Emerging Subjects in ML and Collaborative Learning

Contents

• Introduction and overview
• 0. Review: SGD and its analysis
• 1. Landscape of emerging topics
• 2. Distributed learning
• 3. Federated learning
• 4. Byzantine robustness
• 5. Differential privacy
• 6. Collaboration, personalization, fairness
• 7. Scaling and compute
• 8. Course research notes — CMAP (El Mhamdi, Dieuleveut)
• Exercises
• Projects and assessment
• References

Introduction and overview

Audience: an engineer who deploys ML and hits distribution, federated learning, robustness. Empirical first: FedAvg that stalls as soon as 3 clients are Byzantine; DP-SGD that costs −6 accuracy points for ε=8; then we name robust aggregation, DP composition, scaling.

Distributed / federated learning, Byzantine robustness, privacy — the systems view of LLMs (CMAP).

What you will be able to do

• Analyze distributed stochastic gradient descent: convergence speed, the effect of mini-batch size, step size, and number of workers.
• Distinguish distributed learning architectures (centralized, local, federated) and their communication/computation trade-offs.
• Explain the federated learning model (FedAvg) and its assumptions, in particular data heterogeneity across clients.
• Identify Byzantine failures in a learning cluster and apply the robust aggregation rules that neutralize them.
• Define differential privacy (ε-differential privacy), apply it to SGD, and interpret the utility/privacy trade-off.
• Reason about collaboration challenges: per-client personalization, fairness across participants, incentives.
• Estimate the cost of a training run (scaling models and compute) and read the scaling laws that structure the field (self-study).
• Turn a theme of collaborative learning into a well-posed research question, and work on it in a group up to a presented and written research project.
• Read a research paper in three passes and write a critique of it: claim, assumptions, evidence, scope, next question.

Official objectives and syllabus (2026-2027 catalog)

Official objectives: the 2026-2027 SynapseS sheet of the course unit (APM_51178_EP, “EA Collaborative Learning”) now displays a short description.

In paraphrase: the course explores collaborative learning through a scientific approach and teaches students to formulate their own research questions; the class first studies together the foundations of several themes, then students carry out group activities around these questions; finally, three sessions are devoted to reading scientific articles, to learn how to read them and how to take a critical view of their content.

The sheet names neither the themes nor a session-by-session programme, and displays no separate objectives list. The only assessment text it shows (in the section of the MScT IoT track; the LLGA section is empty) is that the final grade is based on the presentation and the report of the research project prepared during the course unit; the recommended prerequisite (MAP433) is stated for the engineering cycle only.

The title and its history (“Emerging Topics in Machine Learning - Collaborative Learning” in 2025-2026, under the Dieuleveut & El Mhamdi team as recorded earlier on this site) designate the field: collaborative learning — learning together when data, computation and participants are distributed, heterogeneous and mutually distrustful.

The following table maps every element of the official description to the section that covers it; the choice of themes is ours, built on the published literature of the field (see the References).

Two cautionary points, stated honestly:

1. since the 2026-2027 sheet names no theme, the choice of themes is a reasoned reconstruction around the official title — the actual syllabus announced at the start of the course unit by the coordinator will be authoritative; the structure, by contrast (foundations together, group work on research questions, then three paper-reading sessions), is the sheet’s and the session plan follows it;
2. the 2026 renaming (“EA Collaborative Learning”) narrows the course unit to collaborative learning: the generic “emerging” chapter on scaling (ch. 7) goes beyond it and is therefore studied outside class, while ch. 1 (landscape) is used in class as the starting point of the research questions.

Where this course fits in the program

One of the “Choose 3” electives of Year 1 · Period 1 (36 h, 4.5 ECTS), preselected by the Graph × LLM route of the home page. The official sheet recommends MAP433 for students of the engineering cycle; in practice, this module assumes the optimization foundation of the Machine Learning module, whose opening chapter covers the analysis of SGD — extended here to the distributed case — and the theory of generalization.

The two refreshers (Refresher in Statistics, Refresher in Computer Science) are its upstream prerequisites. The course unit is shared with the engineering cycle (X), the MJH master, exchange programs, the MScT Visual Computing and Creative AI track, and (according to the assessment sections of the sheet) the MScT IoT and TRAI tracks.

Downstream, this module opens three directions. Privacy and Uncertainty Quantification (M2) extends the differential privacy seen here toward private inference and uncertainty quantification; ML Ops and LLM Engineering Principles (M2) picks up scaling and the systems viewpoint for industrializing LLMs; Reinforcement Learning and Autonomous Agents (Period 2) draws on the same questions of collaboration and multiple agents, up to multi-agent RL.

