Personalized Subgraph Federated Learning with Differentiable Auxiliary Projections
Authors: Wei Zhuo
Zhaohuan Zhan
Han Yu
Venue: NeurIPS 2025 poster ()
Keywords: Graph Neural Networks
Federated Learning
Node Classification
Graph Representation Learning
Primary area: deep_learning
TL;DR: A personalized subgraph federated learning framework that learns inter‑client similarity on the fly, enabling adaptive, client‑specific aggregation at the server.

Abstract: Federated Learning (FL) on graph-structured data typically faces non-IID challenges, particularly in scenarios where each client holds a distinct subgraph sampled from a global graph. In this paper, we introduce **Fed**erated learning with **Aux**iliary projections (FedAux), a personalized subgraph FL framework that learns to align, compare, and aggregate heterogeneously distributed local models without sharing raw data or node embeddings. In FedAux, each client jointly trains (i) a local GNN and (ii) a learnable auxiliary projection vector (APV) that differentiably projects node embeddings onto a 1D space. A soft-sorting operation followed by a lightweight 1D convolution refines these embeddings in the ordered space, enabling the APV to effectively capture client-specific information. After local training, these APVs serve as compact signatures that the server uses to compute inter‑client similarities and perform similarity‑weighted parameter mixing, yielding personalized models while preserving cross‑client knowledge transfer. Moreover, we provide rigorous theoretical analysis to establish the convergence and rationality of our design. Empirical evaluations across diverse graph benchmarks demonstrate that FedAux substantially outperforms existing baselines in both accuracy and personalization performance. The code is available at [https://github.com/JhuoW/FedAux](https://github.com/JhuoW/FedAux).

