Certifying safety for federated bayesian neural networks through parameter aggregation
Certified Uncertainty Propagation in One-Shot Federated Bayesian Models via Posterior Event Transport
Machine Learning
Summary
When many devices train parts of a model separately and combine their results, it's hard to prove the combined model is safe or reliable. The authors created a way to trace safety guarantees from each device through the combining process, so the overall model's safety can be measured more accurately. They tested this on common image tasks and showed that models can be accurate but still vary in how confidently their safety is certified. This helps understand safety in complex collaborative training.
What this means in practice
- •For machine learning engineers: Assess safety guarantees of neural network models trained collaboratively across devices using FedAvg aggregation.
- •For federated learning platform developers: Improve deployment safety checks by propagating local client uncertainty through model aggregation rules.
Authors
Mahyar Mohammadi, Mohammad Hossein Badiei, Abolfazl Yaghmaei, Hamed Kebriaei
Abstract
Probabilistic certification of Bayesian neural networks lower-bounds the posterior probability that a model satisfies a verifier-defined safety property. In one-shot federated Bayesian learning, however, the deployed model is obtained by aggregating parameters drawn from client-specific posterior distributions, so local certificates do not directly guarantee safety of the aggregated model. This paper develops a deployment-consistent certification framework by propagating local posterior events through the deployment aggregation rule, with an exact geometric characterization for Federated Averaging (FedAvg). Each client constructs disjoint hyper-rectangular regions in parameter space and computes their probability masses. The server forms Cartesian products of these regions, maps them through the deployment rule, and retains a product event only when its aggregation image is verified to satisfy the safety property. Under independent client posteriors, each product-event probability factorizes into local masses, and summing verified disjoint events yields a lower bound on safety probability of the deployed model. For FedAvg with nonnegative aggregation coefficients, the image of a Cartesian product of axis-aligned hyper-rectangles is exactly a weighted hyper-rectangle, introducing no set over-approximation. We distinguish the proposed transported-event certificate from direct certification under posterior distributions induced by FedAvg and Product-of-Gaussians aggregation. Experiments on MNIST and Fashion-MNIST under label-Dirichlet heterogeneity show that the transported FedAvg certificate ranges from 22.51% to 46.89%, while direct global certificates range from 72.05% to 91.39%. Results show that predictive accuracy and certifiable safety do not necessarily follow the same trend, and that global posterior constructions can exhibit distinct certification behavior across architectures.