FedXDS: Federated XAI Data Sharing

Updated 5 July 2026

FedXDS is a federated learning method that selectively shares privacy-protected, attribution-filtered input regions to counter non-IID data challenges.
It integrates a warmup phase with attribution mapping (notably using LRP) and applies Gaussian noise to ensure metric differential privacy.
Experimental evaluations on CIFAR-10, CIFAR-100, and Tiny-ImageNet demonstrate improved accuracy and convergence compared to conventional federated approaches.

FedXDS, short for Federated Learning via XAI-guided Data Sharing, is a federated learning method designed to mitigate statistical heterogeneity by selectively sharing privacy-protected, attribution-filtered input regions across clients. The method uses a warmup federated model to generate attribution maps, retains only the most relevant input features, perturbs the retained representation with Gaussian noise calibrated for metric privacy, aggregates the resulting private shared data at the server, and then reuses that shared dataset during subsequent federated optimization. In the formulation introduced in 2026, FedXDS is presented as the first approach to use feature attribution methods for selective data sharing in federated learning, with the explicit goal of counteracting non-IID client distributions (Hoefler et al., 30 Jun 2026).

1. Concept, scope, and nomenclature

FedXDS addresses the canonical federated learning failure mode in which client datasets are statistically heterogeneous, so local objectives diverge and standard parameter averaging becomes less effective. The paper motivates this in terms of client drift, contradictory local updates, slower convergence, and degraded final accuracy under non-IID data. Its intervention is not primarily at the optimizer level, but at the level of what information is shared across clients: rather than exchanging raw data, full features, or generator-produced samples, it shares selectively retained, task-relevant input regions identified by explainable AI methods (Hoefler et al., 30 Jun 2026).

A central terminological point is that FedXDS is distinct from several similarly named methods. Earlier work introduced FedEx for federated hyperparameter tuning via weight-sharing (Khodak et al., 2021), FedX for unsupervised federated learning with two-sided knowledge distillation (Han et al., 2022), FedX for adaptive model decomposition and quantization in IoT federated learning (Lai et al., 17 Apr 2025), and FedX for explanation-guided pruning in remote sensing federated learning (Büyüktaş et al., 8 Aug 2025). Those methods address different problems—hyperparameter search, unsupervised representation learning, communication-efficient quantization, and pruning—and do not define FedXDS as an alias or variant.

2. Learning problem and training pipeline

The global learning objective is the standard federated empirical-risk form

$\min_\theta \frac{1}{N} \sum_{k=1}^K \sum_{i=1}^{n_k} \mathcal{L}(f_\theta(x_i^k), y_i^k),$

with client $k$ holding local dataset $\mathcal{D}_k = \{(x_i^k,y_i^k)\}_{i=1}^{n_k}$ . FedXDS modifies the training process by inserting a one-time private representation extraction stage between an initial warmup period and the main federated training phase (Hoefler et al., 30 Jun 2026).

The procedure begins with standard FedAvg warmup for $R_{\text{warmup}}$ rounds, yielding parameters $\theta_{\text{warmup}}$ . This warmup is methodologically important because attribution maps are only useful once the model has learned task structure. After warmup, each client computes attribution maps on its local samples, converts those maps into binary masks, applies the masks to inputs, privatizes the masked inputs with additive Gaussian noise, and uploads the resulting private dataset to the server. The server aggregates all such client contributions into a global shared dataset

$\mathcal{D}_g = \bigcup_{k=1}^N \mathcal{D}_k^p,$

then redistributes $\mathcal{D}_g$ to clients for the remainder of training (Hoefler et al., 30 Jun 2026).

Subsequent local optimization uses both local raw data and the shared privatized dataset. The client-side objective is

$\begin{split} \min_\theta \bigg[ &\mathbb{E}_{(\mathbf{x},y)\sim \mathcal{D}_k}[\ell(f_\theta(\mathbf{x}), y)] \ &+ \lambda \mathbb{E}_{(\mathbf{x},y)\sim \mathcal{D}_g}[\ell(f_\theta(\mathbf{x}), y)] \bigg], \end{split}$

where $\lambda$ controls the influence of the shared dataset. This design treats the global private dataset as an auxiliary source of heterogeneity-reducing supervision rather than as a replacement for local data (Hoefler et al., 30 Jun 2026).