Personalized Subgraph Federated Learning with Differentiable Auxiliary Projections
Wei Zhuo', Zhaohuan Zhan', Han Yu Nanyang Technological University, "Shenzhen MSU-BIT University {wei. zhuo, han.yu)@ntu hyt)entteedu........... edu.sg, Zzhan. z0smbu. edu. cn
Abstract
Federated Learning (FL) on graph-structured data typically faces non-lID chal- lenges, particularly in scenarios where each client holds a distinct subgraph sampled from global graph. In this paper, we introduce Federated learning with Auxiliary projections (FedAux), a personalized subgraph FL framework that learns to align, compare, and aggregate heterogeneously distributed local models without sharing raw data or node embeddings. In FedAux, each client jointly trains (i) local GNN and (ii) learnable auxiliary projection vector (APV) that differentiably projects node embeddings onto a 1D space. A soft-sorting operation followed by a lightweight ID convolution refines these embeddings in the ordered space, enabling the APV to effectively capture client-specific information. After local training, these APVs serve as compact signatures that the server uses to compute inter-client simi- larities and perform momilarrty-weighhee parameter mixing, yielding personalized models while preserving cross-client knowledge transfer. Moreover, we provide rig- orous theoretical analysis to establish the convergence and rationality of our design. Empirical evaluations across diverse graph benchmarks demonstrate that FedAux substantially outperforms existing baselines in both accuracy and personalization performance. The code is available at https://gituub.com//uuo// W/Fe///uu
Introduction
Real-world data often manifests as relational structures, ranging from social interactions 30 46
and financial networks (28 45) molecular graphs [35 44 whose scale and privacy constraints increasingly require training to be carried out in a federated manner [2], whereby multiple clients collaboratively learn Graph Neural Network (GNN) model without exchanging their raw data. However, applying federated learning graph-structured data, such social networks, faces severe challenges due to ii-iddentically and independently distributed (non-lID) data across clients. For example, consider federated learning scenario involving multiple regional social networking platforms, each representing a distinct subgraph a global social network. Users within each region exhibit unique interaction patterns and distinct interests, resulting in significant heterogeneity in local graph structures and node attributes. This inherent diversity among subgraphs leads to substantial difficulties when attempting aggregate local GNN models into unified global model, traditional typically assume homogeneous data distributions across clients.
FL algorithms
(20 [4]
To tackle the non-lID challenges inherent in subgraph federated learning, personalized FL (29 has recently emerged as a promising paradigm, which aims to provide client-specific GNN models rather than enforcing universal global solution. Existing personalized subgraph FL approaches commonly achieve personalization by clustering clients on the server side, necessitating a reliable measure of client similarity without direct access client-side data. In this work, impose even stricter privacy constraints: neither raw data nor embeddings are shared, and only model learnable parameters can be exchanged. Although the server could compare clients by directly measuring similarity between their
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Local Learning in Subgraph Clientss
Server-side F Federated A Aggregation
Aucilar Prtjctioos
Cliert
Client Similarity Malrix
K
6
(((-1)
Ciient
Server
Global
APV a
GNN
Cllent X
a
a
[x
1 JE
Update Global Parameters
Figure The overall framework FedAux. Left: The server maintains a global GNN model together with learnable auxiliary projection vectors (APVs) that are broadcast to all clients at the start of each communication round. Middle: Clients jointly optimize the GNN and APV during local training, where the APV projects node embeddings onto a ID dx-Space that positions related nodes closer together. Right: After local training, clients transmit their optimized GNN parameters and personalized APVS the server. The server computes client similarity matrix by comparing the learned APVs. which captures the heterogeneity across subgraphs without accessing raw data. These similarities determine personalized aggregation weights. At the end of each round, the updated global parameters are broadcast for the next communication round.
parameter matrices uploaded, the high dimensionality of these matrices makes such metrics unreliable under the curse of dimensionality (4. Recent improvements have proposed measuring similarity by comparing communication--eve parameter gradients (35) or generating a common anchor graph on the server as a neutral testbed (3). Although these strategies mitigate some limitations, they remain largely heuristic and do not explicitly model the heterogeneity inherent in subgraph clients (See extended discussion in Appendix(A)
Motivation Our key insight that a compact, low-dimensional proxy, derived directly from the faithfully summarize local subgraph characteristics without leaking sensitive node features or embeddings. Such a proxy remains compact enough to avoid the pitfalls of high-dimensional similarity measures, yet expressive enough to reflect meaningful differences between clients. By learning this proxy jointly with the GNN parameters in each client, and using to guide both local adaptation and server-side aggregation, we obtain a principled, mechanism for personalization that directly leverages model parameters as stand-in for subgraph information.
client's model parameters,
Contribution this work, we propose FedAux, which employs differentiable auxiliary projections to effectively capture and exploit client-specific heterogeneity for subgraph FL. As illustrated on the left of Fig. | the server stores not only a global GNN but also a learnable auxiliary projection vector (APV) that accompanies the model parameters. At the start of the first communication round, the server broadcasts the global GNN and the current APV to all clients. Each client projects its node embeddings onto the APV, which is treated soft-sorting operator then orders the projected embeddings by similarity, after which a simulated ID convolution aggregates the sorted embedding sequence. The aggregated representations drive supervised loss that simultancously refines the local GNN and the APV, so that the optimized APV preserves the relational structure of the client subgraph. Upon completing local training, clients send their updated GNN weights and personalized APVs back to the server. Since the APV reveals only the latent space that best preserves local node relationships while concealing the exact position of every node in this space, it acts as a compact privacy preserving summary of the client subgraph. Then the server computes similarity among the returned APVS to quantify inter-client affinity and yields client-specific aggregation weights. The server uses these weights to combine the incoming parameters, producing personalized model for each client that respects both shared knowledge and local subgraph idiosyncrasies.
oie-dimensional latent space. A differentiable

