Extension of single-step calibration to multi-step FedAvg

Determine how the AEGIS gradient-uniformisation calibration derived for single-step FedSGD extends to clients performing multiple local optimisation steps under multi-step FedAvg.

Background

The experiments evaluate AEGIS in a single-client, single-step FedSGD setting. The noise scales and moment calculations are calibrated for one backward pass before the masked gradient is exported.

The paper states that multi-step FedAvg may alter this calibration and leaves the extension unresolved. Establishing the appropriate calibration would be necessary for applying AEGIS to the common setting in which clients perform multiple local updates before communication.

References

Two important settings are outside the scope of AEGIS's threat model: (1)~Formally adaptive adversary: AEGIS covers the MLP-SVD adaptive extension (Channel~3) and additionally stress-tests MLP projection, LayerNorm, and untied-LM-head probes. A fully adaptive adversary that co-designs attack and model remains an open problem. (2)~FedAvg multi-step setting: all experiments use FedSGD (one gradient step per round); the calibration is derived for a single backward pass and may differ when clients accumulate gradients over multiple local steps.

— AEGIS: Attention-Embedding Gradient Isolation Shield - Triple-Channel Gradient Masking for Privacy-Preserving Federated LLM Fine-Tuning  (2608.19534 - Tao et al., 20 Aug 2026) in Section 5.1, Remark “Threat model scope”; Section 6, Conclusion