FedDecouple: Mitigating Noise Accumulation in Differentially Private Federated Learning via Phase Decoupling

Abstract

Differential privacy protection in federated learning faces the fundamental challenge of noise accumulation: noise added dispersedly by clients accumulates in variance during server-side aggregation, severely harming model convergence and accuracy. This paper proposes FedDecouple, a phase-decoupled differentially private federated learning framework that is analytically suited for resource-constrained mobile devices. The core innovation lies in decoupling the noise addition phase from the client computation phase—clients only upload clean gradients, while two auxiliary servers collaboratively generate and inject noise through a secure two-party MPC protocol. This design reduces the effective noise variance while eliminating the per-sample gradient computation burden on clients. Experimental results show that on MNIST, FedDecouple maintains 97.75% accuracy under strict privacy, significantly outperforming client-side noised DP-SGD with 94.0% accuracy. On CIFAR-10, it achieves 76.2% test accuracy, which is 13.4 percentage points higher than DP-SGD. FedDecouple’s total training time on both datasets is faster than Opacus and DP-SGD.

1. Introduction

Federated learning (FL) [1], as a distributed machine learning paradigm, enables multiple clients to collaboratively train models without sharing raw data, making it a key technology in privacy-sensitive domains such as mobile devices, medical data, and financial risk control. Taking mobile devices as an example, applications like Google’s Gboard input method and Apple’s Siri voice assistant have successfully implemented federated learning frameworks, enhancing model performance while protecting user privacy. However, recent research indicates that shared model updates may leak sensitive information—attackers can reconstruct training data from shared gradients through techniques such as gradient inversion attacks [2], member inference attacks [3], and model inversion attacks [4], severely limiting the practical deployment of federated learning in high privacy-sensitive scenarios.

To address this threat, differential privacy (DP) [5] has become the gold standard for providing quantifiable privacy guarantees in federated learning. In federated learning environments, the predominant privacy protection approach is client-side differential privacy [6]: after local training, each client applies gradient clipping and Gaussian noise to its model updates before uploading the noisy updates to the server for aggregation. This paradigm can be formally regarded as a natural extension of DP-SGD [7] to federated settings, and the industry has developed mature tools such as Opacus [8] to support such training.

1.1. Problem Statement and Research Question

However, a thorough analysis reveals a fundamental structural flaw in this paradigm—the noise accumulation effect. Let each round involve m clients, with each client contributing Gaussian noise of variance ${\sigma }_{\mathrm{loc}}^2$. During server-side aggregation, this noise accumulates via the sum-of-squares principle, resulting in a total noise variance of $m{\sigma }_{\mathrm{loc}}^2$. This severely compromises convergence speed, significantly reduces model accuracy, and leads to inefficient utilization of the privacy budget. The issue becomes particularly pronounced with a large number of clients—where mobile device federated learning typically involves thousands or even tens of thousands of participants—the noise accumulation effect becomes a critical performance bottleneck.

This observation motivates our central research question:

“Given the limited resources of mobile devices, can we fundamentally restructure the noise injection process in DP-FL to eliminate noise accumulation at its source, rather than merely mitigating its effects?”

To answer this question, we formulate the following research objectives:

• Feasibility Objective: To determine whether it is possible to decouple the noise addition phase from the client computation phase without compromising the DP guarantee.
• Privacy Objective: To design a protocol that achieves equivalent $(ϵ,\delta )$-DP protection without relying on client-side noise injection.
• Utility Objective: To demonstrate that the proposed phase-decoupled design achieves superior convergence speed and final accuracy compared to existing client-side DP approaches under the same privacy budget.
• Efficiency Objective: To reduce the client-side computational burden, making the approach suitable for resource-constrained mobile devices.

1.2. State-of-the-Art Gap Analysis

Recent advancements have explored various directions to improve DP-FL. Xue et al. [9] proposed adaptive noise mechanisms that dynamically adjust the noise scale based on historical gradient information. Wang et al. [10] developed FedFR-ADP, which uses Earth Mover’s Distance to quantify data heterogeneity and adaptively tunes noise intensity and privacy budget. Yuan et al. [11] introduced DP-FedPUAC with update-wise adaptive clipping and adaptive local iteration. Li et al. [12] designed SFLES with hierarchical sparsification and direction-similarity-aware aggregation.

Despite these advances, a fundamental gap remains: all existing approaches still follow the client-side local noise injection paradigm. They attempt to mitigate the effects of noise accumulation through adaptive techniques, but they do not eliminate its root cause—the tight coupling between noise injection and client-side computation. This structural limitation persists across all current DP-FL methods, and we are not aware of any prior work that fundamentally restructures the noise injection process by decoupling it from client-side computation.

This gap is particularly critical for mobile device deployments, where client-side per-sample gradient computation and noise injection impose significant computational and energy overhead. A phase-decoupled approach that shifts the privacy burden from clients to the server side could simultaneously address both the noise accumulation problem and the client-side efficiency challenge.

1.3. Proposed Approach: Phase Decoupling

This paper proposes a novel design philosophy—phase decoupling—that fundamentally restructures the noise injection process. The key insight is that noise need not be added at the client side. Instead, we propose that clients upload clean gradients, and noise is injected once at the server side after aggregation, through a secure two-party MPC protocol.

This design addresses our research objectives as follows:

• Feasibility (Objective 1): We demonstrate that phase decoupling is feasible by designing a complete protocol where clients upload clean gradients, and two auxiliary servers collaboratively generate and inject a single calibrated Gaussian noise through a secure two-party MPC protocol.
• Privacy (Objective 2): We provide rigorous RDP-based privacy analysis showing that our protocol achieves $(ϵ,\delta )$-DP equivalent to client-side DP.
• Utility (Objective 3): By injecting noise only once, our approach reduces the effective noise variance from $m·{\sigma }_{\mathrm{loc}}^2$ to ${\sigma }_{\mathrm{global}}^2$, enabling faster convergence and higher accuracy.
• Efficiency (Objective 4): Clients only compute batch gradients (not per-sample gradients) and do not perform local noise addition, significantly reducing the computational burden on mobile devices.

1.4. Contributions

The main contributions of this paper are as follows:

• Phase Decoupling Design Principle: We propose phase decoupling as a new design principle for DP-FL, breaking the tight coupling between noise and computation. This principle opens up new design possibilities for DP-FL and makes it particularly suitable for deployment on mobile devices with limited computing resources (Section 4.2).
• Secure Two-Party Noise Generation Protocol: We design a complete six-round interactive protocol that enables two auxiliary servers to collaboratively generate Gaussian noise satisfying DP requirements without a single trusted server. This protocol uses commitment schemes to prevent malicious behavior (Section 4.2.2).
• Comprehensive Privacy Analysis: We provide rigorous RDP-based privacy analysis with formal sensitivity bounds, subsampling amplification, and complete RDP composition across rounds. We quantitatively compare our privacy guarantees with DP-FedAvg (Section 4.3).
• Experimental Validation: Extensive experiments on MNIST and CIFAR-10 across three privacy levels ($ϵ=8,4,1$) demonstrate that FedDecouple consistently outperforms DP-SGD, Opacus, and DP-FTRL in convergence speed and final accuracy. On CIFAR-10, FedDecouple achieves 76.2% accuracy, surpassing DP-SGD by 13.4 percentage points (Section 5).

1.5. Paper Roadmap

The remainder of this paper is organized as follows:

• Section 2: Reviews related work on DP-FL, including foundational methods and recent advances in adaptive noise, shuffling, and MPC-based approaches.
• Section 3: Provides preliminary knowledge on differential privacy, DP-FedAvg, privacy accounting, and secret sharing.
• Section 4: Describes the FedDecouple protocol, including system models, threat assumptions, the two-phase design, security analysis, and complexity analysis.
• Section 5: Presents implementation details, including model architectures, dataset preprocessing, hyperparameter configurations, and experimental setup.
• Section 6: Reports experimental results and analysis, comparing FedDecouple with baseline methods across multiple privacy levels and datasets.
• Section 7: Concludes this paper and discusses future research directions.

2. Related Work

A central challenge in differentially private federated learning (DP-FL) is the trade-off between privacy protection and model utility. Existing approaches to this challenge can be categorized along a spectrum according to how they handle the relationship between noise injection and client-side computation:

• Client-side noise injection (traditional paradigm): Methods such as DP-FedAvg [6] and DP-SGD [7] add noise independently at each client before aggregation. These methods suffer from noise accumulation during server-side aggregation, which is the fundamental problem we address in this work.
• Optimized client-side noise: Recent works have attempted to mitigate the effects of client-side noise through adaptive mechanisms [9,10,11,13,14], shuffling [15,16,17], or personalized privacy budgets [18,19]. While these approaches improve utility, they still operate within the client-side noise paradigm and do not eliminate its root cause.
• Server-side noise with trusted servers: Some works achieve server-side noise injection by relying on a single trusted server to add noise after secure aggregation. However, this reintroduces a single point of trust and requires heavy client-side cryptographic computation.
• FedDecouple (this work): We propose a fundamentally different approach—phase decoupling—where noise is injected once on the server side through a secure two-party MPC protocol, without requiring a trusted server. This positions our work at the extreme end of the spectrum: fully decoupling noise from client-side computation.

This categorization clarifies the unique positioning of our contribution: while existing methods either accept the consequences of client-side noise or attempt to mitigate them through optimization, we fundamentally restructure the noise injection process to eliminate noise accumulation at its source. The following subsections review representative works across three dimensions: noise mechanism optimization, privacy budget management, and model update optimization, with particular emphasis on how each relates to the noise-computation coupling problem.

Differentially Private Federated Learning (DPFL) aims to balance privacy protection and model utility. This section reviews representative works across three dimensions: noise mechanism optimization, privacy budget management, and model update optimization.

2.1. Foundational Works

Geyer et al. first demonstrated the feasibility of client-side differential privacy in federated learning, showing that adding noise to each client’s updates can provide formal privacy guarantees. McMahan et al. formally proposed DP-FedAvg [6], which clips and adds Gaussian noise to client updates before upload, laying the foundation for client-level DP. This paradigm has become the de facto standard for DPFL. Abadi et al. [7] introduced the moments accountant, a critical advancement that enables precise privacy budget tracking in iterative training by tracking the moment generating function of privacy loss, significantly reducing the required noise compared to traditional composition theorems. Kairouz et al. [8] proposed DP-FTRL, which injects correlated noise via tree aggregation, achieving differential privacy without relying on sampling amplification. Unlike DP-SGD, DP-FTRL allows arbitrary data access order, making it particularly suitable for federated settings where client participation is unpredictable. Pichapati et al. [20] developed AdaClip, an adaptive gradient clipping mechanism that dynamically adjusts the clipping threshold based on gradient norm distributions, reducing the amount of excess noise injected. Thakkar et al. further extended adaptive clipping to federated scenarios, demonstrating its effectiveness in heterogeneous data settings. Industrial tools like Opacus [21] provide efficient per-sample gradient computation for DP-SGD, making DP training more accessible to practitioners. An amplitude-varying perturbation strategy [22] was also introduced, which uses smaller noise early in training for faster convergence and larger noise later for stronger privacy protection.

2.2. Adaptive Noise and Dynamic Privacy Allocation

Xue et al. [9] proposed an adaptive noise mechanism that dynamically adjusts the noise scale based on model parameter magnitudes and historical gradient information, improving model utility while maintaining privacy guarantees. Wang et al. [10] developed FedFR-ADP, a framework that employs Earth Mover’s Distance to quantify client-side data heterogeneity, thereby adaptively adjusting Gaussian noise intensity. It also incorporates a feedback adjustment mechanism to dynamically optimize the privacy budget according to global model errors, achieving at least 3.05% and 1.76% accuracy improvements on two image datasets. Yuan et al. [22] further refined amplitude-varying perturbation, deriving an upper bound for the optimal number of global aggregation rounds. Wang et al. [23] introduced FedAPCA, which integrates dynamic privacy budget allocation, adaptive segmented perturbation mechanisms, and hierarchical clustering aggregation methods. The framework enables clients to independently set privacy budgets based on their data characteristics, achieving 1–2% accuracy improvements on MNIST and CIFAR-10. Yuan et al. [11] proposed DP-FedPUAC, featuring update-wise adaptive clipping thresholds based on real-time gradient norm responses and an adaptive local iteration strategy that automatically adjusts training rounds based on model performance. Extensive experiments on MNIST, FMNIST, CIFAR-10, and CIFAR-100 demonstrate superior privacy-utility trade-offs with significantly reduced communication rounds. Wang et al. [13] presented APDP-FL, a personalized framework with adaptive noise addition that scores training processes and dynamically adjusts noise levels—adding larger noise early and gradually reducing it to accelerate convergence while respecting personalized privacy preferences. Li et al. [12] designed SFLES, which employs hierarchical sparsification, bounded noise mechanisms based on symmetric segmented distribution, and direction-similarity-aware aggregation to accelerate convergence under DP constraints. Xu et al. [14] introduced GDPFed and GDPFed+ to address heterogeneous privacy requirements, grouping clients by privacy budget and optimizing sampling ratios to minimize convergence error.

