🤖 machine learning

Private and Robust Contribution Evaluation in Federated Learning

This paper introduces two novel marginal-difference contribution scores, Fair-Private and Everybody-Else, that enable fair, private, and robust evaluation of client contributions in cross-silo federated learning under secure aggregation, overcoming the limitations of existing methods while improving model performance and malicious participant detection.

Original authors: Delio Jaramillo Velez, Gergely Biczok, Alexandre Graell i Amat, Johan Ostman, Balazs Pejo

Published 2026-02-26

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Delio Jaramillo Velez, Gergely Biczok, Alexandre Graell i Amat, Johan Ostman, Balazs Pejo

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a group of hospitals, banks, or research labs wanting to build a super-smart AI together. They all have valuable data (like patient records or financial transactions), but they can't share that raw data because of privacy laws and security risks. This is Federated Learning.

Instead of sending their data to a central server, they send small "updates" (mathematical hints about what they learned) to a central hub. The hub combines these hints to improve the global AI.

The Problem: The "Black Box" of Credit
Here's the catch: How do you know who deserves credit (and money) for the final result?

If Hospital A sends a terrible update, they shouldn't get paid as much as Hospital B, who sent a brilliant one.
But to be safe, they use a technique called Secure Aggregation. Think of this like a "magic blender." Everyone drops their update into the blender, and the blender only spits out the total mixture. The server (the blender operator) never sees individual updates. This protects privacy perfectly.

The Dilemma:
Because the server can't see individual updates, it can't easily tell who contributed what.

The Old Way (Leave-One-Out): Imagine asking every hospital, "Hey, if you didn't send your update, how much worse would the AI be?" The hospital calculates this and tells the server.
- The Flaw: This is like asking a student to grade their own homework. A selfish hospital could lie and say, "Oh, if I left, the AI would crash!" to get a bigger reward. It's a self-evaluation trap.
The Ideal Way (Shapley Value): This is the mathematical "gold standard" for fair credit. It calculates exactly how much every possible combination of hospitals adds to the group.
- The Flaw: It's computationally impossible for large groups (you'd need to train millions of models) and requires seeing individual updates, which breaks the "magic blender" privacy rule.

The Solution: Two New "Fairness Scores"
The authors of this paper invented two new ways to score contributions that work inside the "magic blender" (Secure Aggregation) without letting people cheat.

1. Fair-Private (FP): The "Symmetric Self-Check"

The Analogy: Imagine a team project where you are asked to calculate your own score, but you have to do it in a very specific, balanced way. You calculate how much the team improves when you join an empty room, and how much it worsens when you leave the full room. You average these two numbers.
Why it works: It's mathematically fair (satisfies standard fairness rules) and respects privacy.
The Catch: It still relies on you calculating your own number. A truly selfish cheater could still fudge the math to look better.

2. Everybody-Else (EE): The "Peer Review System"

The Analogy: This is the paper's big breakthrough. Instead of asking Hospital A to grade itself, we ask Hospital B, C, and D to grade Hospital A.
- Hospital B looks at the group without A and compares it to the group with A.
- Hospital C does the same.
- We average all these "peer reviews" to get A's score.
Why it works:
- No Self-Grading: Hospital A cannot manipulate its own score because it doesn't calculate it.
- Privacy Safe: The server only sees the final aggregated score, not the individual peer reviews.
- Robust: Even if Hospital A tries to sabotage the group, the "Everybody-Else" method dilutes their ability to game the system.
The Trade-off: In pure math theory, this method isn't perfectly fair in one tiny edge case (if someone contributes absolutely nothing, they might still get a tiny score), but in the real world, this is a tiny price to pay to stop cheaters.

Why Does This Matter?

The authors tested these methods on real medical data (like brain scans and skin cancer images) and standard AI datasets.

Fairness: They found that these new scores rank the hospitals almost exactly the same way the "perfect but impossible" Shapley Value would.
Security: They successfully stopped selfish hospitals from inflating their own scores.
Better AI: When they used these scores to give more weight to good hospitals and less weight to bad ones, the final AI model became more accurate and caught "bad actors" (like hospitals trying to poison the data) much better than the old methods.

In a Nutshell:
This paper solves the "How do we pay people fairly when we can't see what they did?" problem in privacy-protected AI. They replaced the "honor system" (self-grading) with a "peer-review system" (Everybody-Else), ensuring that in a world of secret data, fairness and security can finally coexist.

1. Problem Statement

In Cross-Silo Federated Learning (FL), multiple organizations collaborate to train models without sharing raw data. While Secure Aggregation (SA) is a standard privacy-preserving mechanism that hides individual client updates (gradients) from the server, it creates a fundamental conflict with Contribution Evaluation (CE).

The Conflict: Fair reward allocation and the detection of malicious or low-quality participants require assessing each client's marginal contribution to the global model.
The Limitation of Existing Methods:
- Shapley Value (SV): The gold standard for fairness, but computationally intractable (exponential complexity) and requires access to individual updates, making it incompatible with SA.
- Leave-One-Out (LOO): The only practical SA-compatible method, but it relies on self-evaluation (each client computes its own score). This makes the system vulnerable to manipulation by selfish clients who can inflate their own scores.
- Cosine Similarity (COS): A common alternative that ignores marginal contributions, leading to poor ranking accuracy and failure to capture true data value.

