A research team led by Arpit Guleria, Harshan Jagadeesh, Ranjitha Prasad, and B. N. Bharath has demonstrated that employing the Cheon-Kim-Kim-Song homomorphic encryption scheme allows distributed machine learning systems to detect and correct global class imbalance while preserving client data confidentiality. Published in Discover Data, the investigation introduces FLICKER, an iterative data-level framework designed to identify skewed class distributions across decentralized devices without inspecting raw training records or unprotected label statistics. In extensive benchmark evaluations conducted on image and text classification tasks, the protocol improved federated learning model accuracy by up to eight percent over conventional implementations, successfully mitigating systemic training bias without requiring clients to alter their internal model architectures or disclose proprietary data distributions.
Federated learning establishes collaborative model training across dispersed participating nodes, such as mobile devices or institutional servers, by communicating model weight updates rather than centralizing private raw records. Although the integration of differential privacy and cryptographic safeguards has made federated learning increasingly viable for security-critical deployments, standard decentralized architectures remain fundamentally vulnerable to the challenges of class imbalance. In practical deployments, participating edge devices accumulate data organically based on localized events, regional demographics, or distinct user behaviors, naturally yielding heavily skewed class frequencies where specific target categories are severely under-represented across participating nodes. Unlike centralized machine learning settings where engineers possess complete visibility over aggregate sample frequencies and can directly rectify uneven categories through centralized re-sampling or generative augmentation, federated coordinators cannot aggregate plain-text label statistics without creating severe privacy leakages and violating confidentiality guarantees.
To illustrate the operational friction caused by obscured data distributions, the authors formalized a toy federated learning scenario involving two clients collaborating with a central server to solve a two-class classification task. In this illustrative configuration, the first client holds ten samples belonging to the first category and ninety samples belonging to the second category, while the second client holds ninety samples of the first category and ten samples of the second category. If both clients were permitted to reveal their internal distributions to the central coordinator, the server could instantly observe that the aggregated global dataset comprises exactly one hundred samples per class, demonstrating perfect overall balance and requiring no pre-processing modifications whatsoever. However, when strict data privacy rules prevent participants from disclosing local label tallies, both clients independently perceive severe internal deficits, prompting them to execute unnecessary local pre-processing interventions that distort the learning process before collaborative training even begins.
Independent local pre-processing introduces significant operational trade-offs that can degrade global model convergence and strain client hardware resources. When an isolated client attempts to balance its internal partition by under-sampling its dominant majority class, it frequently removes unique data samples whose distinguishing features, while locally redundant, are entirely absent from partner devices and vital for global model generalization. Conversely, when an edge node attempts independent over-sampling through synthetic data augmentation, it injects artificial data points that may not accurately reflect natural variations, incurring what the researchers formalize as an augmentation overhead. In memory-constrained hardware environments such as Internet of Things appliances and embedded smart devices, massive sample inflation imposes severe computational and memory penalties. Consequently, the authors determined that balancing distributed training sets effectively requires a coordinated mechanism that tracks aggregate distribution metrics across the global server without exposing individual client profiles.
To establish rigorous mathematical criteria for identifying imbalance, the researchers formulated distinct quantitative balance metrics for both individual edge clients and the aggregate system. For any client possessing a local sample distribution across multiple target classes, the local imbalance metric is defined as the mathematical ratio of the minimum class frequency to the maximum class frequency, yielding a value that approaches one under perfect balance and nears zero under severe skew. Correspondingly, the global distribution vector aggregates the class-specific sample counts across all participating clients, with the global imbalance metric defined as the ratio between the minimum and maximum class counts within this aggregated global vector. In conventional practice, system designers define acceptable tolerance thresholds between zero and one, below which corrective interventions become mandatory to protect downstream neural network accuracy and ensure statistical fairness across minority classifications.
