The Complete Guide to Federated Learning
From FedAvg to differential privacy and secure aggregation — a structured, visual walkthrough of how models are trained collaboratively across thousands of devices or institutions, without the raw data ever leaving its source.
Core Concepts
Federated Learning (FL) is a distributed machine learning paradigm in which many clients — phones, hospitals, banks, edge devices — collaboratively train a shared model while keeping their raw data local. Only model updates (gradients or weights) are exchanged, coordinated by a central server or a peer-to-peer protocol.
Client
A device or institution holding a private, local dataset that never leaves its boundary during training.
Central Server
Coordinates training rounds, selects participating clients, and aggregates their updates into a new global model.
Local Training
Each selected client performs several epochs of gradient descent on its own data, starting from the current global model.
Aggregation Round
The server combines client updates — typically a weighted average — to produce the next global model version.
Why Federate Instead of Centralize?
Three forces drive adoption: privacy regulation (GDPR, HIPAA, and similar laws restrict moving sensitive data), data gravity (data generated on billions of edge devices is too large or too sensitive to upload), and competitive or institutional boundaries (hospitals and banks want the benefit of pooled models without ever sharing proprietary records with each other).
FL is not automatically private. Sharing gradients instead of raw data reduces exposure but does not eliminate it — gradient-leakage and model-inversion attacks can sometimes reconstruct training examples, which is why differential privacy and secure aggregation (covered later) are treated as complements to FL, not optional extras.
Types of Federated Learning
FL systems are classified along two independent axes: how data is partitioned across clients (horizontal vs. vertical), and how many clients participate (cross-device vs. cross-silo).
By Data Partitioning
Horizontal FL
Clients share the same feature space but hold different samples — e.g. every phone's keyboard app has the same input fields but different users. The most common and best-studied setting.
Same FeaturesVertical FL
Clients hold different features for an overlapping set of entities — e.g. a bank and an e-commerce company that share customers but hold different attributes about them. Requires private entity alignment before training.
Same SamplesFederated Transfer Learning
Applies when clients differ in both features and samples, using transfer-learning techniques to bridge the gap and still benefit from shared representations.
Minimal OverlapBy Deployment Scale
Cross-Device FL
Millions of unreliable, resource-constrained clients (phones, IoT sensors). Only a small fraction participate per round; clients may drop out mid-training; data is massively non-IID.
Cross-Silo FL
A small number (tens to hundreds) of reliable, well-resourced organizations — hospitals, banks, enterprises. Higher per-client compute, more consistent participation, and often stronger security requirements.
The FedAvg Algorithm
Federated Averaging (FedAvg), introduced by McMahan et al. in 2016, is the foundational FL algorithm. Each round, a subset of clients trains locally for several epochs, and the server averages the resulting weights — weighted by each client's local dataset size.
# server selects a random fraction C of clients selected = sample(clients, frac=C) updates = [] for client in selected: w_local = client.local_train(w_global, epochs=E, lr=eta) updates.append((w_local, client.n_samples)) # weighted average by local dataset size total_n = sum(n for _, n in updates) w_global = sum(w * (n / total_n) for w, n in updates)
FedAvg's simplicity is also its weakness: it assumes clients contribute roughly comparable, IID-like updates and complete a fixed number of local epochs — assumptions that break down under statistical and system heterogeneity, discussed next.
Advanced Federated Optimization
A family of algorithms extends FedAvg to handle non-IID data, partial participation, and unstable convergence more gracefully.
| Algorithm | Year | Key Idea | Addresses |
|---|---|---|---|
| FedAvg | 2016 | Weighted averaging of locally-trained client models over multiple communication rounds. | Baseline |
| FedProx | 2018 | Adds a proximal term penalizing local models that drift too far from the global model. | Client Drift |
| SCAFFOLD | 2020 | Uses control variates to correct for client-drift bias in local gradient updates directly. | Non-IID Convergence |
| FedOpt / FedAdam / FedYogi | 2021 | Treats the aggregated update as a pseudo-gradient and applies adaptive server-side optimizers (Adam, Yogi). | Slow Convergence |
| FedNova | 2020 | Normalizes client updates by the number of local steps taken, correcting for objective inconsistency. | Uneven Local Epochs |
| FedDyn | 2021 | Dynamically regularizes each client's local objective so its optimum aligns with the global optimum. | Client Drift |
Statistical & System Heterogeneity
Real federated deployments look nothing like centralized training's clean, shuffled batches. Two kinds of heterogeneity dominate practical FL system design.
