⚡ electrical engineering

Fed-FBD: Federated Functional Block Diversification for Isolation, Privacy, and Surgical Unlearning

Fed-FBD is a modular federated learning architecture that decomposes neural networks into independently tracked functional blocks to provide architecturally guaranteed isolation against adversarial clients, inherent privacy against membership inference, and sub-second surgical unlearning of departed participants, all while maintaining competitive accuracy on medical and general image datasets.

Original authors: Weijie Chen, Alan B. McMillan

Published 2026-06-12

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Weijie Chen, Alan B. McMillan

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are running a massive cooking competition where chefs from different hospitals (the "clients") want to create the world's best recipe for diagnosing diseases, but they cannot share their secret ingredients (patient data) with each other due to privacy laws.

In the current standard method (called FedAvg), all the chefs send their notes to a central judge, who mixes them all together into one giant, single "Master Recipe."

The Problem: If one chef is a saboteur (an "adversarial client") or just makes a huge mistake, they ruin the entire Master Recipe. If a chef wants to quit and have their contribution removed, you have to throw away the whole Master Recipe and start cooking from scratch.

The paper introduces a new system called FED-FBD. Instead of one giant Master Recipe, this system builds a Warehouse of Six Different "Color" Recipes.

Here is how it works, using simple analogies:

1. The Modular Kitchen (Functional Block Diversification)

Imagine a ResNet (the AI model) isn't a single block of clay, but a car made of six distinct parts: the engine, the chassis, the wheels, the interior, the electronics, and the paint job.

In FED-FBD, the system creates six different versions (or "colors") of the final car.

Color A might have an engine from Chef 1, wheels from Chef 2, and paint from Chef 3.
Color B might have an engine from Chef 2, wheels from Chef 3, and paint from Chef 4.

The warehouse keeps track of exactly which chef contributed to which part of which color car.

2. The "Firewall" Against Saboteurs (Isolation)

This is the system's superpower.

The Scenario: Chef 1 is a saboteur. They try to put a bomb in the engine of Color A.
The Result: Because Chef 1 only had access to the engine of Color A, they cannot touch the wheels, the paint, or the engine of Color B, C, D, E, or F.
The Outcome: The "Clean Colors" (B through F) remain perfectly safe and functional. The saboteur only ruined the specific cars they were allowed to touch. In the old system, the bomb would have exploded in the one Master Recipe, ruining everything for everyone.

3. The "Right to be Forgotten" (Surgical Unlearning)

What if Chef 2 decides to quit and demands their contribution be erased?

Old Way: You have to retrain the whole model from scratch, which takes days.
FED-FBD Way: The system looks at the warehouse, finds the specific parts (blocks) that Chef 2 built, and simply swaps them out with the average of the other chefs' parts.
The Speed: This happens in less than a second. It's like swapping a tire on a car while it's parked, rather than rebuilding the whole factory.

4. Built-in Privacy (Privacy-by-Design)

In the old system, the Master Recipe memorized details about specific patients, which could be hacked to reveal who was in the training data.

FED-FBD: Because the data is split so finely (each "part" of the car only sees a tiny slice of the data), no single part ever learns enough to remember a specific patient.
The Result: Even before adding any extra security measures, the system is naturally "blind" to individual identities. It's like trying to guess a specific person's face by looking at a single pixel of a photo; it's impossible.

5. The Trade-off (The Cost)

Is this perfect? Almost, but there is a small price to pay.

The Cost: On very large, well-balanced datasets, the new system is slightly less accurate (about 0.3% to 3% lower) than the old "Master Recipe" method.
The Benefit: You trade a tiny bit of accuracy for total safety against saboteurs, instant removal of bad actors, and built-in privacy.
The Catch: If the data is very messy or the chefs have very little data (small datasets), the system can struggle to agree on a good recipe, and the accuracy drops more significantly.

Summary

FED-FBD changes the game from "mixing everything into one pot" to "building a library of modular, tracked components."

If a component is poisoned, only that specific component is ruined; the rest of the library is safe.
If a chef leaves, you just swap out their specific components instantly.
The system is naturally private because no single component sees enough data to memorize secrets.

The paper proves this works well on medical image datasets (like X-rays and skin scans), keeping the system safe and private while maintaining high performance, provided there is enough data to go around.

Technical Summary: FED-FBD

Problem Statement

Federated Learning (FL) enables collaborative model training on decentralized medical data without sharing raw patient records. However, dominant methods like FedAvg, FedProx, and FedNova treat clients as black boxes, leading to three critical vulnerabilities in realistic medical deployments:

Lack of Isolation: A single adversarial or mislabeled client can corrupt the entire global model because every client's gradient contributes to every parameter.
Weak Privacy Guarantees: Standard FL offers no inherent privacy; protection relies on "bolt-on" mechanisms like differential privacy or secure aggregation.
Inefficient Unlearning: Honoring a participant's "right to be forgotten" typically requires retraining the model from scratch or using expensive approximations.

