RESFL: An Uncertainty-Aware Framework for Responsible Federated Learning by Balancing Privacy, Fairness and Utility
Authors: Dawood Wasif
Terrence J Moore
Jin-Hee Cho
Venue: ICLR 2026 Poster (2026)
Keywords: Federated Learning
Fairness
Privacy
Adversarial Representation Learning
Uncertainty Quantification
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: RESFL is an FL framework that suppresses sensitive attributes via adversarial representation learning and improves group fairness via uncertainty-guided aggregation, delivering strong privacy–fairness–utility trade-offs on FACET and CARLA.

Abstract: Federated Learning (FL) has gained prominence in machine learning applications across critical domains, offering collaborative model training without centralized data aggregation. However, FL frameworks that protect privacy often sacrifice fairness and reliability; differential privacy reduces data leakage but hides sensitive attributes needed for bias correction, worsening performance gaps across demographic groups. This work explores the trade-off between privacy and fairness in FL-based object detection and introduces RESFL, an integrated solution optimizing both. RESFL incorporates adversarial privacy disentanglement and uncertainty-guided fairness-aware aggregation. The adversarial component uses a gradient reversal layer to remove sensitive attributes, reducing privacy risks while maintaining fairness. The uncertainty-aware aggregation employs an evidential neural network to weight client updates adaptively, prioritizing contributions with lower fairness disparities and higher confidence. This ensures robust and equitable FL model updates. We demonstrate the effectiveness of RESFL in high-stakes autonomous vehicle scenarios, where it achieves high mAP on FACET and CARLA, reduces membership-inference attack success by 37%, reduces equality-of-opportunity gap by 17% relative to the FedAvg baseline, and maintains superior adversarial robustness. However, RESFL is inherently domain-agnostic and thus applicable to a broad range of application domains beyond autonomous driving.

Published as conference paper ICLR 2026
RESFL: AN UNCERTAINTY-AWARE FRAMEWORK FOR RESPONSIBLE FEDERATED LEARNING BY BALANCING PRIVACY, FAIRNESS AND UTILITY
Dawood Wasifl, Terrence J. Moore", Jin-HHe Cho²
I Virginia Tech U.S. Army Research Laboratory
(dawoodwasif, f, jicho edu terrence. w.m.rr..cieeareeee
ABSTRACT
Federated Learning (FL) has gained prominence in machine learning applications across critical domains, offering collaborative model training without centralized data aggrega- tion. However, FL frameworks that protect privacy often sacrifice fairness and reliability; differential privacy reduces data leakage hides sensitive attributes needed for bias cor- rection, worsening performance gaps across demographic groups. This work explores the trade-off between privacy and fairness in FL-based object detection and introduces RESFL, integrated solution optimizing both. RESFL incorporates adversarial pri- vacy disentanglement and uncertainty sarial component uses gradient reversal layer remove sensitive attributes, reducing privacy risks while maintaining fairness. The uncertainty-aware aggregation employs evidential neural network weight client updates adaptively, prioritizing contribu- tions with lower fairness disparities and higher confidence. This ensures robust and eq- uitable FL model updates. We demonstrate the effectiveness of RESFL in high-stakes autonomous vehicle scenarios, where it achieves high mAP on FACET and CARLA, re- duces memhership-inferemt
sireerdaittyguuieed guided fairness-aware aggregation. The adver-
attack success by 37%, reduces -follity-f-opporuuuity gap by 17% relative to the FedAvg baseline, and maintains superior adversarial robustness. However, RESFL is inherently domain-agnostic and thus applicable to a broad range of application domains beyond autonomous driving.
1. INTRODUCTION
Federated Learning (FL) has emerged as promising solution to privacy concerns by enabling decentralized model training, ensuring data remains on local devices. In contrast, only model updates, such as gradients or weight deltas, are shared for aggregation. This paradigm not only reduces the risk of raw data exposure but also supports collaborative learning across heterogeneous and sensitive data silos domains like healthcare, finance, and smart cities. However, the inherent obfuscation of sensitive attributes such as demographic labels or personal identifiers introduces critical trade-off: fairness interventions often require direct access to these attributes detect and correct biases. By withholding sensitive information in pursuit of privacy preservation, FL frameworks inadvertently hamper bias mitigation strategies, leading to disparate model performance across groups defined by age, gender, ethnicity (Kaplan 2024 Zhang et al.) 2024).
The problem is exacerbated by external uncertainties real-world data collection and inference, which un- dermine model confidence and reliability. In safety-critical applications, input data are affected by sensor noise, environmental variability (e.g.. lighting, weather, occlusions), and domain shift between training and deployment. Unmodeled, these uncertainties disproportionately degrade performance for subpopula-

---

Published as a conference paper ICLR 2026
tions, amplifying disparities. For example, under foggy or low-light conditions, object detection models show higher false-negative rates for pedestrians with darker skin tones, compounding risks for vulnerable groups. Quantifying such epistemic uncertainty therefore essential to ensure equitable reliability across demographic cohorts (Pathiraja et al., 2024). Beyond environmental shift, federated deployments also face adversarial clients that can poison updates or manipulate confidence signals (Kumar et al. (023). which can inflate group disparity and increasing privacy leakage risk.
While a growing body of work has advanced privacy-preservine techniques, such as differential privacy, secure multi-party computation, and homomorphic encryption, and fairnes--wwae methods, such as pre- processing transformations, in-processing regularizers, and post- post-processing adjustments, these solutions frequently optimize one objective at the expense of others. Differential privacy mechanisms can effectively limit membership inference and attribute leakage, but often degrade model utility and exacerbate fairness disparities by obscuring minority data patterns (Sun et al.] [022]] Xin et al. 2020). Conversely, fairness- oriented re-weighting or regularization approaches can narrow demographic gaps but may inadvertently expose sensitive information if not carefully integrated. Centralized learning paradigms further magnify these tensions by aggregating unprotected data, while many federated solutions prioritize privacy guaran- tees without explicitly addressing equitable performance across groups (Chen et al.) 2025 Ezzeldin al., 2023
Yu et al. 2020). Post hoc fairness corrections or hard constraints also struggle e to capture the nuanced interplay between privacy protection and bias mitigation in decentralized environments (Kim et al., 2024a).
To address these limitations, we propose RESFL, domain-agnostic federated learning framework that jointly optimizes privacy and group fairness by integrating two complementary components within single pipeline: (i) an adversarial representation module with gradient reversal that suppresses sensitive-attribute signals in shared representations, and (ii) an uncertainty- idential uncertainty (via scale-invariant uncertainty faimess metric (UFM) to up- up-weight client updates exhibiting lower inter-group disparity and higher confidence. This unified design yields sevvacy-preserving. equitable, and reliable updates without sacrificing utility. We validate RESFL on autonomous vehicle (AV) scenarios to demonstrate its effectiveness in safety-critical and diverse environments. Empirically, RESFL delivers strong accuracy while reducing fairness gaps and privacy leakage, and remains robust under distri- bution shifts (weather variations). Across both FACET and CARLA, it consistently outperforms standard and state-of of FL baselines on utility, faimess, and privacy.
aggregation mechanism that leverages ev-
2. RELATED WORK
Federated Learning. Federated Learning (FL) is decentralized training paradigm where multiple clients collaboratively train shared model while keeping data on-device. This mitigates privacy risks of centralized aggregation but introduces challenges, particularly data heterogeneity, as clients typically hold non-lID data (Yang et al., 2023). Early research focused on improving communication efficiency and convergence under heterogeneous (non-IID) client data (Li et al.) 2019, Karimireddy et al.) 2020 Martinez et al.) (020)) How- ever, FL introduces new challenges beyond optimization, including privacy leakage, performance disparities across participants, and fairness across sensitive demographic groups (Wasif et al. 2025).
Privacy Preservation Techniques. Preserving user privacy core objective in FL. A fundamental pri- vacy-utility tradeoff holds; any mechanism that guarantees nontrivial privacy necessarily incurs some loss in utility (Dinur Nissim| 2003). Differential Privacy (DP) quantifies this tradeoff by bounding the influence of any individual on the released updates outputs (Dwork) (006). Secure computation techniques such as homomorphic encryption (HE) and secure multi-party computation (SMC) protect data during computa- tion and transport, but by themselves do not limit statistical inference from the outputs (Chen et al.) 2023 Xu et al., 2021): they are orthogonal to DP and often combined with it for end-to-end protection YYi et al. 2014 Tran al. 2023). Recent work also studies perturbation and shuffling for privacy amplification and
2

---

Evidential Uncertainty Modeling. In RESFL, each client replaces its standard softmax detection head with evidential output layer that predicts nonnegative concentration vector (a1...., ac) for C object classes. These concentration parameters parameterize a Dirichlet distribution over the categorical Published as a conference paper ICLR 2026
communication efficiency (Erlingsson al. 2019 Chen et al. 2024a Kim al. 2024b). However, most privacy solutions in FL neglect fairness, risking inequitable outcomes despite strong privacy protections.
Fairness in Federated Learning. Fairness in machine learning has been extensively explored in central- ized settings, with numerous methods mitigate biases against underrepresented groups (Hardt et al. [0116] Kairouz et al., 2021; Mehrabi et al., (021). In FL, researchers distinguish between client fairness, which aims for uniform model performance across data-silo clients Yu et al. 2020 Karimireddy al. 2020). and group fairness, which seeks equitable outcomes across sensitive demographic cohorts despite decentralized data (Kairouz al. 2021). Traditional fairness strategies such constrained optimization regularization work well in centralized frameworks (Wu et al. 2018) but falter in FL,, since the server lacks direct access sensitive attributes for bias measurement (McMahan et al., 2017), and client-level equalization does not guarantee demographic parity, underscoring the need for FL-specific fairness mechanisms.
Privacy-preserving Fair FL.. Given the inherent tension between privacy and fairness, recent research has explored joint approaches to address both in FL.. Differentially private algorithms can worsen fairness disparities by masking minority-group patterns (Zhang et al., (02I). while Fairness-aware techniques may increase privacy risks by exposing sensitive attributes. Prior work includes FairDP-SGD and FairPATE for centralized settings (Yaghini et al. 2023), FPFL which enforces group fairness under DP guarantees but high communication cost (Rodríguez- Srodrfguez-Gáávezz Gálvez et al. (02TT) and two-step schemes that align privacy- protected model with a fair proxy (Sun et al.] [023] Pujol et al. 2020). Pre- and post-procsssing defenses like (Pentyala al. 2022) and (Corbucci et al. 2024) also integrate privacy and fairness but often incur computational overhead or limited scalability (Imteaj et al. 2021). Concurrently, FL methods use epistemic evidential uncertainty for calibration, reliability, and chent personalization, notably in medical imaging c.g., (Chen et al. 22224b] Hendrix et al. 2024 Chen et al. 2024c).. Despite these advances, many approaches struggle to scale or balance the trade-offs effectively, motivating our unified RESFL framework. Moreover, most FL. studies evaluate under benign clients and do not test resilience to adversarial updates or evidence manipulation (Kairouz al., 202I), leaving the stability of their guarantees unclear.
Building on these insights, our proposed RESFL framework overcomes these limitations by integrating privacy preservation and group fairness optimization into single, end-to-end FL algorithm and explicitly evaluates under both benign and adversarial settings.
3. METHODOLOGY
This section introduces our integrated responsible FL (RESFL.). Our approach tackles two key challenges: (i) preventing sensitive attribute leak- age during training to ensure privacy and (ii) mitigating bias in client updates to ensure group fairness. To achieve this, integrate adversarial privacy disentanglement with uncertainty-guide fairness-awaee ag- gregation using an evidential neural network (ENN), enabling the estimates of epistemic uncertainty (Amini et al. 2020). The flow of the RESFL algorithm is depicted in Figure
and fairness-aware Federated Learning framework,
3.1. UNCERTAINTY FAIRNESS METRIC (UFM) FOR GROUP-FAIE AGGREGATION
probability simplex, allowing closed-form computation of epistemic uncertainty without resorting to costly
3

---

Published as conference paper ICLR 2026
Local Training
Upcate
(Ae, UFM.)
UPM
Binking
Sun (nuus))
PUEM,
Ac
Ly...r C
DUPM,
+11
Mi A6,
Disprrty Comcols
Confidenns Gap Phooy
Group Anurape Evideroo
Computo rogaaiation Welghts
Apgrogate
Evidential Head E.
Server
Feeture Extractor A fle 0.)
Delection Heed 12,
UFM:
UPM,
0G
0g
A6.
24
Σ 1/a Ac(h)) x
Evaa Lisa + Agute + Aase Eoreosrtatayy
Cillett
Client 2
Ciient
Gratheet Revernal Layer
Compostn Lose
Figure I: Overview of the RESFL framework. Left: Server receives (A0;, UFM:), computes aggregation weights W/ & exp(-3 UFM)), and updates the global model tg. Right: Client computes feature rep- resentation, applies gradient reversal layer for adversarial privacy loss Ladv. and an evidential head for uncerta metric UFM, then forms the composite loss Liocal to produce update A0;
Monte Carlo sampling or deep ensembles, Formally, for each input the evidential head produces
rEC ae)
C
P(p a+) I(ae)
II
P--!
where is the number of considered classes, r(-) denotes the Gamma function, and (p),..., .PC
represents the class probabilities. The total evidence ag
Ee ae directly yields analytic estimate of
the approximate epistemic variance (Sensoy et al. 2018).
eppLc = Elp.][ 11-1111-p] Elp.))
ag ae
(2)
00
0k
where the first two equalities give the exact Dirichlet predictive variance and the final "~~" indicates asymp- totic scaling, i.c.. Varip.] = ((1/ag). This faithfully reflects model confidence: higher ag implies lower epistemic uncertainty. Raw logits are passed through poftplus-plus-ome bias, a, = softplus(z.). to ensure strict positivity and numerical stability. Training uses composite Dirichlet negative likeliill augmented with a regularization term that penalizes overconfident errors, thereby encouraging calibrated uncertainty estimates practice. At inference, each client computes epistemic variances in single forward pass, enabling efficient uncertainty assessment edge devices. This evidential formulation, integrated into the detection pipeline, provides a principled mechanism for quantifying per-detection confidence under data heterogeneity and environmental variability.
UFM is computed solely from the classification Dirichlet evidence. For an image x. let (x) post- NMS detections above a fixed score threshold We define the per-image average total evidence (set to 0 if |P, (a:) 0) and then the group-wise mean:
0o.g = EZED, max(1, (x))
Σ
00
deP.(t)
Here, Dy is the set of images that contain at least one ground-truth person instance group J the sum runs over post-NMS detections in v, and only detections matched to group-g instances contribute.
4

---

Published as conference paper ICLR 2026
Group-Level Disparity Quantification. Using {āo.g3g= g= gap and the normalized Uncertainty Fairness Metric (UFM) as
IG from Eq.
define the inter-group uncertainty
Au max
min
UFM
Ev,g
g=
Go.g
with c > for numerical stability. Higher UFM indicates greater disparity; lower UFM indicates better group fairness. See Appendix A.r detection-hear details.
We formalize UFM as a scale-invariane measure of inter- group epistemic disparity and show (under bounded loss and standard evidential assumptions) that controlling it tightens confidence-adjusted group general- ization terms (Appendix [ Thm. [.1] Cor. B.2]. We then lift this to federated evaluation via a mixture argument (Lemma B.3) and bound the global disparity by eegregation-weighted combination of client UFMs (Prop. B.4:: with UFi-wtighted aggregation wi x exp(-3 UFM,), the surrogate bound decreases (Cor. B.S which in turn tightens explicit bounds downstream group-parte gap functionals JF evaluated at the fixed fairness IoU Tiair. Under non-degenerate group coverage and standard client sampling, smaller B behaves like uniform averaging. while larger 3 emphasizes clients with tighter per- group disparities, linking the theory to practice and motivating UFM-guided aggregation for global fairness.
Aggregation Weighting Mechanism. On the server side, aggregate client updates using fairness-aware weighting scheme that dynamically adjusts to reported UFM values. Given each client i's update A and corresponding UFM, (see Figure we assign weights via a temperature-scaled exponential:
(FPM))UFM))
Wi Σ Ej=1 exp (-3 UFM,)
where / > 0 controls the sharpness of fairesss prioritization. As 3 - 0, weights approach uniform averag- ing, while larger concentrates updates on clients with minimal uncertainty disparity. The global model then updated by:
N w AO:.
((++)) G
(t)
+
(6)
ensuring that contributions from clients exhibiting both high confidence and equitable performance are am- plified. This continuous reweighting adapts temporal shifts and data heterogeneity, promoting robust con- vergence with reduced fairness gaps and preserved accuracy. We gate Eq. (5) with a deterministic confidence check: if client's validation accuracy is below fixed floor, we set reported fairness statistic u, + b (the clipped worst value), forcing R= O; this blocks uniformly low-confidence clients from receiving high weight and limits the influence of poisoned or low-confidence updates.
3.2. ADVERSARIAL PRIVACY DISENTANGLEMEN VIA GRADIENT REVERSAL
To mitigate sensitive attribute leakage during federated training, we augment the feature extractor f(z; f) X' Rdd which maps input data to latent representation h, with an adversarial classifier A(h; Φ) Rd [0, 1|K The adversary is trained to predict the sensitive attribute label feature extractor jointly optimized to make this prediction as difficult as possible, thus encouraging the leamed representation to be invariant to During training. the classifier parameters & seek to minimize the cross-entropy over the joint distribution of inputs and labels, while the feature extractor parameters 0 are embed
{1, K} from h, while the
trained to maximize this same objective, thereby removing serribute-relevan signals. Concretely, a Gradient Reversal Layer (GRL) RA,. between f and A, which acts as the identity in the forward pass but multiplies incoming gradients by - Andy in the backward pass. The resulting adversarial minimax objective
5