2.3. Shuffling, Privacy Amplification, and Lightweight DP

Xu et al. [15] proposed Camel, a framework that, for the first time, supports malicious security and integrity checks within the shuffling model. Leveraging secret-sharing shuffling technology, Camel enhances server-side computation security through system-level communication efficiency optimization and lightweight integrity verification. Through Rényi differential privacy analysis across the entire FL process, the authors derived tighter upper bounds for privacy loss. Wang et al. [16] investigated individual computation beyond statistical estimation in the shuffling model, proposing a novel paradigm that incorporates statistical random identities into DP, preserving security functions while maintaining privacy amplification effects after message shuffling. This technique is suitable for non-statistical computing scenarios such as spatial crowdsourcing and combinatorial optimization. Hong et al. [17] developed LightDP-FL, a lightweight DPFL scheme for untrusted peers and servers. By injecting both individual and pairwise noise simultaneously, it achieves privacy protection with minimal overhead. The scheme leverages upper bounds on the numbers of stragglers and colluders to prove sufficient noise variance conditions under worst-case scenarios.

2.4. MPC and Secret Sharing for DP-FL

Wei et al. [24] designed DDP-SA, a scalable privacy-preserving framework combining client-side local DP with full-threshold additive secret sharing. Its two-stage protection ensures that no single compromised server can obtain client updates, and the parameter server only reconstructs aggregated noisy gradients. Hua et al. [25] proposed Clover, integrating gradient sparsification, data encoding, lightweight cryptography, and DP with a three-server distributed trust model. Its secure sparse vector aggregation mechanism achieves orders of magnitude reduction in communication and runtime compared to ORAM-based baselines. Madathil et al. [26] introduced TACITA, a single-server secure aggregation protocol satisfying four key properties: single client communication, input reliability, constant-size communication, and dropout robustness, relying on compact multi-key linearly homomorphic threshold signatures. Tjuawinata et al. [27] proposed a zero-failure bounded discrete Laplacian perturbation mechanism with MPC implementation, overcoming failure probabilities in existing bounded discrete Laplacian variants. Xie et al. [28] proposed CoSIFL, integrating active alerting, local DP, and Stackelberg game incentives to defend against Byzantine attacks while rewarding honest clients. Ebrahimi Atani et al. [29] proposed FedSelect-ME, a hierarchical multi-party framework with intelligent client selection based on utility, energy efficiency, and data sensitivity, combined with homomorphic encryption and DP.

2.5. Low-Rank Adaptation, Verifiable Aggregation, and System Optimization

Zhu et al. [30] proposed DEeR, addressing aggregation bias and noise amplification when combining Low-Rank Adaptation (LoRA) with DP in federated learning. The framework includes a deviation eliminator ensuring zero aggregation bias and a noise regulator that decouples DP from LoRA using two adjustment factors, suppressing noise amplification effects. Shen et al. [18] introduced PLDP-FL, supporting personalized local DP by allowing each client to autonomously choose its privacy budget level based on data sensitivity, with a privacy-budget-aware aggregation mechanism. Shen et al. [19] further developed an adaptive local DP scheme with dynamic privacy budget allocation based on data distribution characteristics and training progress, plus a verifiable aggregation mechanism to prevent server tampering. Shen et al. [31] proposed a verifiable privacy-preserving scheme under multiple encrypted keys using proxy re-encryption and zero-knowledge proofs. Peng et al. [32] proposed a communication-efficient verifiable aggregation scheme combining gradient quantization, additive secret sharing, and homomorphic message authentication codes. Chen et al. [33] proposed M2FDP for hierarchical networks with layer-wise noise adaptation based on trust models of different subnets. Shan et al. [34], Amanullah et al., and Rahdari et al. provided comprehensive reviews of DPFL optimization, applications in deep learning, and comparisons of privacy protection approaches including MPC, DP, trusted execution environments, and federated learning. A recent MDPI study proposed adaptive DP-FL for edge devices with gradient sparsification and quantization to reduce communication overhead while maintaining privacy protection.

3. Preliminary Knowledge

This section provides the foundational concepts necessary for understanding the proposed FedDecouple framework and its analysis. The content is organized to serve three specific purposes that directly support the subsequent sections of this paper:

• Differential Privacy Foundations (Section 3.1, Section 3.2 and Section 3.3): We introduce the formal definition of differential privacy, the Gaussian mechanism, and the DP-FedAvg algorithm. These concepts establish the baseline privacy model and provide the reference point against which we compare our approach. The privacy analysis of FedDecouple in Section 4.3 directly builds upon the Rényi Differential Privacy (RDP) framework introduced in Section 3.3 and the moments accountant formulation used for cumulative privacy tracking.
• Secret Sharing and Cryptographic Primitives (Section 3.4): We cover additive secret sharing as the fundamental cryptographic primitive underlying our secure two-party MPC protocol. This material directly supports the protocol design in Section 4.2 and the security analysis in Section 4.4.
• Symbols and Conventions (Section 3.5): We define the notation used consistently throughout this paper, including the symbol table that facilitates readability across all sections.

In essence, this section provides the theoretical building blocks—differential privacy definitions, the DP-FedAvg baseline, privacy accounting methods, cryptographic primitives, and notation—that are systematically combined in Section 4 to construct the FedDecouple protocol and analyze its privacy guarantees. Experimental comparisons in Section 5 and Section 6 rely on the DP-FedAvg formulation established here as the primary baseline.

The following subsections review the federated learning workflow, the definition of differential privacy, the moments accountant and Rényi differential privacy, outline the federated learning process for differential privacy, and explain the relevant symbols and conventions used in this paper.

In this section, we briefly review the workflow of federated learning and the definition of differential privacy, introduce the moments accountant and Rényi differential privacy, outline the federated learning process for differential privacy, and explain the relevant symbols and conventions used in this paper.

3.1. Differential Privacy

Differential Privacy (DP) provides quantifiable privacy protection for algorithms. Its core principle is that the output distributions of an algorithm across two adjacent datasets must be sufficiently similar, preventing attackers from inferring the presence of a specific sample based on the output observations.

Definition 1 

(Adjacent datasets). Two datasets D and $D^{\prime }$ are considered adjacent if they differ by at most one record (i.e., $|D▵D^{\prime }|=1$).

Definition 2 

($(ϵ,\delta )$-Differential Privacy). A randomized algorithm $\mathcal{M}:{\mathcal{D}}^n\to \mathcal{R}$ satisfies $(ϵ,\delta )$-differential privacy if, for any adjacent datasets $D,D^{\prime }$ and any output subset $S\subseteq \mathcal{R}$, the following holds:

$$Pr[\mathcal{M}\left(D\right)\in S]\le e^{ϵ}Pr[\mathcal{M}\left(D^{\prime }\right)\in S]+\delta$$

where the probability is taken over the randomness of the algorithm.

The Gaussian mechanism [35] is a commonly used tool for achieving differential privacy. For a query function $q:{\mathcal{D}}^n\to {\mathbb{R}}^p$, its ${\mathsf{\ell }}_2$ sensitivity is defined as:

$${\mathrm{\Delta }}_2=\underset{D,D^{\prime }}{max}{\parallel q\left(D\right)-q\left(D^{\prime }\right)\parallel }_2$$

The Gaussian mechanism returns $q\left(D\right)+\mathcal{N}(0,{\mathrm{\Delta }}_2^2{\sigma }^{2}I)$, where $\sigma$ is determined by the target privacy parameter. It has been proven that this mechanism satisfies $(ϵ,\delta )$-differential privacy when $\sigma \ge {\mathrm{\Delta }}_2\sqrt{2log(1.25/\delta )}/ϵ$.

Differential privacy possesses three important properties:

• Sequential Composition: The combination of multiple DP algorithms still satisfies DP, with privacy parameters accumulating accordingly.
• Parallel Composition [36]: A combination of DP algorithms applied to non-overlapping datasets satisfies DP with the privacy parameters set to their maximum values.
• Post-processing Invariance: Any subsequent processing applied to the output of a DP algorithm does not compromise privacy protection.

3.2. DP-FedAvg Algorithm

Privacy Model: We adopt the standard client-level differential privacy model for federated learning [6]. In this model, two datasets $\mathcal{D}$ and ${\mathcal{D}}^{\prime }$ are considered adjacent if they differ by the data of exactly one client (i.e., one client’s entire local dataset is added, removed, or replaced). This is the privacy model used throughout this paper. The terms “client-level” and “user-level” are used interchangeably to refer to this same adjacency definition.

The classic DP-FedAvg algorithm can be described as follows: In the t-th communication round, the server selects a subset of clients ${\mathcal{S}}_t$ and distributes the current global model ${\theta }^t$ to them. Each selected client k performs E rounds of SGD on its local data to obtain a model update ${\mathrm{\Delta }}_k^t$. Subsequently, the clients undergo a two-step privacy processing:

• Gradient clipping: Clip the update to ensure the ${\mathsf{\ell }}_2$ norm does not exceed a certain value C:

  $${\tilde{\mathrm{\Delta }}}_k^t={\mathrm{\Delta }}_k^t·min\left(1,{\displaystyle \frac{C}{\parallel {\mathrm{\Delta }}_k^t{\parallel }_2}}\right)$$
• Local noise addition: Add Gaussian noise:

  $${\widehat{\mathrm{\Delta }}}_k^t={\tilde{\mathrm{\Delta }}}_k^t+\mathcal{N}(0,{\sigma }_{\mathrm{loc}}^2{C}^{2}I)$$

The client uploads the noisy update ${\widehat{\mathrm{\Delta }}}_k^t$ to the server, and the server aggregates it to obtain the global update:

$${\theta }^{t+1}={\theta }^t+{\displaystyle \frac{1}{|{\mathcal{S}}_t|}}\sum _{k\in {\mathcal{S}}_t}{\widehat{\mathrm{\Delta }}}_k^t$$

This privacy analysis paradigm typically relies on the moments accountant or RDP. It has been demonstrated that, with an appropriately configured noise scale ${\sigma }_{\mathrm{loc}}$, the entire training process satisfies $(ϵ,\delta )$-client-level DP.

However, this paradigm suffers from a fundamental issue—noise accumulation under the client-level DP model. Since each client’s update contains independent noise, the effective noise variance in the aggregated global update is given by:

$$Var\left[{\mathrm{noise}}_{\mathrm{global}}\right]={\displaystyle \frac{{\sigma }_{\mathrm{loc}}^2{C}^2}{|{\mathcal{S}}_t|}}$$

Averaging over $|{\mathcal{S}}_t|$ clients reduces the variance of the per-round noise. However, this does not eliminate noise accumulation in the following sense: to achieve a target $(ϵ,\delta )$-DP guarantee over T rounds, the required per-client noise scale ${\sigma }_{\mathrm{loc}}$ must grow with $\sqrt{T·|{\mathcal{S}}_t|}$ (due to RDP composition). Substituting this required ${\sigma }_{\mathrm{loc}}$ into the effective variance shows that the resulting effective noise is proportional to $T·|{\mathcal{S}}_t|·C^2$, which grows linearly with $|{\mathcal{S}}_t|$. This constitutes the noise accumulation problem: more clients do not reduce the effective noise after accounting for the privacy cost of composition.

More critically, when employing the moments accountant to analyze multi-round training, the noise scale corresponding to the total privacy loss is inversely proportional to ${\sigma }_{\mathrm{loc}}$. This necessitates the use of a larger ${\sigma }_{\mathrm{loc}}$ to achieve the same $(ϵ,\delta )$ privacy guarantee, thereby further amplifying the noise. The dual accumulation of this noise across spatial and temporal dimensions constitutes a bottleneck that limits the performance of existing DP-FL methods.

3.2.1. Noise Accumulation vs. Noise Averaging: A Clarification

A central claim of this paper is that client-side differential privacy suffers from noise accumulation. However, the reviewer correctly observes that aggregation via averaging reduces variance by a factor of $|{\mathcal{S}}_t|$, as shown in Equation (1):

$$Var\left[{\mathrm{noise}}_{\mathrm{global}}\right]={\displaystyle \frac{{\sigma }_{\mathrm{loc}}^2{C}^2}{|{\mathcal{S}}_t|}}$$

This seems to contradict the claim that “noise accumulates” at the server. We clarify this important distinction below.

The Core Issue Is Not Per-Round Variance, but Required Noise Scale

The critical observation is that the variance in Equation (1) assumes a fixed ${\sigma }_{\mathrm{loc}}$. However, in client-side DP, the per-client noise scale ${\sigma }_{\mathrm{loc}}$ itself must be set based on the desired total privacy budget over T rounds. Through the RDP composition, the required ${\sigma }_{\mathrm{loc}}$ scales with $\sqrt{T·|{\mathcal{S}}_t|}$ to meet a target $(ϵ,\delta )$, while in FedDecouple the required ${\sigma }_{\mathrm{global}}$ is independent of $|{\mathcal{S}}_t|$ and only scales with $\sqrt{T}$.