The authors argue these issues stem from a common root: every weight is a shared resource. If parameters were instead owned by small, known sets of clients, contamination could be contained by construction, memorization structurally limited, and client removal reduced to a set operation.

Methodology: FED-FBD

The paper proposes FED-FBD (Federated Functional Block Diversification), a modular architecture that decomposes a ResNet backbone into six functional blocks: the stem, four residual groups, and the classification head.

Core Architecture

The Warehouse: The server maintains a warehouse of $N$ "colour variants" (complete models). Each colour is assembled from one block per functional position.
Contributor Stamping: Each block weight tensor is assigned a unique hash and a training trace recording the specific client IDs that updated it.
Shipping Plan: A predefined plan restricts each client to a known subset of colours. For example, in a 6-client, 6-colour setup, Client 0 might only be allowed to write to blocks for colours $M_0, M_1, M_2$ . Consequently, colours $M_3, M_4, M_5$ are architecturally isolated from Client 0.
Training Objective: Clients minimize a loss function combining cross-entropy accuracy and a Kullback-Leibler (KL) divergence term. The KL term pulls a client's predictions toward a randomly chosen, differently parameterized "sibling" colour to encourage functional diversity and prevent collapse.
Server Protocol: The server performs direct replacement of block weights rather than weighted averaging. When a client returns an updated block, it overwrites the existing tensor for that specific block-colour intersection.

Key Mechanisms

Block-Level Isolation: Because blocks are overwritten directly, any block excluded from a client's shipping plan is mathematically guaranteed to never contain information derived from that client's data.
Surgical Unlearning: To remove a client, the server identifies all blocks where the client is a contributor and replaces them with the average of the remaining "clean" colours at those positions. This requires no retraining.
Inference Routing: At inference, the system can route predictions to the most trustworthy colour per sample or average the ensemble, allowing for the exclusion of compromised colours post-hoc.

Key Contributions

Architectural Isolation: FED-FBD provides perfect block-level isolation. Experiments show that even under severe adversarial attacks (label-flip, noise injection), "clean" colours (those the attacker cannot touch) deviate by no more than $\pm 0.01$ AUC, while poisoned colours degrade significantly.
Privacy-by-Design: The framework structurally suppresses memorization. Membership inference attack (MIA) advantage is indistinguishable from chance ( $0.50 \pm 0.01$ ) before any explicit privacy mechanism is applied, as no single block sees enough data to memorize individual samples.
Sub-Second Unlearning: The paper demonstrates "surgical" machine unlearning via aggregate block replacement. This achieves exact removal of a client's contribution in sub-second wall-clock time with a utility loss of less than $0.25\%$ AUC, avoiding the need for retraining.
Phase Transition Characterization: The authors identify a "data-per-client $\times$ heterogeneity" phase transition. FED-FBD performs competitively (within $\sim 4\%$ of FedAvg) when clients have sufficient data (e.g., $\ge 15,000$ samples) even under high heterogeneity ( $\alpha=0.25$ ), but performance collapses on very small datasets with high skew.

Experimental Results

Experiments were conducted on six MedMNIST-2D datasets, PathMNIST at $224\times224$ resolution, and CIFAR-10 using 6 clients and 100 communication rounds.

Accuracy Trade-offs: On adequately sized datasets, FED-FBD trades a modest accuracy gap of $0.3\%$ – $3.1\%$ against FedAvg for its safety guarantees. On PathMNIST ( $224\times224$ ), the gap shrinks to $1.2\%$ .
Non-IID Performance: Under mild heterogeneity ( $\alpha=1.0$ ), FED-FBD remains within $0.8\%$ – $4.0\%$ of FedAvg on three of four datasets. Performance degrades under extreme skew on small datasets, but the gap narrows as samples-per-client increase.
Adversarial Robustness: Across six attack configurations, clean colours remained isolated. A simple server-side z-score on validation loss detected $39\%$ – $76\%$ of attacks with low false positives.
Unlearning Efficiency: Unlearning operations completed in under 1 second with negligible AUC loss (worst case $-0.0022$).

Significance and Claims

The paper claims that FED-FBD shifts the paradigm of federated learning from "probabilistic" safety (relying on robust aggregation or noise) to structural safety. By making parameter ownership granular and explicit:

Contamination becomes impossible rather than merely improbable.
Unlearning becomes a lookup and aggregation operation rather than an optimization problem.
Privacy is inherent to the architecture, not an add-on.

The authors position FED-FBD as a solution specifically motivated by the strict data governance needs of hospital networks, offering a tractable way to handle poisoned clients and deletion requests without costly retraining. They acknowledge limitations, including fixed shipping plans and the fact that exact unlearning is only possible for exclusively owned blocks, but argue that the trade-off in accuracy is justified for high-stakes medical applications where isolation and auditability are paramount.