---

Published as a conference paper ICLR 2026
is expressed as:
K
1 {s = k) log A& (Rx. (f(z; (f 6)]
min max B(a,a)=D,
-
>av
k=1
where D; denotes the local dataset of client and 1 = }} is the indicator for class h and (+ denotes the k-th output probability. While do not claim (e, 6D guarantees, our objective has an information- theoretic interpretation: letting H = f(X;0) denote the learned representation and S the sensitive at- tribute, maximizing Ladv reduces the mutual information S); by Fano's inequality, as T(H;
any attribute-inference attack $ = g (H) is driven to chance level, i.e., accuracy
K (Appendix C
Once the adversarial classifier is optimally trained for a fixed feature extractor, we obtain the induced privacy loss for 0 by substituting the worst-case classifier parameters Ø (0) = arg max L0 Φ). The privacy- preserving gradient step for the feature extractor is then driven by:
K
Cpriv (0) = Audy (a.s)=>D Dj
Σ 1 k} log A (f(;0); 60))]
(8)
which, when differentiated through the GRL, enforces that feature representations / become invariant to In practice, we interleave updates of & (maximization) and (minimization) within each local SGD step. ensuring that the learned representation provably suppresses sensitive attribute information while retaining utility for the primary detection task.
3.3. JOINT OPTIMIZATION OF PRIVACY AND FAIRNESS
In each client's 's training loop, RESFL minimizes composite loss that balances detection accuracy, attribute obfuscation, and uncertainty- based bias control. Formally, each client solves:
(9) where Apriv scales the gradient reversal adversarial loss limit information leakage, and Afair weights the evidential uncertainty term to reduce group disparity. By selecting (Apriv A along the convex envelope of evaluated tradeoff points, practitioners obtain models that meet target privacy and fairness thresholds without unnecessary sacrifice of either objective.
(0, Φ) Lussk (0) Apriv Ladv (0, o) + Afair Luncertainty (0),
After local updates, each client computes its UFM, and sends both the parameter update A6; and UFM, to the server. The server then aggregates via:
N
exp (UF(-)
(1++1)
AO
(10)
j= exp((B
where 3 controls the fairness weight. This alternating sequence of local composite-loss minimization and aaire aggregation (Algorithm [ in Appendix D) drives the global model to converge with robust detection, provable attribute privacy, and equitable treatment across sensitive groups
4. EXPERIMENTAL RESULTS & ANALYSES
We evaluate RESFL in autonomous vehicle (AV) context using the FACET dataset and CARLA simulator to capture demographic variation and environmental perturbations. Given the safety-critical and privacy- sensitive nature of AV perception, we pose the following key questions: (1) To what extent does RESFL balance utility, privacy, and fairness under standard AV operating conditions? (2) How resilient is RESFL increased uncertainty caused by environmental variations such as changing weather and lighting?
6

---

Published as a conference paper at ICLR 2026
Table 1: Comparison of FL algorithms on the FACET dataset in detection performance (mAP), fairness (I-DII, AEOP). privacy (MIA, AIA SR), and robustness (BA AD, DPA EODD). Arrows in headers indicate whether higher (1) or lower (4) values are better. Results are mean Etd over seeds.
Utility
Fairness
Privacy Atfacks
Robustness Atfacks
Algorithm
Overall mAP (1)
DI (L)
AEOP ())
MIA SR (L)
AIA SR ())
BA AD (
DPA EODD ())
FedAvg
0.6378
0.2159: 0.215910.000 10,006
0.2362 10.007
0.3341:001
0.4431
0.3125
0.0792.0:005
FedAvg-DP (e 1)
0.4612.10005
0.3945 10,003
0.2879 100009
0.016
0.2627-0006
0.3097 10.005
0.1396.10:08
FaitFed
0.7013
0.2496100006
0.2562 10.007
0.4409
10002
0,5256_0012
0.4139 100001
0.05661.000
PrivFairFl-Pre
00615420006
0.2504=00.00
0,2659 20.07
0.3875
=0.100
0. 0,4038
0. +.3238+0.009
+.0953+0000
PriPaaiFl-Post
0.6119 10:09
0,2718
0.2505 10.005
0.2872 10.00
0.3159
L0.00
0.3212 10,000
0.0937 10,006
PUFFLE
0.4192
0,3721 0
0.2976
0.2725 =0009
0.2909
0.1439 0.1439=0.000 20,000
0,1360 20,008
PFU-FL
0.3952 100009
0.3356 1,,007
0,3446 10:008
0.2409 10.009
0.2546 0.009
0.2612 10,009
0,1459 10:008
Ours (RESPL)
0.6654_g0.00
0,2287 2.0,005
0.1959
0.2093
0.1832 0.005
0.1692:..007
0,0674
4.1. EXPERIMENTAL SETUP
Datasets. The FACET benchmark Guustatson al. 2023) comprises 32,000 real-world images with over 50,000 person instances annotated for perceived skin tone on the ten-level Monk Skin Tone (MST) scale (MST = 1 lightest to MST 10 darkest, see Figure [ in Appendix E}: we average multiple annotations per instance, discretize back to the ten MST levels. partition into ten cohorts, and split into four IID client shards simulate cross-device heterogeneity and demographic variation without sharing raw data. Using the CARLA simulator (Dosovitskiy et al. 2017). we collect 6,000 weether frames (600 per MST level) for fine-tuning and 7,800 evaluation frames across three urban layouts (Town01, Town03, and Town05) under clear, foggy, and rainy conditions at five intensities (0%, 25% 50%, 75%, 100%). Each walker blueprint available CARLA manually assigned to a corresponding MST label through visual inspection based on appearance and attributes. Pedestrian bounding boxes are extracted via connecte--compnent analysis on semantic segmentation masks, which serves as our ground truth (see Appendix for details).
Comparing Schemes. We benchmark RESFL against standard and state-of-the-art federated learning meth- ods. Avd serves as the canonical baseline, performing weighted averaging of client updates. We evaluate FedAvg-DP (per-example DP-SGD), which adds calibrated Gaussian noise per-example clipped local gradients under a fixed privacy budget (e = 1). FairFed (Ezzeldin et al. (023)) dynamically adjusts aggre- gation weights penalize cross-client performance gaps. PrivFairFL (Pentyala al., 2022) incorporates fairness constraints either before aggregation (PrivFairFLL-Pre) or after local updates (Priv PrivFairFL--Pot).
PUFFLE (Corbucci et al. 2024) unifies noise injection with fairness regularization in a joint optimization framework. Finally, PFU-FL (Sun et al. 2023) employs adaptive weighting to balance privacy, fairness, and utility objectives.
Metrics. We measure detection accuracy using mean Average Precision (mAP), which averages per-class AP to capture both object localization and classification quality. For fairness, we report the absolute disparate impact deviation [1 DI,, quantifying the ratio of favorable outcome rates between the most- and least- advantaged groups, and the equality of opportunity gap AEOP, the absolute difference in true positive rates across cohorts. Privacy is assessed by Membership Inference Attack Success Rate (MIA SR) and Attribute Inference Attack Success Rate (AIA SR), where lower values indicate stronger confidentiality. Robustness is measured by Byzantine Accuracy Degradation (BA AD), the relative per-condition mAP drop between clean and attacked runs, and Data Poisoning Attack Equalized Odds Difference Deviation (DPA EODD), the rise in faimess disparity, under fixed protocol with constant Byzantine-clies fraction each round (sign-flip, fz-bounded) and a constant poisoning fraction over a specified block of local epochs.
Experimental Configuration. We implement RESFL using a modified YOLOv8 backbone with an evi- dential concentration-vectt veetro head. We run a standard federated setup with K = 4 clients and T = 100 communication rounds; in each round every client trains for one local epoch (batch size 64) using SGD
7

---

Published as a conference paper ICLR 2026
(momentum 0.9, weight decay 1e 4) with an initial learning rate of 0.001, decayed by 0.1 at epochs 50 and 75. The FACET dataset (32k images) is split into four equal i.i.d. subsets, and within each client shard we keep a fixed 90/10 train/validation split, using the validation portion only to compute per-client UFM, and apply the mAP@50- 50-95 floor of 0.30 in the aggregation gate. CARLA fine-tuning uses 6k neutral-weather
frames and evaluates on 7.8k frames across 13 weather conditions. We set Apriv = 0.1, Atir = 0.01, and
aggregation temperature B = 2.0, and average results over three random seeds. All hyperparameters were selected via an extensive grid search (more details in Appendix F and
4.2. TRADE-OFF ANALYSIS ON THE FACET DATASET
In this experiment, we evaluate the performance of various FL algorithms on the FACET dataset. Our objective is to compare the overall trade-offs of each method in a controlled setting. Table | reports re- sults for baselines in Section 4.1 and our proposed RESFL, while Figure 6 illustrates per-skin-tone mAp distributions. RESFL attains 0.6654 mAP, close to FairFed (0.7013), and exceeds PUFFLE and PFU-FL. It maintains consistent accuracy across all ten MST cohorts via uncertainty-guide [1 - DI| = 0.2287 and ΔEOP = 0.1959, improves privacy (MIA 0.2093. AIA O. (832) over FedAvg and its DP variants, and remains robust under attacks (BA AD 0612 DPA EODD 0.0674). See Appendix HH for IID vs. non-IID results with 4 and 8 clients, where RESFL maintains strong accuracy with the best fairness-privacy profile. We also note its linear cost and practical scalability in Appendix
weighting. It yields
4.3. RESILIENCE ANALYSTS UNDER ADVERSE CONDITIONS IN CARLA
We fine-tune best performing FACET baselines, FedAvg-DD DP (c=1), FairFed, PUFFLE, and RESFL, on 6,000 clear-weather frames and compare on 7,800 adverse-weather frames under clear, cloud, rain, and fog at five intensities (0-100%) each. Figure 2 reports utility (mAP, higher is better), fairness (mean of |I-DI] and AEOP, lower is better), and privacy risk (mean MIA/AIA success rate, lower is better). Under clear weather (0%), ) RESFL achieves 0.46 mAP, 0.24 fairness, and 0.17 privacy. As cloud cover increases, contrast and illumination vary but scene geometry remains visible; RESFL degrades gently to 0.39 mAP 100% cloud (vs. 0.22 FedAvg-DP and 0.34 FedAvg), with fairness rising to 0.28 (vs. 0.40 FedAvg-DPP and privacy to 0.20 (vs. 0.38 FedAvg). Rain adds dynamic streaks and partial occlusions; despite this, RESFL retains 0.42 mAP, 0.25 faimess, and 0.20 privacy at 100% rain. These trends indicate that uncertainty-guide aggregation with adversarial disentanglement retains discriminative evidence while damping group-specific overconfidence, which helps contain both disparity and attackability in cloud and rain.
Fog is the hardest setting because hides edges and distant objects, so the useful signal drops sharply. The loss of visibility is uneven across scenes and groups (e.g., small or dark objects disappear first, see Figure 3 which raises| |I-DI| and ΔEOP as fog gets denser. With fewer real cues, models fall back on shortcuts and memorized patterns: training images stay relatively more confident than unseen ones, and attribute-related proxies become stronger, so membershhip/atributte attacks succeed more often. At 100% fog, RESFL keeps 0.17 mAP, 0.50 fairness, and 0.44 privacy, while others drop below 0010 mAP with fairness/privacy > 0.50. This gap reflects the physical limit of severe fog, but RESFL still slows the increase in disparity and attack success through evidence flooring, temperature control, and vacuity masking (Appendix Np.
4.4. ABLATION STUDY WITH RESFL
We conduct an ablation study to examine the impact of two key hyperparameters in RESFL: the uncertainty- based fairness coefficient (Asar) and the adversarial privacy coefficient (Apri),, while keeping the task loss one. Fixing privacy and sweeping Aaar (first block of Table 2). a lower fairness weight can yield higher mAP. This occurs because increasing Atar reallocates model capacity toward high-uncertainty or minority slices and applies evidence flooring with group normalization, which redirects gradient mass away from majority slices that dominate average precision and tempers overconfident detections on easy cases, introducing a
8

---

Published as conference paper ICLR 2026
FedAvg
FedAvg-DE DP
FairFed
PUFFLE
RESFL
0.50
64
0.40
0.40
0.9
0.2
0.30
0.40
6.1
20
40
20
40
60
Strength (9))
Strength
Fog Strength (561
(a) mAP in cloud
(b) mAP in rain
(c) mAP in fog
0.400
0.400
0.7
Faimers Score
0.6
20
20
80
Strength
Strength (%)
Fog Strength (861
(d) Fairness score in cloud
(e) Fairness score in rain
(I) Fairness score in fog
0.7
6.6
0.35
0.35
6.5
0.30
C.4
0.3
0.0
c2
20
40
20
40
60
Strength (96)
Strength (%6)
Fog Strength (361
(g) Privacy attacks in cloud
(h) Privacy attacks in rain
(1) Privacy attacks in fog
Figure 2: Performance comparison of four state-of-the-art FL methods and RESFL across three weather conditions (cloud, rain, fog) at 100% intensity. Curves show the mean + std over three seeds: accuracy is mAP (higher is better); fairness score averages [1 - DIJ and ΑEOP (lower is better) to capture inter- group disparity; privacy score averages MIA and AIA success rates (lower better). RESFL sustains strong mAP while keeping fairness gaps and privacy attack rates low under harsher weather.
bias dlas-variance trade-off under finite capacity. Consequently, increasing Atair lowers |1 DI and ΔEOP (both better), but reduces average mAP once fairness pressure pulls learning away from majority segments.
Holding Alir 0.1 and varying Apriv (second block of Table 2p. moderate privacy pressure reduces mem- orization and stabilizes uncertainty without erasing discriminative cues, whereas excessive privacy weight pushes features toward overly invariant representations that hurt both accuracy and fairness. The best bal- ance occurs at Aair 0.1, Apriv 0.01, achieving mAP 0.6654, |1 11-DI DI 0.2287, AEOP 0. 0919,, MIA 0.2093, and AIA 08132 (all mean + std in Table 2); increasing Apriv beyond 0.01 degrades both detection and group parity by over-suppressing informative, but privacy-sensitive, signals.
4.5. IMPACT OF SENSITIVE ATTRIBUTES AND CROSS-DOMEL GENERALIZATION
We only sensitive attributes for local loss computation and faimess estimation and transmit- ted outside each client. This setting matches regulated domains where client-side demographic labels are routinely stored under consent, such as hospital consortia (race/age), automotive mobility fleets (driver
9

---

Published as a conference paper ICLR 2026
Table 2: RESFL performance under varying uncertainty- fairness (Atai) and adversarial privacy (Apes)) coefficients. Utility is measured as mAP (f), fairness via [1 - DIJ and AEOP (4), and privacy via MIA/AIA
success rates (L). Results are mean + std over seeds.
Coefficients
Utility (1)
Fairness (L)
Privacy (L)
Apir
Apriv
mAP
DI|
AEOP
MIA SR
AIA SR
1
0
0.627840..06
0.2258
0.206240.007
0.3341
0.1431 +0.006
0
1
0.585640.008
0.2571
0.2846400.008
0.1025 00001
0. 40.00040000
0.01
1
0.6056120.077
0.2653+00.07
0.345940.010
0.1256_0.012
0. 0.1668+0.002
0.1
0.6254
0.2538
0.2626-40.007
0.1477 00.003
0.1 40.0000000
1
0.0053
0.2432-+0.006
0.2513
0,2197 =0.008 000
0. 0..088
0.1
0.01
0.6654:100005
0.2287 -00005
0.1959=20006
0.2093 0.000
0.1832-+00005
0.1
0.1
0.6430+0.006
0.2625+00.07
0,3143
0,1363 =0.00
0, 0..401
0.1
1
0,5839 +0.010
0.3862
0,4146+0.004
0.1 0..17000.005
0, 16.666000007
profiles), and enterprise datasets with gender or ethnicity for compliance reporting. In all such cases, attribute information remains local, and RESFL operates entirely within each silo without additional disclosure.
To study cases where explicit attributes are unavailable, also train RESFLL using the attribute-free UFM (AF-UFM) variants described in Appendix [12 Label-free training preserves over 90% of the fairness and privacy gains obtained with labeled cohorts, with less than two-percent drop in utility across all datasets. On the Adult and TveetEval benchmarks, RESFL and its AF-UFM variants maintain comparable accuracy while achieving markedly lower fairness and privacy scores than all baselines (Table [6]. These results show that uncertainty-guit vision and that the proposed mechanisms extend beyond visual perception to structured tabular and textual modalities, supporting RESFL domain-agnostic route to privacy-aware and fair federated optimization.
aggregation captures latent heterogeneity even without explicit demographic super-
5. CONCLUSIONS
This work introduced RESFL, unified framework for responsible federated learning that jointly enhances utility, fairness, and parameter privacy under realistic adversarial and environmental conditions. The frame- work integrates adversarial privacy disentanglement through gradient reversal mechanism with eviden- tial uncertainty head that estimates calibrated epistemic uncertainty. A scale-invariant Uncertainty Fairness Metric (UFM) further guides aggregation by weighting clients with lower inter-group uncertainty disparity, yielding updates that are both confident and equitable. Experiments across visual (FACET, CARLA) and non-visual (Adult, TweetEval) domains show that RESFL sustains strong predictive utility while substan- tially reducing fairness gaps and privacy leakage, confirming its potential as a comain-agnostic foundation for responsible federated optimization.
Limitations and Future Work. While RESFL already demonstrates linear scalability across clients, its joint optimization of backbone, adversarial, and evidential modules may still constrain deployment on highly resource-limited devices. Future work will focus on optimizing these components for lightweight partici- pation and adaptive scheduling across heterogeneous clients. Extensions will refine UFM through vacu- ity- diy-disooaacce decomposition to yield interpretable faimess signals and adaptive temperature schedules that self-balance privacy and fairness. We also plan to strengthen trust by incorporating median-base or consistency-checkee UFM reporting for robustness against falsified fairness inputs, evaluate RESFL, in mul- timodal and streaming federations, and integrate secure aggregation with calibrated differential privacy to deliver end-to-end verifiable responsible learning.
10

