PTOPOFL: Topology-Guided Personalised Federated Learning with Persistent-Homology Client Descriptors

arXiv:2603.04323 · cs.LG, cs.CR, cs.DC, math.AT, stat.ML · Submitted 2026-03-04 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: AI Radio. Generated commentary on the latest Artificial Intelligence papers.

Tom: We're looking at the paper: "PTOPOFL: Topology-Guided Personalised Federated Learning with Persistent-Homology Client Descriptors".

Jane: The gist: PTOPOFL introduces a framework that replaces gradient communication in federated learning with persistent homology descriptors to simultaneously address privacy leakage and client heterogeneity.

Tom: First, who's behind it and why it matters.

Paper summary: Tom: So we're looking at this paper, "PTOPOFL: Topology-Guided Personalised Federated Learning with Persistent-Homology Client Descriptors," and the big idea here is to solve two problems at once in federated learning.

Jane: Right, so it’s about those two things that keep messing with standard federated learning: the risk of data reconstruction attacks from shared gradients, and the way non-identical data across clients makes all those models drift apart during training.

Lu: The core thesis is replacing gradient communication with topological descriptors derived from persistent homology to handle both issues simultaneously.

Meng: So, instead of clients sending their model updates or gradients to the server, they only send these forty-eight-dimensional PH feature vectors <ref:2603.04323#pg1,48-dimensional PH feature vectors>.

Tom: That's right, and the paper claims this structure makes inversion attacks provably ill-posed because the many-to-one mapping of persistence diagrams means infinitely many datasets could share the same descriptor.

Jane: And that’s what they mean by it being "provably ill-posed," which is a strong claim when you're talking about privacy and security.

Lu: They use persistent homology to create these descriptors, which are fixed-length vectors of forty-eight dimensions, containing things like Betti curves and persistence entropy <ref:2603.04323#pg1>.

Tom: So this isn't just some random feature vector; it’s a compact shape summary of the client’s data structure.

Jane: And they say that because of how persistence diagrams work, these summaries are much harder to invert than the gradients we usually send.

Meng: From an engineering standpoint, that means instead of dealing with noisy gradients and reconstruction risks, we deal with these topological summaries for clustering and aggregation.

Tom: Exactly. The paper then describes a server process where clients get clustered based on the Wasserstein similarity between their PH diagrams.

Jane: So they group clients by how similar their underlying data shapes are, which is a way to handle the non-IID aspect of federated learning.

Lu: Within those clusters, the aggregation scheme uses topology-weighted combination for intra-cluster models, where the weights depend on both client size and how close that client’s descriptor is to the cluster's centroid.

Meng: I'm curious about the deployment side here—what does this clustering actually look like when you try to run it at scale?

Paper summary: Tom: Well, they also have a step for inter-cluster blending where those individual cluster models get blended with a global consensus model to stop them from becoming too specialized.

Jane: The paper shows that this whole process leads to convergence that is linear with a strictly smaller error floor compared to standard methods like FedAvg under strongly convex local objectives.

Lu: They tested it on some real-world scenarios, like a non-IID healthcare setting with eight simulated hospitals and two adversarial ones, and PTOPOFL achieved AUC values of zero point eight four one and zero point nine one zero respectively, which are the highest they got in those settings <ref:2603.04323#pg3,0.841 and 0.910 respectively>.

Meng: That’s impressive performance numbers for a method that relies on topological descriptors instead of raw gradients.

Tom: And they also showed it converges starting from round one in both scenarios, which is a big win for practical training efficiency.

Jane: It really changes the picture by showing how this topological abstraction can help manage client heterogeneity without sacrificing quality too much.

Lu: The authors quantify the reduction in per-sample mutual information achieved by using PH descriptors instead of gradients, showing a ratio of rho topo over rho grad that is about zero point two two, which is a factor of four point five reduction in reconstruction risk compared to gradient sharing <ref:2603.04323#pg3>.

Tom: A factor of four point five reduction is significant when you're worried about those data inversion attacks we talked about earlier.

Jane: And they also provide a guarantee that the influence of adversarial clients decays exponentially as their topological separation from the honest majority increases <ref:2603.04323#pg3>.

Meng: From a production standpoint, that exponential decay of influence sounds much better than what we see with linear decay in standard FedAvg when you have a few bad actors.

Lu: The paper notes that when feature geometry and decision rules vary together, this PH partition recovers the latent client groups even if a simple linear-subspace descriptor misses those differences <ref:2603.04323#pg1>.

Tom: So it means PTOPOFL can find groups that other methods based on simpler geometry just miss, which is valuable when data distributions are complex.

