ERIS: Enhancing the Privacy-Utility-Scalability Trade-Off in Federated Learning via Federated Shard Aggregation

arXiv:2602.08617 · cs.LG · Submitted 2026-02-09 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: AI Radio. Generated commentary on the latest Artificial Intelligence papers.

Tom: Today's paper: "ERIS: Enhancing the Privacy-Utility-Scalability Trade-Off in Federated Learning via Federated Shard Aggregation".

Jane: Comprehensive Research Summary of ERIS: Enhancing Privacy-Utility-Scalability Trade-Off in Federated Learning via Federated Shard Aggregation This research introduces ERIS (Enhancing the Privacy-Utility-Scalability Trade-Off in Federated Learning),

Tom: First, who's behind it and why it matters.

Paper summary: Tom: So we’re looking at this paper called "ERIS: Enhancing the Privacy-Utility-Scalability Trade-Off in Federated Learning via Federated Shard Aggregation". Essentially, they’re tackling that big problem where you have to choose between keeping your data private and keeping your AI model accurate and scalable.

Jane: Right. It claims they introduce a new framework called ERIS, which focuses on three things at once: privacy, scalability, and utility. They say current methods usually force you to pick two of those things by making the process really expensive or by messing up the model's performance.

Lu: The core idea they propose is Federated Shard Aggregation or FSA. They partition every single client update into separate pieces, which are then sent to different client-side aggregators to handle the math.

Meng: So how does that help with scalability? If you have a massive number of clients or huge models, a central server getting everything at once is a real bottleneck, and they think distributing that aggregation task removes that single point of failure.

Lalam: And by splitting the update into shards, it limits what any one observer can see initially, which is an early form of privacy protection before anything else happens.

Tom: Exactly. So the thesis here is that this FSA mechanism lets you keep a model training process running smoothly even when you have millions of parameters or tons of clients without needing heavy cryptography or messy perturbations to the data itself.

Jane: That’s the main claim: they want to achieve high utility while offering better privacy and scaling than existing methods that either use slow math tools or just clip the gradients.

Meng: I’m interested in how this plays out practically. The paper talks about integrating Distributed Shifted Compression, or DSC, as a way to make things even more efficient before the sharding happens.

Lu: They integrate DSC to significantly reduce both the size of the data being transmitted and the amount of coordinates that are exposed during that process. This combination is what they call synergistic enhancement.

Tom: So we’ve got sharding for distribution and compression for efficiency, which they say substantially reduces communication overhead compared to older setups. But they also want to make sure this doesn't ruin the actual model update when everything comes back together properly.

Jane: The theoretical guarantees they give are pretty solid on the convergence side, stating that the framework preserves convergence under standard federated learning assumptions.

Meng: They also put some bounds on utility loss, linking it directly to how much variance you have in your local mini-batch gradients. If you use a lower-variance estimator like SVRG or SAGA, they say the stationarity error decreases with the square root of both the number of clients and the local data size.

Paper summary: Lu: And for privacy itself, they quantify it by bounding mutual information leakage, showing that this leakage scales as I Dk; v t,col T n p A c C according to Theorem three point three <ref:2602.08617#pg1>.

Tom: That scaling factor involving A, which is the number of aggregators, provides inherent privacy amplification through a factor of one over A, while the DSC helps shrink that observable subset even further.

Jane: But what does this mean for someone just using a standard federated learning setup? It means you can probably use this ERIS method to get accuracy comparable to standard FedAvg across different tasks, like image classification or text processing.

Meng: I saw some empirical results on IMDB with four local samples per client, and ERIS with DSC actually cut the Membership Inference Attack leakage by a lot, going from ninety-two point three percent down to about sixty-eight point two percent accuracy for that attack.

Tom: That reduction in MIA accuracy is pretty significant. It shows that you aren't just getting privacy protection; you’re getting tangible security improvements without having to use heavy cryptographic tools or introduce big mathematical noise into the updates.

Jane: They also tested robustness, and ERIS stays stable even if some nodes fail or if there are edge failures, as long as enough of those shards can still be aggregated. The degradation is mostly linked to convergence speed, not the mechanism breaking down.