---

Published as a conference paper ICLR 2026
ETHICS STATEMENT
This work addresses fairness and privacy in federated learning, with experiments involving demographic attributes such as perceived skin tone. The FACET dataset used in our experiments contains annotations of perceived skin tone collected under informed consent and made publicly available for fairness research. We do not collect any personal data. Sensitive attributes in framework are used solely for local fairness estimation and are never transmitted outside each client. While RESFL is designed to reduce demographic bias and privacy leakage, acknowledge that uncertainty- based faimesss proxies may not perfectly capture all forms bias. Deployment in safety-critices systems such as autonomous vehicles should involve domain- specific auditing and regulatory oversight. We release all code and model checkpoints to support transparent evaluation and reproducibility.
REPRODUCIBILITY STATEMENT
We have taken the following steps to ensure reproducibility. Full implementation details, including hyper- parameters, dataset splits, training schedules, and attack protocols, are provided in Appendices F and G All experiments are averaged over three random seeds with standard deviations reported. The FACET dataset (Gustafson et al.) 2023) and CARLA simulator (Dosovitskiy et al. (017) are publicly available. Code, training seripts, dataset wrappers, and pretrained checkpoints are provided in the supplementary ma- terial and are publicly available at atttps: //tt::::///tthta com /twooddasii//EESFL
ACKNOWLEDGEMENTS
This work was supported in part by the National Science Foundation under Award No. 2107450 and by the Army Research Office under Grant No. W911NF-242-0241.
REFERENCES
Alexander Amini, Wilko Schwarting, Ava Soleimany, and Daniela Rus. Deep evidential regression. Ad- vances in neural information processing systems, 33: 33:14927-14937, 2020.
Francesco Barbieri, Jose Camacho-Collados, Leonardo Neves, and Luis Espinosa-Anke. Tweeteval: Unified benchmark and comparative evaluation for tweet classification. arXiv preprint arXiv:2010. 12421, 2020.
Chunlu Chen, Ji Liu, Haowen Tan, Xingjian Li, Kevin I-Kai Wang, Peng Li, Kouichi Sakurai, and Dejing Dou. Trustworthy federated learning: Privacy, security, and beyond. Knowledge and Information Systems, 67(3):2321-23566 2025.
E Chen, Yang Cao, and Yifei Ge. A generalized shuffle framework for privacy amplification: Strengthening privacy guarantees and enhancing utility. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pp. 1126-111275 2024a.
Huiqiang Chen, Tianqing Zhu, Tao Zhang, Wanlei Zhou, and Philip S Yu. Privacy and fairness in federated learning: on the perspective of tradeoff. ACM Computing Surveys, 56(2):1-37, 2023.
Jiayi Chen, Benteng Ma, Hengfei Cui, and Yong Xia. Fedevi: Improving federated medical image segmen- tation via evidential weight aggregation. In International Conference on Medical Image Computing and Computer-Assisted Intervention, pp. 361-372. Springer, 2024b.
11

---

Published as a conference paper ICLR 2026
Jiayi Chen, Benteng Ma, Hengfei Cui, and Yong Xia. Think twice before selection: Federated evidential ac- tive learning for medical image analysis with domain shifts. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 1 11439-11 1 11449, 2024c.
Luca Corbucci, Mikko A Heikkila, David Solans Noguero, Anna Monreale, and Nicolas Kourtellis. Puffle: Balancing privacy, utility, and fairness in federated learning. arXiv preprint arXiv:2407.15224 2024.
Irit Dinur and Kobbi Nissim. Revealing information while preserving privacy. In Proceedings of the twenty- second ACM
SIGACT-SIGART symposium on Principles of database systems, pp. 202-210,,
2003.
Alexey Dosovitskiy, German Ros, Felipe Codevilla, Antonio Lopez, and Vladlen Koltun. CARLA: An open urban driving simulator. In Conference on robot learning, pp. 1-16. PMLR, 2017.
Cynthia Dwork. Differential privacy. In International colloquium on automata, languages, and program- ming, pp. 1-12. Springer, 2006.
Ülfar Erlingsson, Vitaly Feldman, Ilya Mironov, Ananth Raghunathan, Kunal Talwar, and Abhradeep Thakurta. Amplification by shuffling: From local central differential privacy via anonymity. Pro- ceedings of the Thirtieth Annual ACM-SIAM Symposium on Discrete Algorithms, pp. 2468-2479. SIAM, 2019.
Yahya H Ezzeldin, Shen Yan, Chaoyang He, Emilio Ferrara, and A Salman Avestimehr. Fairfed: Enabling group fairness federated learning. In Proceedings of the AAAI conference on artificial intelligence, volume 37, pp. 7494-7502, 2023.
Laura Gustafson, Chloe Rolland, Nikhila Ravi, Quentin Duval, Aaron Adcock, Cheng-Yang Fu, Melissa Hall, and Candace Ross. Facet: Fairness in computer vision evaluation benchmark. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 20370-20382, 2023.
Moritz Hardt, Eric Price, and Nati Srebro. Equality of opportunity in supervised leamnin.. Advances in neural information processing systems, 29, 2016.
Rutger Hendrix, Federica Proietto Salanitri, Concetto Spampinato, Simone Palazzo, and Ulas Bagci. Ev- idential federated learning for skin lesion image classification. In International Conference on Pattern Recognition. pp. 354-365. Springer, 2024.
Ahmed Imteaj, Urmish Thakker, Shiqiang Wang. Jian Li, and Hadi Amini, A survey on federated learning for resource-comstrainee iot devices. IEEE Internet Things Journal, 91):1-22, 2021.
Peter Kairouz, H Brendan McMahan, Brendan Avent, Aurelien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, et al. Advances and open problems federated learning. Foundations and trends in machine learning, 14(1 (1112))12210 2021.
Caelin Kaplan. Inherent trade-offs in privacy-preserving machine learning. PhD thesis, Université Côte d' d'Azur, 2024.
Sai Praneeth Karimireddy, Satyen Kale, Mehryar Mohri, Sashank Reddi, Sebastian Stich, and Ananda Theertha Suresh. Scaffold: Stochastic controlled averaging for federated learning. In Inter- national conference machine learning pp. $132-51433 PMLR, 2020.
Dohyoung Kim, Hyekyung Woo, and Youngho Lee. Addressing bias and fairness using fair federated learning: A synthetic review. Electronics, 13(23):4664, 2024a.
12

---

Published as conference paper ICLR 2026
Kiback Kim, Krishnan Raghavan, Olivera Kotevska, Matthicu Dorier, Ravi Madduri, Minseok Ryu, Todd Munson, Rob Ross, Thomas Flynn, Ai Kagawa, et al. Challenges and research directions. In 2024 IEEE International Conference on Big Data (BigData), pp- 7849-7853. IEEE, 2024b.
federated learning for science:
Ronny Kohavi and Barry Becker. Uci machine learning repository: adult data set. Avaliable: https://archie. ics. uci. eluum//mcchin--terrinn-- hew.armmiiininuuuuuussssualdd 1996.
Kummari Naveen Kumar, Chalavadi Krishna Mohan, and Linga Reddy Cenkeramaddi. The impact of ad- versarial attacks on federated learning: survey. IEEE Transactions on Puttern Analysis and Machine Intelligence, 46(5):2672-269) 2023.
Tian Li, Maziar Sanjabi, Ahmad Beirami, and Virginia Smith. Fair resource allocation in federated learning. arXiv preprint InXiv:1905.10999 2019.
Natalia Martinez, Martin Bertran, and Guillermo Sapiro. Minimax pareto faimess: A multi objective per- spective. In International conference on machine learning. pp. 6755-6764. PMLR, 2020.
Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera Arcas. Communication--efitte learning of deep networks from decentralized data. Artificial intelligence and statistics, pp. 1273-1282. PMLR, 2017.
Ninareh Mehrabi, Fred Morstatter, Nripsuta Saxena, Kristina Lerman, and Aram Galstyan. A survey on bias and fairness in machine learning. ACM computing surveys (CSUR), 54(6):1-33, 2021.
Bimsara Pathiraja, Caleb Liu, and Ransalu Senanayake. Fairness in autonomous driving: Towards understanding confounding factors in object detection under challenging weather. arXiv preprint arXiv:2406.00221, 2024.
Sikha Pentyala, Nicola Neophytou, Anderson Nascimento, Martine De Cock, and Golnoosh Farnadi. Priv- fairfl: Privacy-preserving group fairness in federated learning. arXiv preprint arXiv:2205.11584 2022.
David Pujol, Ryan McKenna, Satya Kuppam, Michael Hay, Ashwin Machanavaihhlla, and Gerome Miklau. Fair decision making using
data. In Proceedings of the 2020 Conference on Fairness, Accountability, and Transparency, pp. 1899199,90 2020.
Borja Rodríguez- Gallez, Filip Granqvist, Rogier van Dalen, and Matt Seigel. Enforcing fairness in private federated learning via the modified method of differential multipliers. arXiv preprint arXiv:2109.08604 2021.
Murat Sensoy, Lance Kaplan, and Melih Kandemir. Evidential deep learning to quantify classification uncertainty. In Advances Neural Information Processing Systems, volume 31, 2018.
Kangkang Sun, Xiaojin Zhang, Xi Lin, Gaolei Li, Jing Wang, and Jianhua Li. Toward the tradcoff's between privacy, fairness and utility in federated learning. In International Symposium on Emerging Information Security and Applications, pp. 118-132. Springer, 2023.
Peng Sun, Haoxuan Che, Zhibo Wang, Yuwei Wang, Tao Wang, Liantao Wu, and Huajie Shao, Pain-fl: incentive for federated learning. IEEE Journal on Selected Areas Personalized (201)))3305-2222 2021. Communications,
Anh Tu Tran, The Dung Luong, and Xuan Sang Pham. A novel privacy-preserving federated learning model based on secure multi-party computation. In International Symposium on Integrated Uncertainty in Knowledge Modelling and Decision Making, pp. 321-333. Springer, 2023.
13

---

Published as conference paper ICLR 2026
Dawood Wasif, Dian Chen, Sindhuja Madabushi, Nithin Alluru, Terrence J Moore, and Jin-Hee Cho. Em- pirical analysis of privacy-farmees--ccuure accuraacy trade-offs in federated learning: A step towards responsible ai. arXiv preprint arXiv:2503.1623:3 2025.
Yongkai Wu, Lu Zhang, and Xintao Wu. Fairness-aware classification: Criterion, convexity, and bounds. arXiv preprint 1iXiv:100.044733 2018..
Bangzhou Xin, Wei Yang, Yangyang Geng, Sheng Chen, Shaowei Wang, and Liusheng Huang. Private
fi-gan: Differential privacy synthetic data generation based on federated learning. In Ieassp 2020-2020 IEEE international conference on acoustics, speech and signal processing (ICASSP), pp. 2927-2931. IEEE, 2020.
Runhua Xu, Nathalie Baracaldo, and James Joshi. Privacy-preserving machine learning: Methods, chal- lenges and directions. arXiv preprint arXiv:2108.04411 2021.
Mohammad Yaghini, Patty Liu, Franziska Boenisch, and Nicolas Papernot. Learning with impartiality to walk on the pareto frontier of faimess, privacy, and utility. arXiv preprint arXiv:2302.09183 2023.
Lei Yang, Jiaming Huang, Wanyu Lin, and Jiannong Cao. Personalized federated learning non-iid data via group-based meta-learning. ACM Transactions on Knowledge Discovery from Data, 17(4):1-20, 2023.
Xun Yi, Russell Paulet, Elisa Bertino, Xun Yi, Russell Paulet, and Elisa Bertino. Homomorphic encryption. Springer, 2014.
Han Yu, Zelei Liu, Yang Liu, Tianjian Chen, Mingshu Cong, Xi Weng, Dusit Niyato, and Qiang Yang. fairness-awer aware incentive scheme for federated learning. In Proceedings of the AAAT/ACM Conference on AI, Ethics, and Society, pp. 393-399, 2020.
Tao Zhang, Tianqing Zhu, Kun Gao, Wanlei Zhou, and S Yu Philip. Balancing learning model privacy, fairness, and accuracy with early stopping criteria. IEEE Transactions on Neural Networks and Learning Systems, 34(9):5557-5569, 2021.
Yifei Zhang, Dun Zeng. Jinglong Luo, Xinyu Fu, Guanzhong Chen, Zenglin Xu, and Irwin King. A survey of trustworthy federated learning: Issues, solutions, and challenges. ACM Transactions on Intelligent Systems and Technology, 15(6):1-47, 2024.
14

---

Published as conference paper ICLR 2026
Appendix to "RESFL: An Uncertainty-Aware Framework for Responsible Federated Learning by Balancing Privacy, Fairness and Utility"
A. PRELIMINARIES
This section presents the mathematical foundations and system specifications of our work. We detail the YOLOv8-based object detection model, describe the FL setup in the AV scenario, formalize threat models (privacy, robustness, and fairness attacks), and define evaluation metrics. We also provide unified overview of the datasets used for training and testing.
A.I. SYSTEM MODEL: OBJECT DETECTION
Let E #xxx denote an input image. Our object detection model, derived from YOLOv8, produces a set of detections:
= {(bi, Ci 8;)]
where each b; R$ specifies the bounding box coordinates, C2 {,...., C} is the predicted class label, and 8, E [0, 1] the corresponding confidence score. The overall detection loss given by:
Last Ads Less + λtoc Lix Acont Leont,
(11)
where Cels, Lives and Ccont represent the classification, localization, and confidence losses, respectively, and Aotas Alses Acoat R+ are hyperparameters.
A.2. FEDERATED LEARNING SETUP AND NETWORK MODEL
Consider of N clients {C.) each possessing local dataset D, C R.xWCC and local model with parameters 0,. central server maintains the global model 0g. The FL process begins with the server initializing and distributing ((0) to all clients. Each client then updates its model by performing local stochastic gradient descent (SGD): (((+1) 0.00 0 - (O.")
where > 0 is the learning rate, is the local iteration index, and L; is the local loss (e.g., Laa)). The server aggregates the locally updated parameters via FedAvg:
0
Σ
D
((++1)
D
This FL framework preserves data locality (raw data remain on devices); the server receives only model updates and no formal privacy guarantee is implied.
A.3. UNCERTAINTY QUANTIFICATION VIA EVIDENTIAL REGRESSION
Evidential head for detection (Dirichlet & NIG). Our detector uses a decoupled evidential head on top of YOLOv8. For every anchor/location, the classification branch outputs nonnegative concentration vector a (dq....,, ac) via a = 1 + softplus(zz)). (z.), which parameterizes a Dirichlet over class probabilities. Normal-Inverse Inverse Gamma (NIG) parameters for each box coordinate ạ {z, W. h1, (7g, Mg oiin, (.). following (Amini et al. 2020). Concretely:
The localization branch outputs Normal
p(p a) Dir(a:),
(Mg. (pg:0))) NIG Ny 0. .3))
15

---

Published as conference paper ICLR 2026
For the Dirichlet, total evidence at epistemic variance (Sensoy et al. 2018 For the NIG, the epistemic variance of the mean is Var[ug] 8g/(v, (Vg(a 1))-
C
ae controls epistemic uncertainty; larger ag implies lower
Per-detection scalar uncertainties.
We extract two scalar measures:
(classification epistemic; lower is more confident),
ao
Varlug]
Ubox
Σ
(localization epistemic; normalized, lower more confident).
22 q
qE (x.
Here 8q = W, By = H, Su = W, Sh = H are image-scale normalizers (width W and height H) so that thex is dimensionless and comparable across resolutions. In practice we compute Var[u,] 1 + ()) with small for stability.
What feeds UFM. Unless otherwise specified, UFM is computed only from the classification Dirichlet evidence. For an image æ with detections (x) (post-NMS, score 2 r), define the group-wiss wise mean evidence ao,g as Eq. 3. of the main text. Plug {āo.gly=1 into the UFM definition Eq. 4 to obtain UFM UFM
Training losses. The classification branch is trained with the Dirichlet NLL plus an evidential regularizer that penalizes overconfident errois (Sensoy al. 20188; the localization branch uses the NIG NLL with the regularizer from (Amini et al. 2020). This yields calibrated epistemic estimates for both branches while keeping the UFM definition unambiguous.
A.4. THREAT MODEL.
We study cross-silo FL setting with an cunest-but-curious server that observes client updates and may col- lude with subset of clients. Training data remain on-device and are never shared; thus raw data exposure is reduced, but parameter-level inference and sensitive-attribut leakage from updates/models remain possible. Our privacy goal is parameter privacy: reduce sensitive-attribu leakage from intermediate representations or model updates. also evaluate robusiness to malicious updates and fairness against bias amplification. The attacks below instantiate these goals.
1.4.1. Privacy Attacks
The selected privacy attacks assess whether adversary can extract sensitive information from federated model updates.
Membership Inference Attack (MIA): MIA tests whether sample Rd was used in training. An adversarial client C. trains shadow model to mimic the global model Mr, queries M, on member/non- member samples, and uses the resulting outputs train a binary classifier AMiA that predicts membership:
AMIA (x) = =60,
x E Durin
x & D
We report the MIA Success Rate (binary accuracy):
TP + TNN TP+TN + FP+ FN
SMIA
(12)
16

---

Published as a conference paper ICLR 2026
where TP,TN,,, FP, PN are counts over a balanced member/non-membee evaluation set. Higher SMIA indicates greater privacy leakage.
Attribute Inference Attack (AIA): AIA tests whether sensitive attribute s can be inferred from update- derived features. The adversary extracts features I from observed gradients/updates and trains AalA to predict 8:
AAMa(T)
(13)
We report the AlA Success Rate as top-1 accuracy over M instances:
M Σ
SAIA
16 =
(14)
M
(For binary attributes, SAIA reduces to standard binary accuracy.)
Adversary knowledge and data. We assume an honest-but cut-cirousu server that sees per-round updates and the final global model. Attack probes trained only on model outputs and update metadata computed over a small, non-overlapping slice of the benchmark that we reserve exclusively for attack training (no private client data are used). For FACET, this slice is sampled from unused images disjoint from our train/test splits; for CARLA, it is rendered with independent seeds and kept separate from tuning/evaluation.
Membership inference (MIA) protocol and reporting. We adopt score-based MIA with a single shadow run per method/seed to preserve compute parity. For FACET, we reserve a fixed 5% of the full benchmark as an attack-reserve slice disjoint from all train/val/test splits (1,600 images: stratified by MST). For CARLA, we render an additional 600 clear- weather frames with independent seeds (balanced by town and MST) reserved exclusively for attacks and never used in tuning or evaluation. For each method, the adversary (i) trains one shadow model with the same optimizer and schedule on subset of the attack- reserve; (ii) collects per-example attack features for both members (sampled from the actual training sets of participating clients) and non-members (from the remaining attack-reserve portion) by querying the target global model at round T: final loss, logit margins, evidential concentration summaries (mean/variance of a)), and confidence; and (iii) fits calibrated logistic classifier a balanced member/non-memen training set (attack-reserve split: 70% train, 10% validation for threshold selection, 20% test).
Attribute inference (AIA) protocol and reporting. We evaluate update-aware attacker aligned with the server's 's view. From each round's client update we extract layerwise meta-features (per-layer & norm, sign ratio, top-k index histogram of magnitudes, and head-gradient statisties), concatenate across layers, and train a probe to predict the sensitive attribute s. Attack training uses a balanced attribute distribution, a 70/10/20 train/val/test split within the attack-reserve, and is strictly disjoint from the model's train/val/test data. AIA is reported as top-1 accuracy (lower is better) with macro-Fl in the additional experiments in Appendix H
Supplementary privacy results (FACET, 4 clients, IID). Tables 13 and 14 summarize the additional MIA/AIA results; values are mean + std over three seeds. Privacy Score in the main paper continues to use balanced accuracy for MIA and AIA; the TPR @ FPR values are reported here for completeness.
A.4.2. Robustness Attack
We assess the FL. system's resilience to malicious modifications of model updates using robustness attack.
Byzantine Attack: In a Byzantine attack, subset of clients manipulates their model updates before sending them to the central aggregator. Let 9g be the legitimate update from client k and let the adversary introduce a perturbation 6g, yielding modified update:
17

