PTOPOFL: Privacy-Preserving Personalised Federated Learning via Persistent Homology
| Authors | Kelly L Vomo-Donfack et al. |
| Year | 2026 |
| Field | Machine Learning |
| arXiv | 2603.04323 |
| Download | |
| Categories | cs.LG, cs.CR, cs.DC, stat.ML |
Abstract
Federated learning (FL) faces two structural tensions: gradient sharing enables data-reconstruction attacks, while non-IID client distributions degrade aggregation quality. We introduce PTOPOFL, a framework that addresses both challenges simultaneously by replacing gradient communication with topological descriptors derived from persistent homology (PH). Clients transmit only 48-dimensional PH feature vectors-compact shape summaries whose many-to-one structure makes inversion provably ill-posed-rather than model gradients. The server performs topology-guided personalised aggregation: clients are clustered by Wasserstein similarity between their PH diagrams, intra-cluster models are topology-weighted,and clusters are blended with a global consensus. We prove an information-contraction theorem showing that PH descriptors leak strictly less mutual information per sample than gradients under strongly convex loss functions, and we establish linear convergence of the Wasserstein-weighted aggregation scheme with an error floor strictly smaller than FedAvg. Evaluated against FedAvg, FedProx, SCAFFOLD, and pFedMe on a non-IID healthcare scenario (8 hospitals, 2 adversarial) and a pathological benchmark (10 clients), PTOPOFL achieves AUC 0.841 and 0.910 respectively-the highest in both settings-while reducing reconstruction risk by a factor of 4.5 relative to gradient sharing. Code is publicly available at https://github.com/MorillaLab/TopoFederatedL and data at https://doi.org/10.5281/zenodo.18827595.
Engineering Breakdown
Plain English
This paper introduces PTOPOFL, a federated learning framework that solves two critical problems simultaneously: privacy attacks via gradient reconstruction and performance degradation from non-IID data distributions across clients. Instead of sharing model gradients, clients send only 48-dimensional feature vectors derived from persistent homology—a mathematical tool that captures the topological shape of data. The server uses these compact descriptors to intelligently cluster similar clients and perform weighted aggregation, proving that this shape-based representation makes gradient inversion mathematically impossible while actually improving model quality on non-uniform client data.
Core Technical Contribution
The core novelty is replacing gradient communication with topological descriptors from persistent homology (PH), which are provably invulnerable to reconstruction attacks due to their many-to-one mapping structure. Unlike prior privacy-preserving FL methods that add noise or use secure aggregation (which is computationally expensive), this approach achieves privacy as an inherent property of the representation itself. The secondary contribution is topology-guided personalized aggregation: clustering clients by Wasserstein distance between their PH diagrams and performing topology-weighted intra-cluster aggregation combined with global consensus blending. This directly addresses non-IID heterogeneity by grouping clients with similar data distributions rather than treating all clients uniformly.
How It Works
The system operates in rounds where each client computes gradients locally on its private data, then extracts a persistent homology diagram from the gradient geometry or loss landscape topology—capturing birth/death points of topological features at different scales. These diagrams are compressed into 48-dimensional feature vectors and transmitted to the server instead of full gradients (which could be thousands or millions of dimensions). The server computes pairwise Wasserstein distances between all client PH vectors to identify clusters of similar clients; clients with similar topologies are grouped together. Within each cluster, models are aggregated using topology-aware weights (likely emphasizing clients whose PH features align most closely), then cluster models are blended using a global consensus mechanism. The resulting aggregated model is broadcast back, and the process repeats—crucially, the server never reconstructs or sees raw gradients, only topological summaries.
Production Impact
For engineers building federated learning systems, this approach eliminates the need for expensive differential privacy noise injection or cryptographic secure aggregation protocols, reducing computational overhead while actually improving convergence. The 48-dimensional PH vectors compress communication by orders of magnitude compared to full gradient transmission, directly lowering bandwidth costs in edge/mobile deployments. Privacy becomes a mathematical guarantee rather than a tuning parameter (epsilon-delta in DP), removing the headache of privacy budget management and the accuracy-privacy trade-off curve. However, implementation requires a persistent homology library integrated into the client update loop, which adds local compute cost—calculating PH diagrams is non-trivial and may be slower than simple gradient compression. You'd need to profile whether the PH extraction time and server-side Wasserstein distance computation during clustering offset the bandwidth and aggregation quality gains for your specific network topology and model size.
Limitations and When Not to Use This
The paper assumes that topological structure of gradients meaningfully correlates with client data heterogeneity, which may not hold for all problem domains—some tasks might have very different optimal models that share similar loss landscape topology. The Wasserstein distance calculation between PH diagrams scales quadratically with the number of clients, so clustering could become a bottleneck in very large federated systems (thousands of clients). The approach hasn't been validated on modern large-scale models (the abstract doesn't mention model size or dataset complexity), and persistent homology computation can be numerically unstable for high-dimensional data, potentially requiring careful implementation. The information-contraction theorem proof is incomplete in the provided abstract, so the formal privacy guarantees and under what assumptions they hold remain unclear—PH inversion may be ill-posed in theory but still vulnerable to approximate reconstruction with sufficiently large measurement noise or adaptive attacks.
Research Context
This work builds on the intersection of three active research areas: privacy-preserving federated learning (which has explored DP, secure aggregation, and gradient compression), non-IID optimization (which recognizes that real client data is heterogeneous and uniform aggregation fails), and computational topology (persistent homology has recently been applied to neural network analysis and data representation). It improves upon prior FL frameworks like FedAvg and personalized variants like Per-FedAvg by replacing the aggregation mechanism and privacy model entirely. The use of Wasserstein distance for clustering connects to optimal transport theory and distribution matching, aligning with recent work on learned client clustering in FL. This opens a research direction of using topological and geometric invariants as privacy-by-design representations in distributed learning, potentially applicable beyond federated learning to any setting where gradient sharing poses privacy or communication risks.
:::tip Subscribe Get weekly breakdowns of papers like this in AI Letters - the newsletter for engineers building production AI systems. :::