PrivateDFL: Decentralized Privacy-Preserving Learning

• PrivateDFL is a decentralized privacy-preserving learning framework that uses cumulative noise tracking to achieve formal (ε,δ)-DP guarantees with minimal noise injection.
• It employs ring-based peer-to-peer propagation and hyperdimensional computing to efficiently aggregate and refine class prototypes under adaptive differential privacy.
• Empirical evaluations on MNIST, ISOLET, and UCI-HAR demonstrate substantial gains in accuracy, reduced latency, and lower energy consumption compared to conventional DP methods.

Searching arXiv for the cited PrivateDFL paper and closely related decentralized/private federated learning work. {"query":"PrivateDFL arXiv (Piran et al., 12 Sep 2025) Privacy-Preserving Decentralized Federated Learning via Explainable Adaptive Differential Privacy", "max_results": 5} Searching arXiv for related decentralized FL privacy papers to contextualize PrivateDFL. {"query":"decentralized federated learning differential privacy explainable adaptive 2025 arXiv", "max_results": 10} PrivateDFL most specifically denotes the decentralized framework introduced in "Privacy-Preserving Decentralized Federated Learning via Explainable Adaptive Differential Privacy" (Piran et al., 12 Sep 2025). It is a server-free differentially private learning system that combines hyperdimensional computing, ring-based peer-to-peer model propagation, and an explainable privacy accountant that tracks cumulative Gaussian noise already present in the shared model. The central objective is to prevent the systematic over-noising that arises in classical “black-box” decentralized federated learning, where each participant must conservatively assume worst-case prior privacy exposure and therefore re-inject a full dose of noise at every step. In that formulation, PrivateDFL preserves formal $(\epsilon,\delta)$ guarantees while attempting to retain model utility, latency, and energy efficiency in resource-limited decentralized settings (Piran et al., 12 Sep 2025).

1. Definition and problem setting

PrivateDFL is situated in decentralized federated learning (DFL), where clients collaboratively train a model without a central server. The motivating threat model is explicit: model updates can leak data through model-inversion attacks and membership-inference attacks, and this risk compounds over many client exchanges. Differential privacy (DP) is used as the formal protection mechanism, but naïve deployment in DFL introduces a severe utility penalty because previously injected noise is not explicitly accounted for and later clients therefore add excessive additional noise (Piran et al., 12 Sep 2025).

The framework is designed to address precisely that bookkeeping failure. In the paper’s formulation, each client maintains an auditable account of the cumulative noise already injected by prior clients and prior rounds, and only adds the incremental noise necessary to meet the target privacy level. This distinguishes PrivateDFL from decentralized schemes that rely on communication sparsification or randomized exchange for obfuscation but do not claim formal $(\epsilon,\delta)$-DP. A common misconception in the area is that removing the server is itself sufficient for privacy; the surrounding literature makes clear that server-free communication and formal differential privacy are separate properties, since PaME, for example, explicitly “does not claim a formal $(\varepsilon,\delta)$-DP guarantee” and instead argues for information-theoretic obfuscation through randomized subsampling (Sha et al., 2 Mar 2026).

2. Architectural components

PrivateDFL consists of three building blocks: hyperdimensional (HD) computing, decentralized peer-to-peer updates, and explainable DP accounting (Piran et al., 12 Sep 2025).

The HD component maps each feature vector $F \in \mathbb{R}^m$ to a $D$-dimensional hypervector $H \in \mathbb{R}^D$ by

$$H_d = \cos(\langle F, B_d\rangle), \qquad B_d \sim N(0, I_m), \qquad d=1\ldots D.$$

For each class $s$, the client forms a class prototype by summing the hypervectors of local samples with that label,

$C_s = \sum_{(F^i,\mathrm{label}^i=s)} H^i.$

Inference is performed by cosine similarity,

$$s^* = \arg\max_s \frac{C_s \cdot H_{\mathrm{query}}}{\|C_s\|\|H_{\mathrm{query}}\|}.$$

When a query is misclassified, retraining applies a corrective additive update:

$(\epsilon,\delta)$0

where $(\epsilon,\delta)$1 is the true class and $(\epsilon,\delta)$2 the predicted class.

The communication pattern is ring-based. The first client constructs the class prototypes from its local data, perturbs them with Gaussian DP noise, and forwards the secure model to the next peer. Each subsequent client receives noisy prototypes, encodes its own data, merges local class information, adds only incremental DP noise, and passes the result onward. After client $(\epsilon,\delta)$3 completes round $(\epsilon,\delta)$4, the model returns to client $(\epsilon,\delta)$5 for round $(\epsilon,\delta)$6. No central server is involved (Piran et al., 12 Sep 2025).