Lu: Even when testing against Data Reconstruction Attacks, they found that the reduced visibility in ERIS configurations makes those attacks ineffective even when you only have a small fraction of parameters accessible.

Meng: It seems they found a sweet spot on that utility-privacy frontier where you maintain high accuracy while substantially reducing leakage compared to other methods that suffer more accuracy loss under strict privacy constraints.

Tom: So, the paper "ERIS: Enhancing the Privacy-Utility-Scalability Trade-Off in Federated Learning via Federated Shard Aggregation" essentially proposes a practical way to decouple those competing demands by intelligently distributing aggregation tasks and compressing data using DSC.

Jane: It’s about showing that you don't have to sacrifice model utility or scalability just because you want stronger privacy guarantees in federated learning scenarios.

Lu: The authors are pushing the idea that this serverless architecture, centered on Federated Shard Aggregation, is a much more efficient way to handle LLMs and billion-parameter models in practice.

Meng: For engineers building these systems, it suggests you can focus on optimizing the shard distribution and compression layers rather than implementing complex cryptographic protocols just to get started with privacy.

Tom: So when you think about this for the broader field, ERIS shows how a serverless approach can deliver FedAvg-level performance while offering superior protection against inference attacks without needing heavy cryptography or detrimental perturbation techniques.

Conclusion: Tom: So we've looked at how ERIS uses Federated Shard Aggregation and Distributed Shifted Compression to balance privacy, utility, and scale in federated learning models.

Jane: It really boils down to taking a model training process that usually has these three things fighting each other—privacy, how good the model is at its job, and how big it can grow—and finding a way to keep them all happy.

Lu: The authors are showing that you don't have to use super heavy cryptography or introduce messy data changes just to get better privacy guarantees. They call it enhancing the trade-off.

Meng: From an engineering side, what I find interesting is how they handle the distribution of those aggregation tasks across different client-side aggregators instead of funneling everything through one central point.

Lalam: That distributed approach helps limit how much information any single observer sees at once before everything gets reassembled. It’s a layer of privacy amplification right there in the architecture.

Tom: Exactly, and the results show that they keep the model accuracy almost exactly where standard federated averaging sits, which is a big deal for utility.

Jane: And they also show that for things like membership inference attacks, you can significantly lower that leakage by using this ERIS method with DSC.

Lu: The theoretical analysis confirms it preserves convergence under standard assumptions, and the stationarity error of the model stays controlled by just the variance of your local data gradients.

Meng: So for someone building a system right now, it suggests you can focus on optimizing those shard distributions and compression layers instead of immediately jumping into complex cryptographic protocols.

Tom: It’s about showing that you can get near FedAvg performance with much better protection against inference attacks without adding heavy overhead or hurting the model's actual accuracy.

Jane: That points to a new way of thinking about how we design these decentralized learning systems for real-world use.

Dario Fenoglio, Pasquale Polverino, Jacopo Quizi, Martin Gjoreski, Akash Dhasade, Marc Langheinrich

Universita della Svizzera italiana

cs.LG

Submitted: 2026-02-09

Updated: 2026-10-08

Comments: Accepted at NeurIPS 2026. 53 pages

Code: https://github.com/pako-23/eris

License: http://creativecommons.org/licenses/by/4.0/

Importance score: 92/100

The gist: Comprehensive Research Summary of ERIS: Enhancing Privacy-Utility-Scalability Trade-Off in Federated Learning via Federated Shard Aggregation This research introduces ERIS (Enhancing the

Key concepts

Federated Shard Aggregation (FSA): This mechanism splits every client update into many small, non-overlapping pieces called shards. These shards are then sent to different client-side aggregators who process them separately. This prevents any single entity from seeing the complete update at once, distributing the aggregation workload.
Distributed Shifted Compression (DSC): DSC is a pre-processing step applied to client updates before they are sent. It shrinks the size of the data payload and reduces how much sensitive information is exposed. This makes communication faster and further strengthens privacy by hiding more details in the transmitted data.
Utility Bound Control: This refers to ensuring that ERIS maintains high model accuracy, similar to standard Federated Averaging (FedAvg). The framework proves it keeps utility stable by controlling the error caused by using distributed aggregation and compression, ensuring convergence is preserved.
Privacy Amplification: ERIS provides privacy guarantees by limiting how much information an observer can learn about a single client's data. This is achieved through FSA distributing the aggregation and DSC shrinking the observable gradients, resulting in measurable reductions in attack leakage.