Why DP-FedAvg’s Required Noise Scale Grows with $|{\mathcal{S}}_t|$

The reason ${\sigma }_{\mathrm{loc}}$ must be larger for larger $|{\mathcal{S}}_t|$ lies in the sensitivity analysis and privacy composition:

• Sensitivity of the Aggregated Update: In DP-FedAvg, each client’s update is clipped to ${\mathsf{\ell }}_2$-norm C. The aggregated update ${\overline{\mathrm{\Delta }}}^t={\sum }_{k\in {\mathcal{S}}_t}{\tilde{\mathrm{\Delta }}}_k^t$ has sensitivity $2C$ (not $|{\mathcal{S}}_t|C$). However, the per-client noise $\mathcal{N}(0,{\sigma }_{\mathrm{loc}}^2{C}^{2}I)$ is added independently at each client. After aggregation, the effective noise is ${\displaystyle \frac{1}{|{\mathcal{S}}_t|}}{\sum }_k\mathcal{N}(0,{\sigma }_{\mathrm{loc}}^2{C}^{2}I)\sim \mathcal{N}(0,{\displaystyle \frac{{\sigma }_{\mathrm{loc}}^2{C}^2}{|{\mathcal{S}}_t|}}I)$.
• Privacy Composition Over Rounds: The privacy cost is counted per communication round. Since each round consumes privacy budget, the total RDP over T rounds is:

  $${\rho }_{\mathrm{total}}\left(\alpha \right)=T·{\displaystyle \frac{\alpha }{2{\sigma }_{\mathrm{loc}}^2}}·q^2$$

  where $q=|{\mathcal{S}}_t|/K$ is the sampling rate. To achieve a target $ϵ$, the required ${\sigma }_{\mathrm{loc}}$ is proportional to $\sqrt{T}·q$, i.e., ${\sigma }_{\mathrm{loc}}\propto \sqrt{T}·{\displaystyle \frac{|{\mathcal{S}}_t|}{K}}$.
• Substituting Back: Plugging this required ${\sigma }_{\mathrm{loc}}$ into the effective variance:

  $${Var}_{\mathrm{DP}\text{-}\mathrm{FedAvg}}^{\mathrm{effective}}={\displaystyle \frac{{\sigma }_{\mathrm{loc}}^2{C}^2}{|{\mathcal{S}}_t|}}\propto {\displaystyle \frac{T·|{\mathcal{S}}_t|·C^2}{K^2}}$$
  This grows linearly with $|{\mathcal{S}}_t|$.

Why FedDecouple’s Noise Scale Is Independent of $|{\mathcal{S}}_t|$

In FedDecouple, noise is injected only once at the server after aggregation. The sensitivity remains C (Theorem 1). The RDP per round is:

$${\rho }_{\mathrm{round}}\left(\alpha \right)={\displaystyle \frac{\alpha }{2{\sigma }_{\mathrm{global}}^2}}·q^2$$

which is identical in form. However, the effective variance after aggregation is simply

$${Var}_{\mathrm{FedDecouple}}={\sigma }_{\mathrm{global}}^2{C}^2$$

With ${\sigma }_{\mathrm{global}}\propto \sqrt{T}·q=\sqrt{T}·\left|{\mathcal{S}}_t\right|/K$, the effective variance becomes:

$${Var}_{\mathrm{FedDecouple}}\propto {\displaystyle \frac{T·|{\mathcal{S}}_t{|}^2·C^2}{K^2}}$$

which grows quadratically with $|{\mathcal{S}}_t|$ if ${\sigma }_{\mathrm{global}}$ were to scale with $|{\mathcal{S}}_t|$. However, in FedDecouple, the global noise is injected once, not per client, so the privacy composition is counted once per round regardless of how many clients participate. Therefore, the required ${\sigma }_{\mathrm{global}}$ scales with $\sqrt{T}$, independent of $|{\mathcal{S}}_t|$:

$${\sigma }_{\mathrm{global}}\propto \sqrt{T}$$

The effective variance is therefore

$${Var}_{\mathrm{FedDecouple}}\propto T·C^2$$

which is independent of $|{\mathcal{S}}_t|$.

Key Takeaway

The comparison in

Table 1. Effective noise variance comparison (after aggregation).

Criterion	DP-FedAvg (Client-Side)	FedDecouple (Server-Side)
Per-Round Noise Variance (Conditional on $\sigma$)	${\displaystyle \frac{{\sigma }_{\mathrm{loc}}^2{C}^2}{|{\mathcal{S}}_t|}}$	${\sigma }_{\mathrm{global}}^2{C}^2$
Required Noise Scale to Achieve Target $(ϵ,\delta )$	${\displaystyle {\sigma }_{\mathrm{loc}}=\mathrm{\Omega }\left(\frac{\sqrt{T·|{\mathcal{S}}_t|}}{ϵ}\right)}$	${\displaystyle {\sigma }_{\mathrm{global}}=\mathrm{\Theta }\left(\frac{\sqrt{T}}{ϵ}\right)}$
Effective Variance after T Rounds	${\displaystyle \frac{{\sigma }_{\mathrm{loc}}^2{C}^2}{|{\mathcal{S}}_t|}=\mathrm{\Omega }\left(\frac{T{C}^2}{{ϵ}^2}\right)}$	${\sigma }_{\mathrm{global}}^2{C}^2=\mathrm{\Theta }\left({\displaystyle \frac{T{C}^2}{{ϵ}^2}}\right)$
Dependence on $|{\mathcal{S}}_t|$	Strong (linear)	None
Dependence on T	Linear	Linear

demonstrates that, despite the per-round noise averaging effect, the total privacy budget composition forces ${\sigma }_{\mathrm{loc}}$ to grow with $|{\mathcal{S}}_t|$. As shown in Figure 1, DP-FedAvg requires ${\sigma }_{\mathrm{loc}}\propto \sqrt{|{\mathcal{S}}_t|}$, while FedDecouple requires ${\sigma }_{\mathrm{global}}$ independent of $|{\mathcal{S}}_t|$. This results in higher effective noise variance in DP-FedAvg compared to FedDecouple for the same privacy guarantee. This is the fundamental advantage of our phase-decoupled design: by injecting noise once at the server, we avoid the multiplicative effect of client-side noise injection on the required noise scale.

Privacy Guarantee Equivalence: Both DP-FedAvg and FedDecouple satisfy $(ϵ,\delta )$-user-level DP for the same $ϵ$ and $\delta$. The difference lies in the utility achieved at that privacy level. The experimental results in Section 5 demonstrate that FedDecouple achieves higher accuracy and faster convergence than DP-FedAvg for the same privacy budget.

3.3. Privacy Accounting: Moments Accountant and Rényi Differential Privacy

In iterative algorithms (such as DP-SGD and federated learning), the privacy loss accumulates over training rounds. Traditional composition theorems often provide overly loose upper bounds for privacy, leading to excessive noise introduction and compromised model performance. To address this, researchers have proposed more precise privacy accounting methods.

The moments accountant [7] is the first method to achieve robust privacy accounting in deep learning. Its core approach involves tracking the moment generating function of privacy loss random variables, rather than focusing solely on the worst-case scenario. For Gaussian mechanisms, the moments accountant demonstrates that after T iterations, the total privacy loss $ϵ$ scales proportionally to $\sqrt{T}$, rather than multiplicatively T times as naively expected, thereby significantly reducing the required noise level.

Rényi Differential Privacy (RDP) [37] represents a generalized and theoretical framework developed from the moments accountant. It employs the Rényi divergence to measure privacy loss, offering a more concise and versatile analytical approach.

Definition 3 

(Rényi Differential Privacy). A randomized mechanism $\mathcal{M}$ satisfies $(\alpha ,\rho (\alpha \left)\right)$-RDP if, for any two adjacent datasets $D,D^{\prime }$:

$$D_{\alpha }(\mathcal{M}\left(D\right)\parallel \mathcal{M}\left(D^{\prime }\right))\le \rho \left(\alpha \right)$$

where $D_{\alpha }(P\parallel Q)={\displaystyle \frac{1}{\alpha -1}}log{\mathbb{E}}_{x\sim Q}{\left({\displaystyle \frac{P\left(x\right)}{Q\left(x\right)}}\right)}^{\alpha }$ is the Rényi divergence of order α.

RDP possesses elegant compositional properties: if individual mechanisms ${\mathcal{M}}_1,\dots ,{\mathcal{M}}_T$ satisfy $(\alpha ,{\rho }_1\left(\alpha \right)),\dots ,(\alpha ,{\rho }_T\left(\alpha \right))$-RDP respectively, their combination also satisfies $(\alpha ,{\sum }_{t=1}^T{\rho }_t\left(\alpha \right))$-RDP.

RDP can be converted into the standard $(ϵ,\delta )$-DP: if a mechanism satisfies $(\alpha ,\rho (\alpha \left)\right)$-RDP, then for any $\delta >0$, it satisfies $(ϵ,\delta )$-DP, where:

$$ϵ=\underset{\alpha >1}{min}\left(\rho \left(\alpha \right)+{\displaystyle \frac{log(1/\delta )}{\alpha -1}}\right)$$

This transformation yields the tightest upper bound for privacy through optimization of $\alpha$.

We utilize the moments accountant to precisely track the cumulative privacy consumption across multiple training rounds. For the Gaussian mechanism, the single-step $\lambda$-order log-moment is as follows:

$$\alpha \left(\lambda \right)={\displaystyle \frac{\lambda (\lambda -1)}{2{\sigma }^2}}·{\displaystyle \frac{|{\mathcal{S}}_t|}{K}}$$

After T rounds of training, the total logarithmic moment is ${\sum }_{t=1}^T{\alpha }_t\left(\lambda \right)$, and the corresponding $(ϵ,\delta )$-DP guarantee is:

$$ϵ=\underset{\lambda >1}{min}\left({\displaystyle \frac{{\sum }_{t=1}^T{\alpha }_t\left(\lambda \right)+ln(1/\delta )}{\lambda }}\right)$$

3.4. Cryptographic Primitives: Secret Sharing

Secret sharing is a cryptographic technique that enables the distribution of a secret value among multiple parties, such that only authorized subsets of parties can reconstruct the secret. Two well-known secret sharing schemes are:

• Shamir Secret Sharing [38]: A threshold scheme where a secret is divided into n shares, and any t shares (where $t\le n$) can reconstruct the secret. This scheme is based on polynomial interpolation and is suitable for scenarios requiring threshold-based access control.
• Additive Secret Sharing: A simpler scheme where a secret s is split into n shares $s_1,\dots ,s_n$ such that:

  $$s=s_1+s_2+\dots +s_n$$
  Reconstruction requires all n shares (or a full set of shares summing to the secret). This scheme is efficient and naturally supports homomorphic addition.

Our Choice: In this work, we employ additive secret sharing as the fundamental cryptographic primitive. There are two key reasons for this choice:

• Protocol Requirements: Our two-party MPC protocol requires shares to be combined via addition (the aggregated gradient is the sum of client shares). Additive secret sharing natively supports this operation without additional computation.
• Efficiency: In the two-server setting, additive secret sharing is significantly more efficient than Shamir’s scheme, requiring only simple addition operations rather than polynomial interpolation.

In our protocol, additive secret sharing is used as follows. For a secret value s (e.g., a client’s gradient update), the sharing procedure generates two shares ${\left[s\right]}_1$ and ${\left[s\right]}_2$ such that:

$${\left[s\right]}_1+{\left[s\right]}_2=s$$

where addition is performed over a finite field ${\mathbb{F}}_q$ (component-wise for vectors). The sharing procedure is:

• Generate a random share ${\left[s\right]}_1\in {\mathbb{F}}_q^p$ uniformly at random.
• Compute the second share as ${\left[s\right]}_2=s-{\left[s\right]}_1$ in ${\mathbb{F}}_q^p$.

Reconstruction of the secret requires both shares:

$$s={\left[s\right]}_1+{\left[s\right]}_2$$

The additive homomorphic property of this scheme is crucial for our protocol: given two secrets a and b with shares ${\left[a\right]}_1,{\left[a\right]}_2$ and ${\left[b\right]}_1,{\left[b\right]}_2$, the shares of $a+b$ can be computed locally:

$${[a+b]}_1={\left[a\right]}_1+{\left[b\right]}_1,{[a+b]}_2={\left[a\right]}_2+{\left[b\right]}_2$$

This enables the auxiliary servers to aggregate client gradient shares without ever learning the individual gradients.

Throughout this paper, we use $\langle x\rangle$ to denote the additive secret-sharing state of a value x, where $\langle x\rangle =({\left[x\right]}_1,{\left[x\right]}_2)$. All gradient vectors and noise vectors are shared element-wise.

Note: Shamir secret sharing is mentioned here for completeness as a well-known alternative, but it is not used in our protocol. Our implementation and analysis are based exclusively on additive secret sharing.

3.5. Symbols and Conventions

For clarity and consistency throughout this paper,

Table 2. Core symbol table.