The core technical device is attribution-based feature selection. For each local sample $\mathbf{x}\in\mathbb{R}^{H\times W\times 3}$ , a client computes an attribution map

$k$ 0

where $k$ 1 is an attribution operator. FedXDS evaluates four attribution methods: Gradient $k$ 2 Input, Integrated Gradients, SmoothGrad, and Layer-wise Relevance Propagation (LRP). The principal instantiation reported in the paper is FedXLRP, i.e. FedXDS with LRP (Hoefler et al., 30 Jun 2026).

The binary selection mask is defined by thresholding at the $k$ 3-th largest attribution value: $k$ 4 The retained representation is then

$k$ 5

so only the top-attributed input locations are preserved and all remaining coordinates are zeroed. What is shared is therefore not a latent embedding, gradient, or logit vector, but a sparsified, image-like representation derived directly from the input (Hoefler et al., 30 Jun 2026).

The paper’s interpretation is that attribution-guided masking is preferable to raw sharing, whole-image differential privacy, or random sparsification because it preferentially retains task-relevant content while suppressing irrelevant background. A notable empirical finding is that LRP consistently outperforms the other attribution methods. On CIFAR-10 at $k$ 6, LRP attained 84.74 at $k$ 7, 83.46 at $k$ 8, and 81.88 at $k$ 9, whereas Gradient, SmoothGrad, and Integrated Gradients degraded more sharply under the same sparsity changes (Hoefler et al., 30 Jun 2026). The paper attributes this to the structural coherence of LRP relevance maps, which tend to preserve contiguous object regions rather than isolated hotspots.

4. Privacy model and formal guarantees

FedXDS does not treat attribution-selected features as inherently safe to disclose. Instead, it applies a Gaussian mechanism to the masked representation: $\mathcal{D}_k = \{(x_i^k,y_i^k)\}_{i=1}^{n_k}$ 0 and constructs a private client dataset

$\mathcal{D}_k = \{(x_i^k,y_i^k)\}_{i=1}^{n_k}$ 1

The privacy framework is metric differential privacy, appropriate for continuous-valued inputs such as images. A mechanism $\mathcal{D}_k = \{(x_i^k,y_i^k)\}_{i=1}^{n_k}$ 2 is $\mathcal{D}_k = \{(x_i^k,y_i^k)\}_{i=1}^{n_k}$ 3-metric private if

$\mathcal{D}_k = \{(x_i^k,y_i^k)\}_{i=1}^{n_k}$ 4

for all $\mathcal{D}_k = \{(x_i^k,y_i^k)\}_{i=1}^{n_k}$ 5 and measurable $\mathcal{D}_k = \{(x_i^k,y_i^k)\}_{i=1}^{n_k}$ 6, with $\mathcal{D}_k = \{(x_i^k,y_i^k)\}_{i=1}^{n_k}$ 7 in the paper’s setting (Hoefler et al., 30 Jun 2026).

The sensitivity is defined as

$\mathcal{D}_k = \{(x_i^k,y_i^k)\}_{i=1}^{n_k}$ 8

and the Gaussian noise level is calibrated via

$\mathcal{D}_k = \{(x_i^k,y_i^k)\}_{i=1}^{n_k}$ 9

A key analytical point is that the masking map is non-expansive: $R_{\text{warmup}}$ 0 hence $R_{\text{warmup}}$ 1. The paper is explicit, however, that this does not imply a strictly better worst-case sensitivity constant than the identity map. The practical advantage instead comes from selective disclosure: only a fraction of coordinates remain exposed, and privacy noise is concentrated on those retained coordinates rather than spread over the full image (Hoefler et al., 30 Jun 2026).

The privacy claims are supported both formally and empirically. The paper reports robustness against membership inference attacks and feature inversion attacks, with lower attack effectiveness for masked-and-noised representations than for non-masked differentially private features under the same privacy budget. It also notes that inversion becomes easier when sparsity is lower or $R_{\text{warmup}}$ 2 is larger, which is consistent with the expected privacy–utility tradeoff (Hoefler et al., 30 Jun 2026).

5. Experimental evaluation

The reported evaluation covers CIFAR-10, CIFAR-100, Tiny-ImageNet, CelebA, and FEMNIST using ResNet8, SGD, momentum $R_{\text{warmup}}$ 3, learning rate $R_{\text{warmup}}$ 4, 200 communication rounds, and Dirichlet heterogeneity levels $R_{\text{warmup}}$ 5 for the standard benchmarks. The default FedXDS hyperparameters are $R_{\text{warmup}}$ 6, sparsity $R_{\text{warmup}}$ 7, and $R_{\text{warmup}}$ 8. Client regimes include 10 clients with participation rate 0.5 and 100 clients with participation rate 0.1 (Hoefler et al., 30 Jun 2026).

