Beyond Parameter Space: NTK-Guided Personalized Aggregation for Robust Federated Learning

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION

Beyond Parameter Space: NTK-Guided Personalized Aggregation for Robust Federated Learning Mirko Konstantin1,2

1

Zuse Institute Berlin (ZIB) Takustraße 7 14195 Berlin, Germany

2

Technical University of Darmstadt Karolinenplatz 5 64289 Darmstadt, Germany

konstantin@zib.de

Stefan Zachow1 zachow@zib.de 2

Anirban Mukhopadhyay

arXiv:2608.12108v1 [cs.LG] 12 Aug 2026

anirban.mukhopadhyay@tu-darmstadt.de

Abstract Federated learning (FL) enables collaborative model training across distributed clients while preserving data privacy by keeping data local. A central challenge in FL is determining which client updates are beneficial for aggregation with respect to each client’s target domain. Existing methods typically address this problem in parameter space by comparing model parameters or gradients. However, parameter-space similarity is often a poor proxy for predictive behavior, particularly in heterogeneous settings where client data is not independent and identically distributed. As a result, updates that are misaligned with a client’s target domain, including those arising from heterogeneous data distributions or malfunctioning clients, may be incorporated into aggregation and degrade local model performance. In this work, we propose Local Inference Guided Aggregation for Heterogeneous Training Environments to Yield Enhancement Through Agreement and Regularization (LIGHTYEAR), a federated learning framework that performs update selection in the function space. Central to our method is an NTKbased agreement score that characterizes predictive behavior and is used to determine the optimal aggregation set for each client. By relating model parameters to local predictive responses, the Neural Tangent Kernel (NTK) enables a function-space characterization of model updates and provides a more expressive criterion for update selection than parameter-space similarity alone. Since access to function-space information before aggregation is not available in conventional centralized FL, LIGHTYEAR leverages a peerto-peer (P2P) topology, where clients exchange updates directly and can locally evaluate incoming models on private validation data. This enables each client to construct a personalized aggregation set consisting only of updates that are beneficial with respect to its own target domain. The selected updates are then aggregated using a regularized aggregation rule that further stabilizes training under heterogeneity. Our empirical evaluation across five datasets and nine baseline methods demonstrates that LIGHTYEAR consistently outperforms both centralized FL baselines and existing P2P approaches. The code is available at: https://github.com/MECLabTUDA/LIGHTYEAR

© 2026. The copyright of this document resides with its authors. It may be distributed unchanged freely in print or electronic forms.

1

2

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION

1

Introduction

In recent years, federated learning (FL) has emerged as a powerful approach for collaboratively training machine learning models across a network of distributed clients, without requiring the exchange of raw data [31]. This paradigm has gained increasing attention due to its natural fit for privacy-sensitive applications such as healthcare, mobile personalization, and finance [2, 25, 37]. FL was originally introduced in a centralized star-shaped topology, where a central server coordinates communication and aggregates updates received from participating clients [31]. While this formulation is conceptually simple and effective in homogeneous settings, it faces substantial limitations under real-world conditions characterized by heterogeneous data distributions and unreliable clients [49]. A central objective in FL is to learn models that generalize well to the target domain of each participating client. In practice, however, performance on a client’s target domain can degrade due to two major factors. First, clients frequently operate on non-independent and identically distributed (non-IID) data. Differences in acquisition protocols, sensing conditions, hardware configurations, or user behavior result in client-specific data distributions, violating exchangeability of data samples across the federation [20, 50]. Consequently, updates learned by one client are not equally beneficial for all others. Second, client reliability is inherently variable, and malfunctioning clients may contribute corrupted updates due to faulty sensors, broken data pipelines, or malicious attacks such as model poisoning [24]. Both heterogeneity and malfunctioning updates can negatively affect model performance on the target domain of individual clients. As a result, not every client benefits equally from aggregating updates from the full federation. Instead, each client benefits most from a personalized subset of client updates that best aligns with its own target domain and learning objective [11]. This motivates the need for a personalized client-specific solution, where each client selectively incorporates only the most beneficial updates while excluding irrelevant or harmful ones. Traditional FL methods attempt to identify beneficial updates through operations in parameter space, typically by comparing model parameters or gradients [7, 33, 35, 36, 41]. This is primarily a consequence of centralized FL itself, where the server has access only to model updates, but not to the underlying client data distributions. Without access to data distribution or training behavior, the server cannot directly assess how an incoming update behaves on a client’s target domain and therefore must rely on parameter-space proxies. However, parameter space is often insufficient for this task. Prior work has shown that distances in parameter space do not consistently correlate with similarity in predictive behavior [6]. Models with small parameter differences may lead to substantially different behavior, which is illustrated in Figure 1. Therefore, parameter space can be a poor proxy for actual model behavior. In contrast, evaluating models in function space provides a more expressive representation of how a model behaves on a given data distribution [6]. Function-space information captures predictive behavior directly and therefore provides a more meaningful basis for determining whether an update is beneficial for aggregation with respect to a client’s target domain. The challenge, however, is that this information is inaccessible in centralized FL before aggregation, since the central server has no access to local data [29] and cannot evaluate incoming models on client-specific validation distributions. To address this limitation, we leverage a decentralized peer-to-peer (P2P) training topology [16, 40]. By moving away from the centralized star topology, clients exchange updates directly without relying on a central server. This communication structure provides each client with access to neighboring updates before aggregation and enables local eval-

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION

3

Figure 1: Illustration of the discrepancy between parameter space and function space. While client updates may appear similarly close in parameter space, their effect on model predictions can differ substantially in function space. This illustrates that parameter distance alone is an unreliable proxy for model behavior under heterogeneous settings.

uation on private validation data. As a result, every client can determine the predictive behavior of incoming models with respect to its own local target distribution and construct a personalized aggregation set based on function-space behavior rather than parameter similarity. Based on this idea, we introduce the Local Inference Guided Aggregation for Heterogeneous Training Environments to Yield Enhancement Through Agreement and Regularization (LIGHTYEAR). LIGHTYEAR is a P2P FL framework designed to select a personalized aggregation set for each client by measuring alignment in function space. To estimate model behavior, LIGHTYEAR leverages the Neural Tangent Kernel (NTK) [21], which relates parameter changes to predictive behavior and captures how a model responds locally on a given dataset. Using the NTK, we compute an agreement score that measures the similarity of predictive behavior between client models on a local validation set. This enables each client to identify which incoming updates are most beneficial with respect to its own target domain and selectively incorporate only those into aggregation. Finally, we aggregate the selected updates using a regularization term to mitigate client drift in heterogeneous environments. As a result, LIGHTYEAR enables client-specific model aggregation with fine-grained control over update selection in the function space. This improves robustness against malfunctioning or irrelevant updates, reduces performance drops on the target domain, and enhances personalization in heterogeneous federated learning environments. Our main contributions are as follows: We propose LIGHTYEAR, a framework that combines a function-space agreement score for update selection with a regularized aggregation rule, enabled through P2P FL to support robust and personalized model training. We introduce the agreement score, a metric based on the NTK that captures semantic alignment between client updates and the local model in function space by relating parameter changes to predictive behavior on the target domain. This score is used to select the personalized set of updates for aggregation.

4

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION

We propose a regularized aggregation rule, which includes a round-dependent regularization term that controls the influence of updates over time, mitigating the effects of client drift in heterogeneous environments.

2

Related Work

To address prediction errors in FL, two main research directions have emerged: Robust FL focuses on mitigating the impact of malfunctioning clients and personalized FL, which tackles errors caused by distribution shifts. Robust Federated Learning: Malfunctioning clients pose a significant threat to FL by submitting harmful updates, whether due to adversarial intent or technical faults, that degrade the performance of the aggregated model when incorporated into the global update [24, 48]. To mitigate the impact of such corrupted contributions, a variety of robust aggregation methods have been proposed. Originally introduced for centralized FL, these methods are typically performed at the server level, where no access to client-side data or reference performance metrics is available [46]. As a result, these approaches rely solely on distance-based measures computed over model parameters or gradients to assess the similarity between updates. Clients whose updates deviate significantly from the majority are either down-weighted during aggregation [9, 32, 35] or excluded entirely [7, 36, 44]. Alternative approaches, such as FedTrans [43], improve robustness through utility-based client selection using a shared server-side dataset. With the growing interest in decentralized FL, robust aggregation methods have been adapted accordingly. In this setting, robustness must be ensured at the client level, and distance-based mechanisms are employed locally to evaluate incoming updates [15, 18]. Personalized Federated Learning: To address the limitations of the naive FedAvg approach in heterogeneous settings, where clients operate on non-IID data, personalized federated learning (pFL) was introduced to better adapt the global models to local client requirements. Rather than relying solely on a single shared model, pFL methods aim to tailor the learned representations to each client’s domain. Ditto [28] extends this concept by maintaining two separate models per client: one global model for participation in communication rounds, and one personalized model for local inference, with training guided by a regularization term that encourages consistency between the two. FedALA [47] introduces an additional local aggregation step, where each client combines the global model and its locally trained model using a weighted average, thereby adapting the global knowledge more flexibly to the local context.

3

Problem Statement

We consider a decentralized FL setting in which a set of clients P = {1, . . . , N} collaborate to learn a model. The network is structured as a P2P topology, where each client communicates directly with all other clients. Formally, for each client i ∈ P, let N (i) ⊆ P\{i} denote the set of neighboring clients from whom it receives model updates {θ j } j∈N (i) , where θ j denotes the parameters of the local model of client j. The client then aggregates these models with its own to update its parameters. A central challenge in this setting is that client i has no

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION

5

Figure 2: Illustration of the decomposition of the prediction error. The boxplot displays the error across the instances, with color indicating the magnitude of the error (green: low error, red: high error). information about the training data, optimization procedure, or reliability of its neighbors’ model updates {θ j } j∈N (i) . Consequently, it cannot determine a priori which of the updates will be beneficial or detrimental to its local objective. The naive aggregation of all received models,
θinew ← Aggregate {θ j } j∈N (i) ∪ {θi } , (1) may introduce harmful biases. In particular, blindly aggregating all updates can degrade model performance in the following ways: Malicious clients may submit adversarial updates θ jmal with the intent of corrupting the learning process. faulty , e.g., due to Unreliable clients may unintentionally produce corrupted updates θ j defective data pipelines, incorrect labels, or faulty image acquisition. Non-exchangeability across clients: Even in benign scenarios, updates from clients trained on data distributions D j significantly different from the client’s own distribution Di may lead to performance degradation when aggregated [49]. In general, model updates from such clients often exhibit structural divergence from the models trained on locally aligned data. The training data can be described as < D, f >, where D is the distribution with input data X and f is the labeling function f : X → [0, .., nc ], where nc is the number of classes. Let εi (h(θ )) denote the prediction error of model h with parameters θ on client i’s distribution Di , such that εi (h(θ )) = Ex∼Di [|h(θ ; x) − fi (x)|] .

(2)

The goal is to identify the aggregation set Si ⊆ N (i) of client updates such that: θinew ← Aggregate ({θ j } j∈Si ∪ {θi }) ,

(3)

where εi (h(θ )new i )is minimized. The fundamental problem is: Given a set of client updates {θ j } j∈N (i) and no access to their underlying data distributions or training errors, determine an optimal aggregation subset Si ⊆ N (i) that maximizes local performance on Di . This requires a reliable indicator for distributional similarity or alignment between updates and the local data of client i, which is the core methodological focus of our work.

6

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION

4

Methodology

In the following, we begin by describing the prediction error a model incurs on a target distribution. This formulation accounts for both the violation of exchangeability between the source and target data distributions and the potential corruption of the model’s parameters due to malfunctions. We then highlight that P2P topologies offer a unique opportunity to approximate this error in a decentralized manner, in contrast to traditional star-shaped topologies. Finally, we introduce a novel agreement-based method that enables each client to select a custom aggregation set, thereby improving robustness and enhancing performance on the target distribution.

4.1

Exchangeability in Federated Learning

To consider the second case of disadvantageous clients, we must examine the concept of exchangeability, which plays a crucial role in the effectiveness of model aggregation. In statistical learning theory, a dataset {Zi }ni=1 is said to be exchangeable if its joint distribution is invariant under permutations. Formally, a sequence Z1 , . . . , Zn is exchangeable if for any permutation π of {1, . . . , n}, the joint distribution satisfies: P(Z1 , . . . , Zn ) = P(Zπ(1) , . . . , Zπ(n) ).

