Federated learning: Question bank — AI-ML deep dive

True or false — justify

Federated learning means no data ever leaves the device, so it is automatically private.

False. Raw data stays local, but the updates (gradients / weight deltas) can leak information — gradient-inversion attacks can reconstruct training images from a single small-batch gradient. Privacy needs an extra layer like Differential Privacy.

FedAvg with one local epoch (

E = 1

, full-batch) is exactly ordinary gradient descent on the global loss

F (θ)

True. Averaging

θ^{(t)} - η \nabla F_{k}

with weights

n_{k} / n

pulls the

θ^{(t)}

out and leaves

θ^{(t)} - η \sum_{k} \frac{n _{k}}{n} \nabla F_{k} = θ^{(t)} - η \nabla F (θ^{(t)})

, one clean GD step.

Increasing local epochs

E

always speeds up training because you compute more per round.

False. More

E

means fewer communication rounds but each client drifts toward its own local minimum, adding the

O (E^{2} η^{2} σ^{2})

drift error. On heterogeneous data too-large

E

can make the global model worse.

Weighting client updates by dataset size

n_{k}

is a nice-to-have, not essential.

False. The

n_{k} / n

weighting is the definition of the global objective

F (θ) = \sum_{k} \frac{n _{k}}{n} F_{k}

. Drop it and you're optimizing a different problem where a 10-sample client counts as much as a 10 000-sample one.

If every client had identical (IID) data, the choice of which 10% to sample each round wouldn't matter much.

True. With IID data every client's gradient is an unbiased estimate of the global gradient, so any subset gives a similar update. Sampling only bites when data is heterogeneous / non-IID.

Adding Gaussian noise for differential privacy costs you accuracy.

True. The noise

N (0, σ^{2} S^{2} I)

blurs the true update; larger

σ

(smaller

ϵ

, more privacy) means a noisier gradient and lower final accuracy — the core privacy–utility trade-off.

A smaller

ϵ

(ϵ, δ)

-DP means weaker privacy.

False. Smaller

ϵ

means the output distribution barely changes when one person's data is added/removed (

e^{ϵ} \approx 1

), so more privacy. Big

ϵ

is the weak setting.

Federated learning removes the need for a central server entirely.

False (for FedAvg). Standard FedAvg still needs a server (orchestrator) to broadcast

θ^{(t)}

and aggregate. Fully decentralized variants exist, but the vanilla algorithm is centrally coordinated, data-decentralized.

Sending model weights instead of raw data always reduces total bandwidth.

Usually, not always. For big datasets the model is far smaller than the data (300× savings in the ResNet example). But for a tiny dataset with a huge model over many rounds, repeatedly shipping the model can cost more than shipping the data once — see Model Compression for the fix.

Spot the error

"To combine models, just average all the weights equally:

θ = \frac{1}{N} \sum_{k} θ_{k}

The error is equal weights. It should be

\sum_{k} \frac{n _{k}}{n _{S}} θ_{k}

, weighted by data size; equal averaging lets a noisy 10-sample client sway the model as much as a 10 000-sample one and can cause divergence.

"After local training, each client sends back its raw gradients so the server can do the descent step."

In FedAvg with

E > 1

epochs there is no single gradient to send — the client sends its updated weights

θ_{k}^{(t + 1)}

after several SGD steps, and the server averages weights, not gradients.

"Clipping gradients at norm

S

is a performance tweak; for DP just add noise."

Clipping is required for DP, not optional. Without a bounded sensitivity

S

, one record could change the update arbitrarily, demanding infinite noise to hide it — clipping caps that sensitivity so finite noise suffices.

"The aggregation weight uses

n

, the total data across all clients."

In each round it uses

n_{S_{t}} = \sum_{j \in S_{t}} n_{j}

, the total over the sampled subset, since only those clients contribute that round. Using the global

n

would under-weight everyone.

δ_{k} = ∥ θ_{k}^{*} - θ^{*} ∥^{2}

measures how much noise client

k

adds for privacy."

No —

δ_{k}

measures client drift: the distance between client

k

's local optimum and the global optimum, i.e. how heterogeneous the data is. It's unrelated to the DP noise

σ

"Because gradients are just numbers, they can't reveal the images they came from."