The FLICKER framework executes an iterative four-stage procedure that securely detects and resolves distribution disparities through homomorphic calculations. The first operational stage conducts secure global imbalance computation without requiring plain-text distribution disclosures, organizing participating edge clients into an encrypted virtual ring network. In this relay structure, the initial client encrypts its local class distribution vector using the central server’s Cheon-Kim-Kim-Song public encryption key and transmits the resulting ciphertext to the neighboring device. Successive clients compute homomorphic vector additions by combining their respective local distribution vectors with the received ciphertexts before forwarding the cumulative encrypted sums downstream. When the final client delivers the accumulated ciphertext to the central coordinator, the server applies its private decryption key to extract the precise global class counts, allowing it to evaluate aggregate imbalance while remaining completely ignorant of any individual participant’s local sample distributions.
When the recovered global imbalance falls below the predetermined operational threshold, FLICKER initiates a cryptographic localization stage to isolate the specific participant contributing most heavily to the system-wide skew. The central coordinator first normalizes the global distribution vector to have unit Frobenius norm, encrypts this normalized vector under its public key, and broadcasts the resulting ciphertext to all participating edge nodes. Each client subsequently performs a cipher-domain inner-product operation, calculating the encrypted cosine similarity between its own normalized local distribution vector and the encrypted global vector, and returns the encrypted scalar to the server. Because the Cheon-Kim-Kim-Song scheme natively supports primitive addition and multiplication over ciphertexts, clients execute these projections without decrypting the server’s broadcast. Upon decrypting the returned scalar values, the server identifies the dominant client exhibiting the highest cosine similarity to the global distribution, designating that specific node for targeted local resampling.
Following client localization, the designated dominant node executes a local resampling procedure provided its internal imbalance metric remains beneath a defined client-level threshold. Once the dominant client modifies its data partition, it performs a secure global update by homomorphically subtracting its prior local distribution from the existing encrypted global tally and adding its newly revised distribution vector before transmitting the update directly to the server. The server decrypts the updated global distribution, calculates the refreshed system-wide balance, and terminates the preparation protocol if the global metric meets the target threshold. If the aggregate metric remains deficient, the protocol repeats: if the previous dominant client retains further capacity for modification, it executes another adjustment round; otherwise, the server re-evaluates encrypted cosine similarities across the remaining unsaturated clients, systematically iterating until the target balance is achieved or all clients reach saturation.
The physical resampling implemented by dominant clients utilizes an alternating balance strategy to curb artificial sample generation while safeguarding predictive information. For over-sampling, the dominant client identifies its minority class and generates supplementary training records by systematically modifying the geometric orientations of existing minority samples, uniformly selecting source samples and adding a quantity governed by the inverse of its local imbalance metric. For under-sampling, the framework avoids arbitrary sample removal by identifying both local and global data redundancies through an auxiliary neural network classifier shared across all clients. The dominant node extracts unit-norm feature vectors from its majority-class records, generates a local cosine similarity matrix, and buffers the top candidate vectors displaying the highest mean and variance in cosine similarity. To verify global redundancy, buffered vectors are homomorphically encrypted and evaluated against feature distributions on peer clients; samples displaying global cosine similarities exceeding ninety-eight percent across a specified client fraction are permanently purged.
The authors evaluated FLICKER through rigorous empirical trials utilizing four participating clients and a central server on two standard machine learning benchmarks: the CIFAR-10 image dataset and the AG News natural language text corpus. For CIFAR-10 experiments, clients executed four-class image classification using custom convolutional neural networks comprising 1,288,256 weight parameters and 16,490 bias parameters, totaling 1,304,746 trainable parameters, trained across diverse synthetic distribution splits reflecting varying degrees of initial imbalance. For the AG News natural language benchmark, which tasks models with categorizing news headlines and snippets into world, sports, business, or science and technology topics, clients employed custom text-oriented convolutional networks comprising 644,352 weight parameters and 68 bias parameters, totaling 644,420 parameters. Across all trials, the global imbalance threshold was configured to 0.1, the local client threshold was set to 0.05, and redundancy identification utilized an auxiliary four-class model pre-trained on one thousand auxiliary records for fifty epochs.