Course outline

• Review: SGD and its analysis: convergence of stochastic gradient descent, taken from the Machine Learning module and extended to distributed systems.
• Landscape of emerging topics: a map of the research fronts that structure large-scale ML today, and how to turn one of them into a research question of your own.
• Distributed learning: parallelizing training, synchronizing workers, arbitrating between communication and computation.
• Federated learning: learning on data that never leaves its owners — the FedAvg framework and its variants.
• Byzantine robustness: detecting and tolerating faulty or malicious workers in aggregation.
• Differential privacy: formalizing and guaranteeing the protection of individuals during training.
• Collaboration, personalization, fairness: learning models together that remain useful to everyone — and fair.
• Scaling and compute: what large models cost, and what the field’s scaling laws say.
• Course research notes — CMAP (El Mhamdi, Dieuleveut): the research of El Mahdi El Mhamdi (Byzantine robustness) and Aymeric Dieuleveut (stochastic SGD, federated learning), CMAP, and a method for reading papers critically — the material of the three official paper-reading sessions (the 2026-2027 coordinator is Paul Mangold).

Session plan

36 h in class = 12 sessions of 3 h. The volume is the one of the SynapseS 2026–2027 sheet (36 h in person, lecture/tutorial/lab split not displayed). The sheet gives no session-by-session programme, but it does fix the structure, and the plan follows it: foundations of several themes studied together, with group work on research questions (sessions 1 to 9), then three sessions devoted to reading scientific articles (sessions 10 to 12).

To make room for those three sessions, the scaling chapter (ch. 7), which the sheet does not name, moves to self-study, and distributed learning (ch. 2) and Byzantine robustness (ch. 4) take one session each.

Level 1 = foundations (reviews, definitions, first worked examples, framing a research question), 2 = core methods (the distributed, federated, robust and private algorithms with their guarantees), 3 = research material (reading and criticizing the papers that founded these methods); the level never goes down from one session to the next.

Self-study, outside the 36 h (about 3 h in total): ch. 7 Scaling and compute — scaling laws, compute-optimal allocation, mixtures of experts, with Ex. 11 (≈ 3 h).

How to study this module

• First secure your understanding of SGD analysis: the review chapter is short, but mastering it is a prerequisite for all the distributed and federated chapters.
• For each aggregation scheme (mean, median, trimmed mean), ask yourself “what happens with a malicious worker?” — that is the course’s guiding thread.
• Simulate a small federated learning setup with clients holding heterogeneous data: the gap between homogeneous theory and heterogeneous practice can only be understood by running it.
• Do the differential privacy exercises on paper: composing mechanisms, computing an ε budget, interpreting a guarantee.
• Follow the news on scaling laws and compute in parallel with the scaling chapter: that chapter ages the fastest, and critical reading is the targeted skill.
• If you need a refresher on the basics, go back to the Machine Learning module: optimization and concentration are covered there at the level expected here.

0. Review: SGD and its analysis

Every algorithm of this module — distributed, federated, robust or private — is a variant of stochastic gradient descent in which the gradient is averaged, delayed, compressed, filtered or noised. To measure what each variant costs, one first needs the exact convergence rate of plain SGD and the reason why its noise cannot be beaten; this review proves both.

1. Landscape of emerging topics

Concrete scene: 50 hospital clients, 2 malicious. Gradient averaging pulls the model toward a backdoor. This chapter sets the threat model before recipes.

This module opens with the questions that structure current research and industry, in direct preparation for the M2 modules (LLMs, Explainability/Security/Privacy):

• Scaling laws: power-law loss as a function of data/parameters/compute (Kaplan 2020, Hoffmann/Chinchilla 2022 — chapter 7); emergence of capabilities; compute as a scarce resource;
• Distributed training of large models: data/tensor/pipeline parallelism, MoE (chapters 2 and 7);
• Frugal fine-tuning: LoRA and adapters — the “collaboration” between a large central model and local uses (chapters 3 and 7);
• Trustworthy? Robustness to malicious clients, privacy of training data, fairness across participants — the three guiding threads of chapters 4-6;
• Collaborative agents: multi-agent orchestration = collaboration of models (direct link with the Reinforcement Learning and Autonomous Agents module, chapter 7 — preview, Period 2 — and with “graph engineering”).

1.1. From a theme to a research question

The official description of the course unit asks you to formulate your own research questions and to work on them in groups; the research project that is graded is the answer to one of them. A theme such as “Byzantine robustness” is not yet a question: a question is something that a proof or an experiment can settle, in either direction, within the time of the course.

2. Distributed learning

One GPU is too slow for a large model, so the gradient computation is split across K workers that must then agree on a single update. This chapter quantifies the gain (the variance of the averaged gradient falls like 1/K) and the price — communication — and presents the techniques that reduce the bytes exchanged: quantization, sparsification, asynchrony and decentralized gossip.