Terminology

Aggregation — 4× in this paper
Federated Learning — 2× in this paper · explained in 17 episodes
Federated Shard Aggregation — 2× in this paper
Accuracy — 1× in this paper · explained in 1 episode
Distributed Shifted Compression — 1× in this paper
Federated Learning (FL) — 1× in this paper · explained in 9 episodes
Information Leakage — 1× in this paper · explained in 2 episodes
Mutual Information — 1× in this paper · explained in 2 episodes
Robustness — 1× in this paper · explained in 5 episodes
Scaling Federated Learning — 1× in this paper

Summary

Comprehensive Research Summary of ERIS: Enhancing Privacy-Utility-Scalability Trade-Off in Federated Learning via Federated Shard Aggregation

This research introduces ERIS (Enhancing the Privacy-Utility-Scalability Trade-Off in Federated Learning), a novel Federated Learning (FL) framework meticulously designed to simultaneously satisfy the critical requirements of privacy, scalability, and utility without resorting to computationally intensive cryptography or utility-degrading perturbations. The core innovation of ERIS lies in its central mechanism: Federated Shard Aggregation (FSA).

Core Mechanism: Federated Shard Aggregation (FSA)

ERIS fundamentally addresses the central aggregation bottleneck inherent in standard FL by introducing FSA. This mechanism partitions every client update into non-overlapping shards, which are then distributed and aggregated across multiple dedicated client-side aggregators. The strategic distribution of these aggregation tasks achieves several key benefits:

Bottleneck Removal: It effectively eliminates the single point of failure and communication bottleneck associated with a central server aggregating all updates.
Information Limiting: By distributing the aggregation process, FSA inherently limits the amount of information visible to any single observer, providing an initial layer of privacy amplification.
Update Preservation: Crucially, FSA is designed to preserve the integrity of the centralized FL update after all distributed shards have been reassembled correctly.

Integration with Distributed Shifted Compression (DSC)

To further enhance scalability and privacy efficiency, ERIS seamlessly integrates Distributed Shifted Compression (DSC) as a pre-processing layer applied to the client updates. DSC is employed to significantly reduce both the transmitted payload size and the volume of exposed coordinates. This integration demonstrates that FSA naturally supports DSC, allowing for a synergistic enhancement:

Communication Efficiency: The combination of sharding and compression substantially reduces communication overhead, leading to significantly reduced distribution times compared to centralized or decentralized baselines.
Enhanced Privacy: DSC further shrinks the observable subset of gradients, which directly improves the privacy guarantees provided by FSA.

Theoretical Guarantees and Utility Preservation

The theoretical analysis underpinning ERIS provides rigorous assurances regarding its performance:

Convergence Preservation: The framework is proven to preserve convergence under standard FL assumptions (Theorem B.1), ensuring that the model converges effectively despite the distributed aggregation scheme.
Utility Bound Control: ERIS with DSC–SGD satisfies a utility bound dependent on the gradient estimator variance. This bound vanishes for lower-variance estimators such as SVRG/SAGA (Corollary C.6), confirming its robustness across different optimization settings. The stationarity error of ERIS with DSC–SGD is controlled solely by the variance of local mini-batch gradients and decreases with the square root of the number of clients (K) and local data (m).
Privacy Amplification: Privacy guarantees are quantified by bounding mutual information leakage, showing that this leakage scales as I Dk; v t,col T n p A c C (Theorem 3.3). FSA provides inherent privacy amplification through the factor of 1/A, and DSC further reduces leakage by shrinking the observable subset.

