global_state ``` For FedMA, the server also sends each client a permutation, so the client can rebuild a model of its own size from the global one [arxiv:2002.06440 §2.3]. For FedProto, the paper's algorithm starts with global prototypes, but the released code starts with none, so round one trains with cross-entropy alone [arxiv:2105.00243 alg. 1] [arxiv:2105.00243 §Paper vs code]. For FedDyn, `local_train` also reads and writes the client's stored gradient, and `combine` also updates the server's correction state [arxiv:2111.04263 alg. 1]. For FedProc, the state the server sends includes the class prototypes [arxiv:2109.12273 alg. 1]. For FairFed, `combine` is still a weighted average, but the weights are updated each round from the gaps, and the metrics come from an extra secure-aggregation step [arxiv:2110.00857 alg. 1]. For pFedHN, the state is the hypernetwork, and `combine` backpropagates each client's weight difference through it instead of averaging models [arxiv:2103.04628 alg. 1]. For Ditto, `local_train` also keeps a personal model per device, pulled toward the round's starting global state, and uploads only the global update [arxiv:2012.04221 alg. 1]. VFL does not fit this loop: it exchanges per-batch outputs and gradients rather than weights [arxiv:2211.12814 alg. 1]. FedNTD fits the loop with one change in `local_train`: it keeps a frozen copy of `global_state` and adds the not-true term to the cross-entropy on every batch [arxiv:2106.03097 alg. 1]. k-FED runs the loop once. Its local step is a local k-means, and `combine` seeds and assigns the centers, so there are no averaged weights [arxiv:2103.00697 alg. 2]. The survey's horizontal round fits the loop with coordinator averaging, but its vertical round exchanges intermediate products rather than weights [arxiv:2108.11887 §4.2] [§4.3]. For FEDL, `local_train` replaces the plain step with the surrogate gradient, which reads the global gradient estimate, and each client also returns its full local gradient at the new model. `combine` averages both [arxiv:1910.13067 alg. 1]. Round one has no global gradient, and the paper does not give a starting value for it [arxiv:1910.13067 §IV]. For the digital-twin design, `combine` runs in two levels: each BS averages its twins, then the macro station averages the BS models [arxiv:2011.09902 eq. 4] [eq. 5]. ## Contradictions - **Reported FedMA gains are on different models.** FedMA reports 87.53% against 86.29% for FedAvg on a 9-layer CNN [arxiv:2002.06440 tab. 1]. FedDF reports FedMA only on VGG-9 without batch norm, where it reaches 65.0% without drop-worst, and FedAvg with drop-worst reaches 78.34% [arxiv:2006.07242 tab. 3]. The protocols differ, so the numbers do not compare directly. - **Value of proxy data.** FedDF finds that about 1% of the ImageNet data is enough for fusion [arxiv:2006.07242 §5]. FedGen treats an unlabeled proxy set as often unavailable [arxiv:2105.10056 §1], and its proxy-data baseline leads at EMNIST α = 0.05 [arxiv:2105.10056 tab. 1]. The datasets and baselines differ, so neither result settles the question. - **SCAFFOLD ranks differently.** FedDyn reports itself well ahead of SCAFFOLD on its communication measure [arxiv:2111.04263 tab. 1]. FedNTD reports SCAFFOLD ahead in four of 14 settings [arxiv:2106.03097 tab. 1]. The settings differ. - **Second heterogeneity level, CIFAR10, three classes per client:** FedPer reaches 84.51% ± 4.39 and FedProto 81.75% ± 1.39 [arxiv:2105.00243 tab. 4]. At the first level the two are close, with FedProto at 84.49% and FedPer at 84.38% [arxiv:2105.00243 tab. 1]. The card records no explanation for the reversal. - **FedAvg on MNIST, three classes per client:** the main table gives 95.04% ± 6.48, and the appendix gives 91.40% ± 6.48 for what the card records as the same cell [arxiv:2105.00243 tab. 1] [arxiv:2105.00243 tab. 2]. Use one of them only after checking the other. - **Personalized numbers use different splits.** pFedHN gives each CIFAR10 client two classes [arxiv:2103.04628 §5.1], while FedProto's main CIFAR10 setting gives about three classes per client [arxiv:2105.00243 tab. 1]. The two sets of accuracies cannot be compared directly. - **Baselines are not comparable across cards.** FedAvg reaches 66.3% on CIFAR-10 under a Dirichlet split at β = 0.5 [arxiv:2109.12273 tab. 2]. FedDyn reports its FedAvg runs in rounds to a target on its own splits [arxiv:2111.04263 tab. 1]. The FedProc baseline rows are taken from other papers' reported results [arxiv:2109.12273 §4], so their setups may differ. FedNTD's FedAvg runs use sharding and LDA splits, so its 40.14% on CIFAR-10 with two shards per client [arxiv:2106.03097 tab. 1] is not comparable with either. ## Pitfalls - **FedMA "rounds" are passes.