3. Federated learning

When the data belong to hospitals or sit on phones, they cannot be gathered on one server: the model must travel to the data. Each client then performs several local steps between two communications, and because the clients’ data differ, these local steps pull the model in different directions. This chapter proves this client drift on an example, and presents the corrections (FedProx, SCAFFOLD) and the personalized variants.

import numpy as np
rng = np.random.default_rng(0)

def fedavg(clients, rounds=50, E=5, eta=0.1):
    """clients: list of local functions (theta -> theta after E SGD steps)."""
    theta = np.zeros(d)
    for r in range(rounds):
        local = [c(theta, E, eta) for c in clients]   # local phase
        theta = np.mean(local, axis=0)                # aggregation
    return theta

# SCAFFOLD: add the control variates
def scaffold(clients, rounds=50, E=5, eta=0.1):
    theta = np.zeros(d); c = np.zeros(d)
    ck = [np.zeros(d) for _ in clients]
    for r in range(rounds):
        new_ck, loc = [], []
        for k, client in enumerate(clients):
            theta_k, drift = client(theta, E, eta, correction=c - ck[k])
            loc.append(theta_k)
            new_ck.append(ck[k] - c + (theta - theta_k) / (eta * E))
        theta = np.mean(loc, axis=0)
        ck = new_ck
        c = np.mean(ck, axis=0)                       # uses the new client controls
    return theta

4. Byzantine robustness

Averaging the clients’ gradients assumes that every client is honest; a single faulty or malicious client can move the average anywhere. This chapter defines the threat model and studies aggregation rules that resist a bounded number of arbitrary clients — coordinate-wise median, trimmed mean, Krum, geometric median — together with their guarantees and their limits in high dimension.

grads = np.array([...])                 # K honest gradients
attacker = 10 * np.linalg.norm(grads, axis=1).mean() * rng.standard_normal(d)
all_g = np.vstack([grads, attacker])   # 1 Byzantine client

mean_g   = all_g.mean(0)               # broken: a single attacker suffices
median_g = np.median(all_g, axis=0)    # robust (Th. 4.2)

def krum(gs, f_B):
    D = ((gs[:, None, :] - gs[None, :, :]) ** 2).sum(-1)
    K = len(gs); m = K - f_B - 2
    scores = np.sort(D, axis=1)[:, 1:m+1].sum(1)   # m nearest neighbors
    return gs[scores.argmin()]                     # Th. 4.3
print(np.linalg.norm(mean_g - grads.mean(0)),
      np.linalg.norm(median_g - grads.mean(0)),
      np.linalg.norm(krum(all_g, 1) - grads.mean(0)))

5. Differential privacy

A trained model can leak its training data: an attacker may tell whether a given person was in the dataset, or even extract a memorized sentence. Differential privacy turns “the output barely depends on any one individual” into a measurable guarantee. This chapter defines it, proves the composition rule and the Laplace mechanism, and builds DP-SGD, the private version of stochastic gradient descent.

6. Collaboration, personalization, fairness

The previous chapters make collaboration possible; this one asks when it is worth it for each participant. It surveys how to personalize a shared model, when local models can be averaged at all, how to value each participant’s data, and how to keep the result fair across participants.

• Personalization: a global model + local heads (light per-client fine-tuning); Bayesian interpretation (mixture of posteriors); multi-task formalization (Ditto, ch. 3);

• Model fusion and mode connectivity: two networks trained from the same initialization are connected by a nearly flat path in the loss surface (low barrier along the segment — Frankle et al., 2020).

  Consequence for collaboration: local models can be averaged… provided they stay in the same basin; realigning the neuron permutations between two models is the key to recent fusions (sketch); these are the theoretical foundations of FedAvg (the averaging of chapter 3 only makes sense in this regime);

• Data markets: valuing a data source by its marginal contribution — the Shapley value \phi_i = \sum_{S \subseteq N \setminus \{i\}} \frac{|S|!\,(n - |S| - 1)!}{n!}\,\big[v(S \cup \{i\}) - v(S)\big], where N is the set of the n sources and v(S) the quality of the model trained on the sources of S (estimated by Monte-Carlo permutations when n is large; worked example below); data buyers/sellers, incentives for quality — game theory meets ML;

• Vertical FL: clients hold different features about the same individuals (bank × retailer): split learning, exchanges of protected intermediate representations — a complement to the “horizontal” FL of ch. 3;

• Fairness: performance per subgroup (demographic parity, equalized odds); in the federated setting, fairness also cuts across clients (6.1); the Computational Optimal Transport module (preview, Period 2) provides tools (barycenters, fairness via OT);

• Toward multi-agent systems: when “workers” become LLM agents, collaboration becomes orchestration (roles, votes, verification) — the loop is closed with the Reinforcement Learning and Autonomous Agents module, chapter 7 (preview, Period 2); the mechanisms of this module (robust aggregation, budgets, incentives) carry over directly.

