Fisher-guided personalized federated learning using efficient packed homomorphic aggregation

Artificial intelligence systems are increasingly trained on data that never leaves the devices where it is created—hospital servers holding sensitive patient scans, smartphones carrying private photos, and industrial sensors capturing proprietary information. This approach, known as federated learning, promises collaboration without exposure: a central server coordinates a shared model while each participant keeps its raw data at home. But researchers have long known that the guarantee is weaker than it sounds. An “honest-but-curious” server that inspects the model updates flowing toward it can often reconstruct glimpses of the underlying private data. A new study published in Complex & Intelligent Systems tackles this privacy gap head-on, presenting a framework called FedFIHE that pairs a mathematically principled method for deciding what to share with an encryption scheme efficient enough to run in practice.

The work, led by Zijian Yao of Hangzhou Normal University together with collaborators at Westlake University, including Qiqi Liu and corresponding author Xiumei Li, addresses a tension that has stymied privacy-preserving federated learning for years. Personalized federated learning, or PFL, allows each client to adapt a model to its own local data distribution—for example, a hospital whose patients differ demographically from those of every other hospital. Typical PFL methods split the model into two parts: a subset of parameters that is sent to the server for global aggregation, and the rest that stays local for personalization. The trouble is that the choice of what to share is usually made heuristically, and the shared portion can still leak private information. Moreover, if one tries to hide the shared parameters using homomorphic encryption—a cryptographic technique that allows computation directly on encrypted values—the communication and computation costs can balloon to the point of being unusable, particularly when different clients choose to share different parts of the model.

FedFIHE attacks both problems simultaneously, and the first half of its solution draws on a classical concept from information theory and statistical learning: Fisher information. The Fisher information matrix measures how sensitive a model’s likelihood is to changes in each of its parameters. In practical terms, a parameter with high Fisher information is one the model relies on heavily to fit the data; disturbing it would sharply change performance. Conversely, parameters with low Fisher information contribute less to the model’s fit on any particular client’s data. The researchers exploit this by having each client compute Fisher-information scores across its network and use them to adaptively partition the model. Parameters deemed most informative in a global sense become candidates for sharing and aggregation, while the remainder are retained locally for personalization. Because the partitioning is guided by the data’s actual statistical structure rather than arbitrary rules, the shared subset tends to carry the generalizable knowledge that benefits all clients while the private, idiosyncratic details stay behind.

This Fisher-guided partitioning does more than improve accuracy under heterogeneous data—it also reduces the surface area for privacy attacks. Since the parameters most strongly tied to any individual client’s private data distribution are preferentially kept local, an inquisitive server sees a filtered version of each model that carries less identifying signal. The team reports that this design effectively mitigates privacy leakage compared with approaches in which clients share large or arbitrarily chosen portions of their models, while still delivering personalized performance that is better than or comparable to strong baseline methods.

The second half of the framework confronts the encryption bottleneck directly. Homomorphic encryption schemes, such as the lattice-based methods commonly used in privacy-preserving machine learning, allow a server to add ciphertexts together—which is exactly what federated averaging requires—without ever decrypting them. The catch is that encrypted values are bulky and expensive to process. If clients could agree on a single shared set of parameters, encrypting just that subset would be manageable. But in personalized federated learning, each client’s Fisher-guided selection may differ, and the union of many clients’ selections can approach the whole model. Naively, the server would have to encrypt and aggregate nearly everything, destroying the efficiency gains the partitioning was supposed to provide.

FedFIHE’s answer is a packet-level selective encrypted aggregation scheme with a clever twist of voting. Each client first packs its model parameters into fixed-size packets—containers that bundle many individual weights together. The client then applies a binary mask indicating which packets contain parameters selected for sharing, ranks the packets, and uploads only the top-κ packets by its selection score, along with those binary masks. When the packets arrive, the server performs what the authors call mask voting: it tallies, across all clients, which packet positions were most frequently selected. Only those consensus positions—the packets that a sufficient number of clients chose—are aggregated in ciphertext and broadcast back. The rest are simply never touched by the encrypted pipeline.