The strongest variant is consistently FedXLRP. On CIFAR-10, it reaches 81.72 for $R_{\text{warmup}}$ 9, 83.46 for $\theta_{\text{warmup}}$ 0, 77.02 for $\theta_{\text{warmup}}$ 1, and 80.27 for $\theta_{\text{warmup}}$ 2. On CIFAR-100, it achieves 52.07, 58.09, 46.25, and 52.63 in the corresponding settings. On Tiny-ImageNet, it reaches 36.85, 38.64, 34.64, and 33.18. On real-world federated datasets, the paper reports 91.55 on CelebA and 89.03 on FEMNIST (Hoefler et al., 30 Jun 2026).

The convergence behavior is also emphasized. FedXLRP reaches target accuracies in markedly fewer rounds than conventional federated baselines. On CIFAR-10 with $\theta_{\text{warmup}}$ 3, it reaches 70% in 14 rounds, compared with 15 for FedFed, 28 for FedFTG, and 49 for FedAvg. On CIFAR-100 with $\theta_{\text{warmup}}$ 4, it reaches 40% in 11 rounds, versus 13 for FedFed and 24 for FedAvg. On Tiny-ImageNet with $\theta_{\text{warmup}}$ 5, it reaches 35% in 10 rounds, versus 12 for FedFed and 60 for FedAvg (Hoefler et al., 30 Jun 2026).

FedXDS is also evaluated as a plug-in for existing FL optimizers. On CIFAR-10, the paper reports 72.90 $\theta_{\text{warmup}}$ 6 83.46 for FedAvg, 74.31 $\theta_{\text{warmup}}$ 7 84.05 for FedProx, 70.62 $\theta_{\text{warmup}}$ 8 84.20 for FedDyn, and 71.35 $\theta_{\text{warmup}}$ 9 83.89 for SCAFFOLD when FedXDS is added. This suggests that the selective-sharing mechanism is complementary to optimizer-side heterogeneity corrections (Hoefler et al., 30 Jun 2026).

6. Interpretation, limitations, and relation to adjacent research

FedXDS is best understood as a data-interface intervention for federated learning under heterogeneity. Optimization-oriented methods such as FedProx, SCAFFOLD, FedDyn, FedSAM, and FedDISCO act on gradient dynamics or update regularization, whereas FedXDS attempts to reduce objective mismatch by exposing each client to a globally aggregated, privacy-protected auxiliary dataset composed of attribution-selected input regions (Hoefler et al., 30 Jun 2026). This makes it closer in spirit to data-sharing or distillation-based methods such as FedFed, FedFTG, FedGen, FedAux, and FedDF, but without introducing a generative model into the loop.

Several limitations are explicit. The empirical validation is confined to image classification. The shared objects are noised masked inputs plus labels, so the privacy guarantee applies to the sharing mechanism rather than to every possible leakage channel in the full FL stack. The formal bound $\mathcal{D}_g = \bigcup_{k=1}^N \mathcal{D}_k^p,$ 0 is useful for privacy calibration but does not by itself establish stronger worst-case sensitivity than full-input release. Performance improvements are not uniform in every setting: FedFed remains competitive on some CIFAR-100 and Tiny-ImageNet configurations, and on Tiny-ImageNet with $\mathcal{D}_g = \bigcup_{k=1}^N \mathcal{D}_k^p,$ 1, FedFed slightly exceeds FedXLRP (Hoefler et al., 30 Jun 2026).

A common misconception is to treat FedXDS as simply another member of the pre-existing FedX/FedEx family of methods. That is inaccurate. FedXDS is neither a federated hyperparameter tuner, nor an unsupervised knowledge-distillation framework, nor a pruning system, nor an adaptive quantization architecture. Its defining contribution is the use of XAI attributions as a mechanism for selective, privacy-aware data sharing under federated statistical heterogeneity (Khodak et al., 2021, Han et al., 2022, Lai et al., 17 Apr 2025, Büyüktaş et al., 8 Aug 2025, Hoefler et al., 30 Jun 2026).