6.1. Fairness across participants

FedAvg minimizes the average loss \sum_k p_k F_k, weighted by the data sizes p_k = n_k/n. A small client whose data differ from the others can then be sacrificed to the majority: the average looks good while one hospital receives a useless model. Fairness in collaborative learning works at two levels.

• Group fairness inside the data. Demographic parity, equalized odds and calibration within groups are defined in Machine Learning, Definition 4.4. In federated learning the sensitive groups are spread unevenly over the clients and no client sees the whole population, so the per-group rates must be aggregated (securely, 4.5) before a criterion can even be checked.
• Fairness across participants. Each client is a stakeholder, and one asks for a uniform performance: a small spread of the losses F_k(\theta), or a good worst client.

Reading. Both objectives trade average accuracy for uniformity. q-FFL moves continuously from FedAvg (q = 0) toward the worst-client objective of agnostic FL (q \to \infty); Exercise 12 computes the whole path on two quadratic clients.

Fairness across participants is not group fairness: a uniform loss over hospitals can still hide a disparity between patient groups inside each hospital, so a report gives both.

7. Scaling and compute

Training a large model is first a budget decision: for a fixed amount of compute, how large should the model be and on how many tokens should it be trained? This chapter states the empirical scaling laws, derives the compute-optimal allocation, and shows how mixtures of experts decouple the number of parameters from the cost per token.

8. Course research notes — CMAP (El Mhamdi, Dieuleveut)

The 2026-2027 SynapseS sheet names Paul Mangold (CMAP, École Polytechnique) as the coordinator of the course unit. This chapter is the material of the three official paper-reading sessions.

It presents the work of El Mahdi El Mhamdi (section 8.1, the foundation of the robustness strand of the course) and that of Aymeric Dieuleveut (section 8.2, CMAP), the team of the 2025-2026 edition as recorded on this site — foundational works of the robustness and federated strands of the course — and then the method for reading them critically (section 8.3). These papers are also the natural leads for the research project, the only assessment shown on the sheet.

8.1. El Mahdi El Mhamdi — Byzantine tolerance for distributed ML

The guiding thread: can we learn in a distributed way when some participants lie? — a line of research that founded the field (byzantine-ML) whose chapters 2-4 this course follows.

8.2. Aymeric Dieuleveut — stochastic acceleration and the federated setting

8.3. Reading a research paper critically

The sheet devotes three sessions to reading scientific articles, with an explicit aim: learning how to read them and how to take a critical view of their content. Critical does not mean hostile: it means separating what a paper proves from what it measures and from what it merely suggests, and finding the question it leaves open. This section gives the method used in sessions 10 to 12; the papers are those of 8.1 and 8.2, all of which extend chapters 0 to 4.

Exercises

1. ★ Batch variance. Show that the variance of the batch gradient of size m is \sigma^2/m, and deduce the “linear speedup” of distributed SGD (with K workers, same steps, same iterations: error \sigma/\sqrt{Km}).

2. ★ SGD recursion. Detail the three ingredients of step 2 of Theorem 0.1 (convexity, bias-variance decomposition, smoothness inequality) and verify the telescoping step; what happens if \eta > 1/L?

3. ★ FedAvg = SGD when E = 1. Verify that FedAvg with a single local epoch recovers exactly distributed SGD, then simulate client drift on heterogeneous quadratic data (F_k with different minimizers) for E \in \{1, 5, 20\} and recover the bias of Theorem 3.2 (with a_1 = 1, a_2 = 10).

4. ★ Robust median. Show that if f_B < K/2 gradients are arbitrary, the coordinate-wise median stays at bounded distance from the median of the honest gradients, unlike the mean (give an explicit attack on the mean).

5. ★ Geometric median. Implement Weiszfeld (Proposition 4.4) on Gaussian gradients + one outlying attacker; compare convergence radius and robustness with the coordinate-wise median.

6. ★ DP of the counting query. For the query “how many individuals have property P?”, show that the release q(D) + \mathrm{Lap}(1/\varepsilon) is \varepsilon-DP (sensitivity 1), and compute the typical error.

7. ★ Gossip. Simulate gossip aggregation \theta^{(k)} \leftarrow \theta^{(k)} + \eta_g \sum_{j \in \mathcal{N}(k)}(\theta^{(j)} - \theta^{(k)}) on a cycle then on a complete graph; relate the speed to the algebraic connectivity \lambda_2(L) of the Laplacian (box before Theorem 2.6; Graph ML ch. 4, preview).