The paper attributes two technical advantages to this representation. First, HD vectors distribute information evenly across coordinates, so small Gaussian perturbations degrade performance gracefully. Second, the additive prototype structure makes cumulative noise tracking straightforward, which is essential for the accountant.

3. Explainable adaptive differential privacy

The defining mechanism of PrivateDFL is its XAI-guided DP accountant. Before adding noise, client $(\epsilon,\delta)$7 in round $(\epsilon,\delta)$8 computes

$(\epsilon,\delta)$9

where $(\varepsilon,\delta)$0 is the total variance required to protect all $(\varepsilon,\delta)$1 samples processed so far, and $(\varepsilon,\delta)$2 is the variance already present in the received model. Only the incremental variance is injected, so that after client $(\varepsilon,\delta)$3 the total noise equals the target variance exactly (Piran et al., 12 Sep 2025).

The formal analysis is stated in standard DP terms. A randomized mechanism $(\varepsilon,\delta)$4 satisfies $(\varepsilon,\delta)$5-DP iff for adjacent datasets $(\varepsilon,\delta)$6 and measurable output set $(\varepsilon,\delta)$7,

$(\varepsilon,\delta)$8

For the Gaussian mechanism,

$(\varepsilon,\delta)$9

with

$F \in \mathbb{R}^m$0

where $F \in \mathbb{R}^m$1.

The paper gives a specialized noise schedule for decentralized HD prototypes. For the first client in the first round,

$F \in \mathbb{R}^m$2

For all $F \in \mathbb{R}^m$3 except $F \in \mathbb{R}^m$4, the unified schedule is

$F \in \mathbb{R}^m$5

By telescoping these logarithmic increments, the cumulative variance after client $F \in \mathbb{R}^m$6 in round $F \in \mathbb{R}^m$7 is

$F \in \mathbb{R}^m$8

The contrast class is “black-box” DFL, whose cumulative variance grows as

$F \in \mathbb{R}^m$9

The stated conclusion is that PrivateDFL provides the same $D$0-DP guarantee over $D$1 samples with minimal injected noise, whereas black-box DFL over-noises by an extra factorial factor (Piran et al., 12 Sep 2025).

The paper also discusses Rényi DP (RDP) as a compositional framework and notes that it can be converted back to $D$2-DP via known bounds, but the implementation described for PrivateDFL currently uses standard $D$3 Gaussian growth rather than a tighter RDP accountant.

4. Training procedure and algorithmic form

Algorithm 1 in the paper trains over $D$4 rounds and $D$5 clients. The inputs are each client’s local samples $D$6, the global privacy budget $D$7, failure probability $D$8, per-client dataset size $D$9, and HD dimension $H \in \mathbb{R}^D$0; the output is the final noisy set of class prototypes $H \in \mathbb{R}^D$1 (Piran et al., 12 Sep 2025).

At each client and round, the local samples are encoded into hypervectors, local class sums are computed, and then a noise term $H \in \mathbb{R}^D$2 is added according to the incremental schedule. The first client in the first round initializes the secure model by perturbing its local prototype sum. In later steps, the incoming noisy prototypes are either merged with local prototypes or corrected through retraining, and then “topped up” with only the additional noise required to reach the target variance.

This training rule has two consequences emphasized in the paper. First, the privacy accounting is explicit and auditable rather than implicit. Second, because the accountant matches total variance to the exact protection level required after each client update, noise accumulation follows a logarithmic schedule rather than the much larger black-box alternative (Piran et al., 12 Sep 2025).

A plausible implication is that PrivateDFL is not merely a noise-calibration method layered on a conventional neural network optimizer. Its behavior depends materially on the additive HD prototype model, the ring communication order, and the fact that retraining itself is expressed as structured prototype correction rather than full backpropagation.

5. Empirical evaluation

The empirical study uses MNIST, ISOLET, and UCI-HAR, representing image, speech, and sensor/tabular modalities, under both IID and non-IID partitions. The non-IID split assigns each client only two classes. Baselines are trained centrally with DP-SGD or RDP via Opacus and include Vision Transformer, ResNet50, GoogLeNet, AlexNet, Transformer, CNN, RNN, TCN, TabTransformer, TabNet, DNN, and DCN. The privacy budget is fixed at $H \in \mathbb{R}^D$3, $H \in \mathbb{R}^D$4 (Piran et al., 12 Sep 2025).