The paper addresses the challenge of designing CE methods that are simultaneously fair, private (SA-compatible), and robust against manipulation.

2. Methodology

The authors propose two novel marginal-difference contribution scores that operate strictly within the constraints of Secure Aggregation.

Context & Constraints

SA Constraints: The server only sees the aggregated global model ( $M$ ) and the initial model ( $M_0$ ). Individual updates ( $U_i$ ) are hidden.
Client Capabilities: A client $i$ can locally compute models for the singleton coalition $\{i\}$ ( $M_0 + U_i$ ) and the coalition excluding itself $[N] \setminus \{i\}$ ( $M - U_i$ ).
Goal: Derive scores using only these four accessible models: $M_0$ , $M$ , $M+U_i$ , and $M-U_i$ .

Proposed Schemes

A. Fair-Private (FP)

Concept: FP improves upon LOO by incorporating a symmetric "Include-One-In" (IOI) term. It calculates the marginal difference of adding a client to an empty set and removing them from the grand coalition.
Formula:
$FP(i) = \left( \frac{\alpha(i)}{\sum \alpha(j)} \right) \cdot v(M)$
Where $\alpha(i)$ is the average of the LOO score ( $v(M) - v(M-U_i)$ ) and the IOI score ( $v(M_0+U_i) - v(M_0)$ ).
Properties: Satisfies Efficiency, Null Player, Symmetry, and SA Compatibility.
Weakness: Like LOO, it relies on self-evaluation, making it vulnerable to clients misreporting their own scores.

B. Everybody-Else (EE)

Concept: To eliminate self-evaluation, EE introduces a cross-evaluation mechanism. A client's score is determined by the marginal differences reported by all other clients.
Mechanism:
- Client $j$ evaluates the impact of client $i$ by comparing coalitions where $i$ is present vs. absent, but calculated from $j$ 's perspective.
- Specifically, $\beta(i)$ aggregates the difference between the grand coalition and singleton $\{j\}$ , while $\gamma(i)$ aggregates the difference between $[N]\setminus\{j\}$ and the empty set.
- Client $i$ 's score is the normalized average of these evaluations provided by all $j \neq i$ .
Properties: Satisfies Efficiency, Symmetry, SA Compatibility, and Manipulation Resistance.
Trade-off: It relaxes the Null Player property (a client contributing zero value might still receive a non-zero score) to achieve robustness against manipulation.

3. Key Contributions

Novel Algorithms: Introduction of FP and EE, the first CE scores designed specifically for SA-compatible FL that balance fairness and privacy.
Theoretical Guarantees:
- Proved that both methods satisfy key fairness axioms (with EE trading Null Player for robustness).
- Established $O(N)$ computational complexity, making them scalable for large numbers of clients (unlike the exponential complexity of exact Shapley).
- Demonstrated Manipulation Resistance for EE, proving that a client cannot directly influence their own score.
Privacy Preservation: Both methods strictly adhere to SA constraints, ensuring no individual gradients are exposed to the server or other clients.

4. Experimental Results

The authors evaluated FP and EE on four datasets: ISIC2019, PatchChameleon, Brain-MRI, and CIFAR10, under non-IID data distributions.

Ranking Accuracy:
- Both FP and EE achieved high Spearman correlation ( $\phi > 0.9$ ) with the ground-truth Multi-Round Shapley Value (MR-SV) and the true Shapley Value.
- They significantly outperformed LOO (which had lower correlation) and Cosine Similarity (which performed poorly, often near zero correlation).
Robustness to Manipulation:
- In scenarios where clients attempted to inflate their scores, EE remained robust as it does not rely on self-reporting.
- FP and LOO were shown to be vulnerable to self-reporting manipulation.
Downstream Utility:
- Performance Gain: When aggregating updates weighted by FP/EE scores, the global model achieved accuracy nearly identical to MR-SV weighting, significantly outperforming standard FedAvg (uniform weighting) and LOO.
- Misbehavior Detection: FP and EE successfully identified Byzantine attackers (label flipping) with high probability, nearly matching the detection rates of the computationally expensive MR-SV.
Scalability: The methods remained stable across varying numbers of clients (6 to 15) and different training rounds.

5. Significance and Impact

This work bridges a critical gap in Federated Learning between privacy and accountability.

Practical Deployment: It offers a principled solution for real-world Cross-Silo FL (e.g., healthcare, finance) where strict privacy regulations (GDPR) mandate Secure Aggregation, yet fair compensation and quality control are essential.
Beyond LOO: It moves the field past the crude and manipulable Leave-One-Out approximation, providing mathematically grounded alternatives that preserve the spirit of the Shapley Value.
Robustness: By introducing the "Everybody-Else" concept, the paper solves the "self-evaluation" vulnerability, ensuring that incentive mechanisms cannot be gamed by selfish participants.

In conclusion, the paper demonstrates that fairness, privacy, and robustness are not mutually exclusive in FL. The proposed methods enable efficient, private, and manipulation-resistant contribution evaluation, facilitating trustworthy collaborative machine learning.