Symbol	Description
Federated Learning
K	Total number of clients
${\mathcal{S}}_t$	Set of clients selected in round t
${\theta }^t$	Global model at round t
${\mathrm{\Delta }}_k^t$	Local update from client k in round t
${\tilde{\mathrm{\Delta }}}_k^t$	Clipped local update
${\overline{\mathrm{\Delta }}}^t$	Aggregated clean gradient
${\overline{\mathrm{\Delta }}}_{\mathrm{noisy}}^t$	Aggregated noisy gradient
E	Number of local epochs per round
$|{\mathcal{S}}_t|$	Number of clients per round
p	Model parameter dimension
q	Client sampling probability ($|{\mathcal{S}}_t|/K$)
T	Total communication rounds
Differential Privacy
C	Gradient clipping bound (sensitivity)
$ϵ,\delta$	Privacy budget and failure probability
${\sigma }_{\mathrm{loc}}$	Local noise scale (client-side)
${\sigma }_{\mathrm{global}}$	Global noise scale (server-side)
$\eta$	Final Gaussian noise added at server
${\mathrm{\Delta }}_2$	${\mathsf{\ell }}_2$-sensitivity of the query
$\alpha$	RDP order parameter
$\rho \left(\alpha \right)$	RDP budget as a function of $\alpha$
Cryptography
${\mathbb{F}}_q$	Finite field of order q
${\left[s\right]}_1,{\left[s\right]}_2$	Additive secret shares of s
$\langle x\rangle$	Secret-sharing state of x
$r_j$	Random seed of auxiliary server j
$c_j$	Commitment to seed $r_j$
r	Combined seed ($r=r_1\oplus r_2$)
⊕	Bit-wise XOR operation

summarizes all the primary symbols used. Symbols are organized into logical categories: federated learning parameters, differential privacy parameters, cryptographic parameters, and experimental parameters.

4. FedDecouple: Protocol Design and Analysis

This section presents the complete design of the FedDecouple protocol. Building on the preliminary concepts established in Section 3, we first define the system model, entities, communication model, and threat assumptions under which our protocol operates (Section 4.1). We then provide a detailed, step-by-step description of the two-phase protocol—secure gradient aggregation and distributed noise generation—in Section 4.2, followed by a correctness proof in Section 4.2.3. Section 4.3 analyzes the protocol’s privacy guarantees, including cryptographic privacy and differential privacy, and provides formal RDP accounting. Finally, Section 4.4 and Section 4.5 analyze the communication and computational complexity of the protocol, demonstrating that our MPC-based approach does not increase asymptotic overhead compared to standard federated learning.

The protocol design presented here is implemented and evaluated in Section 5 and Section 6, respectively.

4.1. System Model and Threat Assumptions

This section introduces FedDecouple, a differential privacy federated learning framework that integrates phase decoupling with secure multi-party computation.

The entire protocol workflow is illustrated in Figure 2.

4.1.1. System Entities

Our system includes three types of entities:

• Clients: There are K clients, each holding a local dataset ${\mathcal{D}}_k$. Clients are responsible for executing local model training and gradient updates, but do not perform any privacy-preserving operations (e.g., noise addition). Given their resource constraints, we minimize their computational burden.
• Auxiliary Servers: There are two auxiliary servers, denoted as ${\mathcal{S}}_1$ and ${\mathcal{S}}_2$. They form a two-party secure computation cluster responsible for:
  • Receiving the client’s secret shares.
  • Performing gradient aggregation on the secret share domain.
  • Collaboratively generating Gaussian noise that satisfies differential privacy requirements.
  • Adding noise to the aggregated gradient.
• Central Server: Serving as the training coordinator, it is responsible for:
  • Distributing the global model.
  • Selecting the clients to participate in each round.
  • Receiving the shares sent by the auxiliary servers and reconstructing the final result.
  • Updating the global model.

4.1.2. Communication Model

All entities communicate via secure channels (such as TLS). A peer-to-peer connection is established between each client and the two auxiliary servers; direct connections are also established among the auxiliary servers to execute the MPC protocol; similarly, communication between the auxiliary servers and the central server occurs over secure channels.

4.1.3. Threat Assumptions

We employ the standard honest-but-curious threat model [39]:

• Clients: We assume the clients are honest and will correctly execute the protocol. However, since we do not fully trust the clients, the gradients they upload must be protected through clipping and secret sharing.
• Auxiliary Servers: We assume the auxiliary servers are semi-honest—they strictly adhere to protocol specifications but may attempt to infer private data from the received information. We assume that at most one auxiliary server is compromised, and the two servers do not collude. This assumption is reasonable in practice, as auxiliary servers are typically operated by different institutions.
• Central Server: The central server is considered untrustworthy. It can only access the reconstructed noisy gradient and cannot obtain any private information from intermediate states.
• External Attackers: Attackers may eavesdrop on communication channels, but since all communications are encrypted over secure channels, they cannot obtain any meaningful information.

4.1.4. Design Objectives

Based on the aforementioned system model and threat assumptions, we have established the following design objectives:

• Privacy: The entire training process complies with $(ϵ,\delta )$-differential privacy, and no individual entity (including the auxiliary servers) can obtain the clean gradient information.
• Decentralized Trust: The framework does not rely on a single trusted server, with privacy protection responsibilities shared by two auxiliary servers.
• Efficiency: The client’s computational load is minimized, with complex cryptographic operations handled by the auxiliary servers.
• Scalability: The protocol should be scalable to support more clients and more complex models.

4.2. Core Protocol: FedDecouple Two-Phase Design

This section provides a detailed description of the core workflow of the FedDecouple protocol. The protocol consists of two main phases: the secure gradient aggregation phase and the distributed noise generation and addition phase.

4.2.1. Phase One: Secure Gradient Aggregation

In the first phase, clients collaboratively submit the clean gradients as secret shares to the auxiliary servers. The auxiliary servers then aggregate the gradients within the ciphertext domain without either party being able to access the actual gradient values.

• Step 1: Local Training and Gradient Clipping (Client)
  Each selected client $k\in {\mathcal{S}}_t$ performs E rounds of SGD training on local data to compute the model update:

  $${\mathrm{\Delta }}_k^t={\theta }_k^{t,\mathrm{local}}-{\theta }^t$$
  To meet the sensitivity requirements of differential privacy, clients apply gradient clipping:

  $${\tilde{\mathrm{\Delta }}}_k^t={\mathrm{\Delta }}_k^t·min\left(1,{\displaystyle \frac{C}{\parallel {\mathrm{\Delta }}_k^t{\parallel }_2}}\right)$$

  where C is the preset clipping threshold. Key difference: No noise is added here.
• Step 2: Secret Sharing of Gradient Updates (Client)
  Each client uses additive secret sharing (as defined in Section 3.4) to split the trimmed gradient update into two parts:

  $${\left[{\tilde{\mathrm{\Delta }}}_k^t\right]}_1,{\left[{\tilde{\mathrm{\Delta }}}_k^t\right]}_2\leftarrow \mathrm{Share}\left({\tilde{\mathrm{\Delta }}}_k^t\right)$$

  satisfying ${\left[{\tilde{\mathrm{\Delta }}}_k^t\right]}_1+{\left[{\tilde{\mathrm{\Delta }}}_k^t\right]}_2={\tilde{\mathrm{\Delta }}}_k^t$. The client sends share ${\left[{\tilde{\mathrm{\Delta }}}_k^t\right]}_1$ to auxiliary server ${\mathcal{S}}_1$ and share ${\left[{\tilde{\mathrm{\Delta }}}_k^t\right]}_2$ to auxiliary server ${\mathcal{S}}_2$.
• Step 3: Auxiliary Server Share Aggregation (Auxiliary Servers)
  Each auxiliary server independently aggregates the received shares locally:

  $${\left[{\overline{\mathrm{\Delta }}}^t\right]}_j=\sum _{k\in {\mathcal{S}}_t}{\left[{\tilde{\mathrm{\Delta }}}_k^t\right]}_j,j\in \{1,2\}$$
  Due to the additive homomorphism of secret sharing, the aggregated shares ${\left[{\overline{\mathrm{\Delta }}}^t\right]}_j$ precisely correspond to the correct shares of the actual aggregated gradient:

  $${\overline{\mathrm{\Delta }}}^t=\sum _{k\in {\mathcal{S}}_t}{\tilde{\mathrm{\Delta }}}_k^t$$
  At this point, the two auxiliary servers each hold a secret share of the aggregated gradient, but no single server can reconstruct the actual aggregated gradient.

4.2.2. Phase Two: Distributed Noise Generation and Addition

The second phase constitutes the core innovation of this paper. Two auxiliary servers collaboratively generate Gaussian noise compliant with differential privacy through a six-round interactive protocol and securely integrate it into the aggregated gradient shares.

Since the noise is divided into two parts, each server only knows one portion. Each portion follows a Gaussian distribution $\mathcal{N}(0,{\sigma }^{2}I/2)$ and cannot be used to infer the complete noise. Even if a server is compromised, the attacker cannot obtain the final added noise value.

• Step 4: Two-Party Collaborative Noise Share Generation (Auxiliary Servers)
  Two auxiliary servers execute the secure two-party Gaussian noise generation protocol to generate secret noise shares ${\eta }_1,{\eta }_2$ satisfying ${\eta }_1+{\eta }_2=\eta \sim \mathcal{N}(0,{\sigma }^{2}I)$. The protocol flow is as follows:
  • Round 0—Local Seed Generation: Each server independently generates a local random seed $r_j\in {\{0,1\}}^{32}$.
  • Round 1—Commitment Exchange [40]: Each server calculates a commitment $c_j=\mathrm{SHA}\text{-}256\left(r_j\right)$ [41] to its seed and sends the commitment to the other party.
  • Round 2—Seed Exchange and Verification: Both parties exchange the original seeds and verify $\mathrm{SHA}\text{-}256\left(r_j\right)=c_j$. If verification fails, the protocol terminates.
  • Round 3—Combined Seed Calculation: The shared seed is computed using a bit-wise XOR operation: $r=r_1\oplus r_2$. Due to the symmetry of XOR, both parties independently derive the same result.
  • Round 4—Independent Seed Derivation: Both servers use the same shared seed r to initialize a pseudo-random number generator (PRNG). The PRNG is then used to derive two **independent seeds**:

    $$s_1=\mathrm{PRNG}(r,“\mathrm{server}1”),s_2=\mathrm{PRNG}(r,“\mathrm{server}2”)$$

    where the second argument is a domain-separation string to ensure independence.
  • Round 5—Independent Noise Generation: Each server uses **only its assigned derived seed** to generate its noise share:

    $${\mathcal{S}}_1:{\eta }_1\sim \mathcal{N}(0,{(\sigma /\sqrt{2})}^{2}I)\mathrm{using}{s}_1$$

    $${\mathcal{S}}_2:{\eta }_2\sim \mathcal{N}(0,{(\sigma /\sqrt{2})}^{2}I)\mathrm{using}{s}_2$$
    Crucial distinction from previous version: No server computes the other server’s noise share. ${\mathcal{S}}_1$ does not have $s_2$, and ${\mathcal{S}}_2$ does not have $s_1$. Therefore, neither server can independently determine the final noise $\eta ={\eta }_1+{\eta }_2$.
  Crucial Security Observation: The final noise $\eta$ is never transmitted or communicated between the servers. Each server only holds one additive share ${\eta }_j$. The final noise $\eta$ is only revealed after the shares are added by the central server in Step 6. Even if a single auxiliary server is compromised, the attacker only obtains one share ${\eta }_j$, which is statistically independent of the final noise value $\eta$ (since the other share is unknown and uniformly distributed).
  We formally state this security property:
  Theorem 1 

  (Noise Unpredictability (Revised)). Under the honest-but-curious model, a single auxiliary server ${\mathcal{S}}_j$ cannot determine the final noise value η from its view of the protocol, even if it records all locally computed values.
  Proof. 

  The view of ${\mathcal{S}}_1$ consists of: (1) its own seed $r_1$, (2) the other server’s commitment $c_2$, (3) the other server’s seed $r_2$ after Round 2, (4) the shared seed $r=r_1\oplus r_2$, and (5) its own derived seed $s_1$ and its own noise share ${\eta }_1$.

  Crucially, ${\mathcal{S}}_1$ does not compute $s_2$, because the PRNG is executed only once with the domain-separation string for $s_1$ (since ${\mathcal{S}}_1$ only needs its own share). Without $s_2$, ${\mathcal{S}}_1$ cannot generate ${\eta }_2$. The final noise is $\eta ={\eta }_1+{\eta }_2$, where ${\eta }_2$ is unknown to ${\mathcal{S}}_1$. Since ${\eta }_2\sim \mathcal{N}(0,{(\sigma /\sqrt{2})}^{2}I)$, the conditional distribution of $\eta$ given ${\eta }_1$ remains $\mathcal{N}({\eta }_1,{(\sigma /\sqrt{2})}^{2}I)$, which is non-degenerate. Therefore, ${\mathcal{S}}_1$ cannot uniquely determine $\eta$. The same argument applies symmetrically to ${\mathcal{S}}_2$. □
  On the Use of 32-Bit Seeds: The seed length of 32 bits is a design choice in the current implementation. The security of the protocol does not rely solely on the seed length; it relies on the commitment scheme (SHA-256) and the fact that seeds are exchanged before noise generation. The commitment prevents either party from altering its seed after seeing the other’s. Even with a 32-bit seed, the probability of a successful collision attack is negligible in the context of this protocol (the seed is used only to initialize a PRNG, not as a cryptographic key). For stronger security, the seed length could be increased to 128 or 256 bits in future implementations without changing the protocol structure.
• Step 5: Local Noise Addition (Auxiliary Servers)
  Each auxiliary server locally adds its noise share to the aggregated gradient share:

  $${\left[{\overline{\mathrm{\Delta }}}_{\mathrm{noisy}}^t\right]}_j={\left[{\overline{\mathrm{\Delta }}}^t\right]}_j+{\eta }_j,j\in \{1,2\}$$
• Step 6: Reconstruction of Noisy Aggregated Gradient (Central Server)
  The two auxiliary servers transmit their noisy shares to the central server. The central server then reconstructs the final noisy aggregated gradient through addition:

  $${\overline{\mathrm{\Delta }}}_{\mathrm{noisy}}^t={\left[{\overline{\mathrm{\Delta }}}_{\mathrm{noisy}}^t\right]}_1+{\left[{\overline{\mathrm{\Delta }}}_{\mathrm{noisy}}^t\right]}_2={\overline{\mathrm{\Delta }}}^t+\eta$$
• Step 7: Global Model Update (Central Server)
  The central server uses the aggregated gradient to update the global model:

  $${\theta }^{t+1}={\theta }^t+{\displaystyle \frac{1}{|{\mathcal{S}}_t|}}·{\overline{\mathrm{\Delta }}}_{\mathrm{noisy}}^t$$
  The updated model is broadcast to all clients, initiating the next training round.