8. ★★ Exact SCAFFOLD on the quadratic. On the example of Theorem 3.2, write \bar a = \frac1K\sum_k a_k and recall \theta^\star = \sum_k a_k z_k / \sum_k a_k, the curvature-weighted mean of the z_k (not their plain mean). Show that with the exact control variates c_k - c = a_k(\theta - z_k) - \bar a(\theta - \theta^\star), the corrected local update uses the global gradient — and hence that the fixed point becomes \theta^\star again.

9. ★★ Krum in practice. Implement Krum (code of ch. 4), then the “dimension-by-dimension” attack: show that an attacker who sends the honest mean gradient plus an alternating \pm\delta per coordinate traps the coordinate-wise median but not (immediately) Krum; discuss.

10. ★★ Composition. Prove Theorem 5.3 in the case of three nested mechanisms, then compute the total budget of 100 queries that are \varepsilon_0-DP under simple composition; comment on the gap with advanced composition (\sim\sqrt T).

11. ★★ Chinchilla on paper. Redo the derivation of Theorem 7.2 (a Lagrange multiplier on the budget, as in LLM Theorem 3.1) with \alpha = 0.34, \beta = 0.28: compute the exponents of N^\star and D^\star in C.

    For C = 10^{23} FLOPs, deduce an order of magnitude of N^\star (with the constants of the paper: A \approx 406, B \approx 410) and the tokens/parameters ratio.

12. ★★ q-FFL on two clients. Two clients with weights p_1 = 0.9 and p_2 = 0.1 hold F_1(\theta) = \tfrac12\theta^2 and F_2(\theta) = \tfrac12(1 - \theta)^2 (Definition 6.1).

    1. Show that the q-FFL minimizer \theta_q satisfies \big(\theta_q/(1 - \theta_q)\big)^{2q+1} = p_2/p_1. (ii) Compute \theta_q for q \in \{0, 1, 5\} and its limit as q \to \infty; compare with agnostic FL over the whole simplex. (iii) Tabulate the average loss \sum_k p_k F_k(\theta_q) and the worst-client loss: what does uniformity cost?

13. ★★★ Research project (the official assessment). Choose one open question of chapters 2 to 7 — for instance robust aggregation when honest clients are heterogeneous (Theorem 3.2 meets Algorithm 4.3), DP-SGD for federated LoRA adapters, or compression with error feedback in both directions.

    Reproduce the baseline result of the reference paper on a small benchmark, propose one modification, and report both what the theory of the course predicts and what you observe. Chapter 8 lists leads from the instructors’ own work.

Projects and assessment

The LLGA section of the 2026–2027 SynapseS sheet displays no assessment. The only assessment text, in the MScT IoT section, bases the final grade on “the presentation and the report of the research project” prepared during the course unit (see the sheet summary above). The subjects below are proposals of these notes, not official rules: each can serve as that research project, with the question sheet of 1.1 as its introduction and its reference paper read with the grid of 8.3. Every criterion of the rubric is judged on the report and the presentation.

The projects exercise mainly O8 (trustworthy AI: robustness, privacy, fairness across participants) and O1 (the analysis of SGD and its distributed variants), with O7 (research methodology and hands-on work), O3 for the federated LoRA subject and O4 for the decentralized subject. The written exam is a mock for self-assessment: the sheet announces none.