---

Published as conference paper ICLR 2026
02 0 5k. with ||
>> 0.
(15)
A sufficiently large de disrupts training, leading to model divergence or severe performance degradation. The attack's impact quantified by comparing global model aceuracy without malicious interference (Acteun) to accuracy under Byzantine updates (AByzantine), measured as:
Dayz Actem AByzanine-
(16)
A larger Day. indicates stronger attack and greater vulnerability of the federated learning system such perturbations.
Data Poisoning Attack: This attack injects manipulated samples AD into client's local dataset, altering its distribution. The poisoned dataset is defined as:
Dí UAD.
(17)
The adversary selects injected samples to skew feature distributions, favoring one demographic group over another and shifting the global model's decision boundaries. The impact on fairness measured using the Equalized Odds Difference (EOD), which quantifies disparities in true positive rates (TPR) and false positive rates (FPR) between protected and unprotected groups:
EOD |TPR - TPR Tnnpproeecee
(PPRprotecee FPR umpeoteeced
(18)
To assess the attack's 's effect, we compute the Equalized Odds Difference Deviation (EODD) as the change in EOD between the poisoned and clean datasets:
EODD EOD poisoned EO
DODpoisoned
(19)
larger EODD indicates greater faireess violation, confirming the attack's success in introducing bias. This highlights the dual threat of data poisoning, which compromises both model accuracy and group-level parity across user groups
A.5. DETECTION-BASEI FAIRNESS PRIVACY METRICS
Setup and matching protocol. For each image x, let G(x) = {(b), Me. [k)] be ground-truth person instances with box b%. class y/ person, and sensitive group Os E fl..... G} (e.g., MST). Let P(x) Mr {(be, é, | be predicted boxes, classes, and confidences after standard NMS (we use IoU NMS=0.5 and score threshold Tscore 0.25; same across all methods). We evaluate fairness at fixed IoU threshold Thiir = 0.5 (distinct from mAP's COCO sweep).
We perform one-to-one greedy match between G(x) and P(x) by descending 3; a prediction (6,, 2, 8,) matches ground-trut -ouut (bt, yk 9k) 9k.9k) iff è; yk and loU(b,, bī) 2 Thair and neither has been matched yet. Matched pairs count as true positives (TP); unmatched predictions are false positives (FP); unmatched ground truths false negatives (FN), Multiple predictions for the same ground-truth are penalized as FP except the highest-scoring matched one.
Per-group rates (micro-averagedd) Let TP, En E E 1(GT k is matched] and FN, Σx Ek.g 1 (GT is unmatched]. Define the per-group detection positive rate (recall)
TPp
(PRa(T TP, FN,
In our faimess metrics, the favorable outcome is correct detection of person instance (i.e., contributing to TP, at loU 2 Thair with correct class). Counts are aggregated over all instances the cohort (micro average across images).
18

---

Published as a conference paper ICLR 2026
Why TPR/recall for fairness? Equality of opportunity is defined in terms of true-positive rate (TPR) (Hardt et al., 2016). In detection, the favorable event is a correct person detection at IoU 2 Thair so TPR/recall is the natural rate for both DI and ΔEOP Empirically, substituting precision or per-group AP changes magnitudes but preserves the cohort and method ordering under our fixed matching protocol and thresholds (Appendix G
Disparate Impact (DI) for detection. tion rates and form a ratio:
With multiple cohorts, we compute the best and worst group detec-
DI((tar) ming TPRg(Thar)
E |0, 1],
|1 DI] is reported (lower is better).
max, TPRy (Taair
This "rate ratio" view is standard for multi-group DI and equals under perfect parity.
Equality of Opportunity gap (ΔEOP) for detection. (TOi()) max (P,,, min TPR (Trir) [0. 1].
We report the max range of per-group TPRs:
9 which is under perfect parity (lower is better). Note that both DI and ΔEOP use the same matching protocol and Tiair
Relation to mAP. mAP is computed with the COCO protocol (IoU E {0.50 0.05 0.95). class-aware) Fairnsss metrics use the single threshold Tlair = 0.5 defined above so that TP/FP/EN (and thus TPR) are unambiguous and reproducible.
Reproducibility keys for fairness on detection (we fix these in all experiments):
-IoU NMS 0.5; score threshold Tacore 0.25; max dets per image 300.
Fairness IoU threshold Tisir = 0.5 for TP/FP/FN and TPR.
Greedy one-to-one matching by descending score; ties broken by higher IoU.
Per-group TPR is micro- averrge over all instances with that group ground-truth.
Membership Inference Attack (MIA) for detection. We use a black-box shadow-model attack tailored detectors. Let M be of member images used in training and M disjoint non-member set of the same size from the same distribution. For any image we compute an image-level feature vector from the model's post-NMS outputs:
(xx) [ detss, 8, max Oo, Vels
where detts is the number of predicted person boxes with > Tscores 8 is their mean confidence, and ag and Wels are the mean Dirichlet total evidence and its derived epistemic sealar (Sec. AA.3) over those detections (empty sets zeros). We train logistic-rerression (or two-layer MLP) shadow attacker disjoint shadow split to predict membership from (pxx) and report the attack success rate
TP + TN
MIA SR
TP TN + FF+
evaluated on M U M with 50/50 prior.
Attribute Inference Attack (AIA) for detection. We probe sensitive attributes from per-instance features. For each matched detection (as above), we apply ROIAlign to the model's neck feature map at the matched box to get a fixed-size tensor, global-averee aaarallveeeeeppoo it to a vector h, and train two-layer MLP (on disjoint shadow split) to predict the instance's group g E {1..... ........, G}. We report the top-1 accuracy over all matched instances:
ATA SR #correct group predictions
#matched instances
Note: Images without matched persons contribute nothing to AIA; they still contribute MIA.
19

---

Published as conference paper ICLR 2026
B. THEORETICAL ANALYSIS OF THE UNCERTAINTY FAIRNESS METRIC
In federated learning, each client holds distinct local distribution, resulting in unequal representation of sensitive groups (e.g. demographic cohorts or environmental conditions). Epistemic uncertainty (quanti- fying model's ignorance about its predictions) naturally reflects these imbalances: groups with fewer or more variable examples yield higher uncertainty, while well-represented, homogeneous groups yield lower uncertainty. We formalize this insight and show that controlling the dispersion of group-wise uncertainties effectively enforces fairness.
Let each client compute, for each sensitive group 9 E (1......G. G}. an epistemic variance og- In evidential models, o² = 1/ag. where ag accumulates "evidence" proportional to effective sample size and signal-to- noise ratio. Concretely,
1
ag ng SNRg
Tg SNR,
Thus og is large when group g is under-sampled or noisy, and small otherwise.
To measure fairness, we track the relative spread of {o]]] We define the Uncertainty Fairness Metric (UFM)
UFM = max, 2 ming o
with 6 > for stability. By normalizing by the mean uncertainty, UFM is scale-invariant, takes value zero when all groups share equal confidence, and grows smoothly disparities arise.
Statistical Rationale. Classical generalization bounds for group g involve its sample size ng and model complexity. A simplified high-probability bound is
((s) ((s) + 0 log
12g
where [(a) is the empirical loss. Since of ~ 1/(n, SNR,), the uncertainty gap max, of - min, of upper- bounds the disparity in confidence-adjusie generalization terms. Minimizing UFM therefore tightens and balances each group's 's bound, improving fairness in expected loss.
Fair Aggregation. In federated aggregation, each client i reports its UFM; The server assigns weights
exp( (3 UFM,)
Wis Σ, exp(c
that clients with lower internal disparity (smaller UFM) contribute more. This bias toward uniformly confident updates automatically re-balances the global model as data distributions evolve, without exposing sensitive attributes centrally.
Throughout, evidential classification uses Dirichlet evidence with total evidence (o(x) = Σ (x)) For group 9, let uø,g Ezep,, (x) and define the group epistemic variance proxy og = EZED, [1)) ~ 1/00.g. We set e 10-6 in UFM for numerical stability.
Notation alignment.
Assumptions. (A1) Bounded loss: the per-sample loss l E [0. 1]. (A2) Evidential calibration: there exist constants 0 < Smin S Smax such that No Pmax < o I 9m for each group g (i.e., evidence scales with effective sample size and signal-to-noise) (A3) Group-wise mixing: samples within a group are i.i.d. under a fixed distribution.
20

---

Published as conference paper ICLR 2026
Theorem B.1 (Contidence-adjusted generalization disparity). Under (A1)-A3), for any ô (0, 1) there exists a constant C' > 0 (depending only on Smin, Smax) such that, with probability at least 1 - 8, for every group g.
Cim) I (wv) + C 00 log(1/6).
Consequently,
max (()) - min min(( - -((r) s CVlog(1/6) ( max og
min
Proof sketch. Hoeffding's inequality yields (6)) < ((s) + OV [og(1/5)
under (AI),A3). By (A2), 1/ng
Oig
is sandwiched by constants times og. giving the per-group term Og Vo log(116)) The disparity bound follows by subtracting the best/worst groups.
Corollary B.2 (UFM controls disparity). Let σ² = à Eg Then there exist constants C1, C2 such that
max ((a) -
min( - - Civlog(L/0) UFM S C2Vlog(11/8 UFM,
i.e., minimizing UFM tightens a normalized upper bound on the group disparity in confidence-aljusted generalization.
Federated lifting to the global mixture. Let P. be client i's data distribution, and define the global eval- uation distribution as the mixture Peval Σ> T.P: with fixed nonnegative weights {T²} summing to For group g: let 2 denote client i's epistemic-variance proxy and let og be the proxy under Peval- Write UFM, = UFM( (o" (-)) and UFM, = UFM((0))G=))
Lemma B.3 (Mixture reduction). Assume the evidential head is 1 -Lipschitz in parameters and locally stable across an aggregation step so that (I, 0) + ag (z; 0) is dominated and measurable. Then for each group g.
Egw- (2(
Ti ExmP, [0(
Σ nc o
g
9.
Proposition B.4 (Global disparity bound). Let σ² = 1
④ Eg og and oū = to4 Eg g.r. Under
and Lemma B.3 and Theorem B.1 there exist constants C2 O2 > 0 such that with probability at least 1 - 6,
max ( ((x) - min ((0) ((w) s Ci Ci UFM, S C2v/lg(115))
Σ
o UFM,
Corollary B.5 (Effect of -Fe-weighted aggregation). Let the server choose aggregation weights wi exp(-3 UFM. and let evaluation weights be data cato-poropotiona or equal across clients. If UFM, is computed on a held -out local split and remains stable across a round, then decreasing UFM, tightens the upper bound in Proposition B.4 Hence, making decrease in UFM, reduces provable surrogate of the global fairness gap.
Link to DI and AEOP.
Assume the -erop TPR at the fixed faimess IoU is L -Lipschitz in og and monotone. Then for some L., 1/ > 0,
max, min, min, o2 min, o
ΔЕОР < 4(2 5(V/ng maxo /
min m
| - DI < L'
Combining with Proposition B yields explicit bounds on DI and AEOP that decrease as the aggregation- weighted UFM, decrease.
21

---

Published as conference paper ICLR 2026
Aggregation limits and practice. We compute UFM, per client on held-out local validation split and report & (xp(-$UFM;). As B - O we recover uniform averaging: as B + oo the aggregator con- centrates on clients with smallest UFM. To reduce noise, we use an exponential moving average of UFM; across rounds.
Integrity of reported UFM. We operate under the standard honest-but-curious federation assumption, where clients follow the protocol but may attempt to infer others' information. To ensure consistency, each client reports scalar fairness statistic us UFM, after applying publicly known clipping rule,
U4 - min(maxx(u a), b), (a, b) fixed.
This limits the influence of any extreme or falsified report. In our simulator, model updates Ad; and the bounded scalar u, are transmitted in the clear to the server (no cryptographic secure aggregation which is a future work). During aggregation, the server computes o exp(-3 us) and normalizes across clients as in Eq.
Although Me is single scalar, it is designed as scale-invariant summary of inter-group uncertainty dis- parity, chosen to minimize communication cost while preserving the monotonic relation between UFM and established fairness metrics such as |1-DI| and AEOP (see Appendix [). Empirically, this scalar retains high correlation (r>0099) with those measures, maintaining the correct ordering of clients by fairesss.
In potentially untrusted deployments, additional safeguards can be incorporated: (i) cross-roumt consistency checks on |A0 || and evidence statistics to detect anomalous u, values, (ii) trimmed- meann or median aggre- gation of UFMs bound single-client influence, and (iii) optional secure verifiable reporting schemes (e.g., commitments or eeoolle proofs of evidence norms). These mechanisms are modular and do not alter the core optimization of RESFL.
C. CHTRMMMTTOO-THEORTTIE GUARANTEES OF ADVERSARIAL PRIVACY DISENTANGLEMENT
We analyze how adversarial training with a gradient reversal layer and an attribute classifier limits the leak- age of sensitive attribute S from representations H = fo(X). Throughout, allow H to be (possibly stochastic) mapping of X (e.g., due to dropout); all logarithms are natural (nats).
Adversarial objective and conditional entropy. Consider the minimax problem
min max (0, o), (0,v(0, -x (S H)].
where ( H) is the attribute classifier fed by the representation = fX(). If the adversary family
universally expressive and the supremum is attained, then
sup Lady (0, Φ) H(S H).
In general (with approximation/pppimizztioo error), we have the one-sided relation
sup Ladv < (1($) 11).
Consequently,
T(H;S)= = H( H) S H(S) - sup Ladv (0, +),
so maximizing Ludv (for fixed 0) minimizes an upper bound on S): By the data paoce-proesssig inequality, reducing T(H:S) weakens any inference from H about S.
22

---

Published as conference paper ICLR 2026
0%
25%
50%
75%
100%
Cloud
Rain
Fog
Figure 3: Sample visualization of weather conditions (cloud, rain, and fog) at increasing intensity levels (0%, 25%, 50%, 75%, 100%) using the CARLA simulation, illustrating how environmental severity gradually impacts visibility and scene clarity.
Attack error via Fano. Let an attacker output 3 g(H) over K attribute classes. Fano's inequality yields
Pe 2 1 SH + log log K
Hence as sup, (0, + HS H) (i.e., S( + 0), the minimum achievable error satisfies Pa + 1-11K driving attribute inference toward chance level.
Privacy-utility frontier and tuning. objective,
Incorporating the adversarial term with coefficient Apriv into the local
Liocal (0, 6) = (0) + Apriv Ladv (0, o),
traces a (piecewise) convex frontier in the (I, Lrsk) plane under standard regularity conditions. By the envelope theorem,
(T; d Lusk
Oxyin Lusk
0xmer I ();
so Apriv directly tunes the privacy-utility balance: larger Apriv increases the pressure to maximize Ladv- thereby decreasing S) (stronger privacy) the potential cost of task loss.
Scope of the guarantee. These informationnthhoretii guarantees representation leakage T(H; S); they are not (c, SDP guarantees on the training algorithm. In practice, one monitors Ladv (or a calibrated surrogate) and adjusts Apriv to meet target inference-erree bound while limiting degradation in Lusk-
23

---

risk, and minimal performance disparity Published as conference paper ICLR 2026
Algorithm 1 RESFL, Training with Adversarial Privacy and Uincerainty-Guudeer Aggregation
1: Input: global model fG. adversary A(x; Φ), client data {6:}, weights Apriv Amar temperature B, learning
rates 17, Ng. rounds T
2: for = 0 do
3: Server broadcasts 0 to clients
4: for each client in parallel do
5: Initialize: 0, 6 0; +
6:
for each local step do Compute Lusk. Lady, Lune
7:
8:
Φ; Φ; 11 V 0. Leadv
9:
02
11 v Trakk + Apriv Taad + Atair [unne]
P Composite local loss (Eq. (
10:
end for
Compute UFM, (Eq, (4 and Ao, = 0; 0(0 Client sends {20,, UFM,) to server end for
11:
12:
13:
14:
Server computes W; x exp(-3 UFM, (Eq. 5))
15:
Update: 0 0((+1) = 0 + E W;A0;
D Aggregation (Eq. (6)
16:
end for
Output: final global model 0
17:
D. JOINT TRADE-OFF ANALYSIS OF PRIVACY AND FAIRNESS
Our RESFL framework simultaneously addresses three competing objectives, detection utility, attribute pri- vacy, and demographic fairness, by integrating adversarial privacy disentanglement with uncertainty-guided aggregation (summarized in Algorithm [ The adversarial module employs gradient reversal layer and attribute classifier to suppress sensitive information in each client's features, effectively minimizing the mu- tual information between latent representations and protected attributes. This enforces a controllable privacy constraint without degrading task performance unduly. In parallel, each client's evidential uncertainty head estimates per-group epistemic variances, from which we compute an Uncertainty Fairness Metric (UFM) that quantifies disparities in model confidence across sensitive cohorts. During aggregation, clients report both their parameter updates and UFM scores; the server then weights each update by softmax of the negative UFM, amplifying contributions from clients with more uniform confidence and weightigg those with high disparity. By tuning the adversarial strength Apriv and the uncertainty coefficient Atairs RESFL effectively scalarizes a convex multi- object- problem, tracing out the full Pareto fronticr in the space of utility, privacy leakage, and fairness gap. Unlike single-objective baselines. which either sacrifice accuracy for privacy protection or apply fixed fairness regularizers, RESFL dynamically balances both axes: stronger adversarial signals tighten privacy guarantees, while uncertainty-based weights correct emerging fairness imbalances. Empirically and theoretically, this joint mechanism dominates pure DP or fairness-only schemes by exploring descent directions unavailable to dimennnnsional fixes, yielding models that main- tain high mean average precision, provably low across sensitive groups.
E. DATASETS
Our experiments leverage two complementary data sources: FACET for federated training and CARLA for controlled evaluation, to measure object detection utility, demographic faimess, privacy resilience, and
24