Statistical Heterogeneity (Non-IID Data)
Each client's local data reflects its own usage patterns, geography, or demographics — it is not independently and identically distributed. A keyboard app on a teenager's phone and a retiree's phone see very different vocabulary. This causes client drift: local models converge toward client-specific optima that pull the aggregated global model away from the true objective.
System Heterogeneity
Clients vary enormously in compute power, network bandwidth, battery life, and availability. Slower devices (stragglers) can either delay every round or be dropped, biasing the model toward faster, better-connected clients. Most production systems use partial participation — sampling a random subset of clients each round — and asynchronous or semi-synchronous aggregation to tolerate dropouts.
Client Drift
Local models overfit to skewed local distributions, degrading the aggregated global model's accuracy on the true global distribution.
Stragglers
Slow or intermittently-connected clients delay rounds; mitigated with timeouts, partial aggregation, or asynchronous updates.
Partial Participation
Only a random fraction of clients train each round, which is necessary at cross-device scale but adds variance to the aggregated update.
Communication Efficiency
Communication — not computation — is usually the bottleneck in FL, especially on cellular or IoT links. A whole toolkit exists purely to shrink what gets sent each round.
Model Compression
Reduces the size of transmitted weights through pruning or low-rank factorization before upload.
Quantization
Represents weights or gradients with fewer bits (e.g. 8-bit or ternary) to shrink payloads with minimal accuracy loss.
Sparsification
Transmits only the largest-magnitude gradient updates, accumulating the rest locally for a future round.
Local Epoch Tuning
Increasing local computation per round (more local epochs) reduces the number of communication rounds needed to converge.
Privacy & Security
FL narrows the attack surface but doesn't close it. A mature FL deployment layers several complementary defenses against both privacy leakage and malicious participants.
Privacy-Preserving Techniques
Differential Privacy
Adds calibrated noise to client updates so no single training example can be confidently inferred from the aggregated result, at a quantifiable privacy cost.
Secure Aggregation
A cryptographic protocol letting the server compute the sum of client updates without ever seeing any individual client's update in the clear.
Homomorphic Encryption
Allows computation directly on encrypted updates, offering strong guarantees at the cost of significant computational overhead.
Threats to Defend Against
Privacy Attacks
Membership inference tries to determine whether a specific record was used in training; gradient leakage / model inversion attempts to reconstruct training samples directly from shared gradients.
Integrity Attacks
Data poisoning corrupts a malicious client's local data; model poisoning submits crafted updates designed to bias or backdoor the global model. Byzantine-robust aggregation (e.g. Krum, trimmed mean, median) defends against both.
Personalized Federated Learning
A single global model is often a compromise that serves no client optimally under heavy non-IID skew. Personalized FL adapts the shared model to each client while still benefiting from collaborative training.
Fine-Tuning
Each client takes the converged global model and performs a few additional local training steps to specialize it.
Per-FedAvg (Meta-Learning)
Trains a global model explicitly optimized to be a good starting point for fast per-client adaptation, borrowing from MAML.
Ditto & Multi-Task FL
Jointly optimizes a shared global model and per-client personalized models, balancing collaboration against local specialization.
Clustered FL
Groups clients with similar data distributions and trains a separate model per cluster instead of one single global model.
Federated Distillation
Shares soft predictions rather than model weights, letting clients with different architectures still collaborate.
Layer Personalization
Keeps certain layers (often the final classification head) local and private while federating the shared feature extractor.
Key Dichotomies
Two axes classify almost every FL deployment decision. Knowing where a system sits on each shapes algorithm choice, security posture, and infrastructure.