Solo projects

1. [Solo · ≈ 20 h] Client drift and its cures, from quadratics to CIFAR-10. Does a decreasing step remove the bias of FedAvg, and when do FedProx and SCAFFOLD pay off?
   • Work: reproduce Theorem 3.2 numerically (fixed point against \theta^\star, bias against E and \eta, the \eta(E-1) scaling of Theorem 3.3) and Exercises 3 and 8; then FedAvg, FedProx (a sweep of \lambda) and SCAFFOLD with a small CNN.
   • Data: CIFAR-10 (Krizhevsky, 2009) over 10 clients, with a Dirichlet label split of concentration 0.1 and 1 (Hsu, Qi and Brown, 2019).
   • Success criterion: the simulated fixed points match the closed form to three decimals; on CIFAR-10, accuracy against rounds over 3 seeds, with the ranking of the three methods explained by ch. 3.
   • Deliverables: code, a 4–6 page report, a 10-minute talk; chapters 0 and 3.
2. [Solo · ≈ 20 h] Decentralized SGD and the algebraic connectivity. How does the communication graph set the speed of consensus and the accuracy reached per byte sent?
   • Work: gossip averaging and D-PSGD (Lian et al., 2017) with K = 16 workers on a path, a cycle, a 2-D grid, a random 4-regular graph (an expander with high probability) and the complete graph; \lambda_2(L) computed with NetworkX; top-k compression with error feedback (Proposition 2.4) on the exchanged models, in the form of CHOCO-SGD (Koloskova, Stich and Jaggi, ICML 2019).
   • Data: logistic regression on the Adult census data (Kohavi, 1996; OpenML 1590), first shuffled across workers, then sorted by label.
   • Success criterion: the measured contraction of the consensus error per round matches \rho(W) of Theorem 2.6, equal to 1 - \eta_g\lambda_2(L) for a small enough \eta_g, within 10 % on every graph; accuracy against bytes sent, compared with ring all-reduce.
   • Deliverables: code, report, talk; chapter 2 and Exercise 7. It leads to Graph ML ch. 4 (spectral graph theory) and to Deep Learning P2 ch. 3 (all-reduce).
3. [Solo · ≈ 25 h] Paper study: The Hidden Vulnerability of Distributed Learning in Byzantium (El Mhamdi, Guerraoui and Rouault, ICML 2018). Does the dimension-by-dimension attack defeat the coordinate-wise rules and Krum, and does Bulyan resist it?
   • Work: passes 1–3 of Definition 8.5 and the critique grid of Definition 8.6; mean, coordinate-wise median, trimmed mean, Krum and Bulyan implemented; the attack of Work 8.2 and Exercise 9 reproduced with K = 25 workers and f_B = 5, so that K \geq 4f_B + 3.
   • Data: MNIST (LeCun, Bottou, Bengio and Haffner, 1998) with a small MLP, iid split.
   • Success criterion: the accuracy drop under attack for each rule over 3 seeds, set against the paper’s figures; the grid’s “next question” written as a question sheet (Definition 1.1).
   • Deliverables: code, a report with the filled grid, a talk; chapters 4 and 8.

Group projects

1. [Group of 3 · ≈ 30 h each] Robust aggregation meets heterogeneity. How much bias does each robust rule concede when honest clients disagree?
   • Work: the worked example of 1.1 turned into an experiment — 20 clients, 2 of them Byzantine, honest optima spread by \zeta; coordinate-wise median, trimmed mean, Krum, geometric median (Weiszfeld) and Bulyan as \zeta grows; the predicted slope 0.14\,\zeta of the median checked; then the dimension-by-dimension attack (Work 8.2).
   • Data: the synthetic quadratics of 1.1, then FEMNIST from the LEAF benchmark (Caldas et al., 2018), split by writer.
   • Split: one member per family of rules (coordinate-wise, selection, geometric), with a shared simulator and attack library.
   • Success criterion: bias against \zeta for each rule, with intervals over 5 seeds; the median’s slope within 20 % of 0.14; one ranking of the rules explained by ch. 4.
   • Deliverables: the question sheet (1.1), code, an 8–10 page joint report, a 20-minute talk; chapters 1, 3, 4 and 8.
2. [Group of 3 · ≈ 30 h each] Private, robust federated LoRA for an instruction-tuned language model. What do privacy and robustness cost when silos federate LoRA adapters?
   • Work: FedAvg of the LoRA adapters (FedIT, ch. 3 note) of a small model such as Pythia-160M over 8 silos; DP-SGD on the adapters with a Rényi accountant (Opacus); a median or trimmed-mean aggregator against one hostile silo; a loss-based membership-inference test on training prompts.
   • Data: databricks-dolly-15k (Conover et al., 2023), split into silos by instruction category, so that silos are heterogeneous.
   • Split: federated LoRA and evaluation; DP and the accountant; attack, robust aggregation and membership inference.
   • Success criterion: held-out loss against \varepsilon \in \{1, 4, 8, \infty\}; membership AUC near 0.5 at small \varepsilon; the cost of robust aggregation without attack measured.
   • Deliverables: code, joint report, talk; chapters 3, 4, 5 and 7. It previews LLM 4.3 (PEFT), Privacy and UQ ch. 4 (DP-SGD) and Security ch. 8 (membership inference).
3. [Group of 3 · ≈ 30 h each] Federated, private news recommendation. Can a user encoder be trained on simulated devices under DP, and how much ranking quality does it lose?
   • Work: the design of FedNewsRec (Qi et al., Findings of EMNLP 2020) reproduced: a news encoder on titles, a user encoder trained by FedAvg over simulated users, DP noise on the uploaded gradients; compared with centralized training.
   • Data: MIND-small, the Microsoft News Dataset (Wu et al., ACL 2020), with its impression logs.
   • Split: news encoder and centralized baseline; federated training and client sampling; privacy accounting and evaluation.
   • Success criterion: AUC and nDCG@10 against \varepsilon and against the number of clients per round, with intervals over seeds.
   • Deliverables: code, joint report, talk; chapters 3 and 5. It prepares the Graph × LLM variant of the end-of-year project Y1.3.

Written exam (proposal)

Two hours, one handwritten A4 sheet allowed, a simple calculator allowed; four exercises, 20 points.