4.2.3. Threat Assumptions and Adversarial Analysis

We employ the standard honest-but-curious threat model as our primary adversarial framework. In this section, we systematically analyze the adversarial capabilities, discuss the plausibility of our assumptions, and compare our approach with alternative trust models.

Adversarial Capabilities

We consider the following adversarial scenarios:

• Passive (Honest-but-Curious) Adversaries: Adversaries faithfully follow the protocol but attempt to infer private information from the messages they observe. This is the primary threat model considered in this work.
• Active (Malicious) Adversaries: Adversaries may deviate from the protocol, inject malformed messages, or manipulate their shares to compromise the aggregation correctness or privacy.
• Colluding Adversaries: Multiple adversarial entities may cooperate to combine their views and infer private information about honest clients.

Justification of the Non-Colluding Assumption

The assumption that the two auxiliary servers do not collude is common in two-server MPC literature and is justified by the following practical considerations:

• Institutional Separation: The auxiliary servers are typically operated by independent organizations (e.g., different cloud providers, government agencies, or research institutions). Collusion requires a coordinated breach of trust between independent entities, which is significantly harder to achieve than compromising a single server.
• Legal and Compliance Constraints: In cross-silo federated learning scenarios, participating institutions are often bound by legal agreements and compliance frameworks that prohibit unauthorized data sharing, further raising the bar for collusion.
• Auditability: All server-side operations are logged and can be audited post hoc. Any suspicious activity or coordination between servers can be detected through statistical analysis of their behaviors.

Nevertheless, we acknowledge that this assumption may be restrictive in certain deployment scenarios. We discuss extensions to strengthen collusion resistance in Section 7.2.

Collusion Analysis

We analyze the privacy leakage under different collusion scenarios.

Theorem 2 

(Collusion Resilience). In the proposed protocol, an adversary that compromises one auxiliary server and an arbitrary number of clients cannot reconstruct any honest client’s clean gradient.

Proof. 

Each client $u_i$ splits its gradient ${\tilde{\mathrm{\Delta }}}_k^t$ into two additive shares:

$${\tilde{\mathrm{\Delta }}}_k^t={\left[{\tilde{\mathrm{\Delta }}}_k^t\right]}_1+{\left[{\tilde{\mathrm{\Delta }}}_k^t\right]}_2$$

where ${\left[{\tilde{\mathrm{\Delta }}}_k^t\right]}_1$ is sent to ${\mathcal{S}}_1$ and ${\left[{\tilde{\mathrm{\Delta }}}_k^t\right]}_2$ is sent to ${\mathcal{S}}_2$. A single auxiliary server observes only one share. By the security of additive secret sharing, a single share is uniformly distributed over ${\mathbb{F}}_q^p$ and is statistically independent of the original gradient. Therefore, even a compromised auxiliary server ${\mathcal{S}}_1$ cannot infer any information about the clean gradient of an honest client. □

Theorem 3 

(Bounded Leakage under Limited Collusion). If both auxiliary servers are compromised by colluding adversaries, the adversary can reconstruct the clean aggregated gradient ${\overline{\mathrm{\Delta }}}^t$. However, the privacy of individual clients is still protected by differential privacy.

Proof. 

When both servers are compromised, the adversary can reconstruct:

$${\left[{\overline{\mathrm{\Delta }}}^t\right]}_1+{\left[{\overline{\mathrm{\Delta }}}^t\right]}_2={\overline{\mathrm{\Delta }}}^t$$

However, the aggregation process releases only the noisy aggregated gradient ${\overline{\mathrm{\Delta }}}_{\mathrm{noisy}}^t={\overline{\mathrm{\Delta }}}^t+\eta$, where $\eta \sim \mathcal{N}(0,{\sigma }^2{C}^{2}I)$. By Theorem 4 (Differential Privacy), this release satisfies $(ϵ,\delta )$-DP, which limits the adversary’s ability to infer individual client information even if the clean aggregate is recovered. □

Comparison with Threshold Secret Sharing

Threshold secret sharing (e.g., Shamir’s t-out-of-n scheme) is an alternative approach to distribute trust among multiple servers.

Table 3. Comparison of trust models: two-server additive sharing vs. threshold secret sharing.

Criterion	Two-Server Additive Sharing	Threshold Secret Sharing (t-Out-of-n)
Collusion Threshold	Breaks if both servers collude	Breaks if ≥ t servers collude
Communication Overhead	$O\left(\right|{\mathcal{S}}_t|·p)$ (2 shares/client)	$O\left(\right|{\mathcal{S}}_t|·n·p)$ (n shares/client)
Computational Complexity	$O\left(\right|{\mathcal{S}}_t|·p)$ additions	$O\left(\right|{\mathcal{S}}_t|·n·p)$ additions + interpolation
Recovery Cost	Simple addition of 2 shares	Lagrange interpolation ($O\left(n{log}^{2}n\right)$)
Server Setup	Minimal (pairwise connections)	Requires distributed key generation
Resilience to Collusion	Breaks if both servers collude	Breaks if ≥ t servers collude

compares our two-server additive sharing approach with threshold secret sharing.

Key Trade-offs:

‑

Security: Threshold secret sharing offers stronger collusion resistance at the cost of higher communication and computational overhead.

‑

Efficiency: Two-server additive sharing is significantly more efficient, making it suitable for resource-constrained federated learning scenarios.

‑

Application Context: Our choice is motivated by the practical requirements of cross-silo federated learning, where two independent servers are often available, and efficiency is critical.

Extension to Three-Party MPC

For scenarios requiring stronger collusion resistance, our protocol can be extended to a three-server setting using three-party additive sharing:

$${\tilde{\mathrm{\Delta }}}_k^t={\left[{\tilde{\mathrm{\Delta }}}_k^t\right]}_1+{\left[{\tilde{\mathrm{\Delta }}}_k^t\right]}_2+{\left[{\tilde{\mathrm{\Delta }}}_k^t\right]}_3$$

where shares are distributed among three auxiliary servers ${\mathcal{S}}_1,{\mathcal{S}}_2,{\mathcal{S}}_3$. The noise generation protocol can be similarly extended to three parties:

$${\eta }_{\mathrm{full}}\sim \mathcal{N}(0,{(\sigma /3)}^{2}I),\eta ={\eta }_1+{\eta }_2+{\eta }_3$$

Byzantine Robustness and Future Work

We emphasize that Byzantine robustness (defending against malicious clients or servers that actively deviate from the protocol) is orthogonal to our privacy guarantees and is not the focus of this work. Our threat model is explicitly limited to privacy against semi-honest adversaries. Protecting against Byzantine behaviors (e.g., gradient poisoning attacks) would require orthogonal techniques such as robust aggregation rules, anomaly detection, or verification mechanisms. We leave the integration of Byzantine robustness as an important direction for future work (see Section 7.2).

Summary of Trust Assumptions

In summary, our trust assumptions can be stated as follows:

• Clients are honest-but-curious and execute the protocol correctly.
• Auxiliary servers are semi-honest, with at most one being compromised.
• The two auxiliary servers do not collude.
• No active Byzantine attacks are considered in the current scope.

These assumptions are standard in two-server MPC literature and, as discussed above, are justified in many practical cross-silo FL deployments.

Consequences of Assumption Violation

We explicitly state the consequences if the non-colluding assumption is violated:

• If both auxiliary servers collude, they can combine their shares and reconstruct the clean aggregated gradient ${\overline{\mathrm{\Delta }}}^t$ before noise addition.
• However, individual client privacy is still protected by differential privacy, as the final released gradient is ${\overline{\mathrm{\Delta }}}_{\mathrm{noisy}}^t={\overline{\mathrm{\Delta }}}^t+\eta$. Even with the clean aggregate, an adversary cannot infer individual client updates from the aggregate alone due to the additive nature of the aggregation.
• If the adversary additionally compromises a sufficient number of clients, the risk of inferring individual client information increases, but this falls outside our current threat model.

We emphasize that this assumption is standard in the two-server MPC literature and is justified in many practical cross-silo FL deployments where auxiliary servers are operated by independent institutions.

4.2.4. Comparison with Stronger MPC Settings

For scenarios requiring stronger collusion resistance, our protocol can be extended to a three-server setting using three-party additive sharing.

Table 4. Trade-offs: two-server vs. three-server MPC configuration.

Metric	Two-Server (Ours)	Three-Server (Extension)
Collusion Resilience	Collusion of both servers	Collusion of all three servers
Client Communication	2 shares per client	3 shares per client
Server-Server Communication	Seed/commitment exchange	More complex coordination
Noise Generation Rounds	6 rounds	8–10 rounds
Computation Overhead	Baseline	∼1.5× baseline

summarizes the trade-offs.

Threshold secret sharing (e.g., Shamir’s t-out-of-n scheme) offers stronger collusion resistance at the cost of higher communication and computational overhead. The choice between two-server additive sharing and threshold secret sharing depends on the specific deployment scenario: two-server sharing is preferable when efficiency is critical and the non-colluding assumption is reasonable, while threshold schemes are more suitable when stronger security guarantees are required.

4.3. Rigorous Privacy Analysis and RDP Accounting

We provide a rigorous privacy analysis of FedDecouple under the Rényi Differential Privacy (RDP) framework. We first establish the sensitivity of a single client’s contribution, then derive the privacy amplification via client subsampling, and finally present the complete RDP composition over multiple rounds.

4.4. Analysis of Protocol Privacy

4.4.1. Sensitivity Analysis

We now derive the ${\mathsf{\ell }}_2$-sensitivity of the aggregate gradient update under FedDecouple’s phase-decoupled protocol. We explicitly consider the **client-level replacement adjacency model**, which is standard in DP-FedAvg analysis.

Definition 4 

(Client-level Replacement Adjacency). Two client datasets $\mathcal{D}$ and ${\mathcal{D}}^{\prime }$ are considered adjacent if they differ by the data of exactly one client, where that client’s entire local dataset is **replaced** with a different dataset. Formally, there exists a client k such that:

$$\mathcal{D}=\{D_1,\dots ,D_k,\dots ,D_K\},{\mathcal{D}}^{\prime }=\{D_1,\dots ,D_k^{\prime },\dots ,D_K\}$$

where $D_k\ne D_k^{\prime }$, and all other clients’ datasets are identical.

Definition 5 

(Gradient Clipping). For a client k with local update ${\mathrm{\Delta }}_k^t$, the clipped gradient is:

$${\tilde{\mathrm{\Delta }}}_k^t={\mathrm{\Delta }}_k^t·min\left(1,{\displaystyle \frac{C}{\parallel {\mathrm{\Delta }}_k^t{\parallel }_2}}\right)$$

where $C>0$ is the clipping bound. Note that $\parallel {\tilde{\mathrm{\Delta }}}_k^t{\parallel }_2\le C$.

Theorem 4 

(Sensitivity Bound). Under the replacement adjacency model, the ${\mathsf{\ell }}_2$-sensitivity of the aggregated clipped gradient is bounded by:

$${\mathrm{\Delta }}_2=\underset{\mathcal{D},{\mathcal{D}}^{\prime }}{max}{∥\sum _{k\in {\mathcal{S}}_t}{\tilde{\mathrm{\Delta }}}_k^t-\sum _{k\in {\mathcal{S}}_t}{\tilde{\mathrm{\Delta }}}_k^{t^{\prime }}∥}_2\le 2C$$

Proof. 

Since the two datasets differ only in client k, all other client contributions cancel:

$${∥\sum _{i\ne k}{\tilde{\mathrm{\Delta }}}_i^t+{\tilde{\mathrm{\Delta }}}_k^t-\left(\sum _{i\ne k}{\tilde{\mathrm{\Delta }}}_i^{t^{\prime }}+{\tilde{\mathrm{\Delta }}}_k^{t^{\prime }}\right)∥}_2={∥{\tilde{\mathrm{\Delta }}}_k^t-{\tilde{\mathrm{\Delta }}}_k^{t^{\prime }}∥}_2$$

By the triangle inequality and the clipping bound $\parallel {\tilde{\mathrm{\Delta }}}_k^t{\parallel }_2\le C$ and $\parallel {\tilde{\mathrm{\Delta }}}_k^{t^{\prime }}{\parallel }_2\le C$:

$${∥{\tilde{\mathrm{\Delta }}}_k^t-{\tilde{\mathrm{\Delta }}}_k^{t^{\prime }}∥}_2\le \parallel {\tilde{\mathrm{\Delta }}}_k^t{\parallel }_2+{\parallel {\tilde{\mathrm{\Delta }}}_k^{t^{\prime }}\parallel }_2\le 2C$$

This bound is tight: consider the case where ${\tilde{\mathrm{\Delta }}}_k^t=C·v$ and ${\tilde{\mathrm{\Delta }}}_k^{t^{\prime }}=-C·v$ for some unit vector v. Then $\parallel {\tilde{\mathrm{\Delta }}}_k^t-{\tilde{\mathrm{\Delta }}}_k^{t^{\prime }}{\parallel }_2=2C$. Therefore, ${\mathrm{\Delta }}_2\le 2C$. □

Note 1. 