Centralized ML
- All data pooled on one server before training
- Simple, fast iteration, full data visibility
- High privacy and regulatory exposure
- Limited by data-transfer bandwidth and storage
Federated Learning
- Data stays local; only model updates travel
- Naturally aligned with privacy regulation
- Complex orchestration, communication-bound
- Statistical & system heterogeneity add real difficulty
Cross-Device FL
- Millions of unreliable, resource-limited clients
- Small random fraction participates per round
- Extreme non-IID skew, frequent dropouts
- Examples: mobile keyboards, wearables
Cross-Silo FL
- Tens to hundreds of reliable, well-resourced clients
- Near-full participation every round
- Stronger security/compliance requirements
- Examples: hospital consortia, bank networks
Milestones in Federated Learning
A young field defined by one landmark paper, rapid production deployment, and a fast-growing research and tooling ecosystem.
Real-World Applications
Federated learning is deployed wherever data is sensitive, siloed, or too large to centralize — but a shared model still creates value.
Mobile Keyboards
Next-word prediction and autocorrect models trained across millions of phones, personalized to typing patterns without uploading messages.
Healthcare
Multi-hospital consortia train diagnostic and prognostic models on medical imaging and records that legally cannot leave each institution.
Financial Services
Cross-institution fraud-detection and credit-risk models trained without banks ever exposing customer transaction data to each other.
IoT & Edge Devices
Sensor networks and smart-home devices collaboratively improve anomaly-detection and predictive-maintenance models on-device.
Autonomous Vehicles
Fleets share perception-model improvements learned from diverse driving conditions without transmitting raw sensor footage.
Telecommunications
Network operators train traffic-prediction and anomaly-detection models across base stations while keeping subscriber data local.
Tools & Frameworks
A modern FL stack layers a client-server orchestration framework, a privacy toolkit, and the underlying deep-learning library of choice.
Flower (flwr)
Framework-agnostic FL library that works with PyTorch, TensorFlow, JAX, and scikit-learn, popular for both research and production.
TensorFlow Federated
Google's research-oriented framework for simulating and prototyping federated computations at scale.
FedML
An open research and deployment platform spanning cross-device, cross-silo, and federated analytics use cases.
NVIDIA FLARE
An enterprise-grade FL framework with strong support for healthcare and life-sciences cross-silo deployments.
PySyft (OpenMined)
A privacy-focused library combining FL with differential privacy and encrypted computation primitives.
IBM Federated Learning
An enterprise FL toolkit integrated with IBM's broader AI and data-governance platform.
Opacus & TF Privacy
Differential-privacy libraries for PyTorch and TensorFlow used to add DP guarantees to local client training.
Secure Aggregation Libraries
Cryptographic primitives (e.g. secret sharing, pairwise masking) implementing Google's original secure-aggregation protocol.
Glossary of Key Terms
Quick definitions for terms used throughout this guide.
- Client
- A device or organization holding local, private training data.
- Communication Round
- One cycle of local training followed by server-side aggregation.
- Global Model
- The shared model maintained and updated by the central server each round.
- Non-IID Data
- Data whose distribution varies meaningfully from client to client.
- Client Drift
- Local models diverging toward client-specific optima under statistical heterogeneity.
- Straggler
- A client that is slow or unreliable, potentially delaying a communication round.
- Partial Participation
- Sampling only a subset of available clients to train in a given round.
- Differential Privacy
- A mathematical framework bounding how much any single record can influence a released output.
- Secure Aggregation
- A cryptographic protocol that reveals only the sum of client updates, not individual contributions.
- Gradient Leakage
- An attack that reconstructs training data from shared gradients.
- Model Poisoning
- Submitting malicious updates designed to corrupt or backdoor the global model.
- Byzantine-Robust Aggregation
- Aggregation rules (e.g. median, trimmed mean) resilient to a fraction of malicious clients.
- Personalized FL
- Techniques that adapt the shared global model to each client's local distribution.
- Cross-Device FL
- FL across millions of resource-constrained, unreliable clients like phones.
- Cross-Silo FL
- FL across a small number of reliable institutional participants.
- Federated Analytics
- Computing aggregate statistics (not full model training) across decentralized data.