To rigorously assess model efficacy without ignoring the memory and computational footprints created by sample generation, the authors formulated a novel normalized accuracy metric. Traditional accuracy metrics in federated environments reflect only the raw proportion of correct classifications, failing to capture the performance penalties and memory overheads imposed on resource-constrained devices when over-sampling inflates training collections with synthetic points. The proposed normalized accuracy metric scales the raw test accuracy by dividing it by the maximum of one and the ratio of post-resampling total samples to initial total samples. Consequently, this formulation directly penalizes approaches that achieve performance gains through excessive sample duplication or synthetic data inflation, while leaving under-sampling strategies unpenalized, providing an equitable basis for comparing distributed resampling methods intended for deployment across constrained edge nodes and Internet of Things environments.
Empirical results across twenty federated communication rounds demonstrated that FLICKER consistently surpassed uncorrected baselines, local under-sampling, and independent over-sampling. On CIFAR-10 distribution benchmarks, uncorrected models achieved baseline accuracies of 66.04, 53.45, and 59.77 percent alongside severe global imbalance figures of 0.016, 0.016, and 0.0039. Local under-sampling severely degraded classification performance to 58.77, 46.00, and 44.67 percent while disrupting balance metrics to 0.117, 0.081, and 0.1617 due to the indiscriminate elimination of useful features. Independent over-sampling recovered raw accuracies of 69.07, 58.85, and 59.77 percent, but injected 680 synthetic samples that inflated memory demands and left residual imbalances of 0.084, 0.078, and 0.2107. In contrast, FLICKER achieved superior accuracies of 68.73, 59.60, and 63.05 percent while attaining superior balance scores of 0.0994, 0.083, and 0.0672 with virtually zero sample inflation, a performance advantage confirmed on the AG News benchmark where FLICKER attained 79.26 percent accuracy alongside superior normalized accuracy curves and elevated class-wise F1-scores.
An asymptotic complexity analysis confirmed that FLICKER preserves computational feasibility throughout its cryptographic coordination lifecycle. Establishing the initial encrypted global distribution across the ring network requires N plus one operations involving Cheon-Kim-Kim-Song encryption and decryption routines. Executing dominant client localization requires two N plus one cryptographic operations to broadcast normalized vectors, compute encrypted inner products across all clients, and decrypt similarity scalars at the central server. With each dominant update requiring two operations and bounding maximum localized adjustment rounds by an integer M, the complete worst-case computational ceiling across all participants totals two N M plus three N plus two cryptographic operations. The authors noted that while homomorphic lattice-based operations introduce measurable operational overhead, the restriction of cryptographic calculations to vector additions and similarity projections prevents debilitating latency, establishing collaborative homomorphic pre-processing as a viable pathway for privacy-preserving federated optimization.
Subject of Research: Privacy-preserving class imbalance mitigation in federated learning using homomorphic encryption
Article Title: On homomorphic encryption based strategies for class imbalance in federated learning
Article References: Guleria, A., Jagadeesh, H., Prasad, R., & Bharath, B. N. (2025). On homomorphic encryption based strategies for class imbalance in federated learning. Discover Data, 3(1), Article 59. https://doi.org/10.1007/s44248-025-00095-7
Image Credits: AI Generated
DOI: 10.1007/s44248-025-00095-7
Keywords: Federated Learning, Homomorphic Encryption, CKKS Scheme, Class Imbalance, Distributed Machine Learning, Data Privacy, Normalized Accuracy, Convolutional Neural Networks, homomorphic, encryption, based, strategies
News Source: Veronica Carney. (November 7, 2026). Homomorphic Encryption Framework Balances Distributed Datasets and Boosts Federated Learning Accuracy. Scienmag.
