Detecting Atypical Clients in Federated Learning via Representation-Level Divergence

Technical Summary: Detecting Atypical Clients in Federated Learning via Representation-Level Divergence

Problem Statement

Federated Learning (FL) enables collaborative model training across distributed clients without sharing raw data, addressing privacy and security constraints. However, FL faces significant challenges due to data heterogeneity (non-i.i.d. distributions), which often leads to unstable convergence and degraded global performance. Beyond benign statistical heterogeneity, practical deployments face risks where client updates deviate due to distributional shifts, sensor drift, or anomalous inputs.

Current approaches for detecting such deviations often rely on comparing model parameters or gradients. The authors argue these methods provide limited insight into how different clients affect the internal functional behavior and decision boundaries of the Neural Network (NN). There is a need for a mechanism to distinguish between expected variability caused by non-i.i.d. data and potentially harmful deviations that compromise the stability or trustworthiness of the aggregation process.

Methodology

The paper proposes a lightweight, geometric metric to quantify the functional divergence between a client's local model and the global model. Instead of analyzing parameters, the approach focuses on the activation-induced partition of the input space.

1. Activation Patterns and Input Space Partitioning:

   • For a ReLU-based Feedforward Neural Network (FF), the authors define binary activation patterns $a_l(x; \theta)$ for each layer $l$.
   • These patterns partition the input space into piecewise-affine regions. Samples sharing the same activation pattern belong to the same region.
   • The authors utilize a fixed, shared probe set $P$ (an i.i.d. subset of data) to evaluate these patterns.

2. Activation Affinity Metric:

   • For a given layer $l$, the activation affinity $K^\theta_l(i, j)$ between two probe samples $x_i$ and $x_j$ is calculated based on the Hamming distance between their activation patterns.
   • This metric quantifies the "distance" between samples in terms of the number of hyperplanes crossed. A high affinity indicates samples lie in the same or nearby regions; a low affinity indicates separation by multiple hyperplanes.
   • This results in an affinity matrix $K^\theta_l$ that captures how a model groups inputs.

3. Hierarchical Geometric Divergence:

   • To compare a client model ($\theta_c$) with the global model ($\theta_g$), the authors compute the Frobenius norm of the difference between their affinity matrices: $d_l(\theta, \theta') = \|K^\theta_l - K^{\theta'}_l\|_F$.
   • A hierarchical divergence ($D_{hier}$) is defined to account for the structure of NNs. Since early layers define coarse separations and deeper layers refine them, discrepancies in early layers are weighted more heavily.
   • The formula is:
     $$D_{hier}(\theta, \theta') = d_1(\theta, \theta') + \sum_{l=2}^{L} \left( \prod_{r=1}^{l-1} \lambda_r \right) d_l(\theta, \theta')$$
     where $\lambda_l = \exp(-\beta d_l)$ acts as a downweighting factor for deeper layers if earlier layers already exhibit significant differences.

4. Anomaly Detection:

   • In an FL setting, the divergence $D_c^{(t)}$ is computed for each client $c$ at round $t$.
   • To identify atypical clients, a robust outlier score (z-score) is calculated using the median and Median Absolute Deviation (MAD) of the divergence distribution across all clients.

Key Contributions

• Geometric Perspective: Introduces a novel perspective for analyzing FL client behavior based on the geometric structure induced by NN activation patterns, rather than parameter values.
• Lightweight Metric: Proposes a metric that quantifies functional divergence by measuring how local training alters the organization of the input space, capturing differences beyond parameter-level comparisons.
• Interpretable Signal: Demonstrates that this metric provides an interpretable signal for monitoring data heterogeneity and identifying atypical client contributions.

Experimental Results

The authors evaluated the metric on two scenarios: an MLP on Fashion-MNIST and a ResNet-18 on CIFAR-10, using Stochastic Gradient Descent (SGD) with Dirichlet partitioning to simulate non-i.i.d. data.

1. Metric Validation (Heterogeneity Analysis):

   • Experiments varied the Dirichlet parameter $\alpha$ (from $\alpha=10$ near i.i.d. to $\alpha=0.1$ highly heterogeneous).
   • Results: In near i.i.d. settings ($\alpha=10$), client divergences stabilized quickly. In highly heterogeneous settings ($\alpha=0.1$), the metric captured a systematic increase in divergence and identified clients that persistently deviated from the global model, aligning with the intuition that distinct data distributions induce distinct geometric organizations.

2. Anomalous Client Identification:

   • A "shifted" client was simulated by applying perturbations (Gaussian noise, rotations, blurring) to one client's dataset while others remained standard.
   • Results: The shifted client consistently exhibited significantly higher geometric divergence and robust z-scores compared to regular clients across all rounds. While regular clients converged to stable divergence values, the shifted client maintained a persistent deviation, indicating a fundamentally different geometric organization of the input space. This held true across both architectures and datasets.

Significance and Claims

The paper claims that monitoring the geometric structure induced by NNs provides a meaningful and interpretable signal for assessing client contributions in FL. The proposed metric effectively distinguishes between stable, heterogeneous clients and those whose updates induce atypical functional changes.

The authors position this work as a tool for risk-aware aggregation strategies. By identifying clients that deviate functionally (rather than just parametrically), the system can weight or filter updates based on their functional behavior. The paper concludes that this approach opens the door to more informed aggregation, though it notes that future work is required to integrate this signal directly into the training loop and apply it to large-scale or adversarial settings. The work is presented as complementary to existing cryptographic privacy and Byzantine robustness methods, offering a geometric monitoring signal rather than formal cryptographic guarantees.