Long-Horizon Federated Learning Exposes Trust-Boundary Drift; Held-Out Audits Preserve 98% of Gains

Summary:A long-horizon benchmark for receiver-directed federated learning tracks how each site admits, rejects, or abstains from knowledge transfers based on local evidence. The evaluation spans 13 semi-synthetic sites, 14 methods, 600 CPU rounds, and 500 rounds with Qwen3-1.7B LoRA clients. The results expose a fundamental trade-off: a gate evaluated against a fixed reference admits 29% of transfers that harm the site's current model, while a gate evaluated against the current model reduces harmful ad

---

Core Finding: Trust in Federated Learning Is Not a One-Time Admission Decision

The central difficulty in receiver-directed federated learning is not whether a site can absorb knowledge from another site, but whether that judgment remains valid after hundreds of training rounds. As the local model changes, a transfer that was previously beneficial may become harmful, while a rejected transfer may still offer useful gains. The paper therefore frames each site-level decision over a source and model component as admit, reject, or abstain, then asks whether this trust boundary remains stable over time.

The benchmark contains 13 semi-synthetic sites, an exact oracle for every evaluated transfer, paired seeds, and an attack protocol. It compares 14 methods across 600 CPU rounds and 500 rounds with Qwen3-1.7B LoRA clients. A separate common-target Qwen3 evaluation examines 60 selected transfers over 100 rounds. The results show that the problem is not simply gate accuracy: it depends on which reference state defines the boundary.

Two Trust Boundaries, Two Failure Modes

A fixed-reference gate compares each transfer with a site's starting model. Across 20 paired CPU seeds, it identifies transfers that are useful relative to the starting model, yet admits 29% of transfers that harm the model's current state. The underlying issue is non-monotonic model drift: a transfer that once reduced loss does not necessarily remain beneficial after the local parameters move.

A current-model gate compares each transfer with the site's present model. It admits only 2% of transfers that harm the current target in the CPU tier, but misses many transfers that would have benefited the starting model. Two short propositions explain the distinction. A frozen reference can treat stale knowledge as progress, while a continually changing reference makes admission decisions drift with model state and removes a stable baseline for measuring improvement.

Receiver-directed federated learning therefore cannot rely on a single gate definition that simultaneously captures initial potential and current-state safety. Production systems need to distinguish three objectives:

• Exploration value relative to the initial model;
• Marginal benefit relative to the current model;
• Deployment permission that remains valid under the accumulated training history.

Held-Out Audit: Decoupling Online Admission from Final Deployment

The paper introduces a held-out audit that leaves existing gate verdicts intact. After training, the audit uses independent data to determine whether each final model should be deployed or the site should fall back to local training. It also reports admissions that have gone stale.

Because the audit data are independent of the data used to make gate decisions, its guarantees can hold after any training history. At 600 rounds, the audit deployed 65–72% of final models. None showed negative benefit on the audit target, and the system retained 98% of the attainable gain. In these runs, no stale report had the wrong sign.

The practical architecture separates low-cost online screening from final risk control. The gate produces candidate permissions; the audit checks whether each permission remains valid after model-state drift. This is more robust than expecting an online gate to maintain a permanent certificate of trust indefinitely.

Variance-Adaptive Bound: Identifying Costly Stale Decisions

Using 20,000 audit observations, the paper derives a variance-adaptive bound that identifies 99% of stale transfers costing at least 0.01 in log loss. The 0.01 threshold is not a universal safety constant; it is a performance-loss budget that must be scaled to the objective and deployment context.

A statistical audit is more practical than a fixed hard threshold because client data volume, label noise, and heterogeneity can produce different transfer-benefit variances. Deployment policies should jointly consider:

1. A confidence lower bound on estimated benefit;
2. The maximum acceptable performance loss;
3. The cost of falling back to local training;
4. Whether the audit observations remain genuinely independent from gate training.

The guarantee is not unconditional. Shared bias, inadequate coverage, or distribution shift between audit and deployment data can invalidate it. Statistical guarantees also depend on independence and sample-size assumptions and should not be interpreted as absolute production safety.

Adversarial Settings and Baseline Behavior

With 38% adversarial sites, FedFomo and CS-Gate were the only evaluated methods with positive mean gain in every honest group. Including adversarial-site ratios is essential for model- or component-level federation, where a malicious source may selectively send locally favorable updates and bias aggregation without immediately corrupting the global model.

The benchmark nevertheless remains semi-synthetic, and the exact oracle makes it closer to controlled mechanism validation than to a full production reproduction. Real deployments also introduce privacy budgets, systems heterogeneity, communication failures, stragglers, and label shift.

Deployment Guidance

For teams experimenting with model-component transfer, federated LoRA, or cross-site parameter merging, the study offers four actionable principles:

• Define the reference model explicitly; do not conflate benefit relative to the starting model with benefit relative to the current model.
• Separate admission from auditing, use independent audit data, and bind every decision to the model version that produced it.
• Monitor harmful-admission rate, mean gain, staleness, deployment rate, and fallback cost jointly instead of optimizing accuracy alone.
• Re-test under adversarial-site ratios, client heterogeneity, and realistic network conditions; positive results in a semi-synthetic benchmark do not replace production validation.

The work does not establish a permanently valid federated trust boundary. It provides a more actionable alternative: allow trust boundaries to drift, and contain that drift through conservative online admission, independent held-out auditing, and model-level fallback.

---

Source: ArXiv Machine Learning (cs.LG) (2026-11-05)

— END —

Tags: #Federated Learning Follow #Trust Boundaries Follow #LoRA Fine-Tuning Follow #Long-Horizon Benchmarking Follow #Model Auditing Follow