FedIF: Federated Influence-Based Aggregation

• FedIF is an adaptive aggregation framework for federated learning that uses lightweight trajectory-based influence estimation instead of Shapley-value reweighting.
• It quantifies client contributions by normalizing and smoothing directional influence scores derived from local updates and a public validation set.
• FedIF delivers up to 450× faster aggregation while maintaining robust performance under noisy, non-IID, and adversarial client conditions.

Searching arXiv for the cited FedIF paper and closely related federated learning papers to ground the article. FedIF, short for Federated Influence-based aggregation, is an adaptive model-averaging strategy for federated learning that uses lightweight, trajectory-based influence estimation in lieu of expensive Shapley-value reweighting (Tang et al., 29 Sep 2025). It is designed for federated settings in which non-IID data distributions and adversarial client behavior create persistent robustness challenges. The method quantifies each client’s utility to the global model through normalized and smoothed influence scores derived from client updates and a public validation set, and then uses those scores as aggregation weights. Within the reported formulation, FedIF is presented as a practical, theoretically grounded, and scalable alternative to Shapley-value-based contribution evaluation, with robustness under label noise, gradient noise, and adversarial samples.

1. Definition and intended function

FedIF is defined as an adaptive aggregation framework for federated learning whose central objective is contribution evaluation. The method replaces repeated model reweighting and inference, which characterize state-of-the-art Shapley-value-based approaches, with a trajectory-based estimate of influence. Its stated objectives are fourfold: to quantify each client’s contribution to the global model via a single dot-product of its local update and a public validation gradient; to normalize and smooth these scores across rounds so that they are stable and comparable; to use the resulting influence scores as aggregation weights so that benign or high-quality clients receive higher weight while adversarial or noisy clients receive lower weight; and to avoid the computational burden of Shapley-style aggregation, yielding up to $450\times$ lower aggregation overhead (Tang et al., 29 Sep 2025).

The framework is motivated by a specific weakness of robust federated learning. In the presence of non-IID local datasets, label corruption, noisy gradients, or poisoned samples, uniform or weakly adaptive averaging can amplify harmful updates. FedIF addresses this by treating aggregation as a valuation problem: each client update is not merely averaged, but evaluated for its alignment with a validation gradient computed on a public validation set. This suggests a design in which aggregation is driven by directional usefulness to the validation objective rather than by client identity or update magnitude alone.

2. Aggregation mechanics

The FedIF procedure is organized round by round. The input consists of $K$ clients, a validation set $D'$, global epochs $T$, local epochs $E$, batch size $B$, stepsize $\eta$, client participation fraction $C$, and smoothing rate $\gamma$. The model is initialized as $w_0$, and the global influence scores satisfy $K$0 for all clients $K$1 (Tang et al., 29 Sep 2025).

At round $K$2, the method first samples $K$3 clients to form $K$4. Each participating client computes a local model $K$5 by training from the previous global model $K$6. FedIF then evaluates a round influence signal against a validation gradient

$K$7

For each $K$8, the local update is

$K$9

and the round influence used in the pseudocode is

$D'$0

These round scores are then normalized within the participating set by min–max scaling. Let $D'$1 and $D'$2. FedIF computes

$D'$3

The global influence score is updated by exponential smoothing:

$D'$4

Finally, the aggregation weight is

$D'$5

and the new global model is formed by

$D'$6

Two design choices are structurally central. Local weight normalization makes the influence measure depend on direction rather than scale, so that large but noisy updates do not dominate simply by magnitude. Influence smoothing reduces round-to-round oscillation, particularly when client participation is intermittent. In the paper’s framing, these steps turn a volatile per-round alignment score into a stable longitudinal estimate of client contribution (Tang et al., 29 Sep 2025).

3. Influence formulation and theoretical analysis

FedIF grounds its contribution estimate in a TracIn-style approximation. The paper starts from the influence of dataset $D'$7 on a validation set $D'$8 over $D'$9 epochs:

$T$0

At round $T$1, the raw round influence is

$T$2

Local weight normalization yields

$T$3

and round-wise min–max normalization gives

$T$4

The smoothed score $T$5 then serves as the long-horizon valuation signal (Tang et al., 29 Sep 2025).

The theoretical analysis is developed under three assumptions. Assumption 1 is $T$6-Lipschitz smoothness:

$T$7

Assumption 2 is bounded local dissimilarity:

$T$8

Assumption 3 is a noisy client update model:

$T$9

where $E$0 captures adversarial or noisy updates.

Under these conditions, Theorem 1 gives the one-step global loss bound

$E$1

The proof sketch proceeds through a smoothness upper bound based on Taylor expansion, bounds the model-difference term by Jensen’s and Young’s inequalities, and substitutes the noisy-gradient decomposition. The crucial interpretation given in the paper is that, because $E$2 is inversely related to $E$3 for large noise, the last term is down-weighted, which yields a tighter bound than uniform-weight FedAvg under adversarial noise (Tang et al., 29 Sep 2025).

4. Experimental configuration and quantitative results

The reported experiments use CIFAR-10, with $E$4 training and $E$5 test samples, and Fashion-MNIST, with $E$6 samples. In each case, $E$7 of the test data is held out as a public validation set. There are $E$8 clients, partitioned non-IID via a Dirichlet$E$9 split. The client fraction is $B$0, local epochs are $B$1, batch size is $B$2, and local optimization uses SGD with $B$3 and momentum $B$4 (Tang et al., 29 Sep 2025).