** A pass needs one round per layer, and the paper's round budgets equal passes times layers [arxiv:2002.06440 §2.3] [§3]. This reading is the card's inference from the numbers, not a stated fact. - **FEDL's rate formula.** The remark's numerator for Θ is about twice what eq. (11) gives. By hand, eq. (11) matches the Θ values in the paper's Table I, so use eq. (11) [arxiv:1910.13067 eq. 11] [tab. I]. - **FEDL's accuracy test is not enforced in the released code.** The paper defines a local accuracy θ and a local-step count from its lemma. The card's Paper vs code section records that the code neither checks the test nor computes the count from the lemma, so read it before reproducing the runs [arxiv:1910.13067 eq. 3] [lemma 1]. - **FEDL's local round means different things.** The theory's local round is a gradient step, while the experiments make passes over the data in mini-batches [arxiv:1910.13067 eq. 7] [§VI]. - **The digital-twin aggregation is not normalised.** Eq. 3 divides by N, not by the total data, and eq. 4 divides by the twin count, so with unequal data the result is not a weighted average [arxiv:2011.09902 eq. 3] [eq. 4]. The text calls this FedAvg, which weights by data share. - **The digital-twin target update is degenerate as printed.** Eqs. 24 and 25 use the same parameters on both sides, so the target would equal the primary network. The intended update is not stated [arxiv:2011.09902 eq. 24] [eq. 25]. - **The digital-twin constraint is an equality.** Eq. 18b sets the sum of twin counts equal to D, which the paper does not define [arxiv:2011.09902 eq. 18b]. - **Blockchain economics are not specified.** Stake, voting, rewards and the number of producers are not stated [arxiv:2011.09902 §2.3]. - **The dataset-security survey has no results.** It is a map of threat models, so do not read a ranking of defenses from it [arxiv:2012.10544 §5]. - **Secure aggregation hides updates from screening.** Masking client models blocks defenses that inspect incoming updates [arxiv:2012.10544 §2.7]. - **FedMA's averaging rule differs between paper and code.** The algorithm box uses a plain average of matched units [arxiv:2002.06440 alg. 1]. The released code uses a posterior mean that shrinks each unit toward a prior, which for two unit variances means a factor of m/(m+1) for a unit matched by m clients [arxiv:2002.06440 §Paper vs code]. Decide which one you reproduce. - **FedProto's aggregation differs between paper and code.** Eq. 6 weights each client's prototype by its data share, and the code takes an unweighted mean [arxiv:2105.00243 eq. 6] [arxiv:2105.00243 §Paper vs code]. The code also computes its reported accuracy as a running average over clients, which affects the ± values [arxiv:2105.00243 §Paper vs code]. - **FedProto's λ depends on the loss form.** The paper's λ values are tied to the code's mean squared error, not to the L2 distance in the main text [arxiv:2105.00243 app. A] [arxiv:2105.00243 §Paper vs code]. - **Embedding dimension must match** across FedProto clients, even when architectures differ [arxiv:2105.00243 app. B]. - **Batch norm is not handled in FedMA**, and the LSTM matching ignores hidden-to-hidden weights [arxiv:2002.06440 §3] [arxiv:2002.06440 §2.2]. - **FedDyn's exact solve versus SGD.** The theory and Algorithm 1 assume each local subproblem is solved accurately. The experiments use SGD, so the proofs do not directly cover the reported runs [arxiv:2111.04263 §3]. The number of local epochs controls how close the solve gets, and it is a tuned value [arxiv:2111.04263 app. Hyperparameters]. - **FedDyn's α is scaled per client in the code.** The released code divides α by each client's relative data size, which matters for unbalanced data. The paper does not describe this [arxiv:2111.04263 §Paper vs code]. - **FedDyn's cost units.** The table caption and the text describe the cost cells differently, and SCAFFOLD's cells count two models per round [arxiv:2111.04263 tab. 1] [§3]. Compare cells within one table only, and expect the censored "1000+" entries to understate the gap. - **FedProc's prototypes are ambiguous.** The text calls them global and the server sends them, but the local positives and negatives could be the server average from the previous round or the client's own means [arxiv:2109.12273 §3.3] [alg. 1 l.18]. The paper does not say which one is used. - **FedProc's denominator.** The text sums over k' ≠ k, but Algorithm 1 line 18 does not exclude k [arxiv:2109.12273 eq. 4] [alg. 1 l.18]. Read the text. - **FedProc has no temperature.