---

Published as conference paper ICLR 2026
robustness under diverse conditions. In this section, we detail dataset composition, annotation processing, domain-specific partitioning, and preprocessing pipelines.
Figure 4: Example images from the FACET dataset. Each red bounding box denotes a detected person instance, annotated with its corresponding Monk Skin Tone (MST) label (e.g. MST #2, #3, #4, #6). These samples illustrate the range of skin-tone levels (1 = lightest to 10 darkest) used for faimess evaluation in object detection experiments.
E. FACET DATASET
The FACET dataset (Gustafson et al. 2023) provides 32 000 real-world images with over 50 500 annotated person instances, each labeled with bounding box and multiple attributes (perceived skin tone, hair type, person class). We concentrate on perceived skin tone, a sensitive attribute strongly correlated with perfor- mance gaps in detection model (Pathiraja al. 2024). FACET adopts the Monk Skin Tone (MST) scale with ten discrete levels E {1.... 10J. where
is the lightest and 10 the darkest tone, as shown in Fig- 5 To mitigate annotation noise due lighting or labeler variance, each instance receives n independent MST labels $1, .,,
8n. We aggregate these as
1=
then discretize by rounding the nearest integer {l...., 10). This yields a robust single-toned label per instance, denoted MST(b).
We group the dataset into pairs (N = 50 000). Define
MST cohorts. Let D = {(xx. by, + be the full set of instance
D, (x, Mb)(b) }
9= 1 10,
that - [D,l .N. In practice, each [D, ranges from approximately 000 000 instances, ensuring sufficient representation across the skin-tone spectrum.
To simulate federated clients, we partition the 32 000 FACET images into K = 4 i.i.d. subsets {I each containing 8 000 images and all associated instances. Formally, I, I, = & for i * j. U I, covers all images, and each split preserves the MST distribution:
Yg, ((z,b) b) E Dg: == HDDyl
Clients share only model updates (gradients A0; and a scalar UFM per round), never raw images or labels. A few samples are visible in Figure
Preprocessing and Augmentation. Each image is resized to 640 x 640 pixels using bicubic interpolation. We apply standard YOLOv8 augmentations: random horizontal flip (probability 0.5), brightness and contrast
25

---

Published as a conference paper at ICLR 2026
jitter (1:20%), and random hue shift (+10%). Pixel values are normalized to [0,1] and then standardized using ImageNet channel means jr = [0.485, 0.456, 0.406] and standard deviations o = [0.229. 0.224, 0.225].
During training. we further apply mosaic augmentation by stitching four images into 1 x 1 grid with random scaling in [0.5, 1.5].
E.2. CARLA SIMULATION DATASET
The CARLA simulator (Dosovitskiy et al. 2017) v0.9.13 generates synthetic driving scenarios to evaluate model robustness under controlled environmental and urban variations. We select three canonical maps: Town01 (suburban streets), Town03 (dense downtown), and Town05 (mid-density mixed-use) to capture a broad spectrum of road geometry, building density, and occlusion patterns.
An autopilot-enabled ego vehicle equipped with an RGB camera (1920 x 1080, 100 FOV) and a semantic segmentation sensor (same specs) records frames every 3s. We retain only frames containing at least one pedestrian. Pedestrian bounding boxes
b (Tiinn M/min Tmax, Umax R²
are extracted via comnected-component analysis on semantic masks, discarding detections with fewer than 50 pixels.
Skin-tone assignment. Each synthetic pedestrian blueprint is manually mapped to a Monk Skin Tone (MST) label by visual inspection, ensuring consistency with the FACET scale. Let
C= [Town001, Town03, Town05), S= (1, (1,....100 10).
Each pedestrian instance receives pair (c, 8) E C S.
Domain adaptation fine-tuning. To reduce domain shift, we fine-tune the federated global model on clear- weather CARLA frames. For each e E C and E S we sample 200 frames, yielding
Ntune = |C| x [S] x 200 = 3 x 10 x 200 = 6000
tuning samples. Fine-tuning uses the same SGD hyperparameters as federated local updates.
Fine-tuning scope and schedule. Starting from the global checkpoint at round T=100, we fine-tune all pa- rameters end-to-end on the 6,000 clear-weather CARLA frames; no layers are frozen. Optimization mirrors local training: SGD (momentum 0.9, weight decay 10-4) with parameter groups and layer-wise learning- rate multipliers: backbone at 0.1x the base LR and the detection/evidential heads plus the GRL adversary at 1.0x. The base LR is 10-3 with step decays by 0.1 at [0.6 E and [0.8 J. where we set En=10 epochs (batch size 64, image size 640x 640). Mixed-precision gradients are clipped to a global norm of 5. BatchNorm layers remain in training mode and update both statistics and affine parameters. No data augmentation is applied during fine-tuning beyond normalization; the Matching/NMSSevalluung
training (PyTorch aut (cast) is enabled;
thresholds are identical to those used elsewhere. The adversarial privacy branch is active with =0r1 and the evidential regularizer used for uncertainty calibration/ fairness is retained with A We do not use early stopping; the final checkpoint is the last epoch.
Differential privacy during fine-tuning. When fine-tuning uses private client data, the DP baseline (FedAvg-Die DP) keeps per-example DP-SGD enabled with the same clipping bound C and noise multiplier z as in training: these Eg local steps are composed into the reported run-level (c, 8) using a PRV accoun- tant (same and sampling rate q as training). Non-DP baselines fine-tune with the identical optimization schedule but without noise, and all evaluations are performed noise-free. In our CARLA adaptation runs, the fune-tune set public/synthetic, so DP is disabled for that stage and no additional accounting is included.
Adverse-weathen evaluation. We evaluate under 13 conditions: a clear baseline plus fog. cloud and rain at intensities a E {0, 25, 50, 75, 100)% %. For each e, 8, and weather condition w we capture 20 frames,
N evall
|C| x S|
13 20 3 10
13 x 20 7800.
26

---

Published as conference paper ICLR 2026
Figure 5: The Monk Skin Tone (MST) scale (Pathiraja et al. 2024) ranges from MST=1, representing the lightest skin tone, to MST=10, representing the darkest skin tone.
This design isolates the effects of environmental severity and urban topology on detection, fairness, and privacy metries.
Evaluation set rationale. This balanced evaluation design is intentional rather than attempt match real-world weather frequencies. By sampling an equal number of frames for every (c, 8, w) triplet, each of the 13 conditions receives the same support (3 10 20 600 frames per weather type), differences in mAP, fairness, and privacy scores can be attributed to environmental severity and topology instead sample- count imbalances clear-weather dominance. This setup yields more discriminative and interpretable stress test of robustness and group-level parity across adverse conditions; if desired, deployment-specffic mixtures later be obtained by reweighting our per-condition results.
Preprocessing. RGB frames are downsampled to 640 x 640 and normalized as in training; no random augmentations are applied at test time. Semantic masks used only for bounding-box extraction.
E.2.1. DATASET STATISTICS
Table 3: Composition and partitioning of FACET and CARLA datasets
FACET
CARLA (Tune)
CARLA (Eval)
Images
32.000
6000
7 7800
Person instances
50000
6.515
163
Skin-tone levels
10
Urban layouts
N/A
3 clear 200
3
Weather conditions
N/A
13
Frames per (c.s.w)
N/A
20
Table summarizes our real and simulated datasets. FACET provides 32000 images and 50000 person in- stances across ten MST levels, partitioned into four IID client shards of 8000 images each. The CARLA fine-tune set contains 6000 clear-weather frames (200 per town-skin-tone pair), and the evaluation set com- prises 7800 frames collected over three towns under thirteen weather conditions, with twenty frames per (town, skin-tone, weather) tuple (see Fig. 3 for sample images from dataset). This balanced design en- sures comprehensive coverage for assessing RESFL's performance under varied real-world and synthetic scenarios.
F. IMPLEMENTATION DETAILS
All components of RESFL were implemented in Python (v3.9) using the PyTorch (v2.0) framework, and all experiments were executed on a single NVIDIA RTX 3070 GPU with GB of VRAM. We adopted the YOLOv8 object-detection architecture
backbone, modifying its final detection head to emit nonnega- tive concentration vectors for evidential uncertainty estimation. Specifically, we replaced the standard soft- max head with sapplus-ppus-one layer to produce Dirichlet concentration parameters a 1 1+ In (1+e*)).
27

---

Published as a conference paper ICLR 2026
All code, including dataset wrappers, training scripts, and analysis notebooks, will be released upon publi- cation to ensure full reproducibility.
Training proceeded in standard federated loop over T 100 communication rounds. In each round, the server distributed the current global model 0e to N = 4 clients. Each client locally trained for one epoch (one full pass over its data) using stochastic gradient descent with momentum 0.9 and weight decay x 10 The initial learning rate was set to 1 x 10 and decayed by factor of 0.1 at epochs 50 and 75. We fixed the batch size to 64 samples per step. Training on a single RTX 3070 iterates over the four clients serially within each round; the end-to-end wall-clock complete one with 7-100 and F=1 is =o8 hours per seed. All results are averaged over three independent random seeds to account for variability in data splits and optimizer initialization.
For the FACET dataset (Gustafson et al. 2023), we loaded 32,000 annotated images and partitioned them into four i...d. subsets of 8,000 images each, preserving the overall Monk Skin Tone (MST) distribution in each split. No raw image data were exchanged during training; clients only uploaded model gradients A0; and single Uncertainty Fairness Metric (UFM) scalar per round. For the CARLA simulator experiments Dosoviiskky et al. 2017), we first fine-tuned the global model on 6,000 neutral-weather frames (3 towns x TO MST levels x 200 frames each), then evaluated on 7,800 held-out frames spanning 13 weather conditions (clear plus fog, cloud and rain at four intensities each) across the same towns (3 towns x 13 conditions 200 frames each).
We set the adversarial gradient-reversal coefficient Apriv to 0.1 and the uncertainty regularization weight Atair to 0.01. The server aggregation temperature 3 was chosen as 2.0 based on a preliminary grid search balancing fairesss sensitivity against raw accuracy. All four clients performed synchronized local updates in each round, and the server aggregated via
Σ exp(-3UFM.) A0,-
N
(1+1) G
+ 1
2j=1 (xp UFM,)
Hyperparameter values, gating parameters, dataset splits, and training protocols are summarized in Table
All experiments spanning privacy and fairness attacks, adversarial robustness tests, and ablation studies use the same training pipeline above. Our release will include detailed setup instructions, random seed logs, and pre-trained model checkpoints facilitate both replication and future extension.
To avoid ambiguity, we clarify the construction and role of the held-out validation sets used for computing per-client UFM, and the validation mAP floor. For FACET, after forming the four i.i.d. client shards, each client i performs a single fixed stratified split of its local shard into training and validation subsets in 90 90%01% ratio (stratified over MST and detection labels every cohort present in the shard appears in both subsets). This split is created once at initialization and kept unchanged across all communication rounds and seeds. During federated training, local SGD at round & uses only Derain, while
Local validation splits for UFM.
the deterministic gate in Eq. (5) uses these per-round validation mAP values together with the fixed floor of 0.30 listed in Table 4 All global performance and faimess metrics reported in the main tables are computed on separate evaluation splits that are never used to form UFM, or to tune aggregation weights. The attack-reserve slices introduced in the privacy sections remain strictly disjoint from client train/validation and evaluation sets: for FACET, the 5% attack (1,600 images, stratified by MST) used only to train and calibrate the MIA/AIA probes; for CARLA. the 600 clear weather frames reserved for attacks are likewise never used for fine-tuning or evaluation. For CARLA robustness experiments, the 6,000 wletrr tuning frames are split once into training and validation subsets using the same 90 90%/10% ratio (stratified by town and MST) for model selection, while the 7,800 weather frames in Table 3 are reserved purely for final evaluation of accuracy, fairness, and privacy. In all cases, UFM; and gating decisions are based only fixed
the client evaluates on Dyal to compute its scalar UFM (?) and validation mAP@
28

---

Published as a conference paper ICLR 2026
Table 4: Implementation environment and hyperparameter settings
Category
Setting
Framework
PyTorch v2.0, Python 3.9
Hardware
NVIDIA RTX 3070 (8 GB VRAM)
Backbone
YOLOv8 with evidential head
Optimizer
SGD, momentum 0.9, weight decay 10-4
Initial learning rate
1 x 10 decayyd by 0.1 at epochs 50, 75
Batch size
64
Communication rounds
100
Clients
4 (i.id. splits of FACET)
FACET split
32 images - 4 8 k images
CARLA fine-tune / eval
6 k / 7.8 k frames (13 scenarios)
Apriv (GRL)
0.1
Atair (uncertainty)
0.01
Aggregation temperature /
2.0
UFM clip range
[0.0, 5.0]
Validation mAP floor (gate)
0.30 (mAP@50-95)
Random seeds
3
Per-client training time
~ h per 100 epochs
held-out validation data, and all attack probes operate on dedicated attack-reserve slices that never overlap with the data used for federated training, UFM computation, or final reporting.
Baselines and fairness objectives. FedAvg uses standard local detection loss Task and uniform aggre- gation. FedAvg-DP applies applies per-example DP-SGD (classical Gaussian mechanism) with global & clipping 1==10 and noise a set from (e, 6') (no server noise), then aggregates uniformly. PUFFLE augments Linsk with a representation-level fairness regularizer,
Liair
G
Σ 9.9
Ug - Me 1al1
Mg = 1
Σ GAP(o(z)). BEB,
where (xx) is the penultimate feature map, GAP is global average pooling, and B, indexes batch items with sensitive group g: training minimizes Lass + Lfirr with =0.1 while applying per-step DP clipping and Gaussian noise; aggregation is FedAvg. FairFed uses the same Liair locally and additionally reports an epoch-averaged scalar ft the server; the server sets w; = f:/ E, fy and averages parameters with these normalized weights, which in our implementation up-weights clients exhibiting larger inter-group disparity. PrivFairFL-Pre applies light perturb-and and-calibrate step to local logits before upload together with the same representation regularizer during training; aggregation is uniform. PrivFairFIL-Post leaves local training unchanged and performs post-hoc server-side calibration (temperature scaling plus threshold smoothing) on received models to reduce cross-group TPR spread without changing data. PFU-FL uses the composite local objective Lusk + Afai with the same disparity proxy and DP gradient clipping when enabled, with uniform aggregation. Evaluation parity metrics (DI and AEOP) are used only for reporting and never optimized directly in any baseline.
Augmentations and DP clipping. All methods share the same augmentation pipeline (resize to 640 6400, horizontal flip 0.5, brightness/contrast +20%, hue +10%, YOLOv8 mosaic), with RNG seeds fixed. For FedAvg-DD we apply augmentations before the forward pass and use per-example DP-SGD: each example's gradient is computed, its l, norm is clipped to C=1.0, the clipped gradients are summed, and Gaussian noise
29

---

Published as a conference paper ICLR 2026
with standard deviation o=2C' is added prior to the optimizer step. We employ Poisson subsampling with batch size B and compose privacy across all steps with a numerical accountant (PRV), yielding a rev-level (c, 8). Adjacency is defined the individual original example; augmented views of the same example are treated as transformations of that unit and do not change the privacy accounting. There is no server- side noise and no secure aggregation our setup.
Attack-modee hyperparameters. For each method and seed we train one shadow model to preserve com-- pute parity. The MIA probe a calibrated logistic regression fitted on standardized features (loss, margin, evidential summaries); the AIA probe is a two-layer MLP (hidden 128, ReLU, dropout 0.1) on update meta- features, with Adam (Ir=10-3) for 10 epochs (batch 256). Thresholds for TPR @ FPR are chosen on a validation split and then fixed for test. Attack training never uses the test set and does not alter the target models.
Compute resources. All experiments were run on a single workstation equipped with an NVIDIA RTX 3070 GPU (8 GB VRAM), an Intel Core 17-10700K CPU (8 cores, 16 threads) and 32 GB DDR4 RAM, with datasets and logs stored on 1 TB NVMe SSD, Each 100-round federated training session required =8 hours of GPU time and = hour of CPU overhead per seed. CARLA fine-tuning and evaluation took 1.5 hours of GPU time per seed. Averaged over three random seeds, the total compute amounted to =27 GPU-hours and = 12 CPU-hours, and consumed =550 GB of disk storage.
Runtime convention. "Per-client training time" refers to the effective local compute accumulated by one client across all rounds. Under our single-GPU serial simulation, this equals the total wall-clock time divided by the number of clients (#2 hours per client when the full run takes =88 hours over 4 clients). In synchronous FL, the per-round wall-clock is bounded by the slowest client. If clients train in parallel on K GPUs, the wall-clock scales to roughly 8/ min K, 4} hours plus communication. All methods use the same horizon (T=100, E=1); no early stopping is applied.
Training horizon and termination. All methods, FedAvg, FedAvg- DP, FairFed, PUFFLE, PFU-FL, and RESFL, are trained for an identical fixed horizon (7=100 communication rounds, E=1 local epoch per round). We do not early stopping or matience-based termination during tuning final training; runs that appear to converge earlier still complete the full horizon. Hyperparameters are selected on a separate validation split, and the selected configuration is retrained from scratch on the same train split for the same fixed horizon before test evaluation (the validation split remains held out). No method is terminated before T or allowed to exceed T.
Computational linearity and scalability. Although RESFL integrates an adversarial classifier (via a gra- dient reversal layer) and an evidential head on top of the YOLOv8 backbone, the additional overhead is con- stant rather than multiplicative. Let Cse denote the per-batch cost of the backbone, Cady that of the adversary, and Cov that of the evidential head. Because the evidential head replaces the softmax head (Cov = Csotmax) and the GRL performs only sign inversion during back preck--ropggttion the total local cost per epoch is
T. e E' Thi (Cob + Cev + Cadv)) = e L Mi Cro
) (1+
B
B
where 5 Cart < is constant across clients. Hence per-client compute scales linearly with local data Ci. size and epochs, identical in asymptotic order to FedAvg.
Communication cost remains unchanged: each client transmits its model update A0; and single scalar UFM value, i.e., 0(1)))+((1) bytes per round, while the server's aggregation step a convex combination
e BUFM,
((++1) = 000) +
BLFM, AO,,
30

