The work, led by Zijian Yao of Hangzhou Normal University together with collaborators at Westlake University, including Qiqi Liu and corresponding author Xiumei Li, addresses a tension that has stymied privacy-preserving federated learning for years. Personalized federated learning, or PFL, allows each client to adapt a model to its own local data distribution—for example, a hospital whose patients differ demographically from those of every other hospital. Typical PFL methods split the model into two parts: a subset of parameters that is sent to the server for global aggregation, and the rest that stays local for personalization. The trouble is that the choice of what to share is usually made heuristically, and the shared portion can still leak private information. Moreover, if one tries to hide the shared parameters using homomorphic encryption—a cryptographic technique that allows computation directly on encrypted values—the communication and computation costs can balloon to the point of being unusable, particularly when different clients choose to share different parts of the model.

FedFIHE attacks both problems simultaneously, and the first half of its solution draws on a classical concept from information theory and statistical learning: Fisher information. The Fisher information matrix measures how sensitive a model’s likelihood is to changes in each of its parameters. In practical terms, a parameter with high Fisher information is one the model relies on heavily to fit the data; disturbing it would sharply change performance. Conversely, parameters with low Fisher information contribute less to the model’s fit on any particular client’s data. The researchers exploit this by having each client compute Fisher-information scores across its network and use them to adaptively partition the model. Parameters deemed most informative in a global sense become candidates for sharing and aggregation, while the remainder are retained locally for personalization. Because the partitioning is guided by the data’s actual statistical structure rather than arbitrary rules, the shared subset tends to carry the generalizable knowledge that benefits all clients while the private, idiosyncratic details stay behind.

This Fisher-guided partitioning does more than improve accuracy under heterogeneous data—it also reduces the surface area for privacy attacks. Since the parameters most strongly tied to any individual client’s private data distribution are preferentially kept local, an inquisitive server sees a filtered version of each model that carries less identifying signal. The team reports that this design effectively mitigates privacy leakage compared with approaches in which clients share large or arbitrarily chosen portions of their models, while still delivering personalized performance that is better than or comparable to strong baseline methods.

The second half of the framework confronts the encryption bottleneck directly. Homomorphic encryption schemes, such as the lattice-based methods commonly used in privacy-preserving machine learning, allow a server to add ciphertexts together—which is exactly what federated averaging requires—without ever decrypting them. The catch is that encrypted values are bulky and expensive to process. If clients could agree on a single shared set of parameters, encrypting just that subset would be manageable. But in personalized federated learning, each client’s Fisher-guided selection may differ, and the union of many clients’ selections can approach the whole model. Naively, the server would have to encrypt and aggregate nearly everything, destroying the efficiency gains the partitioning was supposed to provide.

FedFIHE’s answer is a packet-level selective encrypted aggregation scheme with a clever twist of voting. Each client first packs its model parameters into fixed-size packets—containers that bundle many individual weights together. The client then applies a binary mask indicating which packets contain parameters selected for sharing, ranks the packets, and uploads only the top-κ packets by its selection score, along with those binary masks. When the packets arrive, the server performs what the authors call mask voting: it tallies, across all clients, which packet positions were most frequently selected. Only those consensus positions—the packets that a sufficient number of clients chose—are aggregated in ciphertext and broadcast back. The rest are simply never touched by the encrypted pipeline.

The elegance of this design lies in how it handles disagreement. In previous selective-sharing approaches, inconsistent sparse selections across clients meant that the union of selected positions grew with the number of participants, and the server’s encrypted workload grew with it. Mask voting caps this cost by construction: no matter how differently the clients choose, only the most popular packet positions enter the encrypted aggregation, so the server’s workload stays bounded and predictable. The binary masks themselves are lightweight to transmit, and packing many parameters per packet amortizes the overhead of ciphertext expansion over hundreds or thousands of individual weights. The result, according to the authors, is encrypted training that remains efficient even under high sparsity—situations where clients share only a small fraction of their model—precisely the regime where naive schemes become prohibitively expensive.