** The loss uses raw cosine similarities inside the exponential, and the paper does not discuss how the scale affects results [arxiv:2109.12273 eq. 4]. - **FedProc and empty classes.** The paper does not say how a client without samples of some class enters the prototype average [arxiv:2109.12273 alg. 1 l.9]. - **Clustered aggregation is under-specified.** The cluster weights are never defined. The paper's equation averages over all clients, while its algorithm averages within clusters first, so the two differ when cluster sizes differ [arxiv:2101.07511 eq. 1] [alg. 1]. - **Clustered learning-rate conflict.** The text gives 0.0001 for the model and Table II gives 1e-3 for the CFL runs [arxiv:2101.07511 §3.2.2] [tab. 2]. Which value produced the results is not stated. - **IoT clients follow IP addresses.** Each client is a destination IP, so a client can see only normal traffic or only one attack class. Accuracy then misleads: some clients score high with zero recall [arxiv:2108.00974 §4.2] [§5.1]. Report per-class recall and F1 as well. - **Fed+ cannot be reproduced from its card.** Its update rule and parameters are missing from the paper [arxiv:2108.00974 §4.4]. - **VFL gradients travel in the clear in the algorithm.** The encrypted path is prose only, so a secure implementation needs its own design [arxiv:2211.12814 alg. 1] [§2.2]. - **FairFed's text and tables disagree.** The text's Adult gain at α = 0.1 is 93%, but the table's −0.174 to −0.017 is a 90% reduction, and other text percentages do not reproduce [arxiv:2110.00857 §5.2.1] [arxiv:2110.00857 tab. 1]. Cite the tables, not the text. - **FairFed's weight update is underspecified.** The paper does not give the starting value of the unnormalised weights, and it does not say whether they are renormalised or clipped to be non-negative. A large β can make them negative [arxiv:2110.00857 §4.2] [alg. 1]. The printed local-EOD equation shows identical terms, so the displayed difference is zero [arxiv:2110.00857 §3.3] [eq. 5]. The intended form must be checked in the PDF. - **FairFed's numbers are selected on the reported metric.** Learning rates and the best method per cell are chosen by the EOD closest to zero, averaged over 20 seeds. The paper does not name a validation split, so treat the gains as upper bounds [arxiv:2110.00857 §5.1.5]. - **pFedHN's update sign.** The printed Algorithm 1 and the authors' code give opposite signs for the weight difference. The surrogate-loss argument in §3.2 is the basis for the sign to implement [arxiv:2103.04628 alg. 1] [arxiv:2103.04628 §3.2] [arxiv:2103.04628 §Paper vs code]. - **pFedHN's metric and margins.** The paper defines federated accuracy as an average over clients, while the released code logs a sample-weighted average. The table does not say which one it reports [arxiv:2103.04628 §5] [arxiv:2103.04628 §Paper vs code]. The text's "2%–10%" gain claim is larger than the table supports [arxiv:2103.04628 §5.1] [arxiv:2103.04628 tab. 1]. - **pFedHN's code has no licence.** The authors' repository carries no licence file, so implement from the paper and not by copying code [arxiv:2103.04628 §Paper vs code]. - **FedNTD's claim is broader than its table.** The text says the method beats the baselines in all setups. The table shows SCAFFOLD ahead in four cells, and the bold marks are inconsistent, with both methods bold on one cell [arxiv:2106.03097 §4.2] [arxiv:2106.03097 tab. 1]. Cite the table. - **FedNTD's baselines are tuned and FedNTD is not.** The paper grid-searches the baselines but fixes FedNTD's β and τ, and the table does not say which baseline value produced each number [arxiv:2106.03097 app. Algorithm Implementation Details]. - **FedNTD's paper and code differ on τ and the learning rate.** The code multiplies the distillation term by τ², which the paper's loss lacks, so the τ ablation depends on the convention [arxiv:2106.03097 §3] [code: algorithms/fedntd/criterion.py#L42]. The main text gives 0.1 for the initial learning rate, while the appendix and code give 0.01 [arxiv:2106.03097 §4.1] [app. Learning Setups]. - **FedNTD's averaging weights differ.** The algorithm averages uploads with equal weight, but the code weights each client by its data size, which matters under LDA [arxiv:2106.03097 alg. 1] [code: algorithms/BaseServer.py#L156-L168]. - **FedNTD's MSE form is not a drop-in swap.** The MSE version gets worse as β rises and diverges at β = 0.3, so use the softmax-KL form [arxiv:2106.03097 app. MSE Loss for Not-True Distillation]. - **k-FED's guarantees do not transfer to real data as checked.