(4)

This condition generalizes the IID assumption and underpins the validity of many theoretical guarantees in machine learning, such as those provided by conformal prediction and generalization bounds. In the context of FL, however, the assumption of data exchangeability across clients is often violated. Each client i ∈ P may possess data drawn from a distinct underlying distribution Di , reflecting variability in user behavior, local environments, or sensing conditions. That is, while traditional learning assumes all data points xi ∼ D, FL encounters the more general scenario where: xi ∼ Di ,

for xi ∈ client i.

As such, the global dataset is no longer exchangeable, and assumptions relying on this property break down. Empirical and theoretical studies have shown that when clients violate exchangeability, such as by training on non-overlapping label distributions or domain-shifted data, the aggregated global model can suffer significant degradation in performance, particularly on the target distribution of interest [30]. This issue is exacerbated by the fact that clients’ local data distributions are not observable, either due to privacy constraints or system limitations. Consequently, we lack the information necessary to directly assess how well each client’s model update aligns with the target task.

4.2

Malfunctioning Clients

While violations of exchangeability across client updates arise from training on heterogeneous data distributions, leading to prediction errors as discussed above, malfunctioning clients represent a more extreme case of misalignment. In contrast to clients optimized for a specific data distribution, malfunctioning clients are generally misaligned with all data distributions. In our work, we consider three distinct types of client malfunctions. Two of these represent untargeted model poisoning attacks, namely, the Additive-Noise Attack (ANA)

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION

7

and the Sign-Flipping Attack (SFA), which are widely studied attacks in the FL literature [1, 24, 26]. In the ANA setting, a client perturbs its model parameters by adding Gaussian noise before broadcasting, i.e., the transmitted update becomes: θ̃ = θ + ε, ε ∼ N (0, σ 2 I), where θ is the locally trained model and ε is the noise vector. In the SFA setting, the client multiplies the entire update by a negative constant, effectively reversing the optimization direction: θ̃ = −α · θ , α > 0. In addition to adversarial behaviors, we simulate a malfunction indicative of technical failures, such as broken data pipelines or failed local training. In this scenario, the client submits a model update consisting of randomly initialized weights, entirely bypassing the optimization process.

4.3

Error Decomposition

As previously described, prediction errors may arise due to either malfunctions or the violation of exchangeability between the source and target distributions. In other words, if xi ∼ DS during training and x j ∼ DT during testing with DS ̸= DT , then the exchangeability assumption is violated. The latter can be understood as natural shifts inherent to distributional differences, while malfunctions represent unnatural shifts introduced through adversarial or unexpected faulty behavior. Therefore, the overall prediction error of a corrupted model h(θ̃ ) on a target distribution T can be expressed as the combination of these two sources of error: ε(h(θ̃ )) = εT (h(θ )) + εM (h(θ̃ ))

(5)

where εT (h(θ )) is the error on the target domain as described in Eq. 2 and εM (h(θ̃ )) is defined as   εM (h(θ̃ )) = Ex∼D |h(θ ; x) − h(θ̃ ; x)| ,

(6)

the error of model h due to corrupted parameters θ̃ . This concept is visualized in Figure 2. To quantify the impact of this shift, the domain adaptation framework developed by BenDavid et al.[5] provides a theoretical upper bound on the expected target domain error of a model h ∈ H, trained on a source distribution DS , and evaluated on a target distribution DT . The bound is given as: 1 εT (h(θ )) ≤ εS (h(θ )) + dH∆H (DS , DT ) + λ , 2

(7)

where εT (h(θ )), εS (h(θ )) are the expected errors of h with parameters θ on the source distribution DS and target distribution DT as described in Eq. 2, dH∆H (DS , DT ) is the classifier induced-divergence between the source and target distributions [4, 23], and λ is the combined error of the ideal model on both domains, defined as: λ = min [εS (h(θ )) + εT (h(θ ))] h(θ )∈H

(8)

This bound demonstrates that the error on the target domain is influenced not only by the model’s performance on the source domain but also by the divergence between the source and target distributions. Thus, the overall error of the corrupted model can be described as:

8

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION

1 εT (h(θ̃ )) ≤ εS (h(θ )) + dH∆H (DS , DT ) + λ + εM (h(θ̃ )) 2 {z } | {z } | exchangeability

(9)

corruption

To assess the sensitivity to corruption of the models used in this work, we added an ablation study to the supplementary material that investigates how the prediction error changes with the level of corruption.

4.4

Communication and Computation Tradeoffs

In centralized FL, a server aggregates client updates without access to local data distributions, ideally selecting only those updates that align well with a target distribution. Since this target may differ across clients, the optimal aggregation set is inherently client-specific. Switching from a star-shaped to a P2P topology allows clients to exchange updates directly, giving each client access to all updates and enabling them to estimate prediction error on their own data to form personalized aggregation sets. This decentralization increases communication costs, as updates must be shared with all clients, but offers improved robustness and personalization. To determine the aggregation set for each client individually, LIGHTYEAR analyzes the model’s prediction behavior. While this requires additional forward passes and Jacobian matrix computations and is therefore computationally more demanding, it enables more fine-grained control in assessing whether client updates are beneficial for aggregation. In domains such as medical imaging, where client numbers are limited and reliability is critical, these tradeoffs are favorable. We added an extended analysis of the scalability and communication costs in the supplementary material.

4.5

Approximation by Agreement

What is available to client i are: (1) its own locally trained model hi , used as reference and representative of the local distribution, trained on data from Di , and (2) a local validation dataset Vi = {(xk , yk )}nk=1 drawn from a distribution Dval ≈ Di . Therefore, we need to reconsider the problem from another point of view. We assumed that a malfunctioning model will exhibit a higher prediction error on the target distribution compared to a model that was specifically optimized for it. This increased error manifests as a behavioral divergence between the two models when making predictions on the target domain. In particular, the corrupted model h(θ̃ ) will tend to disagree with the optimal model h(θ ∗ ), which was trained to minimize error on that specific distribution. This disagreement indicates the presence of a prediction error apart from the irreducible error inherent to the task, such that:   Ex∼Di |h(θi∗ ; x) − h(θ̃ j ; x)| > 0

(10)

From this perspective, our goal is to identify a personalized aggregation set for each client, consisting only of client updates that exhibit strong agreement with the client’s local reference model. Let hi := h(θi ) and h j := h(θ j ) denote the models of client i and client j, respectively, where θi and θ j are their respective parameter vectors. Since we evaluate models that have not yet converged during training, assessing performance alone may not provide meaningful insights. Instead, we aim to capture the tendencies of the models and therefore introduce our agreement score.

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION

9

To identify neighboring clients whose predictive behavior is consistent with the local model, we compute an agreement score based on the NTK induced by the final layer of the networks. We restrict the NTK computation to the final layer in order to significantly reduce the computational and memory complexity while still capturing the task-specific predictive behavior of the models. The NTK has already been shown to be an effective tool for model optimization in heterogeneous FL settings [45]. Intuitively, the NTK describes how the predictions of a neural network change around the data points when the model parameters are slightly modified. It quantifies how strongly and in which direction the model predictions change under small parameter perturbations and therefore captures the local behavior of the model rather than its raw parameter values. Consequently, models with similar NTK structure exhibit similar behavior in the function space, even if their parameter values differ. For each model, we compute the Jacobian of the network outputs with respect to the finallayer parameters θ (L) , ∂ h(θ ; xi ) . ∂ θ (L) The empirical final-layer NTK matrix is then defined as Jθ (xi ) =

[Kθ (Vi )]ab =

(11)

1 ⟨Jθ (xa ), Jθ (xb )⟩ , C

(12)

where C denotes the output dimension of the model and x ∈ Vi . To remove scale dependencies and improve robustness, the kernel matrix is centered and Frobenius-normalized, K̃θ (Vi ) =

HKθ (Vi )H , ∥HKθ (Vi )H∥F

H =I−

1 11⊤ . |Vi |

(13)

Given a local reference model θi and a neighboring model θ j , we define the NTK-based agreement score via normalized kernel alignment, D E A(θi , θ j ;Vi ) = K̃θi (Vi ), K̃θ j (Vi ) . (14) F

Intuitively, this procedure favors models that exhibit similar local predictive sensitivities on the reference dataset and suppresses aggregation with models that rely on substantially different predictive mechanisms. Since both kernel matrices are centered and Frobeniusnormalized, the agreement score admits the following closed-form expression: D E HKθi (Vi )H, HKθ j (Vi )H F A(θi , θ j ;Vi ) = . (15) ∥HKθi (Vi )H∥F · ∥HKθ j (Vi )H∥F

4.6

Update Selection

Based on the agreement score defined in the previous section, we leverage a filtering mechanism that enables each client to selectively aggregate only those updates whose predictions are sufficiently aligned with its own reference model. We introduce a selection threshold τ ∈ R and define the aggregation set Si for client i as: Si = {θ j ∈ N (i) | A(θi , θ j ;Vi ) ≥ τ}.

(16)

This contains only those neighbour models that are considered sufficiently similar to the local model in terms of predictive behavior on the validation data.

10

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION

4.7

Aggregation

After selecting the aggregation set, the chosen updates are aggregated to obtain the new model. Since each client aggregates their own model during training, there is a risk of client drift. To enhance robustness, we introduce a regularization parameter into the aggregation process, as shown in Eq. 17. θ̄i

(t+1)

= θ̄i

(t)

+ γt ·

  1 (t) θ j − θ̄i ∑ |Si | j∈Si

(17)

This parameter is dependent on the training round and can be interpreted as a decay of change, reflecting our observation of a gradual performance decline after a certain number of training rounds. By incorporating this decay, the aggregation becomes more stable and resilient to fluctuations. We have conducted a corresponding ablation study to support our findings. Notably, setting the regulation parameter to 1 reduces the method to the standard FedAvg over the updates from the selected aggregation set.

5

Datasets

To evaluate the effectiveness of LIGHTYEAR, we conducted experiments on five diverse datasets. Each client holds an individual training, validation and test set, created through a random split of their local data. FEMNIST [8] contains 28 × 28 grayscale handwritten digits and characters across 62 classes. Data is partitioned by writer identity, giving each client a distinct distribution that naturally induces heterogeneity. We use 8 clients and train a two-layer CNN for this task. Camelyon17-WILDS [3] contains 98 × 98 tissue-slide patches for binary tumor classification, collected from five hospitals by different scanners. We assign one hospital per client, yielding five clients in total, each training a local DenseNet121 model [19]. Isic19 [12, 13, 39] contains dermoscopic images for multi-class skin cancer classification. Images are preprocessed to 224 × 224 resolution and originate from six medical centers, yielding six clients. Each client trains an EfficientNet model [38] following the common baseline setup [34]. Fetal Abdominal Structures (Ultrasound) [14] is a binary segmentation task, with each patient assigned to a distinct set of patients across five clients. The images were resized to 64 × 64 and training was performed using TransUNet [10]. ChestXRay [22] is a XRay segmentation task. For this paper, we used a subset of 200 samples distributed across five clients. As in the other segmentation task, the images are resized to 64 × 64 and TransUNet was used for training. The detailed training setup and dataset composition are provided in the supplementary material.

6

Experiments

In the following experiments, we consider three different types of malfunctions: ANAs, SFAs and clients who submit random updates. For each experiment, we incrementally increase the number of malfunctioning clients, meaning that the number of malfunctioning clients grows per run. We compare LIGHTYEAR against FedAvg [31] and eight baseline methods for robust aggregation: AFA [33], ASMR [24], CFL [36], Ditto [28], Krum [7],

0.6

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION 0.4 0.2

ANA

SFA

11

Random

0.0 1.0

FEMNIST

0.8

0.8

0.6

0.6

0.4

0.4

0.2

0.2

0.0

Isic19 XRay

Fed Pro x Kru m BA LA NC E SC CL LIG IP HT YE AR

L

to Dit

MR

CF

AS

Av g

AF A

Fed

Fed Pro x Kru m BA LA NC E SC CL LIG IP HT YE AR

to

L

0.8

Dit

MR

CF

XRay

AS

Av g

0.0

Ultrasound

Fed

1.0

Camelyon17 Ultrasound

AF A

1.0

0.6 0.4 0.2

ANA

SFA

Random

Dit to Fed Pro x Kru m BA LA NC E SC C LIG LIP HT YE AR

L

MR

CF

AS

Av g

AF A

Fed

L Dit to Fed Pro x Kru m BA LA NC E SC C LIG LIP HT YE AR

MR

CF

AS

Av g Fed

MNIST

AF A

0.0

Camelyon17

Figure 3: Average performance under three client malfunction types, aggregated over all cases with an increasing number of malfunctioning clients from 1 to n−1. Results report mean accuracy across clients and runs. Segmentation performance is reported as Dice score, while the classification performance is reported as accuracy.