The research team validated FedFIHE through extensive experiments on both natural image benchmarks and medical datasets, a deliberate choice reflecting the framework’s target use cases. Healthcare is arguably the most compelling arena for federated learning: hospitals cannot pool patient records, yet diagnostic models would benefit enormously from learning across institutions. The medical data experiments showed that FedFIHE preserves its privacy and efficiency advantages on realistic clinical distributions, where data heterogeneity between clients is typically severe. Across the evaluation suite, the method mitigated privacy leakage while achieving personalized accuracy that matched or exceeded strong baselines, and it retained its robustness even when the degree of selective sharing was pushed to high sparsity levels.

The significance of the work extends beyond any single benchmark. Federated learning has been deployed at scale by major technology companies for mobile keyboard prediction and other on-device applications, and national health initiatives have explored cross-institutional model training for rare-disease detection. In all of these settings, the honest-but-curious threat model is not hypothetical: gradient-inversion attacks have demonstrated that raw training data can sometimes be reconstructed from shared updates with startling fidelity. Privacy researchers have responded with a toolbox of defenses—differential privacy adds calibrated noise, secure multi-party computation distributes trust, and homomorphic encryption hides values entirely—but each carries costs in accuracy, coordination complexity, or computational overhead. FedFIHE’s contribution is to show that a statistically principled sharing policy can shrink the encrypted workload enough to make homomorphic encryption practical for personalized models, rather than treating privacy and utility as a simple trade-off.

The technical machinery is worth appreciating in its own right. Fisher information has historically served as the foundation for natural gradient optimization and for understanding which weights matter most when pruning neural networks. Repurposing it as a privacy-aware routing mechanism—deciding which parameters travel to the server and which stay home—is a novel application of a decades-old tool. Meanwhile, the mask-voting protocol echoes ideas from consensus systems: instead of forcing clients to agree in advance on what to share, the system tolerates disagreement and resolves it after the fact, cheaply, in the clear. Only the agreed-upon ciphertext positions incur the heavy cost of homomorphic computation. The combination means the strongest cryptographic protection is applied where the most clients have converged, and the sparser, more personal corners of each model remain local by design.

The authors are candid that the framework is aimed at privacy-sensitive applications such as healthcare, and the experimental evidence on medical datasets supports that positioning. Because FedFIHE is compatible with heterogeneous data—each client personalizes its own model after receiving the aggregated global portion—it does not require the unrealistic assumption that all participants draw from the same distribution. That flexibility, combined with bounded communication costs, makes the approach a candidate for real deployments where hospitals, research consortia, or mobile networks must cooperate without exposing patient or user data to the coordinating server.

The study was supported in part by the China-Croatia bilateral science and technology cooperation project, the Hangzhou Joint Fund of the Zhejiang Provincial Natural Science Foundation of China, and the Xinmiao Talent Program of Zhejiang Province. Published open access, the research is available to any institution weighing whether privacy-preserving collaborative learning is ready to leave the laboratory. For a field that has spent a decade watching the gap between cryptographic promises and practical constraints, FedFIHE offers evidence that the gap can be narrowed—parameter by parameter, packet by packet, and vote by vote.

The work, by Jaehyung Lim, Wonbin Kweon, Woojoo Kim, Junyoung Kim, Dongha Kim, and Hwanjo Yu, introduces FedRKG, short for Federated Recommendation with Regularized Knowledge Guidance. The framework is model-agnostic, meaning it can wrap around existing federated recommendation architectures rather than requiring a new model design. Its central claim, backed by both empirical analysis and a formal argument, is that user-specific item representations can form naturally when clients are allowed to train locally for long stretches of time, and that global knowledge should then be injected softly and intermittently rather than written over the local model.

Federated recommendation, or FedRec, emerged from federated learning, the training paradigm introduced by McMahan and colleagues in which a server coordinates models trained on distributed devices without collecting raw data. Privacy regulations such as the GDPR and CCPA have made this approach attractive for services that rely on sensitive behavioral records. But recommendation differs from generic federated tasks in an important way: the same item can mean different things to different users, and each client's interaction history is heavily non-IID. A single shared item embedding table, the kind a centralized matrix factorization model learns, forces one representation to reconcile conflicting preference signals across the whole population.

