💻 computer science

Topology-Aware Differential Privacy in Federated Learning

This paper introduces TADI, a framework for analyzing topology-based information leakage in federated learning, and derives Fulcrum, a closed-form noise allocation mechanism that strictly improves privacy over standard DP-SGD in asymmetric cross-silo federations without compromising model utility.

Original authors: Murtaza Rangwala, Richard O. Sinnott, Rajkumar Buyya

Published 2026-06-05

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Murtaza Rangwala, Richard O. Sinnott, Rajkumar Buyya

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a group of hospitals trying to build a super-smart AI to detect heart disease. They don't want to share their actual patient records (which would be a privacy nightmare), so they use Federated Learning. Instead of sending patient data to a central server, each hospital trains a local version of the AI and only sends back the "lessons learned" (mathematical updates).

To make this even safer, they use a technique called Differential Privacy (DP). This is like adding a little bit of "static noise" to the lessons before sending them, so no one can reverse-engineer the specific patient data from the update.

The Paper's Big Discovery:
The researchers found a hidden flaw in this safety plan. Everyone was worried about the content of the lessons (the math updates), but they forgot to look at the structure of the conversation itself.

Think of the network of hospitals like a social group chat.

The Old View: We assume everyone is just a random person in the chat.
The New View: In reality, some people are the "Group Admins," some are in small, isolated circles, and some are the only representatives of a specific region.

The paper argues that a sneaky observer (a "passive adversary") can learn secrets just by looking at who is talking to whom and where they sit in the network, even if the messages themselves are noisy.

The Analogy: The "Who Sits Where" Leak

Imagine a classroom where students are trying to guess the teacher's secret grade distribution without looking at the papers.

The Content Leak (What we already knew): If a student whispers their guess too loudly, you might hear the numbers. We fix this by having them whisper through a fan (adding noise).
The Topology Leak (What this paper found): Even if everyone whispers perfectly, the pattern of who whispers to whom reveals secrets.
- If Student A is the only one sitting next to the teacher, and Student B is in a corner with no one, the observer knows Student A has more influence.
- If the observer knows that "Student A represents the rich neighborhood" and "Student B represents the poor neighborhood," they can guess the grade distribution just by seeing who is connected to whom, even without hearing the whispers.

The paper calls this Topology-Aware Leakage. The "structure" of the network itself is leaking information about the sensitive data.

The Solution: FULCRUM (The Smart Noise Distributor)

The standard way to fix this is to add the same amount of noise to everyone's message. But the researchers say this is inefficient. It's like giving a heavy backpack to a marathon runner and a light one to a toddler just because they are both walking.

They introduce FULCRUM, a smart system that acts like a balanced noise distributor:

The Weak Link: If a hospital is in a very exposed position (like the only hospital in a small town, or the central hub of a network), they are more likely to leak secrets just by virtue of their position. FULCRUM gives them extra noise (a heavier backpack) to protect them.
The Strong Link: If a hospital is in a symmetric, safe position (like one of many identical nodes in a perfect circle), they don't need as much extra noise. FULCRUM gives them less noise, preserving the quality of the AI.

The Magic Trick:
FULCRUM is "safe to adopt unconditionally."

If the network is perfectly symmetrical (everyone is equal), FULCRUM automatically acts exactly like the old standard method. You lose nothing.
If the network is messy and unequal (which real-world networks always are), FULCRUM automatically adjusts to give better protection where it's needed most, without hurting the AI's performance.

The Detective Tool: TADI

To prove this leak exists, they built a tool called TADI.
Think of TADI as a shadow detective. They created a fake, simulated version of the hospital network. They trained a "shadow AI" to try and guess the secrets using only the network structure.

They tested: "Can the detective guess the secrets just from the math updates?" (Yes, but the noise stops this).
They tested: "Can the detective guess the secrets just from knowing who is connected to whom?" (Yes! This is the new leak).
They tested: "Can the detective guess the secrets if they know the organizational labels (e.g., 'Hospital A is a cancer center')?" (Yes, this is the biggest leak).

The Results

They tested this on real medical data (skin cancer and heart disease) and synthetic data.

Privacy Gain: By using FULCRUM, they could reduce the "leakage" (measured in a unit called "nats") by up to 1.967 nats. That's a huge improvement in privacy.
No Cost: Crucially, they found that making the system more private did not make the AI less accurate. The "utility" (how well the AI works) stayed exactly the same.

Summary

This paper says: "We've been protecting the messages in our secret network, but we forgot that the map of the network is also leaking secrets. We built a smart tool (FULCRUM) that automatically adds extra protection to the most exposed parts of the map, making the whole system safer without slowing anything down."