Fed

Pro x Kru m BA LA NC E SC C

to Dit

L CF

MR

AF A

Av g

AS

Fed

Dit

Fed

CF

Pro x Kru m BA LA NC E SC C LIG LIP HT YE AR

MR

to

Results L

7 AS

AF A

FedProx [27], BALANCE [15], and SCCLIP [42]. While BALANCE and SCCLIP are also P2P methods, the others represent baselines from centralized FL. The performance of each method is evaluated based on the average accuracy for the classification tasks and the average Dice score for the segmentation tasks, evaluated on the client’s test data. The experiments focus on three key scenarios: (1) evaluating the resilience of each method against the three XRay rasoundtypes of malfunctions individually, (2) assessing the resilience based on topology as the number of malfunctioning clients increases, and (3) testing the resilience in a dynamic and highly unpredictable environment, where malfunctioning clients randomly select one of the three malfunctions each round. This dynamic scenario aims to simulate conditions that are more representative of real-world situations. For LIGHTYEAR, we set the hyperparameter γ to 0.95 in all cases. The decision threshold τ was set to 0.6 for all experiments. The choice of these hyperparameters is discussed in the ablation study.

The results demonstrate that LIGHTYEAR consistently outperforms all baseline approaches. We provide detailed tables containing the concrete numbers of our results in the supplementary material. As shown in Figure 3, only LIGHTYEAR is able to deliver stable performance across all datasets under the evaluated training conditions. Especially for the segmentation tasks, it is evident that the models trained by the baseline methods diverge and deliver almost zero Dice scores, highlighting their inability to defend against any type of malfunctioning client. While certain cases, such as BALANCE on FEMNIST, occasionally achieve stable results, they remain exceptions rather than the norm. Figure 4 further illustrates the impact of an increasing number of clients, showing that all baseline methods encounter severe problems when the proportion of malfunctioning clients exceeds 50%. Only in one case do the centralized FL methods deliver comparable performance. In contrast, LIGHTYEAR

LIGHTYEAR ANA LIGHTYEAR SFA

0.2

1

1.0

1.0

FEMNIST

0.8

0.8

0.6

0.6

0.4

0.4

0.2

0.2

0.0 1.0

P2P ANA P2P SFA

FL ANA FL SFA

LIGHTYEAR Random P2P Random FL Random KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION 0.0

12

1

2

3

4

5

6

7

0.0

2

11

4

5

6

7

1

2

3

4

1

Isic19 XRay

22 33 Malfunctioning Clients

XRay

Ultrasound

3

Camelyon17 Ultrasound

44

11

2

3 2 3 4 Malfunctioning Clients

54

0.8 0.6

LIGHTYEAR ANA LIGHTYEAR SFA LIGHTYEAR Random

0.4

P2P ANA P2P SFA P2P Random

FL ANA FL SFA FL Random

0.2 0.0

1

2 3 Malfunctioning Clients

1.0

FEMNIST 4 1

2 3 Malfunctioning Clients

0.8

4

Camelyon17

Isi

0.6 Figure 4: Performance under increasing numbers of malfunctioning clients for centralized 0.4 FL, P2P FL, and LIGHTYEAR. Segmentation performance is reported as Dice score, while the classification performance is reported as accuracy. 0.2 0.0

1

2

3

4

5

6

7

1

2

3

4

1.0 leverages access to the local data distribution to effectively identify XRay and reject malfunctionUltrasound ing clients, maintaining 0.8 stability even when they constitute the majority. Therefore, only LIGHTYEAR unlocks the 0.6 full potential of the P2P topology. Finally, Figure 5 highlights that LIGHTYEAR remains robust under dynamically changing malfunctioning clients, reflecting 0.4 a more realistic, real-world scenario. Methods that perform relatively well on classification 0.2 tasks often fail to maintain consistent performance on segmentation tasks. As a result, the other baseline approaches0.0 do1 not offer2 a reliable3alternative4 for1 diverse medical imaging ap- 4 2 3 Malfunctioning Clients plications, highlighting the need for a Malfunctioning methodClients like LIGHTYEAR that remains robust across both task types. For all experiments, we provide detailed information with exact numbers in the supplementary. Beyond average performance, we observe that LIGHTYEAR exhibits substantially reduced variance across clients compared to both centralized and existing P2P baselines. This effect is particularly pronounced under high malfunction rates, where baseline methods either diverge or collapse to near-random performance. The agreement-based selection mechanism consistently filters out updates that induce unstable training dynamics, resulting in smoother convergence and more uniform client-level outcomes. These findings suggest that the primary advantage of LIGHTYEAR lies not only in higher mean performance, but also in improved reliability across heterogeneous clients.

8

Ablation Study on γ and τ

To study the effect of the regularization parameter γ, we isolated the regularized aggregation component and evaluated it independently of the personalized aggregation set selection. The corresponding results are shown in Figure 6. Camelyon17 and FEMNIST represent the most distinct heterogeneity settings in our benchmark, with FEMNIST showing the lowest and Camelyon17 the highest degree of client heterogeneity. The results show that lower values of γ stabilize training in highly heterogeneous settings, particularly on Camelyon17, while FEMNIST remains largely unaffected by changes in γ. A similar trend is observed for the segmentation datasets, where the ultrasound dataset benefits from a lower regularization

1

0.2

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION 0.0 FedAvg AFA1

1.0

1.0

FEMNIST

0.8

0.8

0.6

0.6

0.4

0.4

0.2

0.2

0.0 1.0

1

2

3

4

5

6

7

0.0

Ditto

3 FedProx 4

Krum BALANCE 5

SCCLIP

6 LIGHTYEAR7

1

Camelyon17 Ultrasound

11

XRay

Ultrasound

ASMR

2 CFL

2

3

4

13 1

2

Isic19 XRay

22 33 Malfunctioning Clients

44

11

2

3 2 3 4 Malfunctioning Clients

54

0.8 0.6

FedAvg ASMR FedAvg ASMR 0.4 FedAvg ASMR 1.0 1.0 1.0 AFA CFL 1.0 FedAvg AFA CFL FedAvg FedAvg AFA CFL FedAvg FedAvg ASMR FedAvg ASMR 0.2 FEMNIST FEMNIST AFA FEMNIST FedAvg 1.0 AFA AFA FedAvg ASMR Ditto 1.0 FEMNIST 1.0 AFA Ditto AFAASMR CFL 1.0 FedAvg ASMR Ditto AFA CFL 1.0 1.01.0 FedAvg ASMR Ditto Krum AFA CFL FedProx 1.00.0 FedAvg ASMR DittoCFL Krum AFA FedProx FEMNIST FEMNIST AFA CFL FedProx FEMNIST FEMNIST Camelyon17 Camelyon17 FEMNIST FEMNIST CFL FedProx 2 BALANCE 0.8 0.8 AFA CFL 4 BALANCE 0.8 FEMNIST 0.8 2 AFA 1FEMNIST 3 1 FedProx 3

0.6 0.6 0.6 0.6

0.2

0.4 0.2

Dice

0.4 0.4

0.6 0.6 0.6 0.6 0.4 0.4 0.4 0.4 0.2 0.2

Dice

0.4

Dice Dice

Camelyon17 Camelyon17 Camelyon17 Malfunctioning Clients Camelyon17 Camelyon17 Isic19 Camelyon17 Isic19 0.8 0.8 Malfunctioning Clients 0.8 0.8 Camelyon17 Isic19 0.8 Camelyon17 Isic19 0.8 0.8 0.8 Camelyon17 Isic19 Camelyon17 Isic19 0.6 0.6Illustrates the resilience of each method to dynamically changing client malfuncFigure 0.6 5:0.6 0.6 0.6 0.6 0.6 0.6 0.60.6 0.6 tions. In this setting, each malfunctioning client randomly selects one of the three malfunc0.4 0.4 0.4 0.4 in every round. The y-axis shows the average score (accuracy/Dice) across all tion types 0.4 0.4 0.4 0.4 0.4 0.40.4 clients, along with the standard deviation. Segmentation performance is reported as Dice 0.4 0.2 0.2 0.2 0.2 the classification performance is reported as accuracy. score, while 0.2 0.2 0.2 0.2 0.2 0.20.2 0.2 0.0 0.0 0.0 0.0 1111 2222 3333 4444 5555 6666 7777 1111 2222 33 0.0 0.0 0.0 0.0 0.0 0.00.0 0.0 1.0 1 2 3 4 5 6 7 1 2 233232366 Dataset 6727266 111Dataset 7 77 13311 Dataset2222 24422 333131 Dataset 33 77 1.0122Dataset 121255 Ultrasound 551.0 0.99770.99 111144 1.01.0 4344343Ultrasound 5545151440.99 661.05660.95 Camelyon17 FEMNIST 0.950.951 Camelyon17 FEMNIST 1.00.95 0.99 XRay XRay Ultrasound 1.0 Camelyon17 1.0 0.99 XRay Ultrasound XRay XRay Ultrasound 1.0 1.0 2 FEMNIST 1.0 33 XRay 441.0 3 2 3 221.0 31.0 2 3 3 56564Ultrasound 4 6767 5555 1177 6666 11 7777 22 11111.0 22 2 3 3 1.0 1.0 1.0 3344221.0 3 11224444 1.0 44551.0 3 4 1 3 4 1 44 Ultrasound XRay XRay Ultrasound 0.8 XRay XRay XRay Ultrasound Ultrasound XRay XRay XRay XRay Ultrasound Ultrasound 0.8 0.8 0.8 0.8Ultrasound 66 0.8Ultrasound 770.8 11 0.8 22 33 0.8 44 XRay 11 22 33 XRay asound XRay asound XRay rasound XRay rasound XRay XRay 0.8 XRay 0.8 XRay 0.8 0.8 0.8 0.8 0.6 0.8 0.6 0.6 0.8 0.6 0.6 0.6 0.6 0.6 0.6 XRay XRay Dice Dice / Accuracy

NIST MNIST NIST MNIST

FedAvg ASMR Ditto Kru FedAvg ASMR Ditto FedAvg ASMR Ditto Krum FedAvg ASMR Ditto KrKK FedAvg ASMR Ditto Kru FedAvg ASMR Ditto AFA CFL FedProx BAL AFA CFL FedProx AFA CFL FedProx BAL AFA CFL FedProx BA AFA CFL FedProx BAL AFA CFL FedProx FedAvg ASMR Ditto Kr FedAvg ASMR Ditto FedAvg ASMR Ditto KBB FedAvg ASMR Ditto Ditto Krum SCCLIP Ditto Krum SCCLIP FedAvg ASMR Ditto Krum FedAvg ASMR Ditto Krum Ditto Krum SCCLIP FedAvg ASMR Ditto Krum AFA CFL FedProx BA FedAvg ASMR Ditto Krum FedAvg ASMR Ditto Krum AFA CFL FedProx B FedAvg ASMR Ditto Krum AFA CFL FedProx AFA CFL FedProx FedProx BALANCE LIGHTYEAR ASMR Ditto Krum SCCLIP FedProx BALANCE LIGHTYEAR AFA CFL FedProx BALANCE ASMR Ditto Krum SCCLIP ASMR Ditto Krum SCCLIP AFA CFL FedProx BALANCE FedProx BALANCE LIGHTYEAR AFA CFL FedProx BALANCE ASMR Ditto Krum SCCLIP AFA CFL FedProx BALANCE AFA CFL FedProx BALANCE Ditto Krum SCCLIP AFA CFL FedProx BALANCE Ditto Krum SCCLIP Camelyon17 Camelyon17 Camelyon17 CFL FedProx BALANCE LIGHTYEAR Camelyon17 CFL FedProx BALANCE LIGHTYEAR CFL FedProx BALANCE LIGHTYEAR Krum SCCLIP CFL FedProx BALANCE LIGHTYEAR Krum SCCLIP FedProx BALANCE LIGHTYEAR Krum SCCLIP FedProx BALANCE LIGHTYEAR SCCLIP BALANCE LIGHTYEAR SCCLIP BALANCE LIGHTYEAR Camelyon17 Camelyon17 BALANCE LIGHTYEAR Camelyon17 Camelyon17 Isic19 Isic19 Camelyon17 Camelyon17 LIGHTYEAR LIGHTYEAR Camelyon17 4 Camelyon17