---

Furthermore, we establish comprehensive and rigorous theoretical analyses that justify the soundness and interoperability of every technique used FedAux. Extensive federated node classification experiments on six datasets, spanning diverse graph domains and client scales, demonstrate that FedAux achieves better accuracy and stronger personalization than state-of-the-ar personalized subgraph FL. baselines.
2 Problem Statement: Subgraph Federated Learning
In Federated Learning (FL), multiple clients collaboratively train global model without exchanging their raw data. In the subgraph federated learning setting, each client holds subgraph of a larger graph. Formally, let graph 9 be partitioned (or subsampled) into K subgraphs {G1, -2.... Gk as K clients, where G2 = (Vz, Ex, Xx. Yε). Here, V2 {vK,1. k-th subgraph with N₂ |V& nodes, Eg the set of edges among those nodes, X E IR Nx xd the node features, and Yx the labels relevant the learning task. In our FL scenario, each client G, has access only to its local data (i.c., its subgraph structure, node features, and labels), and there is no sharing of raw data or any node embeddings between clients.
Uk,N, } is the set of nodes in the
typical GNN Ja, (G&) parameterized by 0g is employed to produce node emheddings and ultimately generate predictions on the client Gg. In standard federated learning setting such as FedAvg [20], one aims to solve the global objective: ming Σ 04 (O), subject to the privacy constraint that raw local data Ge never leaves the client side. A common choice is to weight client Gj. by 0% /N/ N,) simply 04 1/K. The iterative procedure proceeds follows. First, the server initializes ((0) At each global communication round & E (1,.... .T)................... it sends ((t-1) to each client. G₁ then updates ((t-1) locally by taking a few stochastic gradient steps on (+) to update the parameters 0g 0x V,, which produce Gs's 's optimal local parameters o( After the t-th local training, all clients' locally updated parameters (0(") of are sent back to the server, which aggregates them via a weighted average (00) Σk= 0.00 The newly aggregated global parameters g(t) are then broadcast back to each client for the next communication round. When the process converges or reaches a designated number of rounds, the final global parameters ((2)) are taken the parameters of the GNN model on the server.
3 Methodology
In this section, we introduce the proposed Subgraph Federated Learning with Auxiliary Projections (FedAux) framework, designed to address the heterogeneity across local subgraphs in federated learning. Fig. [illustttttt an overview of FedAux. Our objective is twofold: 1) Each client locally encodes its subgraph into a one ane-dimensional space via a learnable auxiliary projection vector APV, and 2) the server then exploits these auxiliary vectors to realize personalized aggregation.
3.1 Client-Side Local Training
Before the first communication round t = alongside the GNN model parameterized by 8(0), the server also maintains a learnable APV (9) E IRd"" During each communication round I, the server distributes (0(t-1), (t--))
(o(t-1),a(t-)) to initialize all clients' local model {(o(²-) at D)
(olc-1),at (((-))))((-1))) For client Gr, it runs the local GNN model to optimize the node embeddings:
(b-1)) H (t-1) fo f (Gx) = [ k. 22,2 ,.. "K,N, E Naxd'
(t-1) (t-1)
(1)
where d' is the output dimension of node embeddings. Given the local APV a (t!-)), we first normalize all node embeddings so that all embeddings are compared on a consistent scale as
(t-1) (t-1) max, [| (t-1)) "II Then the similarity between node UAs and at ((-1) is defined (t-1) (t-1) a (t-1)), where (+-)) denotes the inner product in Rd", Intuitively, $k can
(t-1)
as $,,
be interpreted as the coordinate of each node Uk,i in ag as-space, which is ID line. Since al (1-1) is itself learnable, the client G3 is adaptively refining this space to capture relationships among its node embeddings more effectively.
3