** The separation conditions depend on the unknown true clustering, and the paper says real-data separation is much smaller than the theory requires [arxiv:2103.00697 §4.2] [app. B]. The real-data results are practical evidence, not a check of the bound. - **k-FED's code departs from the paper.** It uses k-means++ in the rough clustering step, runs the global step to convergence instead of one round, and returns centers rather than point labels [code: fkms/algorithms.py#L181] [code: fkms/algorithms.py#L256-L260] [code: fkms/algorithms.py#L284]. - **k-FED's farthest-point seeding picks outliers.** An outlier device center can be chosen as a seed [arxiv:2103.00697 alg. 2]. - **Federated RL is not always identically distributed.** The survey describes the horizontal environments as identically distributed in one place, but says that in practice they usually are not. Implement for the non-IID case [arxiv:2108.11887 §4.2] [§6.1]. - **The survey's policy-gradient formula looks wrong.** It multiplies each step's log-probability by the whole-episode reward, not the reward from that step onward. Check it against a reference REINFORCE [arxiv:2108.11887 §3.2]. - **Vertical FRL is not multi-agent RL.** Vertical agents may have no actions or rewards and cannot share states, so methods that share observations or rewards do not match it [arxiv:2108.11887 §4.3]. - **FedML's numbers are not a recipe.** The FedAvg table has no rounds, epochs, batch size or learning rate, and the example configs use other client counts [arxiv:2007.13518 §5] [arxiv:2007.13518 tab. 5]. Reproducing those numbers needs the exact configuration, which the paper does not give. - **FedML's weight decay is dropped with SGD.** The SGD branch of its local trainer ignores weight decay even when a config sets it [code: python/fedml/ml/trainer/my_model_trainer_classification.py#L29-L33]. - **FedML's security features are partly planned.** Lagrange Coded Computing and a secure-aggregation sample are described as plans [arxiv:2007.13518 §3]. - **Ditto's λ grid has a gap.** The rules cover devices with fewer than 4 and more than 5 validation points, so a device with exactly 4 or 5 is covered by neither [arxiv:2012.04221 app. D.2]. - **Ditto's λ selection differs between paper and code.** The paper picks λ per device from the grids in the appendix. The released code picks λ at every local step from {0.1, 1, 2}, and the released scripts turn that off [arxiv:2012.04221 app. D.2] [code: flearn/trainers_MTL/ditto.py#L96-L113] [code: run_fashion_clean_ditto_lam1.sh#L25-L26]. - **Ditto's tables disagree.** FEMNIST clean Ditto is .834 in Table 1 and .836 in Table 2, and its global A3 20% value is .314 in Table 1 but .364 in the appendix [arxiv:2012.04221 tab. 1] [tab. 2] [app. D.4]. Use the appendix tables for implementation targets, and expect small differences. - **Ditto's closed-form λ* is not usable as stated.** The formulas need τ and σ, which a device does not know, and the paper gives no estimator for them [arxiv:2012.04221 §3.3]. The experiments tune λ on validation data instead. - **Ditto's convergence result does not transfer to the experiments.** The theory assumes strong convexity and a decaying step size [arxiv:2012.04221 app. B]. The experiments use non-convex CNNs with a constant step, and the released code does the same. - **Ditto's boosting factor is set by the code.** The paper gives no factor for model replacement, only a ">10×" threshold for strong attacks. The code multiplies the malicious update by the devices per round [arxiv:2012.04221 app. D.2] [code: flearn/trainers_MTL/ditto.py#L133-L136]. - **The FL survey gives no update rule.** It names FedAvg as the baseline but does not write its aggregation, and it gives no learning rate, round count or clip bound for the defences [arxiv:2101.05428 §5.2] [§6.1.2]. Its differential-privacy description also differs by section: the introduction calls it a cryptographic technique, while §6.1.2 describes noise added to clipped parameters. Follow §6.1.2 and read the original defence papers before implementing [arxiv:2101.05428 §1] [§6.1.2]. - **GLFC's privacy step is not in the code.** The paper's privacy argument rests on adding Gaussian noise to prototype features before the gradients are shared [arxiv:2203.11473 §4.2]. The released code shares gradients of optimised prototypes without that noise, and the paper admits little theory exists for this setting [arxiv:2203.11473 §Paper vs code] [app. E.1]. Do not assume the privacy claim holds for a code-based reimplementation. - **Surveys give few formulas.