0.4 0.2

0.4 0.0 0.0 0.0 0.4 0.0 0.4 0.0 0.4 0.4 0.4 0.4 0.4 10 30 4 20 40 6 30 50 8 40 60 10 502 10 202 6 8 10 12 10 12 604 2 4 6 8 0.2 0.2 0.2 0.2 Training Rounds Training Rounds Training Training Rounds Training Rounds Rounds 0.2 0.2 0.2 0.2 0.2 0.2 0.2 0.2 0.0 Figure 0.0 6: 0.0 0.0Effect of the regularization factor γ measured by the average validation accuracy 1111 and Dice for 2222 segmentation3333across all clients 4444 over1111training rounds. 2222 33 for classification 0.0 0.0 0.0 0.0 0.0 Client Malfunctioning Malfunctioning Malfunctioning Clients Malfunctioning Clien Malfunctioning Clients Malfunctioning Clients 0.0 0.0 MalfunctioningClients Clients MalfunctioningClients Clien 0.0 22 1111 2222 444242 111144 2222 111133 222244 Clients333131 3333 113311 Malfunctioning 242422Clients3333 44 Clients Malfunctioning Malfunctioning Malfunctioning Clients Clients Malfunctioning Clients Malfunctioning Malfunctioning Clients Malfunctioning Clients Malfunctioning Clients Malfunctioning Clients Malfunctioning Clients Clients Malfunctioning Clients Clien Malfunctioning Malfunctioning Malfunctioning Clients Malfunctioning Clients Malfunctioning Clie 3 4 1 2 3 4 Malfunctioning Clients Malfunctioning Clie 3 2222 33 4 3333 1 44 3 2222 33 4 3333 Malfunctioning 1111 22 4444Clien 2 Clients 1 4444 2Malfunctioning 4 2 1 4 nctioning Clients ctioning Clients Malfunctioning Clients Malfunctioning Clients Malfunctioning Clients Malfunctioning Clients Malfunctioning Clients Malfunctioning Clients Malfunctioning Clients Malfunctioning Clients Malfunctioning Clients Malfunctioning Clients Malfunctioning Clients Malfunctioning44Clients 11 22 33 Malfunctioning44Clients Malfunctioning Clients remains stable across all evaluated values. Clients factor of γ = 0.95, whereasMalfunctioning the XRay dataset Based on these findings, we use γ = 0.95 for all experiments, as datasets either benefit from this choice or show little sensitivity to variations of γ.

Figure 7 shows the distribution of the agreement score across all evaluated scenarios. The dashed line indicates the threshold τ = 0.6 used for update selection. A clear separation between malfunctioning and benign updates can be observed. The figure additionally reflects the degree of dataset heterogeneity, with Camelyon17 exhibiting the lowest agreement scores and therefore the strongest client heterogeneity. Since benign updates in highly heterogeneous settings can still yield lower agreement scores while remaining beneficial for the target domain, τ was chosen conservatively in the presented experiments.

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION

Agreement Agreementscore score

14

1.00 1.00 0.75 0.75 0.50 0.50 0.25 0.25 0.00 0.00 0.25 0.25 0.50 0.50 0.75 0.75 1.00 1.00

Femnist FEMNIST Femnist

Camelyon17 Camelyon17 Camelyon17

ISIC19 Isic19

ISIC19 Dataset Dataset

Ultrasound Ultrasound Ultrasound

Xray XRay Xray

Figure 7: Distribution of the agreement score across all evaluated scenarios and clients, measured on the local validation datasets. The dashed line indicates the threshold τ = 0.6 used for update selection.

9

Conclusion

In this work, we addressed the challenge of personalized update selection in FL under heterogeneous and unreliable client populations. A key observation of our work is that parameterspace similarity is often an insufficient proxy for model behavior, particularly in heterogeneous federated settings where small parameter changes can lead to substantially different predictions on local data distributions. This limits the reliability of conventional update selection strategies that operate solely in parameter space. To overcome this limitation, we proposed LIGHTYEAR, a function-space-based framework for personalized and robust federated aggregation. At the core of LIGHTYEAR is a client-specific and NTK-based agreement score that estimates the predictive behavior of incoming updates on the local target domain. By evaluating semantic alignment in function space rather than parameter similarity, each client can identify the subset of updates that is most beneficial for its own data distribution. This enables a more expressive and behavior-aware update selection mechanism for FL. The P2P topology plays a central role in enabling this perspective. Unlike centralized FL, where the server has access only to transmitted parameters, the decentralized setting allows each client to directly evaluate incoming updates on its own local validation data before aggregation. This provides access to the function space and enables personalized aggregation decisions based on model behavior rather than parameter heuristics. LIGHTYEAR further combines this update selection with a regularized aggregation strategy to stabilize training, improve robustness, and mitigate client drift. Our experiments across multiple datasets and challenging heterogeneous and malfunctioning scenarios demonstrate that LIGHTYEAR consistently improves performance compared to both centralized FL methods and state-ofthe-art P2P baselines. These findings highlight the value of function-space-based reasoning for federated optimization and suggest that future FL methods may benefit from moving beyond parameter-space metrics toward behavior-aware aggregation strategies.

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION

15

References [1] Zeinab Alebouyeh and Amir Jalaly Bidgoly. Benchmarking robustness and privacypreserving methods in federated learning. Future Generation Computer Systems, 155: 18–38, 2024. [2] Mansoor Ali, Faisal Naeem, Muhammad Tariq, and Georges Kaddoum. Federated learning for privacy preservation in smart healthcare systems: A comprehensive survey. IEEE journal of biomedical and health informatics, 27(2):778–789, 2022. [3] Peter Bandi, Oscar Geessink, Quirine Manson, Marcory Van Dijk, Maschenka Balkenhol, Meyke Hermsen, Babak Ehteshami Bejnordi, Byungjae Lee, Kyunghyun Paeng, Aoxiao Zhong, et al. From detection of individual metastases to classification of lymph node status at the patient level: the camelyon17 challenge. IEEE transactions on medical imaging, 38(2):550–560, 2018. [4] Shai Ben-David, John Blitzer, Koby Crammer, and Fernando Pereira. Analysis of representations for domain adaptation. Advances in neural information processing systems, 19, 2006. [5] Shai Ben-David, John Blitzer, Koby Crammer, Alex Kulesza, Fernando Pereira, and Jennifer Wortman Vaughan. A theory of learning from different domains. Machine learning, 79:151–175, 2010. [6] Ari S Benjamin, David Rolnick, and Konrad Kording. Measuring and regularizing networks in function space. arXiv preprint arXiv:1805.08289, 2018. [7] Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer. Machine learning with adversaries: Byzantine tolerant gradient descent. Advances in neural information processing systems, 30, 2017. [8] Sebastian Caldas, Sai Meher Karthik Duddu, Peter Wu, Tian Li, Jakub Konečnỳ, H Brendan McMahan, Virginia Smith, and Ameet Talwalkar. Leaf: A benchmark for federated settings. arXiv preprint arXiv:1812.01097, 2018. [9] Xiaoyu Cao, Minghong Fang, Jia Liu, and Neil Zhenqiang Gong. Fltrust: Byzantinerobust federated learning via trust bootstrapping. arXiv preprint arXiv:2012.13995, 2020. [10] Jieneng Chen, Jieru Mei, Xianhang Li, Yongyi Lu, Qihang Yu, Qingyue Wei, Xiangde Luo, Yutong Xie, Ehsan Adeli, Yan Wang, et al. Transunet: Rethinking the u-net architecture design for medical image segmentation through the lens of transformers. Medical Image Analysis, page 103280, 2024. [11] Zihan Chen, Jundong Li, and Cong Shen. Personalized federated learning with attention-based client selection. In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 6930–6934. IEEE, 2024. [12] Noel CF Codella, David Gutman, M Emre Celebi, Brian Helba, Michael A Marchetti, Stephen W Dusza, Aadi Kalloo, Konstantinos Liopyris, Nabin Mishra, Harald Kittler,

16

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION

et al. Skin lesion analysis toward melanoma detection: A challenge at the 2017 international symposium on biomedical imaging (isbi), hosted by the international skin imaging collaboration (isic). In 2018 IEEE 15th international symposium on biomedical imaging (ISBI 2018), pages 168–172. IEEE, 2018. [13] Marc Combalia, Noel CF Codella, Veronica Rotemberg, Brian Helba, Veronica Vilaplana, Ofer Reiter, Cristina Carrera, Alicia Barreiro, Allan C Halpern, Susana Puig, et al. Bcn20000: Dermoscopic lesions in the wild. arXiv preprint arXiv:1908.02288, 2019. [14] C Da et al. Fetal abdominal structures segmentation dataset using ultrasonic images. Mendeley Data, 2023. [15] Minghong Fang, Zifan Zhang, Hairi, Prashant Khanduri, Jia Liu, Songtao Lu, Yuchen Liu, and Neil Gong. Byzantine-robust decentralized federated learning. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 2874–2888, 2024. [16] Edoardo Gabrielli, Giovanni Pica, and Gabriele Tolomei. A survey on decentralized federated learning. arXiv preprint arXiv:2308.04604, 2023. [17] Nicolás Gaggion, Candelaria Mosquera, Lucas Mansilla, Julia Mariel Saidman, Martina Aineseder, Diego H Milone, and Enzo Ferrante. Chexmask: a large-scale dataset of anatomical segmentation masks for multi-center chest x-ray images. Scientific Data, 11(1):511, 2024. [18] Lie He, Sai Praneeth Karimireddy, and Martin Jaggi. Byzantine-robust decentralized learning via clippedgossip. arXiv preprint arXiv:2202.01545, 2022. [19] Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 4700–4708, 2017. [20] Md Sirajul Islam, Simin Javaherian, Fei Xu, Xu Yuan, Li Chen, and Nian-Feng Tzeng. Fedclust: Optimizing federated learning on non-iid data through weight-driven client clustering. In 2024 IEEE International Parallel and Distributed Processing Symposium Workshops (IPDPSW), pages 1184–1186. IEEE, 2024. [21] Arthur Jacot, Franck Gabriel, and Clément Hongler. Neural tangent kernel: Convergence and generalization in neural networks. Advances in neural information processing systems, 31, 2018. [22] Alistair EW Johnson, Tom J Pollard, Seth J Berkowitz, Nathaniel R Greenbaum, Matthew P Lungren, Chih-ying Deng, Roger G Mark, and Steven Horng. Mimic-cxr, a de-identified publicly available database of chest radiographs with free-text reports. Scientific data, 6(1):317, 2019. [23] Daniel Kifer, Shai Ben-David, and Johannes Gehrke. Detecting change in data streams. In VLDB, volume 4, pages 180–191. Toronto, Canada, 2004. [24] Mirko Konstantin, Moritz Fuchs, and Anirban Mukhopadhyay. Asmr: Angular support for malfunctioning client resilience in federated learning. In Medical Imaging with Deep Learning, pages 754–767. PMLR, 2024.