The robustness evaluation considers three vulnerable scenarios. In the label-noise setting, clients experience random label flips with varying noisy-client fraction $B$5 and per-client flip ratio. In the gradient-noise setting, clients add Gaussian noise $B$6 to their updates. In the adversarial-sample setting, local training uses PGD-perturbed inputs with $B$7, $B$8, and $B$9 iterations.

Tables 1 and 2 compare FedIF against FedAvg, FedProx, Krum, and AFedSV, where AFedSV is an adaptive Shapley-value aggregation. The paper states that each entry is test accuracy under clean, label-noise, and adversarial settings, and that FedIF matches or slightly exceeds AFedSV in most noise levels. In the CIFAR-10 excerpt, FedIF attains $\eta$0 in the clean setting versus $\eta$1 for AFedSV and $\eta$2 for FedAvg. Under label noise with $\eta$3 noisy clients and setting $\eta$4, the corresponding accuracies are $\eta$5, $\eta$6, and $\eta$7. Under label noise with $\eta$8 noisy clients and setting $\eta$9, the values are $C$0, $C$1, and $C$2. In the adversarial-sample benchmark with $C$3 noisy clients and setting $C$4, FedIF records $C$5, AFedSV $C$6, and FedAvg $C$7 (Tang et al., 29 Sep 2025).

A distinct claim concerns aggregation-time overhead. The mean aggregation time per round on CIFAR-10 is reported as $C$8 seconds for AFedSV and $C$9 seconds for FedIF; on Fashion-MNIST it is $\gamma$0 seconds for AFedSV and $\gamma$1 seconds for FedIF. This is summarized as an aggregation speedup of approximately $\gamma$2, while maintaining robustness comparable to or exceeding Shapley-value-based methods (Tang et al., 29 Sep 2025).

5. Ablation results, design interpretation, and limitations

The ablation study evaluates three components on CIFAR-10: WN for weight normalization, RN for round normalization, and SU for smoothing update. The reported findings are direct. WN is critical under gradient noise. RN improves label-noise detection. SU stabilizes against adversarial oscillations (Tang et al., 29 Sep 2025).

The tabulated results make those roles concrete. With only WN enabled, the model reaches $\gamma$3 on clean data, $\gamma$4 under label noise, $\gamma$5 under gradient noise, and $\gamma$6 with adversarial samples. With only RN enabled, the corresponding values are $\gamma$7, $\gamma$8, $\gamma$9, and $w_0$0. With WN and RN but no SU, the clean accuracy is $w_0$1, the label-noise accuracy is $w_0$2, the gradient-noise accuracy is $w_0$3, and the adversarial-sample accuracy is $w_0$4. With only SU enabled, the values are $w_0$5, $w_0$6, $w_0$7, and $w_0$8. The full configuration with WN, RN, and SU yields $w_0$9, $K$00, $K$01, and $K$02, respectively.

These results are interpreted in the paper as evidence that local weight normalization and influence smoothing are not merely heuristic refinements but operationally important parts of the framework. Local weight normalization prevents large but noisy updates from dominating by scale, whereas smoothing provides more stable aggregation weights and improves convergence and robustness. At the same time, the paper notes a limitation: FedIF relies on directional influence and can be fooled by adversarial samples whose update direction aligns with the validation gradient. A plausible implication is that the method is robust to several common perturbation modes without constituting a universal defense against adaptive attacks that explicitly target the validation-alignment criterion (Tang et al., 29 Sep 2025).

6. Position within adjacent federated-learning research

FedIF belongs to a broader line of federated methods that address heterogeneity through structure beyond plain averaging, but it does so through contribution evaluation rather than representation learning. This distinguishes it from "FedCiR" (Li et al., 2023), which addresses feature shift by learning informative and client-invariant representations. FedCiR develops a generalization error bound in which the global risk is upper-bounded by the sum of local risks and a representation-distribution gap term, then minimizes a mutual-information objective that improves $K$03 while diminishing $K$04. Its server-side data-free mechanism approximates the global representation distribution without compromising privacy. The comparison suggests that FedCiR primarily modifies feature learning under non-IID features, whereas FedIF primarily modifies aggregation under noisy or adversarial client updates.

A second nearby acronym is "FedIFL" (Wang et al., 12 May 2025), which denotes Federated Invariant Features Learning rather than influence-based aggregation. FedIFL is proposed for federated cross-domain diagnosis of motor-driven systems with inconsistent fault modes. Its core challenge is inconsistent label spaces across clients, and its solution combines intra-client prototype contrastive learning, feature generation, and cross-client feature disentanglement with instance consistency, personalization, and orthogonality losses. In that framework, the cloud still averages feature-extractor parameters in a FedAvg style, while global classifiers are kept separate for majority voting. This contrast is methodologically significant: FedIF targets data valuation and aggregation weighting in generic federated learning, whereas FedIFL targets invariant feature extraction and label-space inconsistency in a specific diagnostic domain.

Taken together, these distinctions place FedIF in the part of the federated-learning literature concerned with robust aggregation, client contribution evaluation, and computational scalability. Its defining characteristic is not privacy preservation alone, which it shares with standard federated protocols, but the use of normalized and smoothed trajectory-based influence scores as a lightweight replacement for Shapley-value-based aggregation in real-world cross-device and cross-silo deployments (Tang et al., 29 Sep 2025).