Early FedRec systems simply ported centralized models like matrix factorization and neural collaborative filtering into the federated setting. Later work split into two camps. Single-knowledge methods keep one persistent item embedding per client and try to add personalization through server-side machinery—user-relation graphs, preference-based grouping, item-similarity exchange, or personalized aggregation schemes. Dual-knowledge methods instead maintain separate local and global item representations on each device, doubling the item-embedding parameters from md to 2md, where m is the number of items and d the embedding dimension, and incurring further overhead when the split is implemented at the module level, as in variational autoencoder architectures. The authors note that both camps carry costs: server-side relational signals can indirectly reveal how clients or items are related, while persistent dual representations burden resource-constrained devices.

What neither camp examined closely, the team argues, is the local optimization horizon itself—how many rounds a client trains before the server intervenes. In most prior FedRec studies, synchronization happens after only one, two, or ten local rounds. The researchers' motivational experiments, run on the Amazon-Video and LastFM-2K benchmarks with a federated matrix factorization backbone, show why this matters. As the synchronization interval grows, hit rate at rank ten improves during local training, indicating that client-side item embeddings gradually capture user-specific preference structures. But abrupt performance drops appear around synchronization rounds: replacing locally optimized embeddings with the server's global model destroys the personalization that has accumulated.

Visualization made the point concrete. Using t-SNE projections of item embeddings for individual LastFM-2K users, the authors compared frequent synchronization with an interval of one round against a longer horizon of fifty rounds. Under frequent synchronization, a user's interacted items were scattered and hard to distinguish from non-interacted ones; with the longer horizon, interacted items formed compact, separable clusters. Personalized structure, in other words, is something local training can build on its own—no server-side graph construction required.

A second set of experiments compared four synchronization strategies: full replacement with frequent aggregation, full replacement with intermittent aggregation, purely local training, and knowledge guidance. Full replacement performed poorly under both schedules, confirming that overwriting local embeddings is destructive. Local-only training preserved personalization but eventually plateaued, since it never benefits from shared collaborative trends. Knowledge guidance—softly pulling local embeddings toward a common global reference—achieved the best final performance and showed step-wise gains at each guidance round. A third analysis swept the guidance interval from one to two hundred rounds and found a sweet spot: performance improved up to moderate intervals around one hundred rounds, but very long intervals hurt, as clients over-specialized to local interactions while receiving stale global information.

These observations shaped FedRKG's design. In ordinary rounds, each client trains its personalized item embedding matrix, a private user embedding, and, if needed, a user-specific scoring function, minimizing a binary cross-entropy loss over positive interactions and sampled negatives. The user embedding and scoring function never leave the device; only item embeddings are exchanged. At every T_int rounds—more than fifty in practice, and one hundred in the main experiments—the server aggregates client item embeddings into a common global matrix using plain FedAvg-style averaging, with no client-specific personalization on the server side.

The synchronization itself is cast as a regularized optimization problem. Rather than replacing the local embedding, the client solves for a new embedding that minimizes a weighted sum of two discrepancy terms: distance from its own personalized state and distance from the global reference, balanced by a coefficient lambda. The global embedding thus acts as a soft anchor rather than a reset. The authors instantiate the discrepancy as squared Frobenius distance, which makes the solution a convex combination of the local and global matrices.

Because a single global anchor may not suit every user–item interaction equally, FedRKG adds Adaptive Guidance. A lightweight per-client gating network takes the local item embedding, the global embedding, and their difference, and outputs a gate value for each item. The gate scales the global anchor item by item: a neutral gate of 0.5 recovers the original global vector, while smaller or larger values attenuate or amplify it. The gate parameters are trained through truncated bi-level optimization. At a guidance round, the recommender's states are frozen via stop-gradient copies, and only the gate is optimized for a few inner steps to minimize the recommendation loss that would result after applying the guidance operator. The optimized gate is then used once to update the actual, unfrozen local embedding, which seeds the next long-horizon training phase. The temporary guided embedding used in the inner loop is never stored as the client's representation.