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION

17

[25] Nick Lemke, Mirko Konstantin, Henry John Krumb, John Kalkhof, Jonathan Stieber, and Anirban Mukhopadhyay. Equitable federated learning with nca. In International Conference on Medical Image Computing and Computer-Assisted Intervention, pages 168–177. Springer, 2025. [26] Suyi Li, Yong Cheng, Wei Wang, Yang Liu, and Tianjian Chen. Learning to detect malicious clients for robust federated learning. arXiv preprint arXiv:2002.00211, 2020. [27] Tian Li, Anit Kumar Sahu, Manzil Zaheer, Maziar Sanjabi, Ameet Talwalkar, and Virginia Smith. Federated optimization in heterogeneous networks. Proceedings of Machine learning and systems, 2:429–450, 2020. [28] Tian Li, Shengyuan Hu, Ahmad Beirami, and Virginia Smith. Ditto: Fair and robust federated learning through personalization. In International conference on machine learning, pages 6357–6368. PMLR, 2021. [29] Pengrui Liu, Xiangrui Xu, and Wei Wang. Threats, attacks and defenses to federated learning: issues, taxonomy and perspectives. Cybersecurity, 5(1):4, 2022. [30] Charles Lu, Yaodong Yu, Sai Praneeth Karimireddy, Michael Jordan, and Ramesh Raskar. Federated conformal predictors for distributed uncertainty quantification. In International Conference on Machine Learning, pages 22942–22964. PMLR, 2023. [31] Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication-efficient learning of deep networks from decentralized data. In Artificial intelligence and statistics, pages 1273–1282. PMLR, 2017. [32] El Mahdi El Mhamdi, Rachid Guerraoui, and Sébastien Rouault. The hidden vulnerability of distributed learning in byzantium. arXiv preprint arXiv:1802.07927, 2018. [33] Luis Muñoz-González, Kenneth T Co, and Emil C Lupu. Byzantine-robust federated machine learning through adaptive model averaging. arXiv preprint arXiv:1909.05125, 2019. [34] Jean Ogier du Terrail, Samy-Safwan Ayed, Edwige Cyffers, Felix Grimberg, Chaoyang He, Regis Loeb, Paul Mangold, Tanguy Marchand, Othmane Marfoq, Erum Mushtaq, Boris Muzellec, Constantin Philippenko, Santiago Silva, Maria Teleńczuk, Shadi Albarqouni, Salman Avestimehr, Aurélien Bellet, Aymeric Dieuleveut, Martin Jaggi, Sai Praneeth Karimireddy, Marco Lorenzi, Giovanni Neglia, Marc Tommasi, and Mathieu Andreux. Flamby: Datasets and benchmarks for cross-silo federated learning in realistic healthcare settings. In S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh, editors, Advances in Neural Information Processing Systems, volume 35, pages 5315–5334. Curran Associates, Inc., 2022. URL https://proceedings.neurips.cc/paper_files/paper/2022/ file/232eee8ef411a0a316efa298d7be3c2b-Paper-Datasets_and_ Benchmarks.pdf. [35] Krishna Pillutla, Sham M Kakade, and Zaid Harchaoui. Robust aggregation for federated learning. IEEE Transactions on Signal Processing, 70:1142–1154, 2022.

18

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION

[36] Felix Sattler, Klaus-Robert Müller, Thomas Wiegand, and Wojciech Samek. On the byzantine robustness of clustered federated learning. In ICASSP 2020-2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 8861–8865. IEEE, 2020. [37] Riccardo Taiello, Sergen Cansiz, Marc Vesin, Francesco Cremonesi, Lucia Innocenti, Melek Önen, and Marco Lorenzi. Enhancing privacy in federated learning: Secure aggregation for real-world healthcare applications. In International Conference on Medical Image Computing and Computer-Assisted Intervention, pages 204–214. Springer, 2024. [38] Mingxing Tan and Quoc Le. Efficientnet: Rethinking model scaling for convolutional neural networks. In International conference on machine learning, pages 6105–6114. PMLR, 2019. [39] Philipp Tschandl, Cliff Rosendahl, and Harald Kittler. The ham10000 dataset, a large collection of multi-source dermatoscopic images of common pigmented skin lesions. Scientific data, 5(1):1–9, 2018. [40] Stefanie Warnat-Herresthal, Hartmut Schultze, Krishnaprasad Lingadahalli Shastry, Sathyanarayanan Manamohan, Saikat Mukherjee, Vishesh Garg, Ravi Sarveswara, Kristian Händler, Peter Pickkers, N Ahmad Aziz, et al. Swarm learning for decentralized and confidential clinical machine learning. Nature, 594(7862):265–270, 2021. [41] Jian Xu, Shao-Lun Huang, Linqi Song, and Tian Lan. Byzantine-robust federated learning through collaborative malicious gradient filtering. In 2022 IEEE 42nd International Conference on Distributed Computing Systems (ICDCS), pages 1223–1235. IEEE, 2022. [42] Caiyi Yang and Javad Ghaderi. Byzantine-robust decentralized learning via removethen-clip aggregation. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 21735–21743, 2024. [43] Mingkun Yang, Ran Zhu, Qing Wang, and Jie Yang. Fedtrans: Client-transparent utility estimation for robust federated learning. In International Conference on Learning Representations, volume 2024, pages 42668–42692, 2024. [44] Dong Yin, Yudong Chen, Ramchandran Kannan, and Peter Bartlett. Byzantine-robust distributed learning: Towards optimal statistical rates. In International conference on machine learning, pages 5650–5659. Pmlr, 2018. [45] Kai Yue, Richeng Jin, Ryan Pilgrim, Chau-Wai Wong, Dror Baron, and Huaiyu Dai. Neural tangent kernel empowered federated learning. In International Conference on Machine Learning, pages 25783–25803. PMLR, 2022. [46] Chang Zhang, Shunkun Yang, Lingfeng Mao, and Huansheng Ning. Anomaly detection and defense techniques in federated learning: a comprehensive review. Artificial Intelligence Review, 57(6):150, 2024. [47] Jianqing Zhang, Yang Hua, Hao Wang, Tao Song, Zhengui Xue, Ruhui Ma, and Haibing Guan. Fedala: Adaptive local aggregation for personalized federated learning. In Proceedings of the AAAI conference on artificial intelligence, volume 37, pages 11237– 11244, 2023.

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION

19

Figure 8: Sample images from each client, illustrating distinct differences in their data distributions. These variations highlight the heterogeneity across clients, which contributes to prediction errors on target domains as described in Eq 5 of the main paper, and underline the challenges of training in federated settings. [48] Zaixi Zhang, Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. Fldetector: Defending federated learning against model poisoning attacks via detecting malicious clients. In Proceedings of the 28th ACM SIGKDD conference on knowledge discovery and data mining, pages 2545–2555, 2022. [49] Yue Zhao, Meng Li, Liangzhen Lai, Naveen Suda, Damon Civin, and Vikas Chandra. Federated learning with non-iid data. arXiv preprint arXiv:1806.00582, 2018. [50] Hangyu Zhu, Jinjin Xu, Shiqing Liu, and Yaochu Jin. Federated learning on non-iid data: A survey. Neurocomputing, 465:371–390, 2021.

A

Dataset Construction

For each dataset we provide a csv-file containing the concrete splits. As mentioned in the main text, each client holds a unique training, validation, and test set. We perform experiments on datasets of five different modalities, including three classification and two segmentation tasks. We used the Camelyon17-WILDS [3] dataset as a representative of histopathology , which consists of 96×96 H&E-stained tissue slide patches of lymph nodes for a binary tumor classification task. The dataset contains images from patients across five hospitals, which naturally form three domains due to differences in image acquisition protocols namely, DHistech P250 (0.24 µm pixel size), Philips IntelliSite Ultra Fast Scanner (0.25 µm), and Hamamatsu XR C12000 whole-slide scanner (0.23 µm). Each client holds the data of one medical center. The distribution shift across the clients is visualized in Figure 8. For the second dataset, FEMNIST, we used the dataset structure provided by the LEAF (https://github.com/TalwalkarLab/leaf) repository. In this setting, each client receives a distinct subset of data corresponding to a unique set of writers. Similar to the Camelyon17 setup, a random train/validation/test split is performed on each client’s data. Our preprocessing scripts for generating these subsets and splits are also included in the datasets directory of our codebase. The Isic19 dataset is a large-scale dermoscopic image collection designed for skin-lesion classification. It includes images labeled across eight diagnostic categories, ranging from benign lesions to malignant skin cancers. These classes form the basis of the multi-class clas-

20

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION

Figure 9: Sample images from each client, illustrating distinct differences in their data distributions. These variations highlight the heterogeneity across clients, which contributes to prediction errors on target domains as described in the main paper, and underline the challenges of training in federated settings. sification task explored in this work. Representative examples of all eight classes are visualized in Figure 9. Since the images have different dimensions across the different centers, we performed a random 200 × 200 crop in out data loader. Further, we applied RandomScale, Rotate, RandomBrightnessContrast, AffineProjection, and Normalization augmentation to the images in the training loop. We employ ultrasound scans from the Fetal Abdominal Structures Segmentation dataset [14], which contains 1,588 fetal abdomen circumference images. These scans were acquired following a standardized protocol using Siemens Acuson, Voluson 730 (GE Healthcare Ultrasound), or Philips EPIQ Elite (Philips Healthcare Ultrasound) devices. In our experiments, we focus on segmenting the fetal liver. All images and corresponding segmentation masks are resized to 64 × 64. Each client receives a distinct subset of patients, forming its local dataset. Figure 10 shows some examples. Lastly, we use chest X-ray images from patients in tertiary care obtained from the MIMICXCR dataset [22]. Lung segmentation masks are sourced from the CheXmask database [17]. Because these masks were automatically generated, we retain only samples with a mean Dice Reverse Classification Accuracy of at least 70%. For our experiments, we randomly select 200 images, resulting in 40 samples per client across five client datasets. All images and segmentation masks are resized to 64 × 64. Figure 11 shows some images with their corresponding segmentation masks.

B

Scalability Analysis

As illustrated in Figure 12, the communication complexity of centralized FL and P2P FL differs substantially with increasing federation size. In centralized FL, each client communicates exclusively with the central server by transmitting its local model update and receiving

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION

21

Figure 10: Sample images with the corresponding segmentation masks from the ultrasound dataset

Figure 11: Sample images with the corresponding segmentation masks from the xray dataset

22

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION

Figure 12: Comparison of communication costs between centralized and P2P topology as a function of the number of participating clients. While the total communication cost in centralized FL grows linearly with the federation size, O(n), the cost in P2P FL grows quadratically, O(n2 ). The markers indicate the client counts used in our experiments for the respective datasets.

the aggregated global model. Consequently, the communication cost per client remains constant across rounds, so O(1), whereas the server-side communication cost increases linearly with the number of participating clients. Summed over the entire federation, this results in an overall communication complexity of O(n). In contrast, for the fully connected P2P topology considered in this work, P2P FL eliminates the central server and instead requires clients to exchange updates directly with one another. Under this topology, the communication cost per client increases linearly with the number of participating clients, meaning O(n), since each additional client introduces an additional communication partner. As a result, the total communication cost over the whole federation grows quadratically, so O(n2 ). Figure 12 visualizes this difference for federations of varying size and highlights that, although P2P FL enables decentralized and client-specific decision making, this flexibility comes at the cost of substantially higher communication overhead compared to centralized FL.

C

Experimental Results

In this section, we provide a detailed breakdown of the results presented in the main paper. For each dataset and malfunction, a dedicated table is included. These tables report the average accuracy or dice score across all clients, along with the corresponding standard deviation. All values are expressed as percentages for consistency and clarity.