In the add/remove adjacency model (where a client is either added or removed rather than replaced), the sensitivity would be C (since the removed client contributes 0). However, we use the replacement adjacency model throughout this paper, which is the standard in DP-FedAvg and yields sensitivity $2C$. The Gaussian mechanism noise scale $\sigma$ is calibrated accordingly.

4.4.2. Privacy Amplification via Client Subsampling

In each communication round, the server randomly selects a subset of clients ${\mathcal{S}}_t$ with sampling probability $q=|{\mathcal{S}}_t|/K$. This random subsampling induces a privacy amplification effect.

Theorem 5 

(Privacy Amplification by Subsampling). Let $\mathcal{M}$ be a mechanism satisfying $(\alpha ,\rho (\alpha \left)\right)$-RDP. Then the subsampled mechanism $\mathcal{M}\circ {\mathit{Sample}}_q$, which applies $\mathcal{M}$ to a uniformly random subset of clients with sampling probability q, satisfies:

$${\rho }_{\mathrm{amp}}\left(\alpha \right)\le {\displaystyle \frac{1}{\alpha -1}}log\left(1+q^2\left({\displaystyle \genfrac{}{}{0pt}{}{\alpha }{2}}\right)min\{4(e^{\rho \left(\alpha \right)}-1),2e^{\rho \left(\alpha \right)}\}\right)$$

for $\alpha \in (1,\infty )$, where $q=|{\mathcal{S}}_t|/K$ is the sampling rate.

Proof. 

This follows directly from the privacy amplification theorem for subsampling with Rényi differential privacy. The bound is obtained by applying the subsampling lemma to the Gaussian mechanism’s RDP guarantee. □

In practice, for the Gaussian mechanism with noise scale $\sigma$, the single-round RDP after amplification is:

$${\rho }_{\mathrm{round}}\left(\alpha \right)\approx {\displaystyle \frac{\alpha q^2}{2{\sigma }^2}}·{\displaystyle \frac{|{\mathcal{S}}_t{|}^2}{K^2}}$$

which is significantly tighter than the non-amplified bound $\rho \left(\alpha \right)=\alpha /\left(2{\sigma }^2\right)$.

4.4.3. Rényi Differential Privacy Composition

Over T communication rounds, the total privacy loss is the composition of T rounds. By the composition property of RDP:

Theorem 6 

(RDP Composition over Rounds). After T rounds of subsampled Gaussian mechanism with noise scale σ and sampling rate q, the total RDP budget is:

$${\rho }_{\mathrm{total}}\left(\alpha \right)=T·{\rho }_{\mathrm{round}}\left(\alpha \right)$$

for any order $\alpha >1$, where ${\rho }_{\mathrm{round}}\left(\alpha \right)$ is the single-round RDP after amplification.

Proof. 

This follows from the additivity of RDP under adaptive composition. Since each round’s mechanism is applied sequentially and the composition is adaptive (the output of each round influences the next), the total RDP is the sum of the per-round RDP budgets. □

4.4.4. Formal Privacy Guarantee

We now present the complete privacy theorem for FedDecouple.

Theorem 7 

(Privacy Guarantee of FedDecouple). For any $\delta >0$, privacy budget $ϵ>0$, let C be the clipping bound and σ the noise scale. After T communication rounds with client sampling probability $q=|{\mathcal{S}}_t|/K$, FedDecouple satisfies $(ϵ,\delta )$-user-level differential privacy, where:

$$ϵ=\underset{\alpha >1}{min}\left(T·{\rho }_{\mathrm{round}}\left(\alpha \right)+{\displaystyle \frac{log(1/\delta )}{\alpha -1}}\right)$$

with

$${\rho }_{\mathrm{round}}\left(\alpha \right)={\displaystyle \frac{1}{\alpha -1}}log\left(1+q^2\left({\displaystyle \genfrac{}{}{0pt}{}{\alpha }{2}}\right)min\{4(e^{\alpha /\left(2{\sigma }^2\right)}-1),2e^{\alpha /\left(2{\sigma }^2\right)}\}\right)$$

Proof. 

The proof combines the sensitivity bound (Theorem 1), the subsampling amplification (Theorem 2), and the RDP composition (Theorem 3). The conversion from RDP to $(ϵ,\delta )$-DP follows the standard RDP-to-DP conversion lemma. □

4.4.5. Privacy Accounting with Corrected Sensitivity

With the corrected sensitivity ${\mathrm{\Delta }}_2=2C$, the Gaussian mechanism with noise scale $\sigma$ has RDP:

$$\rho \left(\alpha \right)={\displaystyle \frac{\alpha {\mathrm{\Delta }}_2^2}{2{\sigma }^2}}={\displaystyle \frac{\alpha {\left(2C\right)}^2}{2{\sigma }^2}}={\displaystyle \frac{2\alpha C^2}{{\sigma }^2}}$$

After subsampling amplification with sampling probability $q=|{\mathcal{S}}_t|/K$:

$${\rho }_{\mathrm{round}}\left(\alpha \right)={\displaystyle \frac{1}{\alpha -1}}log\left(1+q^2\left({\displaystyle \genfrac{}{}{0pt}{}{\alpha }{2}}\right)min\{4(e^{\rho \left(\alpha \right)}-1),2e^{\rho \left(\alpha \right)}\}\right)$$

After T rounds:

$${\rho }_{\mathrm{total}}\left(\alpha \right)=T·{\rho }_{\mathrm{round}}\left(\alpha \right)$$

The final $(ϵ,\delta )$-DP guarantee is:

$$ϵ=\underset{\alpha >1}{min}\left({\rho }_{\mathrm{total}}\left(\alpha \right)+{\displaystyle \frac{log(1/\delta )}{\alpha -1}}\right)$$

4.4.6. Quantitative Comparison with DP-FedAvg

Table 5. Quantitative comparison of privacy guarantees (FedDecouple vs. DP-FedAvg).

Criterion	DP-FedAvg (Client-Side Noise)	FedDecouple (Server-Side Noise)
Sensitivity (${\mathrm{\Delta }}_2$)	$2C$	$2C$
Noise Scale per Round	${\sigma }_{\mathrm{loc}}$	${\sigma }_{\mathrm{global}}$
Effective Noise Variance	${\displaystyle \frac{4{\sigma }_{\mathrm{loc}}^2{C}^2}{|{\mathcal{S}}_t{|}^2}}·{\sum }_{k}1$	$4{\sigma }_{\mathrm{global}}^2{C}^2$
RDP per Round	${\displaystyle \frac{\alpha }{2{\sigma }_{\mathrm{loc}}^2}}·q^2$	${\displaystyle \frac{\alpha }{2{\sigma }_{\mathrm{global}}^2}}·q^2$
Total RDP (T rounds)	${\displaystyle \frac{\alpha T}{2{\sigma }_{\mathrm{loc}}^2}}·q^2$	${\displaystyle \frac{\alpha T}{2{\sigma }_{\mathrm{global}}^2}}·q^2$
Privacy Budget ($ϵ$)	Larger (noise accumulates)	Smaller (noise injected once)
Privacy Efficiency	Lower	Higher

compares the privacy guarantees of FedDecouple and DP-FedAvg under equivalent configurations.

Key Insight: To achieve the same $(ϵ,\delta )$-DP guarantee, DP-FedAvg requires a noise scale ${\sigma }_{\mathrm{loc}}$ that grows with $\sqrt{|{\mathcal{S}}_t|}$ to compensate for the accumulation of client-side noise. In contrast, FedDecouple’s noise scale ${\sigma }_{\mathrm{global}}$ is independent of the number of clients, resulting in significantly tighter privacy bounds and better utility for the same privacy budget.

4.4.7. Discussion of Privacy Budget Efficiency

The privacy efficiency of FedDecouple can be understood through the following comparison. In DP-FedAvg, each client adds noise $\mathcal{N}(0,{\sigma }_{\mathrm{loc}}^2{C}^{2}I)$, and after aggregation, the effective noise variance is:

$${\mathrm{Var}}_{\mathrm{DP}\text{-}\mathrm{FedAvg}}={\displaystyle \frac{1}{|{\mathcal{S}}_t{|}^2}}\sum _{k\in {\mathcal{S}}_t}{\sigma }_{\mathrm{loc}}^2{C}^2={\displaystyle \frac{{\sigma }_{\mathrm{loc}}^2{C}^2}{|{\mathcal{S}}_t|}}$$

while in FedDecouple, the noise is added once at the server:

$${\mathrm{Var}}_{\mathrm{FedDecouple}}={\sigma }_{\mathrm{global}}^2{C}^2$$

To achieve the same effective noise variance and thus the same utility, the server-side noise scale in FedDecouple satisfies ${\sigma }_{\mathrm{global}}={\sigma }_{\mathrm{loc}}/\sqrt{|{\mathcal{S}}_t|}$. However, under the same $(ϵ,\delta )$-DP guarantee, the RDP analysis shows that ${\sigma }_{\mathrm{loc}}$ must be larger than ${\sigma }_{\mathrm{global}}$ to compensate for the privacy cost of repeated client-side noise injection. Therefore, FedDecouple achieves both stronger privacy and better utility.

Conclusion: FedDecouple’s phase-decoupled design provides a formal privacy guarantee that is mathematically equivalent to DP-FedAvg in terms of sensitivity but superior in terms of privacy budget efficiency due to its centralized, one-shot noise injection paradigm.

4.4.8. Privacy Guarantee via Gaussian Mechanism

If the noise scale $\sigma$ satisfies the requirements of the Gaussian mechanism and the clipping threshold C is properly set, the entire training process achieves $(ϵ,\delta )$-user-level differential privacy.

Proof. 

Since only the noisy aggregated gradient ${\overline{\mathrm{\Delta }}}_{\mathrm{noisy}}^t={\overline{\mathrm{\Delta }}}^t+\eta$ is ultimately released and satisfies the requirements of the Gaussian mechanism, the release process itself inherently ensures differential privacy. Due to post-processing invariance, subsequent model updates also maintain the same privacy protection. The cumulative privacy across multiple training rounds can be precisely calculated using the moments accountant. □

4.4.9. Summary of the Unified Privacy Framework

To ensure consistency across the privacy analysis, we summarize the unified framework under the client-level adjacency model:

• Adjacency model: Datasets differ by one client.
• Sensitivity: ${\mathrm{\Delta }}_2=2C$ (clipped gradient norm bound).
• Clipping: Each client’s update is clipped to ${\mathsf{\ell }}_2$-norm C.
• Sampling: Uniform client subsampling with probability $q=|{\mathcal{S}}_t|/K$.
• Noise calibration: Gaussian noise $\mathcal{N}(0,{\sigma }^2{C}^{2}I)$ injected at the server.
• Privacy accounting: RDP composition over T rounds under client-level adjacency.

All privacy parameters and derivations in this paper are consistent with this framework. We use “client-level” as the primary term and “user-level” only informally as a synonym.

4.5. Communication Complexity Analysis

We analyze the per-round communication overhead of FedDecouple and compare it with standard federated learning (FedAvg). We distinguish between asymptotic complexity and actual constant factors.

4.5.1. Asymptotic Complexity

The communication overhead per training round includes:

• Clients to Auxiliary Servers: Each client sends two additive shares, each of size $O\left(p\right)$ (where p is the model dimension). Total client communication volume is $O\left(\right|{\mathcal{S}}_t|·p)$.
• Between Auxiliary Servers: The two-party noise generation protocol requires exchanging seeds, commitments, and other messages. The communication volume is $O\left(1\right)$ independent of model size.
• Auxiliary Servers to Central Server: Each auxiliary server sends one share of size $O\left(p\right)$, totaling $O\left(p\right)$ communication.

The total asymptotic communication complexity is $O\left(\right|{\mathcal{S}}_t|·p)$, which is asymptotically identical to standard FL (without MPC). This is the sense in which our method “does not increase asymptotic communication overhead.”

4.5.2. Actual Communication Overhead (Constant Factors)

While the asymptotic complexity is the same, the actual constant factors are larger due to the following reasons:

• Each client sends two shares instead of one update (2× factor).
• Extra messages are exchanged between the two auxiliary servers (commitments, seeds, verification).
• The central server receives two shares instead of one.

Table 6. Per-round communication overhead breakdown.

Sender → Receiver	FedAvg (No DP)	FedDecouple	Overhead Factor
Client → Server/Aux.	1 · O(p)	$2·O\left(p\right)$	$2\times$
Aux. S1 ↔ Aux. S2	N/A	$O\left(1\right)$ (seeds/commitments)	Extra messages
Aux. → Central Server	N/A	$2·O\left(p\right)$	Extra messages

provides a detailed per-entity breakdown of the communication overhead.

