PTOPOFL: Privacy-Preserving Personalised Federated Learning via Persistent Homology

AI summary

Overview

Research area: Federated learning (FL), topological data analysis, and privacy-preserving machine learning.

Technical level: Advanced. The paper combines persistent homology, Wasserstein geometry, and convergence analysis; the prose summary below is written for a general technical reader, but the underlying theory assumes familiarity with optimisation and topology.

Scope: The paper proposes and evaluates pTopoFL, a federated learning framework that replaces gradient communication with 48-dimensional persistent-homology descriptors, and provides theoretical guarantees plus experiments on healthcare, pathological non-IID, CIFAR-10, and FEMNIST settings.

What This Paper Is About

Standard federated learning has two persistent weaknesses: the gradients clients send can be inverted to reconstruct their private training data, and when client data distributions differ (non-IID), averaging those updates produces a poor global model. This paper argues that both problems share a geometric root and proposes sending topological summaries of each client's data instead of gradients—compact shape descriptors that are informative enough to group similar clients but structurally incapable of being inverted back to raw data.

Key Contributions

1. A topological communication protocol. Clients transmit only a 48-dimensional persistent-homology (PH) feature vector built from Betti numbers, persistence entropies, diagram amplitudes, and 20-point Betti curves, rather than model gradients. The map from dataset to descriptor is many-to-one, which the authors argue makes gradient-style inversion provably ill-posed.

2. A two-level personalised aggregation scheme. Clients are clustered by topological similarity (hierarchical agglomerative clustering with average linkage on ℓ2-normalised descriptors), then combined within clusters by topology-weighted FedAvg, and finally blended with a global consensus using a coefficient β_blend.

3. Four supporting mechanisms. Topology-guided sample weighting during local training, topology-based adversarial detection via descriptor-distance z-scores, continual signature tracking to detect concept drift, and the privacy analysis itself.

4. Formal guarantees. Theorems cover existence of the Wasserstein barycenter, stability of clustering under perturbation, exponential suppression of adversarial influence (from O(ε) under FedAvg to ε²), an information-contraction bound on per-sample mutual information, and linear convergence with an error floor strictly smaller than FedAvg.

Main Findings

• Highest AUC in both non-IID scenarios. pTopoFL reaches AUC 0.841 on the Healthcare scenario (8 simulated hospitals, 2 adversarial) and 0.910 on the Benchmark scenario (10 clients, pathological class imbalance). This is a +1.2 percentage-point margin over FedProx on Healthcare and a +0.1 pp margin on the Benchmark.

• Accuracy did not follow the same ranking. In the same two scenarios, pTopoFL's accuracy was 0.786 (Healthcare) and 0.791 (Benchmark), while FedAvg reached 0.792 and 0.856 respectively. pTopoFL had the highest AUC but not the highest accuracy in these settings.

• Fast convergence. pTopoFL reached 95% of its final AUC at round 1 in both Healthcare and Benchmark, tying FedAvg, FedProx, and SCAFFOLD at round 1 in both, and beating pFedMe (round 5 on Healthcare, round 2 on Benchmark).

• SCAFFOLD destabilised under severe skew. Under the Benchmark's per-client class imbalance drawn uniformly from (0.1, 0.9), SCAFFOLD's control variates overshot and oscillated from round 8 onward, dropping to AUC 0.846 versus 0.910 for pTopoFL.

• Reconstruction risk reduced by a factor of 4.5. The authors report ρ_topo/ρ_grad ≈ 0.22, based on transmitting 48 dimensions instead of the full gradient and on an estimated compression factor α_c ≈ 0.1.

• Adversarial robustness at high attack rates. Sweeping the label-flip attack rate from 0% to 50% of clients, pTopoFL maintained 0.771 AUC at the 50% attack rate, which the authors state matches undefended FedAvg performance.

• Stable topological fingerprints. Across 20 continual FL rounds, the mean normalised topological drift was Δ = 0.55, supporting the choice to cluster once at round 0 rather than recompute assignments.

• Deep-model gains are empirical only. On CIFAR-10 with ResNet-18 over 100 rounds, pTopoFL reached 0.74 top-1 accuracy at Dirichlet α_Dir = 0.1 and 0.86 at α_Dir = 0.5, versus FedAvg at 0.68 and 0.82. On FEMNIST (200-client LEAF split, 50 clients used, ConvNet-2, 200 rounds), pTopoFL reached 0.84 versus FedAvg 0.79. The paper is explicit that Theorem 3.9 does not apply to these non-convex models.

• Privacy claim is bounded, not DP. The information-contraction result gives I(x_i; φ_k) ≤ (m/p)(c²/L²) I(x_i; G), and I(x_i; φ_k) ≤ O(m/n_k²). The authors state this is not a formal (ε, δ)-differential privacy guarantee and do not claim indistinguishability of neighbouring datasets.

Methodology in Plain English

Each participating client first computes a persistence diagram from its own data—a multi-scale summary of the data's shape, recording when topological features such as connected components, loops, and voids appear and disappear as a distance threshold is increased. From this diagram the client extracts a fixed 48-number fingerprint, using Betti numbers, persistence entropy, total persistence mass, and a Betti curve sampled at 20 thresholds. Only this fingerprint leaves the client; no gradients or raw data are transmitted.