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION

23

Table 1: This table reports the results for ANAs on FEMNIST. Average accuracy (%) ± std of each method under increasing number of malfunctioning clients. FEMNIST – ANA Number of Malfunctioning Clients Method FedAvg AFA ASMR CFL Ditto FedProx Krum BALANCE SCCLIP LIGHTYEAR

1

2

3

4

5

6

7

86.0 ± 8.3 87.2 ± 6.7 86.1 ± 4.8 86.7 ± 5.8 84.1 ± 8.6 85.5 ± 7.2 68.6 ± 9.4 80.2 ± 2.8 86.0 ± 3.6 90.7 ± 2.0

84.7 ± 7.3 87.3 ± 6.5 85.5 ± 2.5 86.0 ± 4.0 76.0 ± 4.7 76.2 ± 6.0 68.5 ± 9.2 81.3 ± 2.3 85.1 ± 3.7 89.9 ± 2.4

75.0 ± 5.8 87.0 ± 5.1 85.3 ± 2.1 85.5 ± 2.6 80.3 ± 7.7 74.7 ± 2.7 70.0 ± 9.1 81.3 ± 1.6 85.9 ± 3.7 87.5 ± 3.0

59.4 ± 5.5 54.3 ± 3.9 81.5 ± 2.0 13.5 ± 1.2 68.4 ± 1.9 77.6 ± 5.0 69.2 ± 9.2 81.9 ± 2.6 84.0 ± 3.4 85.7 ± 6.7

68.1 ± 8.0 52.7 ± 4.0 78.2 ± 5.3 66.2 ± 3.6 32.5 ± 2.0 34.3 ± 4.4 70.5 ± 8.7 82.1 ± 2.2 80.4 ± 4.8 88.0 ± 1.2

25.0 ± 1.2 16.0 ± 3.9 73.6 ± 8.0 36.2 ± 3.2 31.2 ± 2.3 25.3 ± 1.6 70.5 ± 9.2 79.0 ± 2.8 80.5 ± 3.1 84.7 ± 1.5

31.2 ± 4.9 25.0 ± 3.0 70.6 ± 8.5 21.2 ± 1.6 36.7 ± 4.1 19.7 ± 4.1 70.1 ± 9.1 80.2 ± 3.4 80.5 ± 3.3 81.4 ± 10.0

Table 2: This table reports the results for SFAs on FEMNIST. Average accuracy (%) ± std of each method under increasing number of malfunctioning clients. FEMNIST – SFA Number of Malfunctioning Clients Method FedAvg AFA ASMR CFL Ditto FedProx Krum BALANCE SCCLIP LIGHTYEAR

D

1

2

3

4

5

6

7

83.6 ± 5.4 86.9 ± 7.1 87.2 ± 4.6 86.9 ± 4.8 84.3 ± 4.2 82.3 ± 4.0 71.4 ± 8.8 81.0 ± 2.5 83.8 ± 2.6 90.6 ± 2.2

76.6 ± 2.4 87.0 ± 6.1 86.8 ± 3.4 85.9 ± 3.4 77.6 ± 1.9 74.3 ± 2.1 71.5 ± 8.2 80.0 ± 2.3 78.9 ± 3.3 90.7 ± 2.0

21.4 ± 5.7 86.0 ± 4.2 84.9 ± 1.7 85.2 ± 3.2 7.7 ± 1.0 4.1 ± 1.6 70.9 ± 9.0 81.3 ± 2.4 67.6 ± 8.2 90.2 ± 1.7

1.5 ± 0.3 2.6 ± 0.3 73.0 ± 6.3 25.6 ± 4.4 5.1 ± 0.5 0.4 ± 0.2 71.4 ± 8.2 81.1 ± 2.0 42.1 ± 16.1 90.1 ± 1.5

1.3 ± 0.3 6.4 ± 0.9 58.8 ± 4.6 51.3 ± 12.5 1.4 ± 0.3 6.8 ± 1.0 71.0 ± 8.7 81.4 ± 2.3 16.7 ± 5.2 88.7 ± 1.0

3.6 ± 0.4 2.9 ± 0.3 42.5 ± 10.5 55.3 ± 1.1 0.8 ± 0.2 2.4 ± 5.3 3.5 ± 0.5 80.9 ± 3.1 6.6 ± 5.0 83.7 ± 2.7

4.5 ± 1.5 1.6 ± 0.3 36.6 ± 2.9 43.4 ± 10.0 0.9 ± 0.1 50.8 ± 10.0 15.5 ± 3.2 81.2 ± 3.0 2.4 ± 1.0 86.9 ± 0.7

Technical Details

In this section, we provide an overview of the hardware and software requirements needed to reproduce our experiments. We detail the dataset construction process for each client in our FL setup, ensuring reproducibility of the data splits and assignments. Additionally, we outline the model architectures used in our experiments, including all relevant hyperparameters.

D.1

Hard- and Software Requirements

Our implementation is based on NVIDIA FLARE, as described in the main paper. The required software configuration includes Python 3.10.17, CUDA 12.2, and PyTorch 2.7.0+cu126. We also used a nightly build of FLARE 2.6.1. All remaining dependencies are listed in the requirements.txt file provided in our codebase. Experiments were conducted on an SLURMmanaged cluster using NVIDIA A100 GPUs with 40GB memory. We used up to three GPUs per training run. Each experiment can be executed with a single GPU, though.

24

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION

Table 3: This table reports the results for the Random malfunction on FEMNIST. Average accuracy (%) ± std of each method under increasing number of malfunctioning clients. FEMNIST – Random Number of Malfunctioning Clients Method FedAvg AFA ASMR CFL Ditto FedProx Krum BALANCE SCCLIP LIGHTYEAR

1

2

3

4

5

6

7

85.6 ± 6.5 87.0 ± 7.1 86.8 ± 3.9 86.7 ± 4.9 83.1 ± 5.0 84.0 ± 5.2 70.5 ± 8.8 81.7 ± 2.8 84.6 ± 2.6 90.6 ± 2.2

77.2 ± 3.0 86.7 ± 6.3 86.0 ± 3.5 85.8 ± 2.7 81.3 ± 5.7 82.7 ± 6.0 70.8 ± 8.7 80.4 ± 2.7 83.6 ± 3.5 90.2 ± 2.1

79.6 ± 5.4 86.0 ± 4.2 85.2 ± 1.8 85.2 ± 2.2 71.8 ± 2.9 78.0 ± 1.8 70.1 ± 8.9 81.3 ± 2.3 77.8 ± 4.2 89.9 ± 1.6

57.2 ± 3.8 60.0 ± 3.8 82.5 ± 2.3 3.9 ± 1.1 53.1 ± 2.6 63.2 ± 2.0 69.5 ± 9.6 81.4 ± 2.5 74.9 ± 3.3 87.9 ± 1.3

10.0 ± 0.9 5.0 ± 1.5 77.5 ± 5.4 0.4 ± 0.2 2.3 ± 0.6 44.4 ± 13.6 70.7 ± 9.0 80.8 ± 2.5 65.5 ± 6.0 85.5 ± 1.4

2.4 ± 0.4 4.1 ± 1.6 72.4 ± 8.6 0.6 ± 0.2 1.7 ± 0.7 4.1 ± 1.6 66.2 ± 9.4 81.2 ± 3.3 31.7 ± 13.9 82.0 ± 0.1

4.2 ± 1.2 0.4 ± 0.3 1.6 ± 0.7 3.0 ± 0.1 1.6 ± 0.7 4.5 ± 1.6 35.4 ± 13.3 82.0 ± 1.6 4.8 ± 2.2 80.3 ± 0.4

Table 4: This table reports the results for the dynamically changing malfunction on FEMNIST. Average accuracy (%) ± std of each method under increasing number of malfunctioning clients. FEMNIST – Dynamic Malfunctions Number of Malfunctioning Clients Method FedAvg AFA ASMR CFL Ditto FedProx Krum BALANCE SCCLIP LIGHTYEAR

D.2

1

2

3

4

5

6

7

84.9 ± 5.8 87.3 ± 7.2 86.8 ± 4.9 87.1 ± 5.1 85.6 ± 5.2 85.4 ± 5.0 71.0 ± 9.0 80.7 ± 2.6 85.6 ± 4.8 90.6 ± 2.2

81.6 ± 2.6 86.7 ± 5.8 85.8 ± 3.4 85.8 ± 2.4 80.1 ± 2.0 81.1 ± 4.3 72.8 ± 8.5 81.5 ± 3.0 83.8 ± 4.8 90.5 ± 1.8

43.7 ± 9.0 86.0 ± 5.0 83.0 ± 2.3 76.7 ± 2.0 82.3 ± 6.3 66.6 ± 2.5 71.2 ± 8.7 80.8 ± 2.6 73.7 ± 7.9 89.9 ± 1.9

29.4 ± 3.1 80.6 ± 2.7 82.7 ± 4.4 78.2 ± 1.6 64.2 ± 3.0 27.1 ± 4.8 70.6 ± 8.4 81.8 ± 1.6 83.0 ± 3.2 89.4 ± 1.3

5.9 ± 1.8 54.4 ± 2.7 0.5 ± 0.1 1.5± 0.2 38.3 ± 3.2 20.4 ± 1.0 70.5 ± 8.9 80.9 ± 2.9 38.5 ± 2.5 87.7 ± 1.0

0.7 ± 0.3 65.7 ± 4.5 2.0 ± 0.6 13.0 ± 5.7 4.7 ± 1.8 5.0 ± 1.5 52.8 ± 12.5 81.5 ± 2.2 51.4 ± 9.9 82.8 ± 3.1

0.3 ± 0.2 0.4 ± 0.2 1.1 ± 0.4 10.7 ± 1.0 0.4 ± 0.2 0.4 ± 0.2 0.4 ± 0.2 81.6 ± 2.3 7.3 ± 3.6 84.2 ± 4.9

Training Details

To complement the description of our training routines provided in the main paper, we present the detailed hyperparameters for our experimental setup in Table 21. Additionally, our codebase includes the full implementation of these training routines, ensuring that all experiments are fully reproducible.

E

Model Sensitivity

To investigate the sensitivity of the models used in our study to corrupted updates, we conducted an ablation study using the ANA. In the main paper, we employed two model architectures: a DenseNet121 for the Camelyon17 dataset, chosen due to its prevalence on the official leaderboard, and a lightweight CNN with two convolutional layers for the FEMNIST dataset, which has shown strong performance on this task. To evaluate how these models react to corrupted updates, we applied ANA as defined in the main paper. In our implementation, noise is injected into the updates using a scaling factor s, as described in Equation 18,

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION

25

Table 5: This table reports the results for ANAs on Camelyon17. Average accuracy (%) ± std of each method under increasing number of malfunctioning clients. Camelyon17 – ANA Number of Malfunctioning Clients Method FedAvg AFA ASMR CFL Ditto Krum FedProx BALANCE SCCLIP LIGHTYEAR

1

2

3

4

58.8 ± 14.2 59.8 ± 19.0 54.3 ± 10.3 58.3 ± 16.8 64.1 ± 15.4 80.2 ± 0.4 63.1 ± 16.3 50.2 ± 0.4 58.8 ± 11.3 89.5 ± 8.8

61.6 ± 18.2 58.5 ± 17.5 61.5 ± 17.3 58.1 ± 18.2 64.7 ± 16.1 77.5 ± 0.5 63.6 ± 17.0 51.5 ± 2.0 50.0 ± 0.4 90.6 ± 8.4

59.5 ± 17.6 59.0 ± 15.1 61.3 ± 14.9 69.4 ± 16.9 59.3 ± 17.0 74.0 ± 0.6 59.0 ± 13.9 57.5 ± 15.9 50.8 ± 1.6 85.9 ± 15.1

58.3 ± 18.5 56.6 ± 19.1 60.6 ± 20.0 73.8 ± 18.8 51.4 ± 0.5 70.1 ± 0.7 60.0 ± 19.5 62.3 ± 15.9 52.7 ± 5.5 77.7 ± 11.7

allowing us to vary the corruption severity from very light to heavy flexibly. This tunable corruption is an advantage over SFA, which inherently applies only strong corruption. For our ablation, we applied different scaling factors and varied the number of malfunctioning clients, ranging from 1 to 3 for FEMNIST, and from 1 to 2 for Camelyon17. We monitored how the corruption affected the learning dynamics by evaluating each client’s local validation accuracy at every training round. The mean validation accuracy across all clients per round is reported in Figure 13 for FEMNIST and Figure 14 for Camelyon17.   s θ̃k = θk + εk · · θk , where εk ∼ N (0, I) (18) 100 Our ablation study reveals that the model trained on the FEMNIST dataset exhibits strong robustness to noise and is therefore less sensitive to corruption. We evaluated this sensitivity using four different noise scaling factors, as detailed in Figure 1. The results indicate that even scaling factors around 50 do not destabilize the training process. However, when scaling reaches around 120, the training begins to show instability, even with only a single malfunctioning client. At a scaling factor of approximately 150, we observe significant performance degradation, particularly when three clients are malfunctioning. In contrast, the model trained on the Camelyon17 dataset is much more sensitive to noise. As a result, we evaluated this setting using substantially smaller scaling factors. Even at a scaling of 1.5, the training becomes noticeably destabilized. It is worth noting that training on Camelyon17 is inherently less stable and more challenging due to the high degree of client heterogeneity. This instability is also reflected in the main paper’s ablation study and motivated our introduction of the regularized aggregation approach. In our final experiments, we used a scaling factor of 120.5 for FEMNIST and 1.5 for Camelyon17. While these settings do not lead to the most extreme performance drops, they effectively destabilize training and negatively impact performance, striking a balance between subtle corruption and the more aggressive, rapidly diverging effect of SFAs.