---

Next, G₁ collects the similarity scores Sk 1/11) = { ,
,,.,, , )
and sort them in non-
decreasing order. Let x be the permutation that orders these scores:
(1) (2) S ... ((-1)
((-1) (t-1)
(2)
(N,))
where (J) represents the node index rank j. Accordingly, we apply this permutation Ty the row indices ! (1( which yields the sorted embedding matrix az (t-1)
as:
H H
(- (1)) (2)) TM (N,))(Na)
(3)
which aligns node embeddings according to their coordinates in the ax-space. As shown Fig. 2
(t-1)
(t)
during local training, the node embeddings and the
le
a
Jc
structure the ag-Space are jointly optimized so positioned
that nodes with stronger relationships closer along this learned space (in G₃ comprising two triangles, nodes within the same triangle should be proximate in the ag-Space). In other words, the objective of the local model is adaptively reshape the APV so that the induced node sorting effectively captures the local data information.
Local Training
Ge
Figure 2: The local training of FedAux aims to map all nodes in G5 to a corresponding ag-space, and the optimization objective to learn the APV ag. such that the resulting ag-space preserves the optimal node sorting.
Under the semi-supervised setting, the node sorting on APV can be adaptively refined under the guidance of the downstream task. Thinking of each h (, as
a feature vector in a ID sequence H (t-1) iinsppred by 18] we can apply ID convolution with a (t-1) fixed kernel size B over H (t-1) as Conv1D ( (2) (Na) ). More specifically,
(t-1)
for each node (t) in the sorted sequence, the convolution can be written as:
[B/2]
(t-1)
Σ
k.7. + b,
(()
T= [B/2]
where W, E RRdd xd' are learnable convolution kernels for offset r, and is a bias term. Convolving around (1) in Eq. (4) amounts to a proximity-basee aggregation in the ag-space, where each embedding is updated by aggregating information from its neighbors along this learned ID sorting. Hence, the quality of this sorting significantly impacts the aggregation effectiveness. Intuitively, nodes with stronger semantic relationships or similar labels should appear closer together in this learned sorting. We can formulate the learning objective to explicitly optimize the sorting induced by the APV ag, ensuring that the resultant sorting facilitates effective aggregation and improves downstream predictive accuracy. Consequently, we formulate the learning objective:
(0,, az. F argmin C (CLF (ConvID ( (E)) .Yx
(5)
,2, 1r
where 4x denotes the full set of parameters for Conv1D and the subsequent classifier CLF that maps node embeddings to final logits. Through this objective, we explicitly encourage ax-space to yield an optimal node sorting, enabling the convolutional operation to effectively capture and leverage
(t) localized, label-informed relationships, thereby the optimized APV d aj accurately preserves and encodes the local node relationships specific to each client.
However, a% does not directly participate in the loss defined in Eq. (5) in a way that enables standard backpropagation update it. because the role of a is limited generating similarity scores, which in turn determine the input order to the Conv1D layer. Thus, a only affects the network's s output by reordering embeddings, which is a purely indirect pathway that does not produce gradient signal for from the downstream loss. [8] attempted to mitigate this by multiplying each node embedding by its similarity score and then sorting. While this modification integrates ag into the learning pipeline directly, the hard discrete sort persists, causing the gradient signal that could refine ag to be still routed through a non-smooth transformation. Hence a still cannot be fully optimized to reorder embeddings based on loss feedback, leaving the core issue unresolved.