---

Published as a conference paper ICLR 2026
which costs ( the same as standard FedAvg. Thus, runtime grows linearly with the number of clients and local samples, and the weighting operation adds only O(N) scalar work.
practice, the GRL adversary is a lightweight two-layer MLP (~-0.2 M parameters) detached at infer- ence, and the evidential head contributes < 8% of per-batch runtime. These components are modular and backbone-agnostic: smaller or quantized detectors (e.g.. YOLOv5-s, MobileNer-SSDD can substi- tuted without altering the objectives or communication protocol, preserving privacy-fairness trade-offs on weaker edge devices. Therefore, RESFL's computational behavior provably linear in data and clients, with bounded constant-factor overhead, ensuring practical scalability even under heterogeneous hardware.
G. SENSITIVITY ANALYSIS
We present a focused sensitivity analysis on FACET with 4 clients under the IID split to avoid confounding from distribution shift. Unless stated otherwise, all settings follow Section We vary hyperparameters that most directly control aggregation dynamics, optimization progress, and the integrity of the faimess signal: the aggregation temperature 3, the number of communication rounds T, the number of local epochs E, the learning rate schedule, the batch size, and the UFM clipping bounds (a, 6). Metrics are identical to the main text. Fairness Score is the average of demographic parity deviation and equality of opportunity gap, 1 (11- 11-DD DI| + AFOP), lower is better. Privacy Score is the average of membership and attribute inference success rates, (MIA SR + AIA SR), lower is better. Accuracy is mAP, higher is better. Results are means over three seeds.
Hyperparameter tuning (all methods). We tune each method separately under equalized compute budget on a held-out client-local validation split (10% of each client's shard). Validation metrics are ag- gregated unweighted client means. After selection, we keep the split unchanged: Drain is used for local
SGD and Di remains held out for per-round UFM and validation mAP; final results are evaluated once on test. No early stopping is used, and the training horizon is fixed (T=100, E=1) for all methods. Se- lection follows an accuracy-floor rule: among configurations whose validation Accuracy is within 1% of the per-method best, we pick the one minimizing Fairness Score+ Privacy Score; ties are broken by lower Privacy Score, then lower Fairness Score, then simpler configuration (smaller grids). Seeds are resam- pled per trial; client validation splits remain fixed (three seeds). If a baseline's public defaults exist, they are included in the grid and treated identically. For IID vs. non-IID, tuning is conducted separately in each regime.
Compute parity and reporting. Each method is capped to the same trial budget (number of hyperpa- rameter settings X 3 seeds x T'=100 rounds). If a grid enumerates more candidates than the cap, we uniformly subsample without replacement. All tables and figures report mean standard deviation over 3 seeds; error bars denote +1 standard deviation. Accuracy is mAP (higher is better). Fairness Score = -1 + ΔEOP) and Privacy Score (MIA SR + AIASR) (both lower are better).
Aggregation temperature B. The temperature controls the strength of softmax weighting w, exp( 3 UFM.), where larger 3 prioritizes clients exhibiting lower inter-group uncertainty disparity. Ta- shows a clear pattern. Moving from 3-0 (uniform FedAvg aggregation) to moderate | yields steady improvements in Fairness Score and Privacy Score with only small changes in Accuracy. At very large B the server over weightsshts a few clients, which can slightly reduce mAP while offering diminishing returns in fairness and privacy. The selected 3=2 lies on the knee of this curve, giving the strongest overall trade-off.
Communication rounds T and local epochs E. We next separate communication and local computation effects. Increasing T at fixed E=1 improves synchronization and reduces variance in client updates, which
31

---

Published as conference paper ICLR 2026
Table Search grids and tuning notes (FACET, 4 clients). All methods use the same T=100, E=1, and step LR schedule unless noted.
Method
Grid (values); Notes
RESFL
B E (0.5, 1, 4]; Apriv {0.01, 0.1, 13; Anair (0.01, 1}: LR E (1x10-*, 5x
10-*); Batch (32, 64). Backbone/head LR multiplier (0.1, Weight decay fixed
10
FedAvg
LR E (1x10-3, 5x10 Batch E f32, 64]; Weight decay 10 No faimess/privacy
terms.
FedAvg-DP
Per-example DP-SGD with Poisson subsampling; clip C [0.5, 1.03: noise multiplier E {0.5, 0.8, 1.0. 1.2] (we sweep E, report run-level E via accountant); subsampling rate g from batch B E {32, LR E {1 10 10- 5 10 10=
10
FairFed
Faimess weight (0.1, 0.5, 1.03; LR (1x10-3, 5x100 Batch {32, 64). Server weighting per authors' rule.
PUFFLE
Fairnsss coeff E {0.1, 1.0); Noise coeff E (..1, IR E (1 10 5x 10-1)
Batch {32, 64). Other defaults per authors.
PRU-FL.
Privacy oneff E {0.1, 1.0]; Fairness coeff E (0.1,
x1x10
"}
Batch E 64).
Table 6: Sensitivity aggregation temperature on FACET (4 clients, IID.. Best row is highlighted.
8
Accuracy 1
Fairness Score +
Privacy Score +
0 0.671
0.252
0.245
0.5
0.669
0.236
0.222
1
0.667
0.223
0.206
0.665
0.212
0.196
4
0.657
0.209
0.194
benefits both Fairness Score and Privacy Score. Gains taper by T-200, indicating a convergence plateau under fixed local compute. Holding 7==00 and increasing E shows the usual compute drift trade-off. A small increase to E=2 keeps utility near constant with a minor relaxation fairness and privacy. Larger E. introduces client drift that harms both scores and can slightly reduce mAP. The default (T=100, F= therefore sits a stable region that balances compute and communication without exacerbating drift. We highlight this configuration as the overall best trade-off row reflect our selection criterion the main experiments.
Table Sensitivity to communication rounds T and local epochs E (FACET, IID). Best overall trade-off row is highlighted.
Setting
Accuracy
Fairness Score +
Privacy Score +
T=50, E=1
0.651
0.231
0.214
T=100, E=1
0.665
0.212
0.196
T-200, Æ=1
0.668
0.209
0.195
T=100, Ø=1
0.665
0.212
0.196
T=100, F=2
0.668
0.218
0.201
T=100, F=4
0.660
0.246
0.228
Selected: 7=100, F=1
0.665
0.212
0.196
32

---

Published as conference paper ICLR 2026
Learning rate schedule and batch size. We compare step schedule, cosine decay, and constant learning rate, as well as batch sizes that fit on an 8 GB GPU. Shows that the step schedule at batch 64 yields the best Fairness Score and Privacy Score with competitive Accuracy. Cosine decay converges smoothly but is marginally less fair, likely due to slower early-phase temperature effect that leaves some inter- group disparities unresolved. 64 strikes good bias-variance balance: smaller batches inject excess gradient noise, while larger batches reduce update frequency and slightly harm fairness.
constant learning rate under-trains, worsening all metrics. For batch size,
Table 8: Optimizer schedule and batch-size sensitivity (FACET, IID).
Best row is highlighted.
Config
Accuracy
Fairness Score +
Privacy Score +
Step 50,75: batch 64
0.665
0.212
0.196
Cosine decay; batch 64
0.662
0.219
0.201
Constant LR; batch 64
0.648
0.233
0.214
Step: batch 32
0.661
0.217
0.200
Step; batch 64
0.665
0.212
0.196
Step; batch 128
0.659
0.224
0.203
UFM clipping bounds and server-side safeguards. Clipping each client's 's into [a, b] bounds the influ- ence of any extreme falsified report and stabilizes the softmax exponentiation. Tableeiiniccatss negligible sensitivity across reasonable bounds, confirming that clipping acts as safety layer without harming util- ity. This preserves the baseline trade-off, consistent with the interpretation that per-client UFMs are already well well-behaved under the evidential head and that lightweight integrity checks suffice for robustness.
Table 9: UFM clipping and simple server safeguards (FACET, IID..
Best row highlighted.
Variant
Accuracy
Fairness Score
Privacy Score
Clipping [0.00, 5.00]
0.665
0.212
0.196
Clipping [0.5, 4.5)
0.644
0.235
0,207
Clipping [1.0, 4.0
0.639
0.226
0.199
DP setup summary. Our FedAvg-DP baseline follows per-example DP-SGD with the classical Gaussian mechanism and standard composition accounting. At each local optimizer step we compute per-example gradients, clip each example's 's gradient to l norm C=1.0, aggregate the clipped gradients, and add i.i.d. Gaussian noise (0,, o²) every parameter. We use Poisson subsampling with batch size B from each client's is shard [Dz] and compose privacy across all local steps and rounds with a numerical accountant (PRV), yielding an overall client-level (e, 8) for the full training run. Adjacency defined the individual example level on each client. There is no server-side noise and no secure aggregation in our setup; the server is honest-but-curious and observes cleartext noisy updates.
Given target (e, 5) and clip C, the accountant selects per-step noise multiplier = a/C under schedule (T=100, E=1, B-64) and client shard sizes (FACET). We sweep three budgets to illustrate the trade-off and fix 8=10- across runs:
We report the Main setting (e=1.0, 8-10-6 C=1.0) all primary tables because it lies near the knee of the piliiyy-prvvacy settings appear the appendix to show the expected trade-off. off. Moreover, see Table 15) for FACET results comparing these three FedAvg-DP privacy budgets under IID and Non-IID splits with 4 clients.
for detection and trains stably across seeds, while the Very strong and Loose
33

---

Published as conference paper ICLR 2026
Table 10: DP-SGD sweep used for FedAvg-Di (per- examlee clipping). PRV accounting determines the per-step noise multiplier that achieves the target ren-level (e, under training schedule.
Variant
C
Noise multiplier ==o/C
Very strong privacy
0.5
10-6
10
1.0
3.0
Main (reported)
1.0
10-6
1.0
2.1
Loose privacy
2.0
10
1.0
1.5
0.75
0.75
0.70
0.70
Average MAP
Average mAP
0.65
0.65
0.60
0.60
0.50
0.50
0.45
0.45
0.40
0.40
3
9
Monk Skin Tone
Monk Skin Tone
(a) FedAvg
(b) RESFL
Figure 6: Accuracy (mAP) across Monk Skin Tones on FACET; RESFL stays consistent; FedAvg drops on darker tones.
Findings. Across all axes, the configuration used the main experiments lies in stable region. 3=2 delivers the best joint Fairness Score and Privacy Score with minimal change in Accuracy. (T=100, E=1) is near the conmunication-compute knee and avoids drift seen at larger E. The step schedule with batch 64 balances convergence and regularization. Reasonable clipping bounds and simple server checks keep UFM- driven aggregation robust. These observations substantiate that our default hyperparameters are chosen at or near Pareto frontier for Accuracy, Fairness Score, and Privacy Score FACET under the IID split.
Table 11: FACET results under IID vs. Non-IID with clients. Accuracy is mAP (higher is better). Fairness/Privacy Scores are averages of (J1 DIJ, AEOP) and (MIA SR, AlA SR), respectively (lower better). Results are sdd over 3 seeds.
IID
Non-IID
Algorithm
Accuracy (1) Fairness Score (1)
Privacy Score (1)
Accuracy (1)
Fairness Score (.)
Privacy Score (1)
FodAvg
0.6378 2..37820.006
0.2261 20.006
0.3885
0.4841 0.484120010
0,3892
0.4317-a012
FedAvg-DP
0.4612..0.08
0.3412 L0.001
0.2496 10,009
0.3264_aam
0.4872 0000
0.2909 10.009
FainFeed
0.7013
0.2529 20.0065
0.4832
0,5080
0.2989 0.2989_o.m
0.5122
0.4192-0.008
0.3348 =0.0070
7000000
0.2726-amm0
0.3650-oa1
0.3140
Ours (RESPL)
0.665420.005
0.2123 2.0008
0.1963
0.5384_..00
0.2387_4.09
0.2387
0.2131
34

---

Published as conference paper ICLR 2026
Table 12: FACET results under IID vs. Non-IID with clients. Accuracy is mAP (higher is better).
Fairness/Privacy Scores are averages of ([1 DII, AEOP) and (MIA SR, AIA SR), respectively (lower is better). Results are pea over 3 seeds.
IID
Non-IID
Algorithm
Accuracy (1) Fairness Score (J)
Privacy Score (U)
Accuracy (1)
Fairness Score (4)
Privacy Score (J)
FodAvg
0.6217=0.00
0.2395=0.00
0.3973
0,3615=0010
0.427--00022
0,4893-a001
FedAvg-DP (e=1)
00.009
0.3937
0.3016:0.007
0.4521
0.2368-aa00
Fairteed
0.6895 0.6895
0.2647:00006
0.4216:0002
0.4284-0011
0.3571
0,5695 20013
PUFFLE
0.3927
-0,007
0.2953=0000
-.1983=am00
0.4237-0011
0.3719+a.m2
Ours (RESFL)
0.65.39
0.2197
0.2059
0.4627
0.2975
0.2635
Table 13: MIA evaluation FACET (4 clients, IID.. Lower is better. We report TPR fixed FPR and balanced accuracy (Success Rate), Values are mean + std over seeds.
Method
TPR@FPR=1%
TPR@FPR=5%
TPR@FPR=10%
Success Rate
FedAvg
0.12+00.01
0.31+0.02
0.45++0.02
0.62+
FcdAvg-DP
0.09++0.01
0.24+0.02
0.36+0.01
0.59+0.001
FairFed
0.14+0.02
0.35++0.01
0.49+00011
0.64+0.01
PUFFLE
0.09110.01
0.2710001
0.40-10.02
0.5911..01
RESFL
0.07
0.20
0.31100.02
0.57
H. FACET EVALUATION RESULTS
We evaluate FACET using two federation sizes (4 and 8 clients) under IID and Non-IID partitions. For IID, we perform stratified sampling that preserves the joint distribution of task labels and sensitive groups within each client; each client thus receives equal-sized subset with approximately identical class and group proportions.
For Non-IID, we induce label/group-skew while keeping client sizes equal to decouple distributional het- erogeneity from data-quantity effects. Concretely, for G=10 Monk Skin Tone cohorts we draw client- specific proportions p; ~ Dirichlet(aIcc with a-0.5, then allocate fixed count nu=N/G per client via Bii ~ Multinomial(n:, ps). Thus non-IlDness arises from class-group proportion skew (not from unequal sample counts), which avoids confounding faimess/pprvacy comparisons with trivial volume advantages and matches common FL practice. We quantify heterogeneity by
N
HTV
1
Σ
lp: Pgloball|1s
N
the mean total-variation distance from the global cohort distribution (higher is more skew). With a=0.5, we observe HTv RJ 0.33 (+0.02) for 4 clients and 0.31 (=0.02) for 8 clients across seeds, with per-client cohort shares typically ranging from 2% 26% Note that smaller a increases skew (non-III severity), while oc recovers IID. The total number of samples and per-client sizes are matched across IID/Non- IID; all methods use the same local training budget and optimizer settings. Full hyperparameters appear in Appendix
F
ID VS. Non-IID with 4 clients (Table I1. Under IID, RESFL attains the best combined fairness-privacy profile while preserving competitive mAP. Compared to FedAvg, RESFL reduces the faimess score (lower is better) from 0.2261 to 0.2123 and the privacy score from 0.3886 to 0963, with a modest accuracy gain over most baselines. FedAvg-DP (c achieves competitive privacy (0.2496) but steep accuracy cost (0.4612 accuracy), illustrating the classic privacy-utilit tension. FairFed delivers the highest mAP (0.7013) but with weaker privacy (0.4832). Under Non-IID, all methods degrade, as expected, yet RESFL retains the
35

---

Published as conference paper ICLR 2026
Table 14: AIA evaluation on FACET (4 clients, IID. Lower better. We report top-1 accuracy of the attribute probe and Macro-Fl. Values mean + std over 3 seeds.
Method
AIA Accuracy
Macro-F1
FedAvg
0.43
0.41
FedAvg-DP
0.21-10.01
0.21+0001
FairFed
0.47=0.02
0.44=0.01
PUFFLE
0.36=0.02
0.35+:0.02
RESFL
0.18:10.01
0.17:0001
Table 15: FACET FedAvg-DP privacy-utility sweep under IID vs. Non-IID with 4 clients. Accuracy mAP (higher is better). Fairnes//rrvvacy Scores averages of (11 DII, AEOP) and (MIA SR, AIA SR),
respectively (lower is better). Results are mean over 3 seeds.
ID
Non-IID
Variant
Accuracy (*)
Score (L)
Privacy (1) Accuracy (1)
Score (L)
Privacy (})
FodAvg-DP (e=0..5 (Very sroong
0,3925 :000
0.3290
0.2110
0.2710 :om::
0.4580
0.2520-nomm
FedAvg-DP (c-10) [Main]
0.4612:m00s
0.3412_nmm
0.2466g00
0.3264
0.487220000
0.2909
FedAvg-DP (x=2.0) [Loos]]
0.5120-0007
0.3620_a0015
0.3863-0010
0.384020000
0.5111 #0007
0,4152=0011
lowest fairness (0.2387) and near-hest privacy (0.2131) with the top mAP (0.5384), indicating robustness client heterogencity.
Scaling 8 clients 12) The trends persist when increasing the client count: under IID, RESFL again achieves strong accuracy (0.6539) with the best fairness (0.2197) and near-best privacy (0.2059), In Non-IID, the gap between data-size-agnostic and DP-based methods widens; FedAvg-DP preserves privacy (0.2368) but collapses in mAP (0.1774) FairFed remains accuracy-lcaning (0.4284) yet with weaker privacy (0.5695). RESFL continues to balance all three criteria (mAP 0.4627; fairness 0.2975; privacy 0.2635), suggesting that uncertainty- seriiddntt-guided aggregation can mitigate distributional skew without over-penalizing utility. For more discussion on scalability, please refer to Appendix
Interpretation of privacy attack outcomes. As shown in Table 13 and Table RESFL reduces attacka- bility across both membership and attribute inference. For MIA, RESFL attains the lowest TPR at fixed FPR and the best balanced success rate (0.57=0.001) improving over FedAvg- and PUFFLE (0.59+0.00) and clearly over FedAvg and FairFed. For ATA, RESFL achieves the strongest protection, with the lowest probe accuracy and Macro-F1 (0. 00.08, 0.17=0.01). improving over FedAvg-DP (0.24+0.01, 0.21++0011.. FedAvg-DP and PUFFLE decrease leakage relative to FedAvg but at higher utility cost (Appendix F. Over- all, evidential disentanglement with UFM-weighted aggregation curbs attribute leakage while driving mem- bership privacy beyond DP baselines, yielding strong privacy when both attack types are considered joitll..
I. CARLA EVALUATION RESULTS
Table shows accuracy (mAP), fairness (I1-DI), AEOP), privacy-attack success rates (MIA SR, AIA SR), and robustness metrics (BA AD, DPA EODD) for all FL algorithms under varying cloud intensities.Table 19 reports the same set of metrics across rain intensity levels. Table T presents these metrics under fog condi- tions increasing severity.
36