** The personalized-FL survey writes formulas for its FedAvg-style objectives and a few methods, and gives none for FedProx, SCAFFOLD or MOON. Its objective is an unweighted average of client losses, and the paper does not discuss weighting by data size [arxiv:2103.00710 eq. 1] [§III-B]. Read the original papers before implementing. ## Papers - [Don't Use Large Mini-Batches, Use Local SGD](/papers/1808.07217): post-local SGD, which switches from mini-batch to local steps at the first learning-rate decay. - [Federated Learning with Matched Averaging](/papers/2002.06440): matches neurons, channels or LSTM units across clients layer by layer and averages the matched units, with a retraining step after each layer. - [Collaborative FL for COVID-19 imaging](/papers/2101.07511): clusters clients by imaging modality, averages within and across clusters, with results on two small COVID-19 datasets. - [Heterogeneity for the Win: One-Shot Federated Clustering](/papers/2103.00697): clusters devices once (k-FED); each device sends a few local centers and the server groups them. - [Personalized Federated Learning using Hypernetworks](/papers/2103.04628): one server network writes per-client models; only weight differences travel back. - [FedProto: Federated Prototype Learning across Heterogeneous Clients](/papers/2105.00243): shares per-class mean embeddings instead of weights, so clients can differ in architecture and label set. - [Data-Free Knowledge Distillation for Heterogeneous Federated Learning](/papers/2105.10056): server generator (FedGen). - [FedProc: Prototypical Contrastive Federated Learning on Non-IID data](/papers/2109.12273): prototype contrastive local loss with a round-wise weight. - [Federated Learning Based on Dynamic Regularization](/papers/2111.04263): corrects each client's objective (FedDyn). - [Preservation of the Global Knowledge by Not-True Distillation in Federated Learning](/papers/2106.03097): not-true distillation (FedNTD), with no extra communication. - [Ensemble Distillation for Robust Model Fusion in Federated Learning](/papers/2006.07242): server-side ensemble distillation (FedDF). - [FedHealth: A Federated Transfer Learning Framework for Wearable Healthcare](/papers/1907.09173): encrypted sharing with transfer fine-tuning. - [Federated IoT intrusion detection](/papers/2108.00974): compares FedAvg and Fed+ on IoT intrusion detection under three non-IID client settings. - [FairFed: Enabling Group Fairness in Federated Learning](/papers/2110.00857): reweights client models in the server's average, using each client's fairness gap, with any local debiasing method. - [Federated Learning: Opportunities and Challenges](/papers/2101.05428): survey of FL setups, applications, bottlenecks and attacks with defences; no experiments. - [Trustworthy AI: From Principles to Practices](/papers/2110.01167): a survey that places federated learning under privacy computing, with no method detail. - [Federated Reinforcement Learning: Techniques, Applications, and Open Challenges](/papers/2108.11887): survey of federated RL, split into horizontal and vertical families. - [Vertical Federated Learning: Concepts, Advances and Challenges](/papers/2211.12814): survey of vertical FL, with no experiments and no official code. - [FedML: A Research Library and Benchmark for Federated Machine Learning](/papers/2007.13518): open library with a worker-oriented API, reference algorithms and non-IID benchmark splits. - [Ditto: Fair and Robust Federated Learning Through Personalization](/papers/2012.04221): one personal model per device, pulled toward the global model by λ. - [Towards Personalized Federated Learning](/papers/2103.00710): survey that sorts personalized FL into two strategies, with no experiments. - [Federated Learning over Wireless Networks: Convergence Analysis and Resource Allocation](/papers/1910.13067): FEDL, a local surrogate with a global gradient term, with a linear-rate proof and a wireless resource model. - [Low-latency Federated Learning and Blockchain for Edge Association in Digital Twin empowered 6G Networks](/papers/2011.09902): digital-twin edge association, two-level aggregation and a blockchain ledger, with a multi-agent DDPG; results only in figures. - [Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses](/papers/2012.10544): survey of poisoning and backdoor attacks and defenses, with federated learning on both sides; no experiments. - [Federated Class-Incremental Learning](/papers/2203.11473): GLFC, with class-aware loss weighting, relation distillation and a proxy server that rebuilds samples from shared gradients.