1. Question (5 points). Explain why FedAvg with E > 1 local steps and a constant step size converges, on heterogeneous clients, to a point that is not the global optimum. Say why a decreasing step removes this bias, and how the control variates of SCAFFOLD remove it at a constant step.
   • Expected: Theorem 3.2 — each client contracts toward its own optimum, and \theta_\infty weights the z_k by 1 - c_k instead of a_k; the two agree only for E = 1 or equal curvatures.
   • For small \eta, 1 - c_k \approx E\eta a_k: the bias is of order \eta(E-1) and vanishes with decreasing steps (Theorem 3.3, where heterogeneity only enters the constant).
   • SCAFFOLD adds c - c_k, an estimate of \nabla F - \nabla F_k: each local step follows the global gradient, and the fixed point is \theta^\star (Exercise 8).
2. Question (5 points). A hospital releases the number of its n = 2000 patients who have a rare condition. (a) Give the sensitivity of this count, the Laplace scale for \varepsilon = 0.5 and the expected absolute error. (b) It releases ten such counts, for ten conditions: what is the total budget under basic composition, and which per-count budget keeps the total at 1? (c) With the Gaussian mechanism, \delta = 10^{-5} and \varepsilon = 0.5, give \sigma_G and check its validity condition.
   • Expected: (a) adding or removing one patient changes the count by at most 1, so \Delta_1 = 1; scale b = 1/\varepsilon = 2, expected error 2 patients.
   • 2. Ten counts at 0.5 cost 5 (Theorem 5.3); a per-count budget of 0.1 keeps the total at 1, with scale 10 and an expected error of 10 patients.
   • 3. With \Delta_2 = 1, \sigma_G = \sqrt{2\ln(1.25 \times 10^5)}/0.5 \approx 9.7, valid since \varepsilon < 1; the expected absolute error \sigma_G\sqrt{2/\pi} \approx 7.7 is worse than Laplace for one scalar count.
3. Question (5 points). Eight workers on a cycle average their models with W = I - \eta_g L and \eta_g = 1/3. (a) Check that this mixing matrix is symmetric, doubly stochastic and non-negative. (b) Give the eigenvalues of both matrices, the factor \rho(W) and the spectral gap \delta_W. (c) How many gossip rounds divide the consensus error by 1000? (d) Same questions on the complete graph with \eta_g = 1/8.
   • Expected: (a) the diagonal is 1 - 2/3 = 1/3 and each of the two neighbours gets 1/3; rows and columns sum to 1.
   • 2. \lambda_j(L) = 2 - 2\cos(2\pi j/8), that is 0, 0.586 (twice), 2 (twice), 3.414 (twice) and 4; so W has eigenvalues 1, 0.805, 0.333, −0.138 and −0.333, \rho(W) \approx 0.805 and \delta_W = \eta_g\lambda_2(L) \approx 0.195.
   • 3. t \geq \ln 1000 / (-\ln 0.805) \approx 31.8, so 32 rounds.
   • 4. L = 8I - \mathbf{1}\mathbf{1}^\top, with eigenvalues 0 and 8 (seven times), hence W = \tfrac18\mathbf{1}\mathbf{1}^\top, with eigenvalues 1 and 0 (seven times): it is non-negative and doubly stochastic, \rho(W) = 0 and \delta_W = 1. Exact consensus in one round, at the price of 7 messages per worker instead of 2.
4. Question (5 points). (a) Prove that the Laplace mechanism with scale b = \Delta_1/\varepsilon is \varepsilon-DP (Theorem 5.4). (b) For the counting query, show that this guarantee is tight: the mechanism is not \varepsilon'-DP for any \varepsilon' < \varepsilon.
   • Expected: (a) by the triangle inequality, for every output z, \frac{p(z \mid D)}{p(z \mid D')} = \exp\Big(\frac{\|z - q(D')\|_1 - \|z - q(D)\|_1}{b}\Big) \leq e^{\Delta_1/b} = e^{\varepsilon}, and integrating over any event gives the definition with \delta = 0.
   • 2. Take neighbours with q(D) = 1 and q(D') = 0. For every z \geq 1 the density ratio equals e^{1/b} = e^{\varepsilon} exactly, so the event S = [1, \infty), of positive probability, satisfies \mathbb{P}[M(D) \in S] = e^{\varepsilon}\,\mathbb{P}[M(D') \in S], which no \varepsilon' < \varepsilon allows.