Paper summary: Jane: But they also pointed out a limitation: if the heterogeneity is invisible in the feature geometry itself, meaning clients look similar topologically, then PTOPOFL offers no advantage over standard FedAvg.

Meng: That’s a fair caveat; if the data isn't structurally different, this topological approach doesn't add much value.

Tom: And they also made it clear that PTOPOFL transmits model parameters and is no more private than FedAvg because they didn't use formal differential privacy guarantees for the descriptor transmission itself <ref:2603.04323#pg1>.

Jane: They did give a record-level differential privacy accounting, which shows that if you privatize the descriptor, you destroy the partition entirely.

Lu: The paper concludes by emphasizing that they have a mathematically principled integration of topological data analysis into federated learning <ref:2603.04323#pg7>.

Tom: So when we look at the full title, "PTOPOFL: Topology-Guided Personalised Federated Learning with Persistent-Homology Client Descriptors," it really tells you exactly what this framework is built on.

Jane: It’s a framework that uses topology—specifically persistent homology—to guide how clients are clustered and how they aggregate their models in federated learning.

Lu: The implication is that for complex, non-IID data, we might be able to get much better performance by understanding the underlying geometric structure of the data distributions instead of just relying on gradients.

Meng: For us deploying this, it means we need to calculate these forty-eight-dimensional descriptors upfront before training even starts to get that benefit <ref:2603.04323#pg1>.

Tom: And for me, it’s exciting because they showed a clean ablation where replacing gradients with descriptors resulted in that factor of four point five reduction in reconstruction risk <ref:2603.04323#pg3>.

Jane: So we're looking at a way to handle privacy leakage and client drift using shape summaries instead of raw data exchange.

Lu: The work is open-source, with the complete implementation available at https://github.com/MorillaLab/TopoFederatedL and a Python package on PyPI <ref:2603.04323#pg7>.

Tom: It’s a solid piece of research because they didn't just claim it works; they showed the theory behind why it should work and provided concrete benchmarks against FedAvg, FedProx, SCAFFOLD, and pFedMe <ref:2603.04323#pg3>.

Jane: It’s a very grounded approach that links topological data analysis directly to the practical problems of distributed model training.

Conclusion: Tom: So we’ve been looking at PTOPOFL, which is about using persistent homology to figure out which clients should share model info in federated learning.

Jane: Yeah, so the authors put "Topology-Guided Personalised Federated Learning with Persistent-Homology Client Descriptors" in the title. It sounds pretty dense for what it actually does.

Lu: It’s dense because they are using this mathematical idea called persistent homology to create a shape summary for each client's data distribution.

Tom: A shape summary. So, instead of sending all those huge model updates, clients just send these small, forty-eight-dimensional vectors that describe their data's structure.

Jane: Right. And the authors claim this is better because it handles two things at once: privacy leakage and client differences across the clients.

Lu: They argue that these topological descriptors are much harder to flip back into actual data than standard gradients, which is what helps with privacy risk.

Tom: I like that part about the reconstruction risk being reduced by a factor of four point five compared to just sending raw gradients. That’s a concrete number showing it works better than just basic gradient sharing.

Jane: It really suggests that if we can understand the underlying shape of client data, we can manage both privacy and model drift more effectively in this setup.

Meng: From what I see, the real question for deployment is how much upfront calculation this topological descriptor step adds to our training pipeline when running at scale.

Tom: That’s a fair point about the cost of that initial description calculation. But they do show that it can actually start converging from round one in their experiments, which is good for training speed.

Jane: It’s interesting because they also say that if the data structure doesn't change much between clients, like in some real-world scenarios, this method doesn't offer any benefit over standard FedAvg.

Lu: That’s the caveat. If the feature geometry is already very similar, then spending time calculating these complex topological features just isn't worth it for performance gains.

Tom: So it depends on the data complexity of your federation, which makes sense. But if those differences are there, they found that PTOPOFL can recover latent client groups even when simpler methods miss them.

Jane: So what this means for someone listening who just wants the gist is that we’re looking at a way to use geometry to intelligently group clients so the AI doesn't get confused by messy data distributions.

Lu: It’s about using math to build a smarter grouping mechanism than just looking at raw feature distances.

Tom: Exactly. And they’ve also shown that their privacy accounting is rigorous, proving that if you try to hide the topological descriptor, you actually destroy the clustering structure they built for them.

Jane: So it's a very principled way to think about managing data heterogeneity and security in AI training right now.

Lu: The future work they mentioned is extending this concept to deep neural network local models, which would be a big step toward making this applicable to complex models like large language models.