---

To eliminate the hard-sorting bottleneck, we propose a continuous aggregation scheme over the a apspee Rather than ranking or discretizing these similarity scores, for each node V/ we (t-1)
define a continuous kernel k(5k,e , _skk which could be a simple Gaussian-like function
Kij <(6,,1 ,Kk ")
(t-1)
exp (-($k, ( Sk.
-skj 1)2")))/0)) with bandwidth
0, measuring
how close v is to in the real line spanned by [s.-") As shown in the right part of Fig. then obtain an aggregated embedding for each node vs by a smooth weighted sum of all node embeddings:
N₂
No.
(t-1) k,
1
K
(t-1) k,
( : Skj
" M
K
k. ")
(6)
M
Unlike discrete sorting, this continuous aggregator is fully differentiable with respect to ag, because changes in ag smoothly shift each & ki
(t-1) and thus adjust the kernel weights k. This approach
naturally learns to group nodes with similar & (t-1) values, emulating the sorted ID convolution effect, while sidestepping the gradient-blocking issues that arise from hard-sorting steps.
To jointly train the GNN parameters 0g and the APV ak we associate each node 2/ with two ((t-1) embeddings: Ai (t-11) produced by the GNN defined in Eq. (1) and #k.i generated via our kernel- based aggregation method as Eq. (6). We then concatenate these embeddings to form e;'s final embedding Tiis 1
1121(11) J. which is fed into a simple MLP classifier CLF(() to produce (t-1), logits for the cross-entropy loss La N₂ CF(CLF(TTT 1), Vi.), where ((--1) = [rk, 1=---
(t-1) [b(,T-1) ||
3.2 Server-Side Federated Aggregation
At the end of local training for communication round f, each client G2 transmits its optimized parameters (0( - ((-1)) to the server. In doing so, only these high-level parameters are exchanged, rather than gradients or node embeddings, thereby limiting direct leakage of private subgraph information. Note that aş serves as the optimal subspace for capturing node relationships, how individual nodes map into this space (and thus the precise relational details) remains unknown to the server. This design strictly adheres to the fundamental FL. principle that Data stays local; only model updates leave.
Since the data distributions across clients can be non-llD, the server is expected to personalize the aggregation for each client. Given that each a (t-1) can be descriptor of how node embeddings in G3 are arranged and structured, the similarity between two clients G3 and Gi can be measured via
(a
the cosine similarity of their APVs: SIM(a (t-1) , .a (t-1) = 11
We then convert this
similarity into a weight:
(ASIM (ag (t-1) ai a(-111)
exp
(t-1) 3.1
ΣK exp aSSMM (a (t-1) ar )
(t-1) reflects where a > 0 is a temperature controlling the sharpness of the weighting distribution. w how much client Gş should incorporate the update from G,. By emphasizing contributions from similar clients (i.c., those with high similarity in their APVs), each client's 's final model can better handle heterogencous data while reducing interference from dissimilar clients. Instead of averaging all local parameters into one single global model, the server compute a personalized aggregation of parameters for each client G as:
K w
wki [1-
(1-1) 11-1) k. ai
(8)
Thus, after the server performs these personalized aggregations for both 0 and a, it transmits (o(", (a) back to client G3 for the (t + 1)-th communication round starting point. Appendix shows the pseudo code of FedAux.
5