26

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION

Figure 13: Training performance on FEMNIST under varying levels of corruption. Each plot corresponds to a different number of malfunctioning clients, indicated in parentheses in the y-axis label. Results show the average validation accuracy across all clients at each training round.

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION

27

Figure 14: Training performance on Camelyon17 under varying levels of corruption. Each plot corresponds to a different number of malfunctioning clients, indicated in parentheses in the y-axis label. Results show the average validation accuracy across all clients at each training round.

28

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION

Table 6: This table reports the results for SFAs on Camelyon17. Average accuracy (%) ± std of each method under increasing number of malfunctioning clients. Camelyon17 – SFA Number of Malfunctioning Clients Method FedAvg AFA ASMR CFL Ditto FedProx Krum BALANCE SCCLIP LIGHTYEAR

1

2

3

4

50.1 ± 0.4 56.6 ± 19.1 56.1 ± 17.9 56.3 ± 14.4 58.3 ± 10.8 49.6 ± 3.3 80.2 ± 0.4 55.3 ± 7.4 50.1 ± 0.4 95.8 ± 1.9

50.1 ± 0.4 58.6 ± 17.7 60.6 ± 17.8 59.5 ± 17.4 50.1 ± 0.4 50.1 ± 0.4 77.5 ± 0.5 53.0 ± 6.2 50.1 ± 0.4 92.3 ± 6.2

50.1 ± 0.4 50.1 ± 0.4 50.0 ± 0.4 50.1 ± 0.4 50.1 ± 0.4 49.9 ± 0.4 74.0 ± 0.6 57.5 ± 14.3 50.1 ± 0.4 96.0 ± 2.9

50.4 ± 0.4 50.1 ± 0.4 50.1 ± 0.4 50.1 ± 0.4 50.1 ± 0.4 49.9 ± 0.4 70.1 ± 0.7 50.0 ± 0.4 50.1 ± 0.4 95.4 ± 2.8

Table 7: This table reports the results for Random malfunction on Camelyon17. Average accuracy (%) ± std of each method under increasing number of malfunctioning clients. Camelyon17 – Random Number of Malfunctioning Clients Method FedAvg AFA ASMR CFL Ditto FedProx Krum BALANCE SCCLIP LIGHTYEAR

1

2

3

4

50.4 ± 0.4 57.5 ± 18.3 55.3 ± 11.8 60.0 ± 16.6 50.0 ± 0.4 49.9 ± 0.4 80.2 ± 0.4 53.5 ± 6.6 50.0 ± 0.4 96.3 ± 2.2

50.4 ± 0.4 56.5 ± 20.0 57.1 ± 17.5 60.5 ± 14.6 50.0 ± 0.4 49.9 ± 0.4 77.5 ± 0.5 62.4 ± 16.8 50.0 ± 0.4 87.4 ± 6.9

50.4 ± 0.4 50.0 ± 0.4 50.0 ± 0.4 50.0 ± 0.4 50.4 ± 0.4 49.9 ± 0.4 74.0 ± 0.6 62.0 ± 14.9 50.0 ± 0.4 90.9 ± 7.0

50.4 ± 0.4 50.0 ± 0.4 50.1 ± 0.4 50.0 ± 0.4 50.4 ± 0.4 49.9 ± 0.4 70.1 ± 0.7 50.2 ± 0.4 50.0 ± 0.4 94.1 ± 4.3

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION

29

Table 8: This table reports the results for the dynamically changing malfunction on Camelyon17. Average accuracy (%) ± std of each method under an increasing number of malfunctioning clients. Camelyon17 – Dynamic Malfunctions Number of Malfunctioning Clients Method FedAvg AFA ASMR CFL Ditto FedProx Krum BALANCE SCCLIP LIGHTYEAR

1

2

3

4

61.5 ± 15.9 58.5 ± 16.8 61.2 ± 16.1 58.5 ± 18.2 55.0 ± 11.0 55.5 ± 8.9 61.7 ± 18.7 50.1 ± 0.4 50.0 ± 0.4 93.1 ± 6.9

68.2 ± 9.5 56.6 ± 11.5 61.7 ± 17.0 50.0 ± 0.4 50.0 ± 0.4 49.9 ± 0.4 63.6 ± 19.2 50.1 ± 0.4 50.1 ± 0.4 92.2 ± 6.0

53.6 ± 4.5 58.0 ± 9.8 50.0 ± 0.6 50.0 ± 0.4 50.0 ± 0.4 49.9 ± 0.4 61.8 ± 21.0 50.0 ± 0.4 50.0 ± 0.4 90.9 ± 8.6

50.1 ± 0.4 50.0 ± 0.4 61.3 ± 13.6 50.0 ± 0.4 50.0 ± 0.4 49.9 ± 0.4 50.1 ± 0.4 50.0 ± 0.4 50.0 ± 0.4 88.1 ± 8.5

Table 9: This table reports the results for the dynamically changing malfunction on Isic19. Average accuracy (%) ± std of each method under an increasing number of malfunctioning clients. Isic19 – ANA Number of Malfunctioning Clients Method FedAvg AFA ASMR CFL Ditto FedProx Krum BALANCE SCCLIP LIGHTYEAR

1

2

3

4

5

65.4 ± 15.8 62.3 ± 12.1 71.1 ± 15.7 70.8 ± 16.5 63.7 ± 18.5 30.6 ± 10.0 61.2 ± 20.3 20.1 ± 27.8 57.9 ± 21.9 78.0 ± 9.3

41.8 ± 12.2 61.9 ± 12.3 71.9 ± 15.0 16.3 ± 9.6 40.6 ± 9.2 16.3 ± 9.6 25.8 ± 9.4 38.2 ± 35.3 57.9 ± 21.9 78.0 ± 9.6

16.3 ± 9.6 16.3 ± 9.6 67.5 ± 12.0 16.3 ± 9.6 16.3 ± 9.6 16.3 ± 9.6 59.6 ± 22.2 38.2 ± 35.3 16.3 ± 9.6 76.7 ± 11.1

16.3 ± 9.6 16.3 ± 9.6 63.8 ± 16.3 16.3 ± 9.6 16.3 ± 9.6 16.3 ± 9.6 57.4 ± 22.4 38.2 ± 35.3 16.3 ± 9.6 76.6 ± 11.8

16.3 ± 16.3 16.3 ± 16.3 22.1 ± 13.2 16.3 ± 9.6 16.3 ± 9.6 16.3 ± 9.6 16.3 ± 9.6 38.2 ± 35.3 16.3 ± 9.6 68.3 ± 9.2

30

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION

Table 10: This table reports the results for the dynamically changing malfunction on Isic19. Average accuracy (%) ± std of each method under an increasing number of malfunctioning clients. Isic19 – SFA Number of Malfunctioning Clients Method FedAvg AFA ASMR CFL Ditto FedProx Krum BALANCE SCCLIP LIGHTYEAR

1

2

3

4

5

13.1 ± 6.9 63.6 ± 15.7 66.5 ± 15.0 68.7 ± 16.4 57.9 ± 21.9 57.9 ± 21.9 52.9 ± 12.0 22.9 ± 27.1 0.7 ± 0.9 77.5 ± 11.5

2.9 ± 2.7 63.8 ± 12.6 60.4 ± 17.7 70.2 ± 14.4 7.3 ± 8.5 7.3 ± 8.5 60.4 ± 19.5 35.5 ± 37.5 21.7 ± 30.8 78.3 ± 10.0

7.3 ± 8.5 2.0 ± 2.7 64.9 ± 16.7 68.2 ± 15.2 7.3 ± 8.5 7.3 ± 8.5 48.2 ± 15.9 38.2 ± 35.3 21.7 ± 33.3 77.1 ± 12.3

0.7 ± 0.9 57.9 ± 21.9 66.1 ± 17.4 0.7 ± 0.9 7.3 ± 8.5 7.3 ± 8.5 16.3 ± 9.6 38.2 ± 35.3 28.7 ± 32.8 75.7 ± 12.3

0.7 ± 0.4 57.9 ± 21.9 16.3 ± 9.6 16.3 ± 9.6 7.3 ± 8.5 7.3 ± 8.5 16.3 ± 9.6 38.2 ± 35.3 21.1 ± 33.3 75.4 ± 11.7

Table 11: This table reports the results for the dynamically changing malfunction on Isic19. Average accuracy (%) ± std of each method under an increasing number of malfunctioning clients. Isic19 – Random Number of Malfunctioning Clients Method FedAvg AFA ASMR CFL Ditto FedProx Krum BALANCE SCCLIP LIGHTYEAR

1

2

3

4

5

66.3 ± 14.5 62.9 ± 14.1 70.8 ± 15.3 70.7 ± 14.3 68.6 ± 17.8 67.1 ± 13.2 61.5 ± 22.1 22.9 ± 27.1 57.9 ± 21.9 72.6 ± 15.6

58.0 ± 13.5 62.0 ± 14.5 54.3 ± 19.5 44.7 ± 14.3 65.5 ± 16.1 52.1 ± 10.8 7.9 ± 1.9 38.2 ± 35.3 57.9 ± 21.9 75.1 ± 12.1

41.6 ± 8.9 37.6 ± 10.5 41.9 ± 12.7 45.9 ± 15.6 59.1 ± 17.1 44.6 ± 10.7 30.8 ± 11.1 38.2 ± 35.3 57.9 ± 21.9 71.5 ± 12.7

32.7 ± 15.2 10.8 ± 1.4 48.3 ± 19.6 7.3 ± 2.6 49.0 ± 12.3 34.0 ± 16.8 16.2 ± 2.9 38.2 ± 35.3 57.9 ± 21.9 69.2 ± 14.8

35.1 ± 16.0 3.5 ± 2.6 14.9 ± 2.6 8.3 ± 3.9 53.2 ± 13.3 40.1 ± 14.0 9.7 ± 6.5 38.2 ± 35.3 46.6 ± 32.4 72.1 ± 13.6

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION

31

Table 12: This table reports the results for the dynamically changing malfunction on Isic19. Average accuracy (%) ± std of each method under an increasing number of malfunctioning clients. Isic19 – Dyanmic Malfunctions Number of Malfunctioning Clients Method FedAvg AFA ASMR CFL Ditto FedProx Krum BALANCE SCCLIP LIGHTYEAR

1

2

3

4

5

1.8 ± 1.4 62.7 ± 13.6 70.4 ± 15.5 68.9 ± 15.8 67.1 ± 14.0 60.7 ± 18.6 58.3 ± 22.6 22.9 ± 27.1 9.2 ± 16.3 77.6 ± 12.3

57.9 ± 21.9 62.3 ± 13.3 59.0 ± 16.0 16.3 ± 9.6 60.3 ± 21.1 12.3 ± 7.6 5.5 ± 2.2 38.2 ± 35.3 14.8 ± 7.6 77.6 ± 10.6

7.3 ± 8.5 25.2 ± 10.6 16.3 ± 9.6 48.3 ± 13.7 57.9 ± 21.9 12.3 ± 7.6 38.2 ± 16.5 38.2 ± 35.3 25.7 ± 32.1 76.1 ± 11.5

7.3 ± 8.5 1.6 ± 1.4 16.3 ± 9.6 16.3 ± 9.6 57.9 ± 21.9 2.0 ± 2.7 16.3 ± 9.6 38.2 ± 35.3 31.8 ± 28.4 74.1 ± 12.5

7.3 ± 8.5 1.6 ± 9.6 16.3 ± 9.6 16.3 ± 9.6 16.3 ± 9.6 2.0 ± 2.7 17.9 ± 4.4 38.2 ± 35.3 6.9 ± 8.6 73.6 ± 9.9

Table 13: This table reports the results for the dynamically changing malfunction on the Ultrasound dataset. Average dice (%) ± std of each method under an increasing number of malfunctioning clients. Ultrasound – ANA Number of Malfunctioning Clients Method FedAvg AFA ASMR CFL Ditto FedProx Krum BALANCE SCCLIP LIGHTYEAR