Université Sorbonne Paris Nord · Instituto de Hortofruticultura Subtropical y Mediterránea La Mayora Instituto de Hortofruticultura Subtropical y Mediterránea La Mayora

cs.LG, cs.CR, cs.DC, math.AT, stat.ML

Submitted: 2026-03-04

Updated: 2026-10-19

Comments: 32 pages, 6 Figures. Revised version with fine theoretical demonstration on convergence. Also real clinical dataset added

Code: https://github.com/MorillaLab/TopoFederatedL

License: http://creativecommons.org/licenses/by-nc-nd/4.0/

Importance score: 89/100

The gist: The gist: PTOPOFL introduces a framework that replaces gradient communication in federated learning with persistent homology descriptors to simultaneously address privacy leakage and client

Key concepts

Persistent Homology (PH) Descriptor: This is a fixed-length vector of 48 dimensions that summarizes the topological features of a client's data distribution. It is calculated by computing persistence diagrams, which capture connected components, loops, and voids at various spatial scales. This descriptor serves as a privacy-preserving substitute for raw model updates.
Topology-Guided Clustering: The server groups clients into clusters based on the similarity of their PH descriptors using Euclidean distance. This step addresses client heterogeneity by organizing clients with similar data structures together. Clients are then weighted within these clusters to ensure local aggregation is informed by structurally similar peers.
Intra-Cluster Aggregation: Models are combined within each cluster using a topology-weighted combination. The weights depend on the client's size and an exponential decay based on its distance from the cluster center. This ensures that the final model for a cluster is robustly representative of all members while maintaining personalization.
Information Contraction Bound: This theoretical guarantee proves that using PH descriptors leaks strictly less mutual information per sample than transmitting gradients under strongly convex losses. This quantifiable reduction in reconstruction risk demonstrates how the topological abstraction mechanism inherently enhances privacy against inversion attacks.

Terminology

Federated Learning — 2× in this paper · explained in 17 episodes
AUC — 1× in this paper · explained in 2 episodes
Benchmark — 1× in this paper · explained in 2 episodes
Federated Learning (FL) — 1× in this paper · explained in 11 episodes
Loss Function — 1× in this paper · explained in 2 episodes
Mutual Information — 1× in this paper · explained in 2 episodes
Persistent Homology — 1× in this paper · explained in 4 episodes
Scaffold — 1× in this paper · explained in 2 episodes

Summary

The gist: PTOPOFL introduces a framework that replaces gradient communication in federated learning with persistent homology descriptors to simultaneously address privacy leakage and client heterogeneity. This method achieves superior performance and reduced reconstruction risk compared to standard gradient sharing techniques.

The core problem addressed

Federated learning faces two structural tensions: gradient sharing enables data-reconstruction attacks, while non-IID client distributions degrade aggregation quality. In standard FL, clients transmit model updates that encode substantial information about local training data. This leads to two main issues: inversion attacks and client drift due to non-IID data.

The topological abstraction mechanism

The paper introduces a topological abstraction operator Φ that maps each client’s dataset to a persistence diagram PDk computed via persistent homology. These persistence diagrams encode connected components (H0), loops (H1), and higher-dimensional voids (H2) at every spatial scale simultaneously. The descriptor is a fixed-length vector of 48 dimensions, comprising Betti curves, persistence entropy, amplitude, and other scalar statistics. This many-to-one mapping makes inversion provably ill-posed because infinitely many datasets share the same topological descriptor. Furthermore, persistence diagrams form a metric space under the p-Wasserstein distance Wp, enabling principled comparison and clustering across clients.

The personalized aggregation scheme

PTOPOFL employs a two-level aggregation scheme to handle heterogeneity and privacy. Step 1 involves Topology-Guided Clustering, where clients are grouped by their topological similarity using Euclidean distance on normalized feature vectors. Step 2 performs Intra-Cluster Aggregation using a topology-weighted combination: θCj = X k∈Cj w k θ k, w k ∝ n k · exp (−∥ϕˆ k − ϕˆCj∥ · t k). Step 3 involves Inter-Cluster Blending, where cluster models are blended with a global consensus to prevent over-specialisation: θ∗ Cj = (1 − βblend) θCj + βblend ¯θ.

Robustness and privacy guarantees

The framework provides several theoretical guarantees concerning robustness and privacy. Theorem 3.7 establishes an information-contraction bound showing that PH descriptors leak strictly less mutual information per sample than gradients under strongly convex loss functions. This reduction in reconstruction risk is quantified by the ratio ρtopo/ρgrad ≈ 0.22, a factor-of-4.5 reduction in reconstruction risk relative to gradient sharing. Furthermore, Theorem 3.5 proves that the influence of adversarial clients decays exponentially in their topological separation from the honest majority. This suppression reduces adversarial influence from linear (FedAvg: O(ϵ)) to quadratic in the fraction of corrupted clients.