The server then normalises all fingerprints, computes pairwise Euclidean distances between them, and groups clients with hierarchical agglomerative clustering (average linkage). Within each group, local models are averaged with weights that combine client data volume, an exponential bonus for topological closeness to the cluster centre, and a trust weight. Each cluster model is then blended with the global average using β_blend = 0.3, which interpolates between full personalisation (0) and standard FedAvg (1).

Adversarial clients are caught geometrically: each client's mean descriptor distance to all others is computed, and clients whose z-score exceeds 1 are down-weighted exponentially by t_k = exp(−max(z_k − 1, 0)). Larger deviations from the majority mean smaller trust weights.

Evaluation used five methods—pTopoFL, FedAvg, FedProx (μ = 0.1), SCAFFOLD, and pFedMe (λ = 15)—across four scenarios. Scenarios A and B used logistic regression over 15 rounds with 80-point TDA subsamples and M = 2 clusters. Scenarios C (CIFAR-10) and D (FEMNIST) used ResNet-18 and ConvNet-2 respectively, with 200-point TDA subsamples, M = 3 clusters, and 100 and 200 rounds. Performance was measured by AUC-ROC in A/B and top-1 accuracy in C/D.

Why This Matters

The paper reframes the privacy-versus-utility trade-off in federated learning. Instead of adding noise to gradients (differential privacy) or encrypting them (secure aggregation), it changes what is transmitted at all, using a representation whose many-to-one structure is argued to make inversion ill-posed. If the approach generalises, it offers a third path alongside noise injection and cryptography.

Real-world applications:

• Cross-hospital clinical modelling—the paper's own Scenario A targets year-1 mortality risk prediction after lung transplantation across 8 hospitals with mortality rates ranging from 10% to 45%, where both patient privacy and institutional heterogeneity are binding constraints.
• Handwriting and keystroke recognition—the FEMNIST setting reflects deployment on mobile devices where user-specific writing styles create natural non-IID structure across hundreds of clients.
• Industrial sensor networks—predictive maintenance fleets where each machine has a different operating regime and could benefit from topology-based drift detection.
• Adversarially exposed consortia—settings where some participating organisations may be compromised, and where a detector that down-weights anomalous clients before aggregation has direct value.

Industry relevance: The framework is modular (any of the five components can be swapped), the code is released at https://github.com/MorillaLab/TopoFederatedL with a Python package at https://pypi.org/project/pTOPOFL/, and the 48-dimensional communication payload is dramatically smaller than transmitting full model gradients—an appealing property for bandwidth-constrained or cross-silo deployments.

Future Directions

• Extending the convergence proof to non-convex models. Both Theorems 3.7 and 3.9 hold only under smoothness and strong convexity assumptions that deep networks violate. The paper explicitly flags extended Lipschitz bounds along the optimisation trajectory as an open problem.

• Composing PH abstraction with differential privacy. The authors note that layering DP noise on top of topological descriptors could yield tighter privacy budgets than applying DP directly to gradients, but leave this to future work.

• Completing the deep-model evaluation. Table 2 marks certain entries with a dagger for "results to be completed," and the ablation referenced as Section 4.7, along with Sections 4.6 and beyond, are not present in the supplied content.

• Choosing the number of clusters and the blending coefficient more principledly. M was fixed at 2 for Scenarios A/B and 3 for C/D, and β_blend = 0.3 was reported as the best trade-off, but the full ablation supporting that value is outside the provided text.

Target Audience

Researchers and practitioners working at the intersection of federated learning, privacy-preserving machine learning, and topological data analysis. The paper is most valuable to readers already comfortable with persistent homology and convergence analysis who want to see topology applied to a distributed-learning problem, and to FL engineers seeking an alternative to noise-based privacy mechanisms with a very small communication footprint. Readers without a topology background will find the experimental sections accessible but the theoretical guarantees demanding.

Authors’ abstract

Federated learning (FL) faces two structural tensions: gradient sharing enables data-reconstruction attacks, while non-IID client distributions degrade aggregation quality. We introduce PTOPOFL, a framework that addresses both challenges simultaneously by replacing gradient communication with topological descriptors derived from persistent homology (PH). Clients transmit only 48-dimensional PH feature vectors-compact shape summaries whose many-to-one structure makes inversion provably ill-posed-rather than model gradients. The server performs topology-guided personalised aggregation: clients are clustered by Wasserstein similarity between their PH diagrams, intra-cluster models are topology-weighted,and clusters are blended with a global consensus. We prove an information-contraction theorem showing that PH descriptors leak strictly less mutual information per sample than gradients under strongly convex loss functions, and we establish linear convergence of the Wasserstein-weighted aggregation scheme with an error floor strictly smaller than FedAvg. Evaluated against FedAvg, FedProx, SCAFFOLD, and pFedMe on a non-IID healthcare scenario (8 hospitals, 2 adversarial) and a pathological benchmark (10 clients), PTOPOFL achieves AUC 0.841 and 0.910 respectively-the highest in both settings-while reducing reconstruction risk by a factor of 4.5 relative to gradient sharing. Code is publicly available at https://github.com/MorillaLab/TopoFederatedL and data at https://doi.org/10.5281/zenodo.18827595.