Grading rubric (proposal)

References

• P. Kairouz et al., Advances and Open Problems in Federated Learning, Foundations and Trends in ML, 2021 — the reference monograph.
• L. Bottou, F. Curtis, J. Nocedal, Optimization Methods for Large-Scale Machine Learning, SIAM Review, 2018 — the SGD analysis of chapter 0.
• F. Bach, E. Moulines, Non-strongly-convex smooth stochastic approximation with convergence rate O(1/n), NeurIPS 2013 — constant-step averaged SGD (Work 8.3).
• J. Wang et al., A Field Guide to Federated Optimization, 2021 — the practical guide (arXiv).
• B. McMahan et al., Communication-Efficient Learning of Deep Networks from Decentralized Data (FedAvg), AISTATS 2017.
• T. Li et al., Federated Optimization in Heterogeneous Networks (FedProx), MLSys 2020; T. Li et al., Ditto: Fair and Robust Federated Learning Through Personalization, ICML 2021.
• X. Li, K. Huang, W. Yang, S. Wang, Z. Zhang, On the Convergence of FedAvg on Non-IID Data, ICLR 2020 — Theorem 3.3.
• T. Li, M. Sanjabi, A. Beirami, V. Smith, Fair Resource Allocation in Federated Learning (q-FFL), ICLR 2020; M. Mohri, G. Sivek, A. T. Suresh, Agnostic Federated Learning, ICML 2019 — section 6.1.
• S. P. Karimireddy et al., SCAFFOLD: Stochastic Controlled Averaging for Federated Learning, ICML 2020.
• P. Blanchard, E. M. El Mhamdi, R. Guerraoui, J. Stainer, Machine Learning with Adversaries: Byzantine Tolerant Gradient Descent (Krum), NeurIPS 2017.
• E. M. El Mhamdi, R. Guerraoui, S. Rouault, The Hidden Vulnerability of Distributed Learning in Byzantium (Bulyan), ICML 2018; Distributed Momentum for Byzantine-resilient SGD, ICLR 2021.
• Y. Chen, L. Su, J. Xu, Distributed Statistical Machine Learning in Adversarial Settings: Byzantine Gradient Descent (geometric median), Proc. ACM Meas. Anal. Comput. Syst. (POMACS), 2017.
• K. Bonawitz et al., Practical Secure Aggregation for Privacy-Preserving Machine Learning, CCS 2017.
• M. Abadi et al., Deep Learning with Differential Privacy (DP-SGD), CCS 2016.
• C. Dwork, A. Roth, The Algorithmic Foundations of Differential Privacy, FnT-TCS, 2014; B. Balle, Y.-X. Wang, Improving the Gaussian Mechanism for Differential Privacy, ICML 2018 — the analytic Gaussian mechanism.
• R. Shokri, M. Stronati, C. Song, V. Shmatikov, Membership Inference Attacks Against Machine Learning Models, IEEE S&P 2017; N. Carlini et al., The Secret Sharer, 2019.
• D. Alistarh et al., QSGD: Communication-Efficient SGD via Gradient Quantization and Encoding, NeurIPS 2017; J. Bernstein et al., signSGD with majority vote, ICLR 2019.
• B. Recht et al., Hogwild!: A Lock-Free Approach to Parallelizing Stochastic Gradient Descent, NeurIPS 2011; X. Lian et al., Can Decentralized Algorithms Outperform Centralized Algorithms?, NeurIPS 2017.
• F. Seide et al., 1-bit stochastic gradient descent and its application to data-parallel distributed training of speech DNNs, Interspeech 2014; S. Stich, J.-B. Cordonnier, M. Jaggi, Sparsified SGD with Memory, NeurIPS 2018 — error feedback.
• J. Hoffmann et al., Training Compute-Optimal Large Language Models (Chinchilla), NeurIPS 2022; J. Kaplan et al., Scaling Laws for Neural Language Models, 2020 — for chapters 1 and 7.
• W. Fedus, B. Zoph, N. Shazeer, Switch Transformers, JMLR 2022; E. Hu et al., LoRA, ICLR 2022; Y. Zhang et al., Towards Building the Federated GPT (FedIT), 2023.
• J. Frankle et al., Linear Mode Connectivity and the Lottery Ticket Hypothesis, ICML 2020 — chapter 6.
• S. Keshav, How to Read a Paper, ACM SIGCOMM Computer Communication Review 37(3), 2007 — the three-pass method of 8.3.
• P. Zhao, T. Zhang, Stochastic Optimization with Importance Sampling, ICML 2015 — chapter 0.
• Research group: A. Dieuleveut, N. Flammarion, F. Bach, Harder, Better, Faster, Stronger Convergence Rates for Least-Squares Regression, JMLR 2017; A. Dieuleveut, G. Fort, E. Moulines, G. Robin, Federated-EM, NeurIPS 2021; C. Philippenko, A. Dieuleveut, Artemis, 2020; HDR Contributions to Federated Learning and First-Order Methods, 2023 — chapter 8.