Empirical performance

PTOPOFL achieves state-of-the-art results across various settings. Specifically, it reaches AUC 0.841 on the Healthcare scenario and 0.910 on the Benchmark scenario. The method converges from round 1 in both scenarios using only 48-dimensional PH descriptors.

Conclusion and future work

PTOPOFL offers a mathematically principled integration of topological data analysis into federated learning. The authors emphasize that the privacy guarantee provided is information contraction rather than formal differential privacy. Future work includes extending PTOPOFL to deep neural network local models and deriving formal (ε, δ)-DP bounds for PH descriptor transmission. The complete implementation is open-source at https://github.com/MorillaLab/TopoFederatedL.

How it works

Topological Client Descriptor: Each client computes a 48-dimensional descriptor ϕk by computing persistence diagrams and extracting statistics like Betti curves and persistence entropy.
Topology-Guided Clustering: The server forms a pairwise Euclidean distance matrix on the feature vectors and applies hierarchical agglomerative clustering to group structurally similar clients.
Intra-Cluster Aggregation: Within each cluster Cj, models are combined using a topology-weighted combination where weights are proportional to the client's size and an exponential decay based on the distance to the cluster centroid.
Privacy via Topological Abstraction: Gradients are replaced by the 48-dimensional PH descriptors, which are provably harder to invert than gradients.
Anomaly Detection: Clients are flagged as anomalous if their mean descriptor distance to all other clients exceeds a threshold, and their trust weight is exponentially down-weighted.

Key theoretical results

The analysis establishes four formal results. Theorem 3.

Improvements for AI systems

No raw data or gradients are transmitted, replacing them with 48-dimensional PH descriptors which reduces reconstruction risk by a factor of 4.5 relative to gradient sharing. This enables safe deployment in privacy-sensitive domains like healthcare by reducing the channel capacity available to a reconstruction adversary.
The system can perform topology-guided personalized aggregation by clustering clients based on Wasserstein similarity between their PH diagrams, ensuring that intra-cluster models are topology-weighted. This allows the model to adapt specifically to subgroups of data distributions, as shown by the ablation study where disabling topology clustering causes a drop in AUC.
The system includes a mechanism for Topology-based anomaly detection where clients are flagged if their persistence diagrams deviate significantly from the cluster majority, allowing them to be down-weighted exponentially in their anomaly score. This provides robustness against data poisoning and model poisoning by limiting the influence of adversarial clients, reducing adversarial influence from linear (FedAvg: O(ϵ)) to quadratic in the fraction of corrupted clients.
The system supports continual learning by tracking temporal evolution of PDt k monitors concept drift, allowing it to guide adaptive learning-rate scheduling for clients whose signatures change, thereby ensuring that Clients that remain topologically stable retain their original cluster assignments, preserving the computational savings of round-0 clustering.

Abstract

Clustered and personalised federated learning (FL) needs a signal telling the server which clients should share a model. Most methods derive it from losses or model updates that must be recomputed during training. We study pTopoFL, which derives it once, before training, from a compact persistent-homology (PH) descriptor of each client's feature distribution: the server clusters clients on these descriptors, weights them within clusters, and runs blended clustered local gradient descent, returning one personalised model per cluster. For strongly convex, smooth losses we analyse the complete procedure: for any partition, one round is a contraction with factor (1-eta*mu) tau; the fixed point is characterised by a local-step drift bound, an exact formula for the effective strength of blending (which yields a calibration rule) and a stochastic floor exposing a bias-variance trade-off of clustering; and personalisation lowers the heterogeneity floor in proportion to a measurable share of the dispersion of client optima. Experiments on synthetic federations, a label-skew benchmark and a real four-hospital dataset confirm the theory and delimit the method. When feature geometry and decision rules co-vary, the PH partition recovers the latent client groups, including differences a linear-subspace descriptor misses, and pTopoFL is competitive with the strongest clustered baselines; on the real federation it lowers the test log-loss of FedAvg from 0.463 to 0.438, on par with the best personalised methods. When heterogeneity is invisible in feature geometry, it offers no advantage over FedAvg. pTopoFL transmits model parameters and is no more private than FedAvg; we give a record-level differential-privacy accounting and show that privatising the descriptor destroys the partition. Code reproduces every number.