Dataset and setting	PrivateDFL result	Comparator highlight
MNIST non-IID	89.38% accuracy	Vision Transformer 64.47%
ISOLET non-IID	86.66% accuracy	best deep baseline $H \in \mathbb{R}^D$5
UCI-HAR non-IID	92.33% accuracy	TabTransformer 37.53%

For non-IID MNIST, the reported training time is 730.81 s for PrivateDFL versus $H \in \mathbb{R}^D$6 s for Vision Transformer, inference latency is 11.16 ms versus 838 ms, and energy consumption is 0.03 MJ versus 0.33 MJ. For ISOLET non-IID, the paper reports 79.6 s training time versus $H \in \mathbb{R}^D$7 s, latency 1.98 ms versus $H \in \mathbb{R}^D$8 ms, and energy 3.43 kJ versus $H \in \mathbb{R}^D$9 kJ. For UCI-HAR non-IID, the corresponding values are 92.95 s versus 1,007 s, 4.19 ms versus 346 ms, and 3.50 kJ versus 248 kJ (Piran et al., 12 Sep 2025).

The paper further states that across IID splits the performance gaps are similar or larger. Its interpretation is that explainable accounting and HD representation allow the method to maintain formal privacy guarantees without the utility collapse associated with repeated worst-case noise injection.

6. Position within the private federated learning literature

PrivateDFL belongs to a broader family of privacy-preserving federated and decentralized learning systems, but its combination of ring-style decentralization, HD prototypes, and cumulative-noise accounting is distinctive.

System	Core mechanism	Distinguishing feature
DPSFL / DPSFL-AC	Count sketch compression with Gaussian noise on sketch counters	Client-level DP plus communication efficiency and adaptive clipping (Zhang et al., 2024)
DP-RTFL	Local DP on clipped model-deltas with TCM, ARRP, and ZKIP	Resilience, exact rollback, and auditability in regulated settings (Talluri, 27 May 2025)
zkDFL	Groth16-based proof of correct FedAvg with on-chain verification	Verifiable inclusion and aggregation without exposing full updates on-chain (Ahmadi et al., 2023)
DPFedBank	Adaptive LDP with secure aggregation, homomorphic encryption, SMPC, and policy pillars	Finance-oriented governance, authentication, and compliance controls (He et al., 2024)
PaME	Random neighbor selection and sparse coordinate exchange	Communication reduction and obfuscation, but not formal $$H_d = \cos(\langle F, B_d\rangle), \qquad B_d \sim N(0, I_m), \qquad d=1\ldots D.$$0-DP (Sha et al., 2 Mar 2026)

This comparison clarifies several boundaries. DPSFL is federated rather than server-free decentralized and compresses clipped gradients with count sketches before adding noise (Zhang et al., 2024). DP-RTFL retains a coordinator architecture, emphasizing training continuity, precise state recovery, and hash-based commitments rather than cumulative-noise minimization (Talluri, 27 May 2025). zkDFL addresses verifiability of aggregation by combining a central prover with smart contracts and zk-SNARKs, and the paper explicitly frames future work as combining that design with differential privacy for stronger client data protection (Ahmadi et al., 2023). DPFedBank is explicitly finance-focused and policy-driven, with LDP, layered cryptography, and institutional governance mechanisms (He et al., 2024). PaME, despite being decentralized and privacy-motivated, is analytically centered on unbiased partial message exchange and linear convergence under mild assumptions rather than on DP accounting (Sha et al., 2 Mar 2026).

A common misconception is to treat these systems as interchangeable simply because they are “private DFL.” The literature instead spans different privacy notions: formal client- or record-level DP, local DP, zero-knowledge verifiability, secure aggregation, resilience protocols, and randomized obfuscation.

7. Limitations and prospective extensions

The limitations reported for PrivateDFL are specific and consequential. The current communication topology is ring-style and synchronous. Privacy budgets are uniform across clients. The framework is described as secure against inference threats, but “not yet backdoor or poisoning attacks.” The paper proposes future extensions to arbitrary and asynchronous networks, dynamic peer sets, and client churn; adaptive per-client or per-class privacy budgets guided by XAI sensitivity scores; integration of secure aggregation, lightweight homomorphic encryption, or verifiable computation; and tighter Rényi-based composition for very large numbers of rounds (Piran et al., 12 Sep 2025).

These limitations delimit the scope of the current contribution. PrivateDFL does not claim to solve adversarial robustness in general, nor does it present heterogeneous privacy accounting or topology-agnostic decentralization. Its main contribution is narrower and more technical: it demonstrates that interpretable HD representations, decentralized peer-to-peer training, and incremental Gaussian-noise accounting can be combined so that cumulative privacy protection remains formally certified while avoiding the excessive noise accumulation characteristic of black-box decentralized federated learning (Piran et al., 12 Sep 2025).