---

Published as a conference paper ICLR 2026
Table 16: Results on Adult and Tve with 4 clients (IID split, sensitive attribute = gender). Accuracy is overall classification accuracy (f). Fairness/Privacy Scores are lower-is-better (4). Values reported as isd over 3 seeds.
Adult
TweetEval
Algorithm
Accuracy
Fairness Score
Privacy Score
Accuracy 1
Fairness Score
Privacy Score
FedAvg
0,8527 =4005
0.3185=0006
0.3721 +0,00
0.5258 -0.066
0.0439
0.3426_0001
FodAvg-DP
0,7063
0.3018
0.2217 0.2217:0001
0.3724 20,007
0.0415 +0,004
0,1950
FairFed
0.8449 10004
0.2564 10005
0.3965 0.396510.007 10.007
0.5310 10:005
0.0360L00.001 10.004
0.4079 0.008
PUFFLE
0.8294..0000
0.2951 0.295120000 100009
0.285310.008
0.4959 10,004
10.001
0.2851_0000
AF-UFM-Cllster (ours)
0.8425=00006
0.2485
0,2427
0.5053
0.0369
0.2391
AF-UFM Slices (ours)
0.841220001
0.2510_0004
0.2440).o.06
0.5042-40001
0.0375540.04
0.2425_0000
AF-UFM PreMxyyxxyyao (ours)
0.003
0.2475 a.005
0,2411 2o.0u
0,5009 10,001
0.0368 10.004
0.2404_0.001
RESFL (labeled-S)
0.8481 10.00
0,2317
0.2389 10.001
0.5067 10.007
0.0334
0,2353 0.005
J. ADDITIONAL EVALUATION
To rigorously evaluate the RESFL framework beyond visual domains, we perform experiments on dis- tinct modalities: structured tabular data and unstructured text classification. The goal is to examine the generality of our uncertainty-guit guided aggregation and adversarial privacy components across heterogeneous feature spaces.
J.1. GENERALIZATION ACROSS MODALITIES
Experimental setup. We evaluate on the Adult income prediction dataset (Kohavi & Becker 1996) and the TweetEval sentiment analysis benchmark (Barbieri et al., 2020). For Adult, we train a compact with ReLU activations
TabularNet architecture composed of three fully connected layers (256-128 and batch normalization. Each client predicts whether an individual's 'ss income exceeds $50K using census features. The sensitive attribute is race. For TweetEval, we fine-tune Disti BERT with softmax classi- fier for sentiment prediction. The sensitive attribute is gender, inferred from user metadata provided in the dataset.
We construct federation of four IID clients, ensuring approximately balanced class and attribute propor- tions across clients. Each client executes local SGD updates for a fixed number of epochs using the same hyperparameters and learning rate schedule as in the main experiments. Fairness is measured the mcan of demographic parity gap (]1 - -DI) and fied via membership and attribute inference success rates (MIA and AIA) following the evaluation procedure Section A.4
gap (AEOP), and privacy leakage is quanti-
Results. Table I6 summarizes the performance. On Adult, RESFL achieves accuracy 0. 0.848110.000 with the lowest fairness gap 0.2317++0.00 and strong privacy protection 22389++0.001 FedAvg-DP yields im- proved privacy (0.2217) but major cost utility (0.7063 accuracy). This demonstrates that adversarial disentanglement in RESFL preserves performance while improving both privacy and fairness. On Tweet- Eval, RESFL similarly improves fairness (0.0334) and privacy (0.2353) while maintaining accuracy within 0.02 of the best baseline. These consistent results across structured and text data confirm that RESFL gen- eralizes effectively new modalities.
J.2. ATTRIBUTE AVAILABILITY AND LABEL-FREE VARIANTS
Motivation. Although sensitive attributes such as race or gender enable explicit fairness estimation, they often inaccessible in real-world federated deployments due to privacy laws data governance
37

---

Published as a conference paper ICLR 2026
straints. To examine RESFL's robustness under this constraint, we introduce three attribute-free variants of the Uncertainty Fairness Metric (UFM) that compute client-level fairness weights without relying on ex- plicit sensitive labels. These variants operate entirely on local model features and uncertainty statistics while preserving the same communication protocol and training loop.
Label-free UFM formulations.
AF-UFM-Cluster. Each client computes feature embeddings h(z) from the penultimate layer or averages over region-of-interest (ROI) features for structured data. The emheddings are normalized unit length and clustered into K cohorts via k-means. Cluster assignments (C1..... Cx approximate latent subpop- ulations. UFM is computed across clusters the normalized variance of per-cluster evidential uncertainty (1/ag), using the same Au and normalization constants as in the original formulation. This approach models hidden group structure by exploiting representation geometry.
AF-UFM-Slices. Instead of clustering features, clients partition samples by quantiles of evidential vacuity vzx) 1/), which reflects epistemic uncertainty from the Dirichlet head. The quantiles (e.g., tertiles or quartiles) form K strata .Qi..... Qx). UFM is computed as the inter-stratum disparity in average vacuity. This approach assumes that uncertainty strata implicitly capture heterogeneity among unseen demographic or contextual subgroups.
AF-UFM-Proxy. When permissible, clients utilize weak operational proxies that are non-sensitive but correlated with fairness-relevant variation (e.g., acquisition device, time-of-day, or lighting category). These proxies define pseudo-cohort for UFM computation using the same equations as above. This method provides a balance between interpretability and privacy compliance in regulated environments.
Evaluation results. All attribute-fre free UFM (AF-UFM) variants were trained using the same hyperparam- eters, optimizer, and aggregation rules labeled-S RESFL. As shown in Table 16 the label-free variants recover over 90% of the fairness and privacy improvements achieved by labeled-5 RESFL with minimal performance degradation. On Adult, AF-UFM-Cluster attains (0.8425, 0.2485, 0.2427) in (accuracy, fair- ness, privacy), close to the labeled baseline (0.8481, 0.2317, 0.2389). AF-UFM-Slices and AF-UFM-Proxy exhibit similar behavior, indicating that uncertainty quantiles and weak proxies are effective surrogates for sensitive labels. On TweetEval, the label-free methods achieve fairesss gaps between O. 0.0368 and 0.0375, nearly matching the labeled variant (0.0334), confirming that eicertainty-guider grouping generalizes to text-based features well.
Key Findings. These results demonstrate that RESFL's fairness calibration mechanism can function with- out explicit demographic labels. By deriving cohorts from either latent feature geometry or uncertainty statistics, the framework retains privacy-aware and fair aggregation while remaining fully compliant with settings where collecting protected attributes is infeasible. The negligible drop in fairness and privacy met- rics across modalitics underscores RESFL's 's capacity for attribute-fred deployment and its potential to sup- port responsible FL systems under real-world governance constraints.
J.3. ROBUSTNESS UNDER MISSING OR NOISY SENSITIVE LABELS
Protocol. We study robustness of RESFL to incomplete or corrupted sensitive attributes using a lightweight simulation on Adult. Let denote the sensitive label used locally to compute UFM. In the partial-label regime we drop random fraction p {0.25, 0.50, 0.75) of S before UFM computation, UFM is estimated on the remaining labeled subset only. In the noisy-label regime we flip S with symmet- ric noise rate 7) 10, 0.20). When no labels are available (p=1.0), fall back to the attribute-free AF-UFM-Clusted variant, which forms K cohorts by k-means over penultimate features and computes UFM across clusters. No changes made to the training pipeline, aggregation, communication; clients still
38

---

Published as conference paper ICLR 2026
upload 20, and a single scalar UFM per round. Metrics follow Section 4.1 All results are mean + std over three seeds.
Table 17: Adult robustness partial and noisy sensitive labels. Accuracy higher-is-better Fairness and Privacy scores are lower-is-better.
Regime
Accuracy
Fairness Score
Privacy Score +
Labeled-S (baseline)
0,8481 0.005
0.2317100.00
0.2389
Partial labels (p=0.25 missing)
0.8450=0.00
0.2380+10.004
0.2427=00.02
Partial labels (p=0.50 missing)
0,8421 -0.006
0.2442::0.005
0.2461 0.2461 +0.002
Partial labels (p=0.75 missing)
0.8390 -0000
0.251 1 +0.005
0.2490
No labels (p=1.00), AF-UFM-Cluster
0.8425 0.000
0.2485-00.002
0.2427-10.00
Noisy labels (7=).100)
0.8460
0.2400
0.2420
Noisy labels (r=0.20)
0.8430_0.006
0.2460
0.2450
Discussion. Relative to the fully labeled baseline, removing a quarter of labels increases the fairness score by +0.0063 absolute and privacy by +0.0038 with a 0.003 drop in accuracy. At p=0.50 and p=0.75 the fairness score rises to 0.2442 and 0.2511, while privacy reaches 0.2461 and 0.2490; accuracy remains within 1.1% absolute the baseline, In the label-free setting, AF-UFM-Cluster achieves (0.8425, 0.2485, 0.2427), recovering more than 90% of the fairness and privacy improvements of I RESFL. Symmetric noise at 1 and 1 produces modest changes to fairness (-0.0083 and +0.0143) and privacy (+-0.0331 and +0.0061) with accuracy within 0.5 of baseline. Notably, even under p=0.75 0,020, the fair- ness score remains well below FedAvg on Adult (0.3185 in Table [6), indicating that uncertainty-guide aggregation preserves equitable behavior under missing or corrupted attributes. These trends are consistent with the interpretation that UFM relies on calibrated epistemic structure rather than raw demographic su- pervision, so partial information degrades estimation smoothly and the attribute-free fallback maintains the correct client ordering for Cairness-aware aggregation.
K. BROADER IMPACTS
RESFL aims to make federated learning safer and more equitable across domains such as autonomous driv- ing, healthcare, and edge sensing by improving group fairness and reducing -esttive-attribute leakage with- out sharing raw data. Its mncertainty-uuiee aggregation can help models remain reliable under distribution shift and adverse conditions, potentially improving real-world safety and user trust. At the same time, risks remain: stakeholders could tout fairness or privacy benefits without adequate validation, obscure data qual- ity issues behind adversarial masking, or impose extra compute/communication costs that burden smaller clients. These concerns call for transparent reporting of hyperparameters and metrics, independent audits of Rainess-prvvac--uiiiy trade-offs, and safeguards against gaming self-reported signals. Overall, RESFL of- fers practical step toward responsible FL while highlighting the need for oversight, reproducibility artifacts, and domain speuiffc governance in deployments.
LLM USAGE
We used an LLM (GPT-5.1 Thinking) only to aid writing polish and literature discovery. For writing, it suggested alternative phrasings, grammar/clarity edits, and minor LTTXX fixes; all technical content, claims, math, algorithmic choices, figures, tables, and results trieval, it helped brainstorm search queries and surface candidate related-work papers; we independently checked every citation and read primary sources before inclusion. The LLM did not generate datasets, code,
authored and verified by the authors. For
39

---

Published as conference paper ICLR 2026
Table 18: Performance comparison of federated learning algorithms under Cloud in CARLA simulation: The table reports accuracy (mAP), faimess (11 DII, ΔEOP), privacy risks (MIA, AIA), and robustness (BA AD, DPA FODD) across cloud intensity levels. Results are m over seeds.
Unility
Fairness
Privacy Attacks
Rohustress Attacks
Algorithm
Intensity
Overall mAP (1)
[1 DI (1)
AEOP
MIA SR (1)
AIA SR (4)
BA (L)
DPA EODD (L)
0.3052.00006
0.2356_ams
0,391540011 0.2446
04025
0,1531 20007
0,8738 0.8778_go.00
20000
gums
0.246020005
0.398040010
0.4085
0.1053 gImm
0.0821 #00007
FedAvg
0.385020007
0.2394-amm
0.2501 g000s
4,0022
03030
10.004
75
0.3602.0000
0.2535
0.2552
0.4 g,010
00000
0.0908
0.0952
100
0.3387 20,00
0,2877aam
20200
4,015
0,3328 20011
0.0803:00044
0.0893
0.2640 2001
0.3663_0011
0.3898 goor
0.2422,0014
0.500100011
0.1931 11933g0000
0.1947.00.02
203785
0.3908
0.3908 20012
0.2489 2001
0.2123 20000
g.135
0.2058 200014
FodAvg-DP
50
0,2412,0000
0. 0.981500011
0,7936,0010
0.2559
0.3608
0. 0,1203
0.1987.10.01
75
00010
0.39682001
20014
0.2657
0.2485
0.1059
0.1886-200015
0.1754300015
g.022200022
00004
0.2769
0.231500010
00053
0.1819 3,0013
0,2543 gooos
0.3930
0 2.434
0.0638 0.00
25
0.4782.:9.86
0.278 gooss
0,2622
0,3981200
2.112
0,1759
0,0704
FairFed
50
0.4845
0. 0.280320007
1.2650
0.4057 10015
0.4483
0. 0,1602
16002
0.0807 100000
0.3045.0000
2000s
0.412440621
0.557
20.00
0.0945 200007
0.3830o001
0.3190aam2
0,2725
g0000
0,200 200004
0443520017
0.1307 20007
0.0856...006
0.3526
0,3016-u00
0.0882
0.2636
0.286300009
0.1352:
0.1673
25
0.3502.00007
0,3050_ams
0,3905 20010
0.2707
0.2707
0.292)
1,08
0.1788 0.1785
PUFFLE
0.3450 20000
0.3385_mmm
0.394220011 1001
0.2751
10.00
0,2955 2001
0.1357 1000s
0.1614 160100000000
75
2,33892001
0.3422_u012
0.3987 20012
0.2825
2001
0,3054 2012
0,1203 0,1208 gm0ss
0.1831 200013
100
0.5128,,0022
0. 0.3565
0,403420014
0,290
400m
0,3132,0012
0. 0.1052g000
0. 0.1909 19.00400001
0
0-1621
0.2332_aa.4
0.2434
0.1939
0.1420
0,2726:
0.0807 2..007200.07
0,4600 2000s
0,255520005
0.2452:0.004
0.1965
0.1482::0.05
0,1658
0.0912
(RESFL)
0,248)
ga.0s
0.1573_num6
0,15012ums
0.0783
75
0.100800m1
0.2925-um10
0.2523
0.2121:4.007
0.1658
20.07
0,1357
0.1025 1:0.000
100
0.3851 Lou11
0,3070gamm
0.2575
0.2575.0010
0.2205 Lo.810
0.1727 20.88
0. 0.1202 0,1202gn000
0.1093
experiments, proofs, or results, nor did it design evaluations. We reviewed and edited any suggested text to ensure originality and accuracy, and did not include verbatim model output beyond trivial boilerplate. No sensitive or proprietary data were shared in prompts. This usage also disclosed the submission form.
40

---

Published as conference paper ICLR 2026
Table 19: Performance comparison of federated learning algorithms under Rain in CARLA simulation: The result presents accuracy (mAP), fairness (|1 DII, ΔBOP), privacy risks (MIA, AlA), and robustness (BA AD, DPA EODD) across rain intensity levels. Results are mean 2sd over 3 seeds.
Algorithm
Rain Intensity (%)
Utility
Fairness
Privacy
Attacks
Overall mAP
(L)
AROP
MIA (R)))
AIA SR
BA (D)
DPA EODD
0
0.3852.a.007
0.235620000
0.2446:00006
0.3915
0,4235-0012
0.078800.000
25
0.3801 0.3801
0.238
0.2485
0.3998
0.4002-0011
0.1307
0.0814...006
FedAvg
30
0.3705
20005
0,2540
0.40722am1
0:4375a0m3
0.1185
0.0912::
75
0.058
0.2515
0.2628 20.005
0.4150ga012
0.451
0.1023
L.1028::..07
100
0,3120
0.2580
0.2702
0,4228
0:1527
0.0790
0.1305 8:0006
0
0.2610
0.36632001
0.38%
0,24
0.2590aamr1
0.1931
0.1947
25
0.2601.00m
0.369000.00
0.392120011
0,2528
0,2559
0.1368
0.2061 20011
RodAvg-DP
50
0.2577.0.000
0.3724.0000
0.3963
0.26172am4
0.1205 00007
0.2125.0011
0.2523.00m0
0.3770g0011
0,4015
0.2703
0.242__umm
0.1089_4.06
0.2368
100
0.2185200015
0.3829
0,4069 20004
0,28042a016
a.2309aam1
0,061 20005
0 0.3012
0
0.5013
0.2759
0.2593
0.3930
04384_0017
0.2132,0012
0.0638
25
0.4950....06
0.2782.0007
0.2625
0.400
0.4433
0.175220010
0,0725 0..05
FairFed
0.4820 .0,00
2o.0er
20:00
gams
1.059
0.0914.20000
75
0.4652:0.006
0.298020.00
0.2810
0,4250
0.4705
0.0257
0 0.1042:0000
100
0.4300.00a10
0,3125,0010
0.2947.0001
0,4401 4a00
0:452220019
0.1004
0.1501 20000
0
0.3526
0.3016
0.3882
0,2636
0,2863
0.1352-0006
0.1673
25
0.3500.0..07
0.3050 0.309020000 20.00)
0,3905 40011
0.2703
0.2908
0.1527
0.1785
PUFFLE
0.3452.0.006
20,000
0.394020.012
0.2785-a011
n.29
0.1358
0.055
75
0,3585
0.3157
0.398
0,2850
0,3050aama
0.1003
0 0.259 200014
100
0.3023
0.5202
0.4043
0,2951
0.3 0,3128
0.0859
0.2881 =00011
0
0.4621 0.4621
0.2332 14,004
0.2434.a.005
0.1939_aum
0.1420
0.272610015
0.0807 0.0807
25
D.4000--0.000
:0.008
2..0m
0.1984
0.1471 1u:
20.09
0.0925.00000
(RESEL)
g.0500g0.oo
10,000
0.2503
ga250
0,1552_nu87
0.1403_0000
0.1082
75
0,4508_00000
0L2425
10.007
0.2545
0,2121 gums
0.1658
0. 0.1204
0.1301 1000
100
0.4151 g0.011
0.2470
0.25%H 10,00
0.2200
0.1727 10099
0,053 20005
0. 200000
41