Empirical Validation and Trade-Off Analysis

Extensive experiments across diverse tasks—including image classification, text processing, and large language models—validate ERIS's claims:

Utility Equivalence: ERIS consistently achieves utility comparable to standard FedAvg, maintaining accuracy close to non-private baselines across various datasets (e.g., CNN/Daily Mail, CIFAR-10).
Privacy Improvement: A key finding is the substantial reduction in Membership Inference Attack (MIA) leakage. For instance, on IMDB with 4 local samples per client and identical conditions, ERIS with DSC achieved an accuracy of 67.8 plus or minus 4.9, significantly reducing MIA accuracy from 92.3% to 68.2%.
Robustness: The framework exhibits graceful degradation under both node-level and edge-level failures, remaining stable as long as a sufficient fraction of shards can be aggregated, with performance degradation primarily linked to convergence delay rather than mechanism instability.
Attack Resistance: ERIS demonstrates superior robustness against Data Reconstruction Attacks (DRAs). While full-gradient settings allow for near-perfect reconstruction, the reduced visibility in ERIS configurations renders reconstruction attacks ineffective even when only a small fraction of parameters is accessible. The framework provides sufficient obfuscation even with a minimal number of aggregators (A=2).
Optimal Trade-Off: ERIS consistently occupies favorable positions on the utility–privacy Pareto frontier, contributing most points along this frontier. It maintains high utility while substantially reducing privacy leakage toward the idealized minimum leakage baseline, outperforming existing methods that suffer significant utility degradation under stringent privacy constraints.

**In conclusion, ERIS is a highly sophisticated FL framework that successfully decouples and optimizes the competing demands of privacy and utility by intelligently distributing aggregation tasks via FSA and compressing data via DSC. It offers a robust, serverless architecture that delivers FedAvg-level performance while offering superior protection against inference attacks without relying on heavy cryptographic overhead or detrimental perturbation techniques.

Improvements for AI systems

Stable Privacy-Utility Trade-off in Large Models: ERIS allows for achieving FedAvg-level utility while substantially reducing communication bottlenecks and improving robustness to membership inference and reconstruction attacks without relying on heavy cryptography or utility-degrading perturbations. This enables training massive Foundation Models (like GPTNeo) with high accuracy while maintaining quantifiable privacy guarantees.
Scalable Distributed Aggregation: The Federated Shard Aggregation (FSA) mechanism removes the central aggregation bottleneck by distributing updates across multiple client-side aggregators, leading to distribution times that can be substantially reduced compared to centralized FL, especially as the number of aggregators increases.
Optimized Communication Efficiency via DSC: Integration with Distributed Shifted Compression (DSC) reduces transmitted payloads while preserving utility, as it allows for stronger compression (higher ω, i.e., lower retention probability p) further reduces MIA accuracy toward the idealized minimum-leakage baseline. This enables significantly lower communication costs for billion-parameter models.
Robustness to Collusion: The privacy analysis shows that the leakage scales with coalition size, where I Dk; v t,col T = n T p Ac A Cmax, allowing researchers to anticipate and mitigate risks by increasing the shard count or decreasing the retention probability when anticipating up to Amax c colluding aggregators.
Versatility Across FL Algorithms: FSA is a modular aggregation layer that supports algorithms beyond FedAvg, such as FedAdam [114], FedYogi [114], FedNova [115], etc., since it exhibits no deviation from the centralized aggregation trajectory. This allows for the deployment of complex, non-standard FL optimization schemes without sacrificing scalability or privacy structure.

Abstract

Scaling Federated Learning (FL) to billion-parameter models forces a challenging trade-off between privacy, scalability, and model utility. Existing solutions often tackle these challenges in isolation, sacrificing accuracy, relying on costly cryptographic tools, or introducing communication and optimization inefficiencies that affect convergence. We introduce ERIS, an FL framework centered on Federated Shard Aggregation (FSA), a novel mechanism that partitions each client update into non-overlapping shards whose aggregation is distributed across multiple client-side aggregators. FSA removes the central aggregation bottleneck, limits the information visible to any single observer, and preserves the centralized FL update after reassembly. ERIS can further readily integrate Distributed Shifted Compression (DSC) to reduce transmitted payloads and exposed coordinates. We prove that ERIS preserves convergence under standard assumptions and bounds mutual information leakage by the observable fraction of each update, decreasing with the number of client-side aggregators, and with the compression level when DSC is enabled. Experiments across image and text tasks, including large language models, show that ERIS achieves FedAvg-level utility while substantially reducing communication bottlenecks and improving robustness to membership inference and reconstruction attacks, without relying on heavy cryptography or utility-degrading perturbations.