Publications

2026

1. ICLR

   

   Unified Privacy Guarantees for Decentralized Learning via Matrix Factorization

   Aurélien Bellet, Edwige Cyffers, Davide Frey, Romaric Gaudel, Dimitri Lerévérend, and Francois Taiani

   In The Fourteenth International Conference on Learning Representations, 2026

   Abs Bib Paper HTML Video Poster Slides

   Decentralized Learning (DL) enables users to collaboratively train models without sharing raw data by iteratively averaging local updates with neighbors in a network graph. This setting is increasingly popular for its scalability and its ability to keep data local under user control. Strong privacy guarantees in DL are typically achieved through Differential Privacy (DP), with results showing that DL can even amplify privacy by disseminating noise across peer-to-peer communications. Yet in practice, the observed privacy-utility trade-off often appears worse than in centralized training, which may be due to limitations in current DP accounting methods for DL. In this paper, we show that recent advances in centralized DP accounting based on Matrix Factorization (MF) for analyzing temporal noise correlations can also be leveraged in DL. By generalizing existing MF results, we show how to cast both standard DL algorithms and common trust models into a unified formulation. This yields tighter privacy accounting for existing DP-DL algorithms and provides a principled way to develop new ones. To demonstrate the approach, we introduce MAFALDA-SGD, a gossip-based DL algorithm with user-level correlated noise that outperforms existing methods on synthetic and real-world graphs.

   @inproceedings{bellet2026unified,
     title = {Unified Privacy Guarantees for Decentralized Learning via Matrix Factorization},
     author = {Bellet, Aur{\'e}lien and Cyffers, Edwige and Frey, Davide and Gaudel, Romaric and Ler{\'e}v{\'e}rend, Dimitri and Taiani, Francois},
     booktitle = {The Fourteenth International Conference on Learning Representations},
     year = {2026},
     keywords = {Decentralized learning, Differential privacy, Correlated noises},
     url = {https://openreview.net/forum?id=JTUOGo7NFD},
     paper = {https://openreview.net/pdf?id=JTUOGo7NFD},
   }

2. arXiv

   

   Your Neighbors Know: Leveraging Local Neighborhoods for Backdoor Detection in Decentralized Learning

   Sayan Biswas, Antoine Boutet, Davide Frey, Romaric Gaudel, Rachid Guerraoui, Maxime Jacovella, Anne-Marie Kermarrec, Dimitri Lerévérend, François Taı̈ani, and Martijn Vos

   arXiv preprint arXiv:2605.19969, 2026

   Abs Bib Paper

   Decentralized learning (DL) is an emerging machine learning paradigm where nodes collaboratively train models without a central server. However, the collaborative nature of DL makes it vulnerable to backdoor attacks, where a model is taught to behave normally on standard inputs while executing hidden, malicious actions when encountering data with specific triggers. Backdoor attacks in DL remain understudied and existing defenses often overlook DL constraints. We introduce Argus, a novel backdoor detection framework native to DL that requires neither a central coordinator nor prior knowledge of the trigger. In Argus, honest nodes locally analyze received model updates to identify potential backdoor triggers. Nodes then collectively share their triggers with their neighbors and use a structural similarity metric to separate true backdoors from false alarms induced by data heterogeneity. A key insight is that false positive triggers exhibit inconsistencies across participants while true positive ones show consistent patterns. Model updates that fail this collaborative test are rejected, and persistently malicious senders are eventually evicted. We provide the first theoretical convergence guarantees for a DL-specific backdoor detection mechanism, showing that filtering out suspicious model updates with high probability preserves a convergence rate comparable to standard DL. We implement and evaluate Argus on three standard datasets and against three state-of-the-art baselines. Across settings, Argus reduces attack success rates by up to 90 points compared to no defense, while preserving model utility within 5 percentage points of an omniscient oracle. Furthermore, the effectiveness of Argus compared to baselines improves as data heterogeneity increases.