Key Insight: Despite the higher constant-factor communication overhead, our experimental results (Section 6) show that FedDecouple achieves comparable or better total training time than DP-SGD and Opacus. This is because:

• Faster convergence: FedDecouple requires fewer communication rounds to reach target accuracy (see Figure 1, Figure 2 and Figure 3), partially offsetting the per-round overhead.
• Lighter client computation: Clients do not perform per-sample gradient computation or local noise addition, reducing per-round computation time.

In practice, total training time (communication + computation) is a more meaningful efficiency metric than communication rounds alone. Our empirical results show that FedDecouple achieves the shortest total training time on MNIST and competitive performance on CIFAR-10 (see Table 6), validating the practical efficiency of our approach.

4.6. Computational Complexity Analysis

• Client Computation: Each client only needs to compute the gradient once (similar to standard FedAvg) and perform secret sharing ($O\left(p\right)$ addition operations). There is no need for per-sample gradient computation, significantly reducing the computational burden compared to solutions like Opacus.
• Auxiliary Server Computation: Each auxiliary server performs share aggregation ($O\left(\right|{\mathcal{S}}_t|·p)$ additions) and participates in the two-party noise generation protocol ($O\left(p\right)$ PRF calculations). These operations are lightweight.
• Central Server Computation: Requires only one share reconstruction ($O\left(p\right)$ additions).

4.7. Comparison with Existing Privacy-Preserving Paradigms

To further highlight the unique positioning of FedDecouple, we provide a comprehensive comparison with five representative privacy-preserving paradigms in

Table 7. Comparison of FedDecouple with existing privacy-preserving paradigms in federated learning.

Feature/ Paradigm	Distributed DP	SecAgg	SecAgg + Central DP	Distributed Noise Gen.	Local DP	FedDecouple (Ours)
Noise Location	Client-side	None (MPC/SS)	Server-side	Distributed	Client-side	Server-side (via MPC)
Trust Assumption	Trusted Server	No Trusted Server	Trusted Server	No Trusted Server	No Trusted Server	No Trusted Server
Client Computation	Gradient + Noise	Heavy (Encryption/SS)	Gradient	Gradient + (Partial)	Gradient + Noise	Gradient Only (Lightweight)
Resolves Noise Accumulation?	No	N/A	Yes	No	No	Yes (Phase Decoupling)
Key Limitation vs. Ours	Noise accumulates	No inherent DP	Single point of failure	Complex coordination	High noise, low utility	—

.

Analysis of Key Differences:

vs. Distributed DP: While both approaches involve distributed participants, Distributed DP still requires noise to be added locally at each client, which fails to resolve the noise accumulation problem. Conversely, FedDecouple offloads this task entirely by injecting noise at the server side through a secure MPC protocol.

vs. Secure Aggregation (SecAgg) and Central DP: Standard SecAgg protocols ensure that the server cannot see individual updates but do not inherently provide differential privacy. When combined with Central DP, the noise is added by a single trusted server. This reintroduces a single point of trust and requires heavy cryptographic computation on the client side (e.g., for encryption of individual masks). FedDecouple is unique in that it achieves server-side noise injection without requiring a trusted server and with minimal client overhead.

vs. Distributed Noise Generation: Some works propose distributed noise generation, but they often focus solely on generating the noise and still require the server to perform the final aggregation. In contrast, FedDecouple tightly couples the distributed noise generation with a phase-decoupled aggregation protocol, which is specifically designed to leverage the central noise for optimal utility. This comprehensive integration allows our method to fundamentally eliminate noise accumulation, a structural problem left unaddressed by simply distributing the noise generation process.

5. Experimental Setup and Implementation

This section describes the implementation details and experimental configuration used to evaluate FedDecouple. We first define the experimental setup, including the baseline methods we compare against (Section 5.1). We then describe the model architectures used for each method (Section 5.2), followed by the datasets and preprocessing steps (Section 5.3). Section 5.4 presents the common hyperparameter configurations used across all experiments. Section 5.5 explains our implementation of the moments accountant for privacy tracking, and Section 5.6 lists the hardware and software environment. The experimental results obtained from this setup are reported and analyzed in Section 6.

5.1. Overview of Experimental Setup

5.1.1. Limitations of the Comparison Protocol

We acknowledge that the use of different model architectures, normalization methods, and batch sizes across methods may confound the comparison. Specifically:

‑

GroupNorm is used for FedDecouple because BatchNorm’s running statistics are unstable under DP training, as noted in prior work [21]. Using BatchNorm with DP would cause training failure, making comparison impossible.

‑

The baseline methods use the architectures reported in their respective papers, preserving their established performance characteristics.

‑

Batch size differences (64 for most methods, 128 for Opacus) follow the original implementations.

We have added a table reporting the parameter counts for each architecture to facilitate capacity comparisons.

Table 8. Model parameter counts by method.

Method	Model Architecture	Parameters (Approx.)
DP-SGD	3-Conv CNN + 2 FC	∼1.2M
Opacus	Medium CNN (6 Conv + 3 FC)	∼7.2M
DP-FTRL	Lightweight CNN	∼0.55M
FedDecouple (Ours)	GroupNorm CNN (3 Conv blocks + 2 FC)	∼6.5M

summarizes this information.

We also note that due to computational constraints, we do not report multiple-run standard deviations or confidence intervals at this time. These are identified as important directions for future work.

Comparison Protocol: We compare FedDecouple against three representative DP-FL methods: Custom DP-SGD, Opacus DP-SGD, and DP-FTRL. All methods are evaluated under identical settings:

• Privacy budget: Three levels: $\epsilon \in \{8,4,1\}$ with $\delta ={10}^{-5}$.
• Training rounds: 30 rounds for MNIST and 40 rounds for CIFAR-10.
• Evaluation metrics: Test accuracy (%), test loss, and total training time (seconds).
• Number of runs: Single run per configuration (due to computational constraints).

Baseline Methods:

• Custom DP-SGD: Our implementation of DP-FedAvg following McMahan et al. [6], using the moments accountant for privacy tracking.
• Opacus DP-SGD: The Facebook-developed open-source DP-SGD library [21].
• DP-FTRL: The tree-aggregation DP method of Kairouz et al. [8].

Experimental Environment: All experiments were conducted on a server with an Intel Xeon Gold 6230 CPU, NVIDIA V100 GPU (32GB VRAM), 256GB RAM, Ubuntu 20.04 LTS, Python 3.10, PyTorch 1.9.0, and CUDA 11.1. A fixed random seed of 42 is used throughout for reproducibility.

5.1.2. Experimental Limitations

We acknowledge the following limitations in our current empirical validation:

• Single-run results: All results are based on a single representative run per configuration (fixed random seed of 42) due to computational constraints. We do not report standard deviations, confidence intervals, or statistical significance tests. The reported improvements should be interpreted as observed trends rather than statistically validated claims.
• IID data partitioning: All experiments use IID client data partitions. Non-IID and heterogeneous data distributions, which are common in real-world FL, are not considered.
• Limited datasets: Only MNIST and CIFAR-10 are used. More diverse and realistic datasets (e.g., FEMNIST, StackOverflow) are not included.
• No mobile deployment measurements: CPU usage, memory consumption, energy costs, bandwidth usage, and actual mobile deployment results are not reported.

These limitations are addressed as future work in Section 7.2.

5.2. Model Architectures

Note on Architectural Choices: To ensure fair comparison and compatibility with each method’s original implementation, we adopt the architectures recommended in the respective source papers. The baseline methods (DP-SGD, Opacus, DP-FTRL) use their original CNN architectures, while FedDecouple uses a GroupNorm-based CNN. GroupNorm is chosen because BatchNorm’s running statistics are notoriously unstable under the high noise levels of differential privacy; this is a practical necessity rather than a design choice to favor our method. We acknowledge that architectural differences across methods may confound the comparison. The results should therefore be interpreted as system-level performance comparisons of complete DP-FL pipelines rather than isolated algorithmic comparisons.

To ensure fair comparison across all methods while accommodating the specific requirements of different privacy mechanisms, we adopt distinct CNN architectures for each method. All models operate on CIFAR-10’s 32 × 32 RGB inputs and output 10-class logits.

The FedAvg baseline and DP-SGD share a standard three-convolution CNN (conv1: 32 filters, conv2: 64 filters, conv3: 64 filters) followed by two fully connected layers (512 and 10 units). This architecture is commonly used in differentially private deep learning because its moderate parameter count keeps the clipping and noise addition tractable.

The FedDecouple method uses a more powerful model with GroupNorm [42] instead of BatchNorm (three convolutional blocks: 64 → 128 → 256 channels, each followed by GroupNorm, ReLU, and max-pooling; then two fully connected layers of 512 and 10 units). GroupNorm avoids the running statistics of BatchNorm, which are notoriously unstable under the high noise levels required by differential privacy, while the larger capacity allows the method to fully exploit its improved signal-to-noise ratio.

The DP-FTRL employs a lightweight CNN (three convolutions with 32 → 64 → 128 channels, each followed by ReLU and max-pooling, then a 256-unit fully connected layer) to minimize the per-round communication and computational overhead, which is consistent with the original DP-FTRL recommendation of using a low-capacity model.

The DP-Opacus follows the official Opacus examples and uses a medium-sized CNN (three convolutional blocks with 64 → 128 → 256 channels, each block containing two convolutions followed by ReLU, max-pooling, and dropout, and finally three fully connected layers of 512, 256 and 10 units). This architecture is engineered to work well with per-sample gradient clipping while maintaining competitive accuracy under differential privacy.

Table 8 reports the number of trainable parameters for each method’s architecture.

We note that FedDecouple’s architecture has a similar capacity to Opacus (∼6.5M vs. ∼7.2M), but is larger than DP-SGD (∼1.2M) and DP-FTRL (∼0.55M). Architectural differences should be considered when interpreting the results.

5.3. Dataset and Preprocessing

We evaluate FedDecouple on two widely used benchmark datasets for image classification: MNIST and CIFAR-10.

Table 9. Dataset characteristics.

Property	MNIST	CIFAR-10
Number of training samples	60,000	50,000
Number of test samples	10,000	10,000
Number of classes	10	10
Image dimensions	28 × 28 (grayscale)	32 × 32 × 3 (RGB)
Original pixel range	[0, 255]	[0, 255]

summarizes the key characteristics of both datasets.

Preprocessing:

• MNIST: Images are normalized to $[0,1]$ and flattened to 784-dimensional vectors.
• CIFAR-10: Training images are augmented with random crop (32 × 32 with padding 4) and random horizontal flip. All images are normalized using channel-wise mean (0.4914, 0.4822, 0.4465) and standard deviation (0.2023, 0.1994, 0.2010).

Data Partitioning: Data is partitioned among $K=10$ clients in an IID manner. Each client receives approximately 5000 training samples for CIFAR-10 and 6000 samples for MNIST. This IID setting allows us to isolate and evaluate the effect of privacy mechanisms on model performance without the confounding factor of data heterogeneity.

5.4. Common Configuration Hyperparameters

Table 10. Common configuration hyperparameters.

Parameter	Value	Description
num_clients	10	Total number of clients
num_rounds	40	Total communication rounds
local_epochs	3	Number of training rounds per iteration
clients_per_round	5	Clients selected per round
batch_size	64	Local batch size (128 for DP-Opacus)
clip_norm	1.0	Gradient clipping norm C
delta	$1\times {10}^{-5}$	DP failure probability
target_epsilon	8.0	Target privacy budget
momentum	0.9	Retention of historical update directions
weight_decay	$5\times {10}^{-4}$	Penalty term of parameter norm

summarizes the common hyperparameters used across all experiments.

5.5. Implementation of Privacy Accounting

We implemented the moments accountant to precisely track the cumulative privacy consumption across multiple training rounds in FedDecouple. By analyzing the moment-generating function of the privacy-loss stochastic variable, the moments accountant provides a tighter privacy upper bound than traditional composition theorems.

5.6. Hardware and Software Environment

Table 11. Hardware and software environment.

Component	Specification
CPU	Intel Xeon Gold 6230 @ 2.1GHz
GPU	NVIDIA V100 (32GB VRAM)
RAM	256GB
OS	Ubuntu 20.04 LTS
Python	3.10
PyTorch [43]	1.9.0
CUDA	11.1
NumPy	1.21.0
Opacus	1.4.0 (optional)

lists the hardware and software specifications used in our experiments.

6. Experimental Results and Analysis

The experimental results presented in this section should be interpreted within the scope defined in Section 5.1. While we believe these results provide valuable insights into the relative performance trends of FedDecouple and baseline methods, we acknowledge that the empirical validation is limited in scope and that the results are indicative rather than conclusive.

Convergence speed is one of the key metrics for evaluating the efficiency of differential privacy algorithms, as it directly determines the number of communication rounds and training time required to achieve the desired accuracy.

Figure 3, Figure 4 and Figure 5 show the convergence curves of test accuracy for the four methods trained on the MNIST dataset over 30 training rounds under $\epsilon =8$, $\epsilon =4$, and $\epsilon =1$ privacy budgets, respectively.

Figure 6, Figure 7 and Figure 8 demonstrate the loss curves of the four methods trained on the MNIST dataset under the corresponding privacy budgets.