The elegance of this design lies in how it handles disagreement. In previous selective-sharing approaches, inconsistent sparse selections across clients meant that the union of selected positions grew with the number of participants, and the server’s encrypted workload grew with it. Mask voting caps this cost by construction: no matter how differently the clients choose, only the most popular packet positions enter the encrypted aggregation, so the server’s workload stays bounded and predictable. The binary masks themselves are lightweight to transmit, and packing many parameters per packet amortizes the overhead of ciphertext expansion over hundreds or thousands of individual weights. The result, according to the authors, is encrypted training that remains efficient even under high sparsity—situations where clients share only a small fraction of their model—precisely the regime where naive schemes become prohibitively expensive.

The research team validated FedFIHE through extensive experiments on both natural image benchmarks and medical datasets, a deliberate choice reflecting the framework’s target use cases. Healthcare is arguably the most compelling arena for federated learning: hospitals cannot pool patient records, yet diagnostic models would benefit enormously from learning across institutions. The medical data experiments showed that FedFIHE preserves its privacy and efficiency advantages on realistic clinical distributions, where data heterogeneity between clients is typically severe. Across the evaluation suite, the method mitigated privacy leakage while achieving personalized accuracy that matched or exceeded strong baselines, and it retained its robustness even when the degree of selective sharing was pushed to high sparsity levels.

The significance of the work extends beyond any single benchmark. Federated learning has been deployed at scale by major technology companies for mobile keyboard prediction and other on-device applications, and national health initiatives have explored cross-institutional model training for rare-disease detection. In all of these settings, the honest-but-curious threat model is not hypothetical: gradient-inversion attacks have demonstrated that raw training data can sometimes be reconstructed from shared updates with startling fidelity. Privacy researchers have responded with a toolbox of defenses—differential privacy adds calibrated noise, secure multi-party computation distributes trust, and homomorphic encryption hides values entirely—but each carries costs in accuracy, coordination complexity, or computational overhead. FedFIHE’s contribution is to show that a statistically principled sharing policy can shrink the encrypted workload enough to make homomorphic encryption practical for personalized models, rather than treating privacy and utility as a simple trade-off.

The technical machinery is worth appreciating in its own right. Fisher information has historically served as the foundation for natural gradient optimization and for understanding which weights matter most when pruning neural networks. Repurposing it as a privacy-aware routing mechanism—deciding which parameters travel to the server and which stay home—is a novel application of a decades-old tool. Meanwhile, the mask-voting protocol echoes ideas from consensus systems: instead of forcing clients to agree in advance on what to share, the system tolerates disagreement and resolves it after the fact, cheaply, in the clear. Only the agreed-upon ciphertext positions incur the heavy cost of homomorphic computation. The combination means the strongest cryptographic protection is applied where the most clients have converged, and the sparser, more personal corners of each model remain local by design.

The authors are candid that the framework is aimed at privacy-sensitive applications such as healthcare, and the experimental evidence on medical datasets supports that positioning. Because FedFIHE is compatible with heterogeneous data—each client personalizes its own model after receiving the aggregated global portion—it does not require the unrealistic assumption that all participants draw from the same distribution. That flexibility, combined with bounded communication costs, makes the approach a candidate for real deployments where hospitals, research consortia, or mobile networks must cooperate without exposing patient or user data to the coordinating server.

The study was supported in part by the China-Croatia bilateral science and technology cooperation project, the Hangzhou Joint Fund of the Zhejiang Provincial Natural Science Foundation of China, and the Xinmiao Talent Program of Zhejiang Province. Published open access, the research is available to any institution weighing whether privacy-preserving collaborative learning is ready to leave the laboratory. For a field that has spent a decade watching the gap between cryptographic promises and practical constraints, FedFIHE offers evidence that the gap can be narrowed—parameter by parameter, packet by packet, and vote by vote.