   @article{biswas2026your,
     title = {Your Neighbors Know: Leveraging Local Neighborhoods for Backdoor Detection in Decentralized Learning},
     author = {Biswas, Sayan and Boutet, Antoine and Frey, Davide and Gaudel, Romaric and Guerraoui, Rachid and Jacovella, Maxime and Kermarrec, Anne-Marie and Ler{\'e}v{\'e}rend, Dimitri and Ta{\"\i}ani, Fran{\c{c}}ois and de Vos, Martijn},
     journal = {arXiv preprint arXiv:2605.19969},
     year = {2026},
     url = {https://arxiv.org/abs/2605.19969},
     paper = {https://arxiv.org/abs/2605.19969},
   }

3. arXiv

   

   Mosaic Learning: A Framework for Decentralized Learning with Model Fragmentation

   Sayan Biswas, Davide Frey, Romaric Gaudel, Nirupam Gupta, Anne-Marie Kermarrec, Dimitri Lerévérend, Rafael Pires, Rishi Sharma, François Taïani, and Martijn Vos

   Feb 2026

   Abs DOI Bib Paper

   Decentralized learning (DL) enables collaborative machine learning (ML) without a central server, making it suitable for settings where training data cannot be centrally hosted. We introduce Mosaic Learning, a DL framework that decomposes models into fragments and disseminates them independently across the network. Fragmentation reduces redundant communication across correlated parameters and enables more diverse information propagation without increasing communication cost. We theoretically show that Mosaic Learning (i) shows state-of-the-art worst-case convergence rate, and (ii) leverages parameter correlation in an ML model, improving contraction by reducing the highest eigenvalue of a simplified system. We empirically evaluate Mosaic Learning on four learning tasks and observe up to 12 percentage points higher node-level test accuracy compared to epidemic learning (EL), a state-of-the-art baseline. In summary, Mosaic Learning improves DL performance without sacrificing its utility or efficiency, and positions itself as a new DL standard.

   @article{biswasMosaicLearningFramework2026,
     title = {Mosaic {{Learning}}: {{A Framework}} for {{Decentralized Learning}} with {{Model Fragmentation}}},
     shorttitle = {Mosaic {{Learning}}},
     author = {Biswas, Sayan and Frey, Davide and Gaudel, Romaric and Gupta, Nirupam and Kermarrec, Anne-Marie and Ler{\'e}v{\'e}rend, Dimitri and Pires, Rafael and Sharma, Rishi and Ta{\"i}ani, Fran{\c c}ois and de Vos, Martijn},
     year = {2026},
     month = feb,
     number = {arXiv:2602.04352},
     primaryclass = {cs},
     publisher = {arXiv},
     urldate = {2026-02-09},
     doi = {10.48550/arXiv.2602.04352},
     archiveprefix = {arXiv},
     keywords = {Computer Science - Machine Learning},
     url = {https://arxiv.org/abs/2602.04352},
     paper = {https://arxiv.org/abs/2602.04352},
   }

2025

1. PETS

   

   Low-Cost Privacy-Preserving Decentralized Learning

   Sayan Biswas, Davide Frey, Romaric Gaudel, Anne-Marie Kermarrec, Dimitri Lerévérend, Rafael Pires, Rishi Sharma, and François Taïani

   Proceedings on Privacy Enhancing Technologies, 2025

   Abs DOI Bib Paper Poster Slides

   This paper introduces ZIP-DL, a novel privacy-aware decentralized learning (DL) algorithm that relies on adding correlated noise to each model update during the model training process. This technique ensures that the added noise almost neutralizes itself during the aggregation process due to its correlation, thus minimizing the impact on model accuracy. In addition, ZIP-DL does not require multiple communication rounds for noise cancellation, addressing the common trade-off between privacy protection and communication overhead. We provide theoretical guarantees for both convergence speed and privacy guarantees, thereby making ZIP-DL applicable to practical scenarios. Our extensive experimental study shows that ZIP-DL achieves the best trade-off between vulnerability and accuracy. In particular, ZIP-DL (i) reduces the effectiveness of a linkability attack by up to 52 points compared to baseline DL, and (ii) achieves up to 37 more accuracy points for the same vulnerability under membership inference attacks against a privacy-preserving competitor

   @article{biswasLowCostPrivacyPreservingDecentralized2025,
     title = {Low-{{Cost Privacy-Preserving Decentralized Learning}}},
     author = {Biswas, Sayan and Frey, Davide and Gaudel, Romaric and Kermarrec, Anne-Marie and Ler{\'e}v{\'e}rend, Dimitri and Pires, Rafael and Sharma, Rishi and Ta{\"i}ani, Fran{\c c}ois},
     year = {2025},
     journal = {Proceedings on Privacy Enhancing Technologies},
     volume = {2025},
     number = {3},
     pages = {451--474},
     issn = {2299-0984},
     doi = {10.56553/popets-2025-0108},
     urldate = {2025-05-20},
     url = {https://petsymposium.org/popets/2025/popets-2025-0108.php},
     paper = {https://petsymposium.org/popets/2025/popets-2025-0108.php},
     keywords = {Decentralized learning, Differential privacy, Correlated noises},
   }