6.1. Key Observations from the MNIST Dataset ($\epsilon =8$)

Convergence rate [44]: FedDecouple demonstrates the fastest convergence rate: it achieves over 90% accuracy in just 3 rounds, reaches 95% accuracy in 5 rounds, and attains 97% accuracy in 17 rounds. In contrast, Custom DP-SGD requires 7 rounds to reach 90% accuracy and 26 rounds to barely reach 95%. Opacus and DP-FTRL fail to consistently achieve 95% accuracy even after 30 rounds.

The steepness of the convergence curve: As clearly shown in Figure 3, the FedDecouple convergence curve exhibits an almost vertical ascent from rounds 1 to 5, rising rapidly from 85.46% to 94.28%. This indicates that centralized noise addition eliminates client-side noise interference, resulting in more accurate gradient directions in each aggregation round and significantly accelerating early convergence.

Custom DP-SGD: Although it ultimately converges to 94.62%, the convergence process exhibits a distinct plateau phase (precision stagnation from rounds 8 to 13), a typical manifestation of oscillations in the optimization direction caused by accumulated client-side noise.

Opacus: The initial convergence was slow (with accuracy maintained at 49.41% during the first four rounds), showing significant improvement only in the fifth round. This reflects that although gradient computation per sample is precise, it requires more rounds to accumulate effective signals under strong noise conditions.

DP-FTRL: The convergence process exhibits significant fluctuations (e.g., sharp oscillations during rounds 6–8), attributable to instability caused by the noise introduced by tree aggregation. Although the final accuracy reaches 92.55%, the convergence path remains tortuous.

Precision comparison: FedDecouple achieves the highest optimal accuracy of 98.17%, significantly outperforming all baseline methods. The gap compared to other methods is significant: 3.55 percentage points higher than Custom DP-SGD (94.62%), 5.62 percentage points higher than DP-FTRL (92.55%), and 7.77 percentage points higher than Opacus (90.40%).

Stability: After reaching the peak value (98.17% in round 26), FedDecouple showed only a slight decline to 97.72%, demonstrating good stability. In contrast, the accuracy of DP-FTRL continued to fluctuate in later stages, reflecting the instability of tree-aggregated noise.

6.2. Key Observations from the MNIST Dataset ($\epsilon =4$)

Convergence rate: To further validate the robustness of FedDecouple and its performance under varying privacy requirements, we repeated the experiments with a moderate privacy budget $\epsilon =4$ (stricter than $\epsilon =8$). FedDecouple consistently demonstrated the fastest convergence rate: achieving over 90% accuracy in just 3 rounds, 95% accuracy in 5 rounds, and 97% accuracy in 15 rounds. This indicates that the advantages of stage decoupling remain stable across different privacy levels.

The tightening of privacy budgets has the least impact on FedDecouple: compared to $\epsilon =8$, the number of rounds required to achieve 90% and 95% accuracy remains unchanged (still 3 and 5 rounds, respectively), while the number of rounds needed for 97% accuracy slightly decreases from 17 to 15.

Custom DP-SGD is significantly impacted by stricter privacy constraints: under $\epsilon =8$, it requires 7 rounds to reach 90% and 26 rounds to reach 95%; under $\epsilon =4$, although the number of rounds needed to reach 90% decreases slightly to 4, the number required to reach 95% increases to 19 rounds, and it fails to achieve 97% within 30 rounds.

Opacus exhibited severe degradation: under $\epsilon =8$, Opacus could still achieve 90% accuracy after 5 rounds; under $\epsilon =4$, reaching 90% accuracy required 15 rounds, with the final accuracy dropping to only 83.19%.

DP-FTRL continues to exhibit fluctuations: achieving 90% requires 9 rounds (similar to $\epsilon =8$), while reaching 95% demands 27 rounds. However, its convergence curve still shows significant volatility.

Precision comparison: Under stricter privacy constraints, FedDecouple achieves higher accuracy—a counterintuitive yet highly valuable finding. Under $\epsilon =4$, FedDecouple reaches an optimal accuracy of 98.88%, up 0.71 percentage points from the 98.17% achieved under $\epsilon =8$.

6.3. Key Observations from the MNIST Dataset ($\epsilon =1$)

Convergence rate: FedDecouple maintains rapid convergence even under extreme privacy constraints: it achieves over 70% accuracy in just 4 rounds, reaches 80% accuracy after 6 rounds, and attains 90% accuracy after 15 rounds. In contrast, other methods fail to consistently reach 90% accuracy within 30 rounds.

Custom DP-SGD converges significantly slower: it requires 8 rounds to reach 70%, 16 rounds to achieve 80%, and only achieves a final accuracy of 93.96%, failing to exceed 90% within 30 rounds.

Opacus convergence was extremely slow: it barely achieved 70% accuracy until the 22nd round, with the final accuracy reaching only 81.79%.

DP-FTRL exhibited minimal convergence: the accuracy remained below 60% throughout the first 20 rounds, only reaching 70% in the 27th round, with a final accuracy of merely 73.26%.

Precision comparison: FedDecouple maintains over 97% accuracy even under extreme privacy constraints, achieving an optimal accuracy of 97.75%, with only a 1.13 percentage point decrease from $\epsilon =4$ and a 0.42 percentage point decrease from $\epsilon =8$.

6.4. CIFAR-10 Dataset Results

Figure 9 and Figure 10 compare the training performance of the four methods on the CIFAR-10 dataset in terms of accuracy and loss, respectively ($\epsilon =8$).

6.5. Convergence Speed and Accuracy

FedDecouple achieves the highest accuracy: 76.2% test accuracy after 40 training rounds, surpassing DP-FTRL (74.2%) by 2.0 percentage points, DP-Opacus (72.2%) by 4.0 percentage points, and traditional DP-SGD (62.8%) by 13.4 percentage points.

The convergence speed advantage is pronounced: FedDecouple achieves over 70% accuracy around the 20th round, whereas other methods require more rounds to reach comparable performance. This validates the effectiveness of the phased decoupling design in accelerating convergence—centralized noise injection prevents cumulative client-side noise interference, resulting in more accurate gradient directions in each round.

DP-FTRL ranks second, achieving 74.2% accuracy, showing only a slight gap compared to FedDecouple. Traditional DP-SGD demonstrates significantly inferior performance: only 62.8%, 13.4 percentage points lower than FedDecouple. Opacus falls between the two, achieving 72.2%.

6.6. Loss Function Analysis

The loss reduction trend aligns with the accuracy improvement: FedDecouple’s loss decreases most rapidly and steadily, achieving the lowest final test loss. DP-FTRL’s loss reduction is slightly slower than FedDecouple but significantly outperforms DP-SGD and Opacus. DP-Opacus’s loss decreases steadily, but its final loss is higher than that of FedDecouple and DP-FTRL. DP-SGD exhibits the slowest decline and highest final loss, reflecting the severe interference caused by noise accumulation during the optimization process.

6.7. Total Training Time Comparison

Table 12. Total training time (seconds).

Dataset	FedDecouple	DP-SGD	Opacus	DP-FTRL
MNIST ($\epsilon =8$)	580.3	673.1	603.2	647.2
MNIST ($\epsilon =4$)	585.6	672.7	594.5	640.9
MNIST ($\epsilon =1$)	590.4	677.8	600.1	645.8
CIFAR-10 ($\epsilon =8$)	777.5	894.3	785.0	853.3

presents the total training time of all four methods on both datasets.

Key observations: FedDecouple is the fastest overall on both datasets, achieving the shortest training time among all four methods. On MNIST (30 rounds), FedDecouple is 13.8% faster than DP-SGD (580.3 s vs. 673.1 s) and 10.3% faster than Opacus. On CIFAR-10 (40 rounds), FedDecouple is 13.0% faster than DP-SGD and marginally (0.96%) faster than Opacus, while still achieving significantly higher accuracy. The consistent ranking across both datasets confirms the robustness of FedDecouple’s efficiency advantage.

6.8. Comparison with State-of-the-Art Methods

To further validate the effectiveness of FedDecouple, we compare its performance with several representative differentially private federated learning methods that have been published.

Table 13. Comparison with state-of-the-art DP-FL methods.

Method	MNIST Accuracy	CIFAR-10 Accuracy
FedDecouple (Ours)	98.88% ($\epsilon =4$)	76.2% ($\epsilon =8$)
SDP-FL	97.8%	79.2%
LG-DPPA	97.30%	90.18%

summarizes the test accuracy results on MNIST and CIFAR-10 under similar privacy settings.

On MNIST, FedDecouple achieves 98.88% accuracy under a strict privacy budget of $\epsilon =4$, outperforming SDP-FL (97.8%) and LG-DPPA (97.30%). This advantage stems from our phase-decoupled design, which fundamentally eliminates the noise accumulation problem inherent in client-side noise injection paradigms.

On CIFAR-10, while LG-DPPA reports a higher accuracy of 90.18%, it is important to note that this method combines both local and global differential privacy and was evaluated under different experimental conditions, including a simplified model architecture (MLP) rather than the more challenging CNN architectures used in our study. Our FedDecouple achieves 76.2% under a tight privacy budget of $\epsilon =8$ with a standard CNN model, which is comparable to SDP-FL (79.2%) and significantly outperforms traditional baselines such as DP-SGD (62.8%).

6.9. Analysis and Explanation

6.9.1. Convergence Rate Analysis

The rapid convergence of FedDecouple stems from its phased decoupling architecture: clients upload clean gradient updates, while the server introduces a single noise term after aggregation. This enables:

• The aggregated gradient in each round exhibits a higher signal-to-noise ratio, as the noise is not amplified by squaring.
• The gradient direction more accurately points toward the global optimum, avoiding random walks caused by client-side noise.
• During the early training phase (when gradient signals are strong), the pure gradient can be fully utilized to rapidly converge to the optimal region.

6.9.2. Accuracy Advantage Analysis

The accuracy advantage of FedDecouple can be attributed to the elimination of noise accumulation. In the traditional client-side noise addition scheme, the effective noise variance per aggregation round is given by:

$${\sigma }_{\mathrm{eff}}^2={\displaystyle \frac{m·{\sigma }_{\mathrm{local}}^2}{|{\mathcal{S}}_t{|}^2}}$$

where m is the number of clients and ${\sigma }_{\mathrm{local}}$ is the local noise scale. As m increases, the noise variance grows linearly, severely distorting the gradient signal.

In FedDecouple, the effective noise variance is ${\sigma }_{\mathrm{global}}^2$ and is independent of the number of clients. Consequently, the model maintains highly accurate gradient estimates throughout the training process, ultimately converging to a superior local optimum.

7. Conclusions and Future Work

7.1. Conclusions

This paper addresses the fundamental noise accumulation problem in differentially private federated learning, where client-side noise added locally accumulates quadratically during server aggregation, severely degrading model convergence and accuracy. We propose FedDecouple, a phase-decoupled framework that fundamentally restructures the noise addition process: clients upload clean gradients after local training, while two auxiliary servers collaboratively generate and inject a single calibrated Gaussian noise through a secure two-party MPC protocol. This design reduces the effective noise variance from $m·{\sigma }_{\mathrm{loc}}^2$ to ${\sigma }_{\mathrm{global}}^2$, eliminates per-sample gradient computation on clients, and removes reliance on a single trusted server. Extensive experiments on MNIST and CIFAR-10 demonstrate that FedDecouple achieves optimal privacy-utility trade-offs across all privacy levels ($ϵ=8,4,1$), reaching 98.88% accuracy on MNIST ($ϵ=4$) and 76.2% on CIFAR-10 ($ϵ=8$), significantly outperforming DP-SGD, Opacus, and DP-FTRL in convergence speed, final accuracy, and stability. The phase-decoupled design establishes a new paradigm for privacy-preserving federated learning on resource-constrained mobile devices.

Experimental results demonstrate that the FedDecouple pipeline achieves superior performance compared to baseline methods on MNIST and CIFAR-10. While these results are promising, we acknowledge that architectural differences across methods may contribute to the observed gains. The results should be interpreted as system-level comparisons of complete DP-FL pipelines rather than isolated algorithmic evaluations. Controlled ablation studies using identical architectures are needed to fully isolate the effect of phase decoupling and are identified as future work.

7.2. Future Work

Future research directions include extending the two-party MPC protocol to three or more parties for stronger collusion resistance, introducing tighter privacy accounting methods such as Rényi differential privacy to further reduce noise requirements, adapting the framework to non-convex loss functions and heterogeneous data distributions (Non-IID), integrating adaptive noise mechanisms for dynamic privacy budget allocation, and deploying the system on real-world mobile platforms to evaluate communication efficiency and energy consumption under practical network conditions. In addition, we plan to conduct controlled experimental comparisons where all methods use the same model architecture, normalization strategy, and comparable hyperparameters, along with ablation studies designed to isolate the contribution of phase decoupling. This will provide a more definitive assessment of the algorithmic contribution of FedDecouple.

• Empirical Extensions:

• Statistical Validation: Conducting multiple independent runs with different random seeds to report mean and standard deviation of accuracy, along with statistical significance tests.
• Non-IID Data: Evaluating FedDecouple under various non-IID data distributions to assess its robustness to client heterogeneity.
• Additional Datasets: Extending the evaluation to more diverse and realistic datasets, including FEMNIST (larger number of classes) and StackOverflow (real-world FL setting with natural non-IIDness).
• Mobile Deployment: Deploying FedDecouple on real mobile devices to measure CPU usage, memory consumption, energy costs, bandwidth usage, and practical deployment performance.