Technical Summary: Topology-Aware Differential Privacy in Federated Learning

Problem Statement
Federated Learning (FL) protects client data by transmitting only model updates, while Differentially Private SGD (DP-SGD) bounds content-level leakage through gradient clipping and noise addition. However, existing defenses operate solely on the content of updates and ignore the information revealed by the communication topology itself. In cross-silo deployments (e.g., hospital consortia, industrial groups), the network structure and organizational membership create information channels that DP-SGD leaves unaddressed. A passive adversary with knowledge of the topology and organizational structure can infer sensitive data properties—specifically, the concentration of sensitive classes within a client's local dataset—even when the parameter updates are noise-saturated. Standard DP-SGD applies a uniform noise multiplier across all clients, which is suboptimal when the federation's topology is asymmetric, as it fails to account for the varying structural leverage different clients possess.

Methodology
The paper proposes a two-pronged approach: a formal threat model with an empirical decomposition tool (TADI) and a principled defense mechanism (FULCRUM).

Threat Model and TADI (Topology-Aware Distributional Inference):
The authors formalize a threat where an adversary observes parameter updates, the communication graph $G$ , and organizational labels $\omega$ . To empirically quantify leakage, they introduce TADI, a shadow-trained regressor that decomposes the adversary's information sources into four channels via ablation:
- Parameter Channel: Information derived solely from gradient updates.
- Structural Channel: Information derived from the client's position in the graph (degree, depth, centrality).
- Organizational Channel: Information derived from organizational membership labels.
- Combined Channel: The full adversary view.
  TADI is trained on shadow federations to estimate the sensitive-class concentration $p_i$ for each client, allowing the authors to measure the marginal information contribution of each channel.
Theoretical Bound and FULCRUM Defense:
The authors derive a per-client mutual information (MI) bound (Theorem V.2) showing that leakage separates additively into:
- A controllable mechanism term (bounded by DP-SGD noise).
- An uncontrollable prior-coupling floor determined by the client's structural leverage $\ell^\circ_i$ (the worst-case statistical predictability of a client's data given the rest of the federation).
Based on this, they derive FULCRUM, a closed-form, balanced min-max optimal noise allocation (Theorem V.3). Unlike uniform DP-SGD, FULCRUM allocates noise scales $\sigma_i$ asymmetrically based on structural leverage scores. It strictly minimizes the worst-case MI bound across all clients under a fixed utility budget.

Key Contributions

Formal Threat Model: A definition of topology-conditional distributional inference, establishing that structural position and organizational membership act as unaddressed information channels in DP-protected FL.
Additive MI Bound: A theoretical proof separating leakage into a controllable noise-dependent term and an uncontrollable structural prior-coupling term.
FULCRUM Allocation: A closed-form noise allocation strategy that strictly dominates uniform DP-SGD whenever structural leverage is asymmetric and degenerates exactly to uniform DP-SGD when leverage is symmetric, ensuring unconditional safety.
TADI Decomposition: The first empirical characterization of topology-conditional leakage, isolating parameter, structural, and organizational contributions via shadow training.
Empirical Validation: Comprehensive evaluation on Fed-ISIC2019, Fed-Heart-Disease, and synthetic CIFAR-10 across six topology families.

Results

Privacy Gains: FULCRUM achieves privacy gains of up to 1.967 nats (a reduction in the privacy bound) compared to uniform DP-SGD in asymmetric settings (e.g., hierarchical topologies with heterogeneous dataset sizes), with no measurable cost to model utility.
Utility Consistency: Statistical equivalence testing (TOST) confirms that the privacy improvements are achieved without practically meaningful degradation in model accuracy (mean absolute difference < 0.5 percentage points).
Channel Decomposition Findings:
- The parameter channel is effectively bounded by DP-SGD across all settings; the parameter-only adversary performs no better than a constant-mean baseline.
- The prior-coupling channel (structural/organizational) is empirically attainable when the adversary's shadow prior matches the deployment prior (e.g., in synthetic settings with high topology-data coupling).
- Under realistic cross-silo threat models where the adversary lacks native partition labels (mismatched priors), the bound remains conservative, and the prior-coupling term is not fully realized.
Topology Sensitivity: The gap between FULCRUM and uniform DP-SGD scales with the degree of leverage asymmetry. Symmetric topologies (e.g., rings) yield zero gap, while asymmetric topologies (e.g., stars, hierarchical trees) show significant gains.

Significance and Claims
The paper claims to be the first to treat communication topology as a known information channel exploitable for inferring sensitive data properties and to derive a defense that accounts for the resulting structural asymmetry. The authors assert that FULCRUM offers a "safe to adopt unconditionally" solution: it provides strict privacy improvements in asymmetric deployments (the common case in cross-silo FL) and gracefully degrades to the standard uniform baseline in symmetric cases. The work highlights that current uniform noise allocation is suboptimal for real-world FL deployments where structural leverage varies, and it provides a principled mechanism to balance privacy budgets according to the specific structural risks of each client.