The paper also offers a theoretical rationale. Under mild assumptions—a nonnegative discrepancy measure and a local objective that is L-smooth and near-stationary after long local training—the authors prove that the regularized guidance target is no farther from the personalized local state than full replacement is, and no farther from the global reference than leaving the local state unchanged. A corollary quantifies the shock: with squared Frobenius discrepancy, replacement perturbs the local gradient by the full distance between local and global states, while guidance perturbs it by only a fraction lambda over one plus lambda of that distance. This formalizes why abrupt degradation follows naive synchronization even after long local training, and why guidance behaves as a bounded correction.

Evaluation covered four widely used benchmarks—Amazon-Video, FilmTrust, LastFM-2K, and MovieLens-1M—preprocessed with the same filtering thresholds as prior work (at least twenty interactions per user for ML-1M, ten for the others) and converted to implicit feedback. Interactions were split chronologically, with the most recent item for testing, the second most recent for validation, and the rest for training. Notably, the team ranked each test item against the entire set of unobserved items rather than the 99 sampled negatives used in much prior work, a stricter protocol that avoids inflating scores against an easy candidate pool. All methods shared an embedding dimension of 32, a batch size of 256, SGD updates, four sampled negatives per positive, and early stopping with patience of one hundred epochs. Results were averaged over five runs.

FedRKG outperformed centralized MF and NeuMF, a gap the authors attribute not to federated training being inherently better but to personalization capacity: client-specific item tables let the same item carry different meanings for different users. It also beat most single-knowledge baselines, including relation-graph, grouping, and similarity-exchange methods, and outperformed dual-knowledge models such as FedRAP, FedIAR, and the VAE-based FedAe in most cases—despite never persistently storing separate local and global embeddings. Ablations on Amazon-Video and LastFM-2K showed that removing long-horizon local optimization caused the largest degradation, with normalized discounted cumulative gain at rank five collapsing from 14.85 to under one when guidance operated without well-formed local structures. Setting lambda to infinity—full replacement—performed poorly, while lambda of zero, local-only training, was better but still inferior to the full framework. Dropping adaptive guidance left the model competitive but consistently worse.

Efficiency analysis reinforces the practical appeal. In typical rounds, each client stores (m+4)d+1 parameters—essentially one item embedding table plus small private vectors—roughly half the persistent footprint of dual-knowledge methods and far below FedCIA, which exchanges item-similarity matrices with quadratic O(m²) storage. Peak storage during a guidance round rises to (2m+4)d+1, still linear in items. Communication cost falls by a factor of T_int compared with methods that exchange embeddings every round, since transfers occur only once per guidance interval. Under partial participation, the authors show FedRKG is more communication-efficient than per-round baselines unless the client sampling ratio falls below roughly one over T_int—under two percent for typical intervals, an uncommon operating point.

Further analyses probed the guidance mechanism's behavior. Splitting Amazon-Video users into "followers," who interact heavily with popular items, and "distinct" users with idiosyncratic tastes, the authors measured performance changes immediately after guidance rounds. Distinct users sometimes dipped slightly under plain knowledge guidance, while followers consistently improved; adaptive guidance shrank the dips for distinct users and amplified gains for followers, and a larger fraction of users improved overall. The guidance paradigm also proved model-agnostic in practice, consistently improving three different backbones—FedMF, FedNCF, and PFedRec—when integrated into them, supporting the claim that the mechanism is not tied to any particular architecture.

The authors address residual privacy concerns directly. Although raw interactions never leave devices, transmitted item-embedding updates can still encode preference information; a curious server that knows the previous embedding, the global reference, and lambda could reconstruct a client's accumulated local update. To counter this, they show FedRKG can be combined with local differential privacy: updates are clipped to a bounded norm and perturbed with Gaussian noise calibrated to the sensitivity and a target (epsilon, delta) budget, and the server aggregates only the privatized updates, with aggregation acting as post-processing that preserves the guarantee. Empirical results confirm utility and convergence under this mechanism.