They can. Gradient-inversion attacks solve for the input

x

that would produce the observed

\nabla_{θ} ℓ (x, y; θ)

, and for small batches / high-res images the reconstruction can be startlingly accurate.

"With more communication rounds

T

the drift term

O (E^{2} η^{2} σ^{2})

shrinks."

Only the first term

O (1/ T)

shrinks with

T

. The drift term depends on

E

η

, and gradient variance — raising

T

alone leaves it untouched; you must lower

E

η

to shrink it.

Why questions

Why do we send the model to the data instead of the data to the model?

Raw data is huge, sensitive, and often legally immovable (GDPR/HIPAA); model updates are small compressed "knowledge" and keep raw records under user control — solving privacy, bandwidth, and regulation at once.

Why weight each client's contribution by

n_{k} / n

rather than treating clients equally?

Because the global loss is an average over all data points, not over clients; a client with more samples has estimated its slice of the loss more reliably and should steer the shared model proportionally.

Why does non-IID data slow convergence even though the algorithm is unchanged?

Each client's local optimum

θ_{k}^{*}

sits somewhere different, so their updates pull in conflicting directions; the averaged step partly cancels, and the model zig-zags instead of heading straight to

θ^{*}

Why isn't "raw data never leaves the device" enough for a formal privacy guarantee?

It's a design property, not a proof. Updates still carry information and can be attacked; only a mechanism like $(\epsilon,\delta)$-DP gives a mathematical bound on how much any individual's data can leak.

Why do we sample only ~10% of clients per round instead of all of them?

Coordinating billions of intermittently-connected edge devices every round is infeasible; a random subset gives an unbiased-enough gradient estimate while slashing communication and straggler costs.

Why can too much noise for privacy make the model useless, not just less accurate?

When

σ

swamps the true signal in each update, the averaged step becomes nearly random; the model then does a slow random walk and never converges — privacy is bought at the price of learning anything at all.

Why might personalized layers help on heterogeneous clients?

A shared global body captures common structure while small per-client layers absorb the drift

δ_{k}

, so each device fits its own distribution without forcing everyone to compromise on one averaged model — the Multi-Task Learning view.

Edge cases

What happens if a client has zero data points (

n_{k} = 0

Its weight

n_{k} / n = 0

, so it contributes nothing to the average — correct behaviour. In code you simply must not divide by

n_{k}

inside its local loss, or you get a

0/0

; skip empty clients entirely.

What if only one client is sampled in a round (

∣ S_{t} ∣ = 1

The aggregation weight

n_{k} / n_{S_{t}} = 1

, so the global model becomes that single client's local model — maximal drift and the noisy-averaging failure in the extreme. This is why a minimum cohort size matters.

What if all clients have identical data?

Every

F_{k}

equals

F

, so all local optima coincide with the global one, drift

δ_{k} = 0

, and FedAvg behaves exactly like centralized SGD regardless of

E

or sampling — the best-case degenerate scenario.

What happens in the limit

E \to \infty

(train each client to full local convergence before averaging)?

Each client returns its own optimum

θ_{k}^{*}

; averaging those gives

\sum_{k} \frac{n _{k}}{n} θ_{k}^{*}

, which for non-IID data is generally not

θ^{*}

— the model can plateau at a wrong point despite perfect local training.

What if a malicious client sends a huge, adversarial update?

Plain FedAvg has no defence — a large-norm poisoned update can dominate the weighted average. This is exactly the gap Byzantine Robust Learning closes with robust aggregation (median, trimmed mean) instead of a raw weighted average.

What happens to DP as the number of participating clients grows very large?

With more honest participants each round, the added noise averages out relative to the aggregated signal, so you can often reach the same target

ϵ

with less per-client noise — large-scale deployments like Gboard's billion devices exploit exactly this.

Recall One-line summary of the traps

Weight by data size, average weights not raw gradients, clip then add noise, and remember: "data stays local" is a design choice, not a privacy proof.

The two silent killers ::: client drift on non-IID data, and update leakage without differential privacy.

See also: Optimization Theory · Privacy-Preserving ML · Federated learning