1

2

3

4

82.9 ± 5.4 86.1 ± 3.4 84.3 ± 5.3 86.0 ± 3.3 0.1 ± 0.1 58.6 ± 6.7 79.4 ± 3.2 0.3 ± 0.6 0.3 ± 0.6 83.1 ± 3.5

52.3 ± 5.9 84.6 ± 3.2 0.3 ± 0.6 76.5 ± 5.3 1.0 ± 1.0 35.1 ± 9.0 82.7 ± 1.9 0.3 ± 0.6 0.3 ± 0.6 84.0 ± 3.5

3.1 ± 0.6 65.5 ± 5.0 0.3 ± 0.6 0.3 ± 0.6 0.3 ± 0.6 0.3 ± 0.6 81.1 ± 6.7 0.3 ± 0.6 0.3 ± 0.6 84.2 ± 3.5

3.1 ± 0.6 0.3 ± 0.6 0.3 ± 0.6 0.3 ± 0.6 0.3 ± 0.6 0.3 ± 0.6 77.9 ± 2.0 0.3 ± 0.6 0.3 ± 0.6 84.9 ± 3.5

32

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION

Table 14: This table reports the results for the dynamically changing malfunction on the Ultrasound dataset. Average dice (%) ± std of each method under an increasing number of malfunctioning clients. Ultrasound – SFA Number of Malfunctioning Clients Method FedAvg AFA ASMR CFL Ditto FedProx Krum BALANCE SCCLIP LIGHTYEAR

1

2

3

4

0.3 ± 0.6 85.4 ± 2.6 85.8 ± 2.7 86.6 ± 3.5 0.3 ± 0.6 0.3 ± 0.6 81.4 ± 3.9 0.3 ± 0.6 0.3 ± 0.6 83.6 ± 4.4

0.3 ± 0.6 85.2 ± 2.5 84.7 ± 3.9 83.8 ± 5.5 0.3 ± 0.6 0.3 ± 0.6 0.3 ± 0.6 0.3 ± 0.6 0.3 ± 0.6 81.8 ± 5.1

0.3 ± 0.6 0.3 ± 0.6 0.3 ± 0.6 0.3 ± 0.6 0.3 ± 0.6 0.3 ± 0.6 0.3 ± 0.6 0.3 ± 0.6 3.1 ± 3.8 82.8 ± 4.0

9.0 ± 1.2 0.3 ± 0.6 0.3 ± 0.6 0.3 ± 0.6 0.3 ± 0.6 9.0 ± 1.2 0.3 ± 0.6 0.3 ± 0.6 5.2 ± 4.4 81.3 ± 4.3

Table 15: This table reports the results for the dynamically changing malfunction on the Ultrasound dataset. Average dice (%) ± std of each method under an increasing number of malfunctioning clients. Ultrasound – Random Number of Malfunctioning Clients Method FedAvg AFA ASMR CFL Ditto FedProx Krum BALANCE SCCLIP LIGHTYEAR

1

2

3

4

0.4 ± 0.6 85.7 ± 3.1 85.9 ± 2.8 85.0 ± 4.4 0.0 ± 0.0 0.3 ± 0.6 82.1 ± 4.9 0.3 ± 0.6 0.3 ± 0.6 78.8 ± 9.8

0.3 ± 0.6 0.3 ± 0.6 84.4 ± 4.6 85.9 ± 2.9 9.1 ± 1.2 0.3 ± 0.6 0.3 ± 0.6 0.3 ± 0.6 0.3 ± 0.6 81.0 ± 4.2

0.3 ± 0.6 0.3 ± 0.6 9.0 ± 1.2 0.3 ± 0.6 9.0 ± 1.2 0.3 ± 0.6 0.3 ± 0.6 0.3 ± 0.6 0.3 ± 0.6 81.5 ± 4.3

0.3 ± 0.6 0.3 ± 0.6 9.0 ± 1.2 0.3 ± 0.6 0.0 ± 0.0 0.0 ± 0.0 0.3 ± 0.6 0.3 ± 0.6 0.3 ± 0.6 79.1 ± 7.3

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION

33

Table 16: This table reports the results for the dynamically changing malfunction on the Ultrasound dataset. Average dice (%) ± std of each method under an increasing number of malfunctioning clients. Ultrasound – Dynamic Malfunctions Number of Malfunctioning Clients Method FedAvg AFA ASMR CFL Ditto FedProx Krum BALANCE SCCLIP LIGHTYEAR

1

2

3

4

0.3 ± 0.6 85.2 ± 2.6 84.9 ± 4.7 84.5 ± 3.0 7.4 ± 1.7 0.3 ± 0.6 77.7 ± 7.1 0.3 ± 0.6 0.3 ± 0.6 82.1 ± 4.0

0.3 ± 0.6 85.3 ± 3.9 0.3 ± 0.6 80.7 ± 6.5 9.0 ± 1.2 0.3 ± 0.6 0.3 ± 0.6 0.3 ± 0.6 0.3 ± 0.6 81.9 ± 6.3

0.3 ± 0.6 0.3 ± 0.6 0.3 ± 0.6 0.3 ± 0.6 0.3 ± 0.6 0.3 ± 0.6 9.0 ± 1.2 0.3 ± 0.6 0.3 ± 0.6 77.7 ± 7.5

0.3 ± 0.6 0.0 ± 0.0 0.3 ± 0.6 0.3 ± 0.6 9.0 ± 1.2 0.3 ± 0.6 70.9 ± 1.2 0.3 ± 0.6 5.6 ± 4.7 78.6 ± 5.8

Table 17: This table reports the results for the dynamically changing malfunction on the XRay dataset. Average dice (%) ± std of each method under an increasing number of malfunctioning clients. XRay – ANA Number of Malfunctioning Clients Method FedAvg AFA ASMR CFL Ditto FedProx Krum BALANCE SCCLIP LIGHTYEAR

1

2

3

4

79.3 ± 3.4 86.8 ± 1.9 87.1 ± 1.3 85.8 ± 3.0 6.6 ± 1.9 80.1 ± 3.7 82.8 ± 3.5 39.1 ± 15.5 0.0 ± 0. 84.4 ± 1.4

39.7 ± 4.0 85.3 ± 2.3 80.3 ± 3.5 58.2 ± 5.9 0.2 ± 0.2 0.0 ± 0.0 85.5 ± 3.1 78.7 ± 3.6 0.0 ± 0.0 83.8 ± 2.5

38.8 ± 2.5 0.0 ± 0.0 0.0 ± 0.0 0.0 ± 0.0 0.0 ± 0. 0.0 ± 0.0 84.4 ± 3.0 0.0 ± 0.0 0.0 ± 0.0 83.3 ± 1.9

0.0 ± 0.0 0.0 ± 0.0 0.0 ± 0.0 0.0 ± 0.0 0.0 ± 0.0 0.0 ± 0.0 79.2 ± 3.6 67.0 ± 5.1 0.0 ± 0.0 83.4 ± 2.0

34

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION

Table 18: This table reports the results for the dynamically changing malfunction on the XRay dataset. Average dice (%) ± std of each method under an increasing number of malfunctioning clients. XRay – SFA Number of Malfunctioning Clients Method FedAvg AFA ASMR CFL Ditto FedProx Krum BALANCE SCCLIP LIGHTYEAR

1

2

3

4

0.0 ± 0.0 86.5 ± 2.0 86.8 ± 1.8 87.0 ± 1.3 0.0 ± 0.0 0.0 ± 0.0 85.0 ± 1.8 19.0 ± 11.8 0.0 ± 0.0 83.7 ± 1.3

0.0 ± 0.0 86.2 ± 2.6 85.2 ± 3.1 85.2 ± 2.9 0.0 ± 0.0 0.0 ± 0.0 80.3 ± 2.3 0.0 ± 0.0 0.0 ± 0.0 82.9 ± 1.3

34.0 ± 2.5 0.0 ± 0.0 0.0 ± 0.0 0.0 ± 0.0 0.0 ± 0.0 34.0 ± 2.5 0.0 ± 0.0 0.0 ± 0.0 14.2 ± 17.4 82.9 ± 1.1

34.0 ± 2.5 0.0 ± 0.0 0.0 ± 0.0 0.0 ± 0.0 0.0 ± 0.0 34.0 ± 2.5 0.0 ± 0.0 0.0 ± 0.0 34.0 ± 25.3 81.4 ± 1.9

Table 19: This table reports the results for the dynamically changing malfunction on the XRay dataset. Average dice (%) ± std of each method under an increasing number of malfunctioning clients. XRay – Random Number of Malfunctioning Clients Method FedAvg AFA ASMR CFL Ditto FedProx Krum BALANCE SCCLIP LIGHTYEAR

1

2

3

4

0.0 ± 0.0 85.7 ± 1.2 86.6 ± 1.7 86.4 ± 1.7 0.0 ± 0.0 0.0 ± 0.0 82.6 ± 3.9 6.4 ± 11.3 0.0 ± 0.0 83.2 ± 2.0

0.0 ± 0.0 85.9 ± 2.1 86.2 ± 2.7 84.9 ± 2.9 0.0 ± 0.0 0.0 ± 0.0 85.2 ± 2.6 0.0 ± 0.0 0.0 ± 0.0 82.1 ± 2.2

0.0 ± 0.0 0.0 ± 0.0 34.0 ± 2.5 0.0 ± 0.0 0.0 ± 0.0 0.0 ± 0.0 84.1 ± 3.6 0.0 ± 0.0 5.9 ± 11.8 80.0 ± 3.2

0.0 ± 0.0 0.0 ± 0.0 34.0 ± 2.5 0.0 ± 0.0 0.0 ± 0.0 0.0 ± 0.0 0.0 ± 0.0 0.0 ± 0.0 34.0 ± 15.3 80.3 ± 3.7

KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGATION

35

Table 20: This table reports the results for the dynamically changing malfunction on the XRay dataset. Average dice (%) ± std of each method under an increasing number of malfunctioning clients. XRay – Dynamic Malfunctions Number of Malfunctioning Clients Method FedAvg AFA ASMR CFL Ditto FedProx Krum BALANCE SCCLIP LIGHTYEAR

1

2

3

4

80.9 ± 3.5 87.4 ± 1.0 86.6 ± 1.5 86.4 ± 2.4 0.0 ± 0.0 0.0 ± 0.0 84.5 ± 2.8 27.9 ± 15.7 0.0 ± 0.0 82.7 ± 1.5

0.0 ± 0.0 85.3 ± 2.4 81.9 ± 3.0 82.5 ± 2.8 0.0 ± 0.0 0.0 ± 0.0 84.7 ± 2.5 0.7 ± 1.3 0.0 ± 0.0 82.8 ± 1.7

0.0 ± 0.0 0.0 ± 0.0 0.0 ± 0.0 0.0 ± 0.0 34.0 ± 2.5 0.0 ± 0.0 80.2 ± 3.0 0.0 ± 0.0 0.0 ± 0.0 82.6 ± 3.1

34.0 ± 2.5 0.0 ± 0.0 0.0 ± 0.0 0.0 ± 0.0 34.0 ± 2.5 0.0 ± 0.0 0.0 ± 0.0 0.0 ± 0.0 34.0 ± 2.5 81.9 ± 2.2

Table 21: This table lists the hyperparameters used for the experiments in the main paper to reproduce the results. Training Details Datasets Method

FEMNIST

Camelyon17

Isic19

Ultrasound

XRay

Loss Function Optimizer Learning Rate Weight Decay Momentum Batchsize Rounds Local Epochs

Cross Entropy Adam 1e-3 1e-4 32 12 1

Cross Entropy SGD 1e-3 5e-4 0.9 32 12 1

Weighted Focal Loss Adam 5e-4 0 32 20 1

Cross Entropy Adam 1e-3 0 8 60 1

Cross Entropy Adam 1e-3 0 4 60 1

Related documents

• Data-Free Contribution Estimation in Federated Learning using Gradient von Neumann Entropy#134520
• TAPFed: Threshold Secure Aggregation for Privacy-Preserving Federated Learning#341905
• RingSFL: An Adaptive Split Federated Learning Towards Taming Client Heterogeneity#177326
• Automating aggregation strategy selection in federated learning#2627
• FEDBUD: Joint Incentive and Privacy Optimization for Resource-Constrained Federated Learning#10317