---

Published as conference paper ICLR 2026
Table 20: Performance comparison of federated learning algorithms under Fog in CARLA simulation: The result presents accuracy (mAP), fairness ()1 DII, ABOP), privacy risks (MIA, AIA), and robustness (BA AD, DPA EODD) across fog intensity levels. Results are sta over 3 seeds.
Faimess
Privacy Attacks
Robustness
Algorithm
Fog Intensity (%)
Overall mAP
(J)
AEOP(
MIA SR (4)
AIA
(D)
DPA RODD (L)
0.305243006
0.2356ga004
0.391540011 0.2446-0005
04235
0.1531 20.000
0.0738
0,3650
0.2402:0000
0,2605_0.07
0,1251
0.435720005
0.1483 0.1483300000
0.0651 =00007
FedAvg
0.3157
0.2650
0.2872
0,4175
0.4901
0,0891 20,004
0.1002
0.1304
0.0853
04157
0.4505
0.5502
0.0908
0.1657 :9677
0.000
0.5202
0.5358a0m2
06015
0.6950
0.0000g00000
0.3203
0,2640gaoo1
0,3663
0.889_
0.2422.0014
0.2590ooon
0.1951
0.1947
25
0.2395
0,382120012
0.1103
0.2905 2001
0.2801
0.1709
0.2121 200010
RodAvg-DP
0,1900120011
0.4021 20014
0.461_00016
0.3268 20000
0.355910.0r
0.0653 20.005
0.212210018
0.005
0,5159
0,5318amm
200
04776
0.0153.0.00
0.3988
100
0.0000200001
0.7389
0.5301 10034
0.5883
0.0101 10,000
0.5015 100006
0.5013
0.2759
0.2593
0.393
0.438420016
0.213240:010
0.0638
0.4950
0.2805
0,2681
2000
0.4052
0,55220007
0.208540.010
0.0709 0.,06
Fairfee
2000
0.4451
200m
0
0.1505 200000
0.0953..00
0. 0,195240015
0.453
0.3859
20015
0.5085 10002
0 0.5598
0.1104
0.116600006
100
0,075330013
0.5801
0.5802.2003
044300...00
0,075330.000
0.2851
0.3826g30006
0,3016:0005
0.3882-0012
0.2636200100
0.2863
0.1382
0.1673.:0000
0.3458
0.31522a009
0.1027-0m3
0,3101
0.3057
0.1205 10,006
0.1854
PUFFLE
0.3682
0.4558-0m1
00011
0.3708
20.005
0.0128:0005
0,0957
0.1827
0.5782-n.22
0.125610022
0 0.5083 +0,023
0.0552+6.000 +0.005
0.3301 100.:9
100
0.0125
0.6250ga020
0,7208
0.5507
0,5005
0,0125
0.4708
0.1621
0.2332
0,2434
0.1939 10.000
0.1420_a..ox
0:2726100016
0.0807
42,00
20045
10.10
0.1658 20,005
0.1859 20.859
0001010007
(RESEL)
go2780
0,2872_aum
0.2601_a.11
0.2153
2a.0m
0.1201 2o.css
0.1208
0.310729013
0.3e05game
0:105ga0m1
0.3702-0.11
0.3557
10,014
0.1108
0 0,205
1001
0.1652.:0.15
0.4850gam4
0.515220016
0,4450
0.430N
0.0552
0.2993.0011
42


Reviews:
[{"review_id": "ziEvkokpP6", "reviewer": "Reviewer_6gjm", "summary": "This paper proposes RESFL, a composite approach in federated learning to balance privacy, fairness, and performance (utility). The proposed approach replaces softmax with an evidential head that yields calibrated epistemic uncertainty and uses a scale-invariant Uncertainty Fairness Metric (UFM) for aggregation. Evaluations, on two benchmarks, FACET and Carla, use mAP, |1-DI|, delta EOP, and membership/attribute inference success rate to show utility fairness and privacy. The results show that RESFL can maintain or gracefully degrade utility while preserving privacy and fairness.", "questions": "In the ablation study, when fixing the privacy weight and adjusting the fairness weight, a lower fairness weight results in a higher mAP, which is a bit counterintuitive. It would be helpful to give some insight into this. \n\nFigure 2 has a lot of information, which may warrant a bit more detail in text descriptions. For example, why does the privacy attack success rate and fairness score dramatically increase in the fog situation as the intensity increases?\n\nMinor, it would be nice to add an arrow after each metric indicating the lower the better or the higher the better.", "limitations": "", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "+ Evidential uncertainty modeling neatly fits in the framework\n+ Joint optimization over fairness and privacy\n+ Convincing results show tunable knobs and the intended tradeoff", "weaknesses": "- Figure layout could use some polishing. Both Figure 1 and Figure 2 are placed far away from where they were mentioned.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "xWj6Vpfn0w", "reviewer": "Reviewer_qpfy", "summary": "This work targets the challenge of achieving privacy, group fairness, and utility simultaneously in federated object detection. Existing approaches often rely on differential privacy noise that degrades accuracy or fairness, or require the server to access sensitive attributes for fairness optimization, and rarely exploit uncertainty as a signal for aggregation. To overcome these limitations, this work propose RESFL: a framework that (i) suppresses sensitive attribute information in client representations via adversarial privacy disentanglement with gradient reversal, and (ii) estimates epistemic uncertainty using an evidential (Dirichlet) head, from which a Uncertainty Fairness Metric (UFM) measures cross-group uncertainty disparity. The server then performs fairness-aware aggregation by giving larger weights to updates with lower UFM, without accessing any sensitive labels centrally. This design reduces privacy leakage at the representation level and aligns cross-group uncertainty at the aggregation level, jointly improving privacy, fairness, and utility. Experiments on FACET and CARLA show improved equality-of-opportunity fairness and reduced membership/attribute inference risk, while maintaining competitive detection accuracy; ablations and robustness tests further support the method.", "questions": "Can UFM be computed without sensitive labels? Please (i) clarify feasibility, (ii) add a robustness study for no/partial/noisy labels, and (iii) discuss proxy/unsupervised alternatives and their privacy implications. If not feasible by design, state this limitation explicitly.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1. This work tackles a fundamental and highly challenging issue in Federated Learning (FL): the trilemma among privacy protection, model fairness, and model utility. In standard FL, enhancing privacy (e.g., via Differential Privacy) often degrades both fairness and accuracy. This work aims to jointly optimize all three, addressing a key open problem in the emerging field of Responsible AI.\n    \n2. The proposed RESFL framework demonstrates strong innovation. It integrates two advanced components: (1) adversarial privacy disentanglement, using a Gradient Reversal Layer (GRL) to remove sensitive attribute information from local representations; and (2) uncertainty-guided, fairness-aware aggregation, which employs an Evidential Neural Network (ENN) to quantify model uncertainty and introduces a novel Uncertainty Fairness Metric (UFM). The server uses UFM to weight client updates, prioritizing those that are both “fairer” (i.e., have smaller inter-group uncertainty gaps) and “more confident.” This design allows the server to promote global fairness without ever accessing sensitive data.\n    \n3. The experimental design is comprehensive and well-motivated. The authors evaluate RESFL in the high-stakes autonomous driving (AV) domain using two challenging datasets: FACET (real-world demographic data) and CARLA (a simulator with environmental variations). The evaluation includes not only standard utility metrics (mAP) but also fairness measures (DI, EOP gap) and privacy metrics (MIA, AIA attack success rates). Importantly, robustness is tested under adverse weather conditions (cloud, rain, fog)—a crucial aspect for AV systems. Additional ablation studies and cross-domain evaluations (Adult, TweetEval) in the appendix further support the method’s effectiveness and generalization ability.", "weaknesses": "1. Computational overhead at clients is considerably higher than standard FL. Each client must train not only a backbone detector (YOLOv8) but also an adversarial classifier (GRL) and an evidential head (ENN). This “three-in-one” setup is far more complex than FedAvg. Although Appendix F reports training times (~8 hours on RTX 3070), such overhead may be impractical for resource-constrained edge devices (e.g., vehicles or mobile units). The paper lacks discussion on scalability—how the framework behaves when the number of clients scales to hundreds or when hardware heterogeneity increases.\n    \n2. The framework assumes access to sensitive attribute labels (e.g., skin tone) at each client. The GRL-based privacy module and UFM computation both rely on these labels for grouping local data. While the authors stress that these labels remain local and are never shared—technically compliant with FL privacy principles—many real-world applications (e.g., healthcare, finance) legally or ethically prohibit collecting or using sensitive attributes. The paper lists this as future work, but it remains a major limitation for real-world deployment.\n    \n3. The server relies on a single scalar (UFM) reported by each client to determine its fairness contribution and aggregation weight. Compressing complex fairness characteristics (possibly across multiple sensitive groups) into a single number inevitably loses nuance. Moreover, the approach assumes honest reporting: a malicious client could falsify a very low UFM to gain disproportionate aggregation weight. The paper does not discuss any mechanism for verifying UFM authenticity, leaving a potential security vulnerability in untrusted FL environments.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "0hBJTqHBG9", "reviewer": "Reviewer_8ZW3", "summary": "This paper proposes RESFL, an FL training framework designed to simultaneously improve three model properties: utility (defined as downstream performance), fairness (defined as group fairness across sensitive attributes e.g. skin tone) and privacy against inference attacks. To mitigate sensitive attribute leakage, the authors propose adding an auxiliary attribute classifier to the client's representation. The classifier is trained to predict the sensitive attribute and the reverse of its gradient is added to the feature extractor, with the net effect of the extractor learning to hide the sensitive attribute so that attribute-inference attacks see a random signal in the representation. The guarantees stated are not in terms of DP but stems from reducing the MI between the representation and the sensitive attribute. The strength of this effect is controlled by a hyper-parameter of the corresponding loss component $\\lambda_{priv}$. Simultaneously, to address sensitive confounding factors such as skin tone leading to higher false-negatives rates in difficult cases (e.g. driving at night), the authors employ evidential learning to boost contributions from clients with lower inter-group disparities. This is done via a Dirichlet head, the outputs of which are shaped into per-client “Uncertainty Fairness Metric” (UFMs) that then modify the aggregation weights via a temperature-scaled exponential.\n\nThe proposed method is benchmarked on two datasets, FACET which tests contains real-world images with instance annotations for people (and skin tone labels) and is meant to test algorithmic fairness, and a simulated dataset (produced using CARLA) containing self-driving ego-camera frames, which contain at least one pedestrian. Metrics reported include mAP, two fairness metrics, and inference attacks success rate. The presented results show improvement across the board, and the authors claim domain-agnosticity.", "questions": "Q1. Attribute availability: In which application domains do you expect client-side sensitive labels to be available? Could you elaborate on the future directions (attribute-free proxies, vacuity/dissonance) and how partial label scenarios (noisy/missing S) would degrade performance? See also W1\n\n1. Can the authors justify the evaluation set construction for the CARLA-produced dataset? It seems counter-intuitive to include as many clear weather frames as with full adverse weather intensities.\n\n2. Have the authors conducted a sensitivity analysis over the arbitrary choices of T=100 communication rounds and E=1 local epochs?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The paper addresses an important problem in FL, jointly managing performance, fairness, and privacy. The proposed mechanisms are cohesive, practical, well-motivated, and appear empirically effective, thus forming a principled technical approach. The experimental design is thorough, including multiple baselines, attack scenarios (MIA, AIA, Byzantine, data poisoning), robustness tests under weather variations, and ablation studies. There is great experimental rigour and breadth (albeit a lot of it buried in the appendix) that the authors have the right to be proud of. The paper is generally well-written, easy to read and with good pacing.", "weaknesses": "1. Requirement for sensitive attribute annotations. The method presented requires sensitive attribute labels which are hard to procure. I can't see how either of the two components would function without them. The authors seem aware of this limitation and hint towards potential avenues to ablate this requirement, but currently this is a significant limitation. See also Q1.\n\n2. There is a lot of very relevant detail in various parts of the appendix. Were I to not look at it, my score would be lower. For example the main paper results are limited to only 4 IID clients. On the other hand, it is my opinion figures 2 and 3 do little to advance the paper. Perhaps consider moving parts of appendix F to the main paper.\n\n2. **$\\beta$ sweep**:  Could you add an ablation where $\\beta$ is swept (including $\\beta=0$) to quantify the marginal contribution of UFM-guided aggregation independent of the local uncertainty loss? There is brief discussion a value of 2 was chosen after a grid search but no results to gauge sensitivity to this parameter.\n\n3. Computational overhead is listed as a defficiency of relevant work, yet there is no mention of the overhead RESFL occurs.\n\nMisc\n\n- DI/EOP are not introduced in line 168.\n- Epistemic uncertainty in the context of FL has been previously proposed in other works (e.g. **FedEvi** https://papers.miccai.org/miccai-2024/paper/2717_paper.pdf). I believe it would be relevant to include these works in the related work discussion.\n\nI will defer to other reviewers with respect to details about the attack models and related claims as my expertise on this specific topic is limited.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "l2SNOcEhzv", "reviewer": "Reviewer_5t55", "summary": "The paper proposes RESFL, a method for privacy-preserving and fair object detection in federated learning (FL). The main idea is to optimize a composite loss on client-side, with separate terms for utility, privacy (essentially minimizing mutual information between the feature extractor output and sensitive features), and fairness (minimizing group-wise disparity in uncertainty). On the server-side, the proposed method uses averaging using weights derived from the client-specific uncertainty values. The proposed method is compared to several baselines (mostly) on FACET and CARLA datasets on several metrics: utility (mean average precision), privacy (membership inference & attribute inference attacks, MIAs, AIAs, respectively), fairness (disparate impact, equality of opportunity), and robustness (poisoning).", "questions": "## Questions and suggested changes, in decreasing order of importance:\n\n1) Please provide sufficient experimental details to evaluate the results: clarify how all hypers are tuned (eg all grids, do you do separate tuning for each method including the baselines), add some error bars to the results, clarify why recall is the one chosen metric for calculating DI/EOP or does this make a difference, clarify what does it mean in practice to use per-client training time of 8 hours (lines 1137-38), does this imply that some methods are terminated before hitting the same number of total training rounds as others; clarify how model finetuning is done (eg, is this all params, last layer only or something else), clarify how much heterogeneity the chosen Dirichlet allocation produces in the non-IID setup (and why do all clients have the same number of samples even in non-IID setting?).\n\n2) Clarify how exactly MIA and AIA are done (eg, do you assume the adversary has access to some data from the same distribution or how do you train a model to predict sensitive attribute values from the model updates; following Carlini et al. 2022: MIA from first principles arguments, MIA is typically reported as TPR vs FPR, can you show these in addition to just the success rate; if the adversary can train shadow models, why not use eg standard LiRA attack from the Carlini et al. paper with loss values; how many shadow models do you actually use)\n\n3) Which $(\\varepsilon,\\delta)$ values are used for each of the DP baselines, why are these specific values chosen, and how is the privacy accounting done for each of the methods (at least some parts of the code seems to use the classical Gaussian mechanism noise scaling that can be very loose and has limitations on possible $\\epsilon$ values)?\n\n4) For several of the baselines (eg, PUFFLE, FairFed) you need to choose a specific fairness metric to optimize. Which one do you use?\n\n5) Looking at the gradient_dp_custom_trainer.py code, it looks like you might not be clipping per-example grads but the aggregate. Can you clarify if this is so for the DP baselines, and state the corresponding threat model explicitly (also in the paper: state the DP adjacency and granularity you use for the baselines).\n\n6) Some of the provided code (CHFL_train.py) seem to do eg quantization before FedAvg, and client clustering functions, which are not mentioned anywhere in the paper. Can you clarify if these are used somewhere in training, and add all the relevant training details at least in the Appendix.\n\n7) Considering the jump from Thm B.1 & Cor B.2 (which do not explicitly consider FL setting) to the claims on lines 165-171: can you write this step to FL out more formally to make it clear what do you actually claim about the connection of locally optimizing UFM to reducing global DI/EOP gap (ie, move from local optimization to global fairness)?\n\n8) On finetuning with local data: do the DP baselines do DP also when finetuning with local data?\n\n9) Eq.(6) and lines 185-86: is there something that prevents giving high weight to a client with equally low confidence for all groups?\n\n10) Why is robustness one of the performance metrics (the paper says next to nothing about robustness on any level before the experiments)?\n\n11) Lines 889-92: \"We compute $UFM_i$ per client on a held-out local validation split...\" please clarify how this splitting is done (do you assume a separate dataset, split the local training data for the proposed method or something else).\n\n12) Lines 897-98: \"Model updates $\\Delta \\theta_i$ continue to use secure aggregation...\" do you actually use secure aggregation for something?\n\n13) Do you apply same augmentation for non-DP and DP methods, and how do you do clipping with augmentations (see eg De et al. 2022: Unlocking high accuracy... for a good discussion on how augmentations affect DPSGD, and how it should be implemented)?\n### Smaller issues (no pressing need to comment on these, ok to just clarify in the paper when appropriate)\n\n14) Eq.(2): does $\\sim$ mean approximately here? Is the lhs otherwise exact epistemic variance or is that also an approximation?\n15) Lines 83-90: we know from Dinur & Nissim 2003 that there is an inescapable privacy-utility trade-off; any method (not just DP) that guarantees non-trivial privacy needs to compromise on the utility. DP and secure computation are orthogonal, not alternative approaches as they have very different goals.\n16) In several places, eg, lines 647-48 it is claimed in so many words that FL maintains privacy. If this were true, we would not need something like the proposed method but could just use vanilla FedAvg.\n17) Lines 48-49: \"Quantifying both epistemic and aleatoric uncertainty is therefore essential to ensure equitable reliability across demographic cohorts\". Do you actually try to quantify aleatoric uncertainty?\n18) Lines 140-141: does the regularization provably lead to calibrated uncertainty estimates, or is this more empirical observation?", "limitations": "", "rating": 2, "confidence": 4, "soundness": 1, "presentation": 2, "contribution": 2, "strengths": "* Empirical results seem quite nice (although see more detailed comments on this also under Weaknesses & Questions)\n* Focus on object detection seems interesting,: as far as I know, this direction has not been too much explored under privacy and fairness constraints.\n* Using uncertainty gap for fairness mitigation is, to my knowledge, a novel contribution.", "weaknesses": "1) The writing could be clearly improved; eg, the main learning problem as well as several acronyms are only introduced in the appendix (or not introduced at all), some notations are used in more than one sense, there is no explanation why the performance metrics include robustness to poisoning when the stated objective is to guarantee privacy and fairness, etc.\n\n2) Much of the experimental details needed to make sense of the results are missing (see Questions for details).\n\n3) There might be some implementation problems at least for some of the baselines in the provided code, although it is hard to be certain as the scripts used for actually generating the results are missing (see Questions for details).\n\n4) There are plenty of inaccurate or unsubstantiated claims in the text (see Questions for details).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)