---

Complexity Analysis For the client side of FedAux, the local GNN embedding generation incurs a complexity of ([E and the auxiliary projection from embeddings the APV results in ((Ned". Besides, the kernel-based embedding aggregation over the 1D) space induced by the APV has complexity O(NEd). Consequently, the per-client complexity O( Fig |d' + Ngd"). On the server side, computing the client-wise similarity for personalized federated aggregation involves a complexity (') Therefore, the total complexity of FedAux per communication round is O (((Ex) + N3 + K2) )²)d").
3.3 Theoretical Analysis
For notational simplicity, we focus on a single client with N nodes in a given communication round and omit the subscript & and superscript (t- - 1). The core of our model is to use learnable auxiliary projection vector APV a to capture an optimal node sorting of the local node embeddings and thus serves as compact summary of the subgraph. However, there is foundational question that inevitably arises once we replace hard sorting with the smooth kernel aggregator: when the APV a is learned via poop-propagttion, what does it actually learn? Does it encode an arbitrary nuisance direction, or does it converge to a geometrically meaningful axis that faithfully summarizes the local subgraph? To answer these questions, we analyze the fidelity of the APV with the following theorem.
Theorem 3.1 (Fidelity of the APV a). Let C == TV Ei= high be the empirical covariance of node embeddings in the current client with size N. The gradient of the local loss L w.rll the APV a. satisfies:
- 0²
vac= Ca RR+))
(9)
where the remainder term obeys [|((o))] = -(00) as + 0+ Define sd-1 fo E R ||=||2 = 1} as the unit Euclidean sphere embedded in IRd, then the gradient descent on L with unit-norm re- normalization reproduces Oja learning rule (22V:
a t (a- CCa).
(10)
whose unique stable fixed points are the eigenvectors of C, and the global attractor is the principal eigenvector (largest eigenvalue).
The proof and more discussions are provided in Appendix C.I It guarantees that, once the kernel aggregator makes a differentiable, ordinary pack-propagation forces APV to align with the direction along with the node embeddings in that client vary the most. Equivalently, the APV a is not an arbitrary trainable knob but statistically optimal, variance maximizing summary of local embeddings. Thus, the APV a is provably the first principal component of the local embeddings.
In Section 3.1 we propose continuous kernel aggregator to replace the hard Pur-then--Cnvlle pipeline used in earlier work [8]. To justify that replacement, the following theorem rigorously shows that the new smooth operator degenerates to the old one in the appropriate limit.
Theorem 3.2 (Sorting limit and equivalence to ConvID). Let 2; be the kernel- smoothdd embeddings. and gather them in score order = [>=(1); ... (=)))] E Nxd' The original sorted embeddings
H (hx(t))""" (n((N) is defined in Eq. (3) Let W BB8xdd be an arbitrary fixed ConviD
kernel with zero padding, and denote Convw(X)), = E W [B/2], for any sequence X E Nxd'' Then we have:
lim ++
Convw
Convw (H) = =0,
(1))
where || -|e is the Frobenius norm.
The proof is in Appendix C.2 Theorem 2 indicates that the kernel aggregation followed by ConvlD converges to hard- followed by ConvlD as the bandwidth or tends to O. Hence, the two architectures have identical expressive power up to an arbitrarily small error for sufficiently small a. Although the limit a + 0+ recovers discrete sorting, a larger o performs a soft neighborhood pooling that can act as a learnable regularizer against over-fitting noisy local orderings. In practice, we find o = 1 to be effective across all datasets.
Next, we present theoretical analysis of FedAux's convergence rate, which guarantees that it cannot diverge in expectation. Since this analysis focuses on the global model, we use the subscript i to denote the client index.

---

Table 1: Federated node classification results.
The reported results are the mean and standard deviation over three different runs. Best performance is highlighted in bold.
Cora
CiteSeer
Pubmed
Methods
Clients
10 Clients
20 Clients
Clients
10 Clients
20 Clients
Clients
10 Clients
20 Clients
Local
a1.30
29
80.30
69 02:40ss
67,822a1s
65.98
84.04ga.1
82.8 a
82.65-ow
FedAvg
74.45
69.19
6..50
FL06
63.61
64.68+1a
79.40=am
82.71
80,97
FedProx
72.03
60.1817M
48. 22 (m.
71.73
63.
64.85
79.451a2s
82.55
80,50 022
FedPer
81.68ga4
79.35
g8
70.53gem
66.64
85.80ga
84.20
84,72_.91
GCFL
81.47
78.661417
79.21
70.34
69.01
66.33
85,14
84.18
83,94_0x0
FedGNN
81.51 gave
70.12
70. 10
69 16.601
55.52g
52.233
79.522a3
83.25
$1.61_0%
FedGTA
71.26
68.33
69, 24-22-
69 .9.
67.34=1
65.29
78.47
82.79
81,92=00
FedSago+
72.97
69.05
-7.97=12
70.74+uu
65.63-1.0
65.46
79.57
82. 62.62++u
80.82
PED-PUB
83.72
12
81. g0
32.40
71. 71.83
26.89
86.09
84.66-054
FedAux
84.57
82.05
81.60_a44
72.99.00:
73.16_e.
68. 10.as
88. 10
86.43
84.87_
Amazon-
Amazon-Computer Computer
Amazon-Photo
ogbn-arxiv
Methods
Clients
10 Clients
20 Clients
Clients
Clients
Clients
Clients
Clients
Clients
Local
89.22
88.91
89.52-oa
91. +mmm
91.00=oc
90.47
66.76eam
64.92+am
65,06-ee
FedAvg
84.88
79.54
74.79_
89.89 1os:
83.15
81.35
65.54
64.44.4m
63.24_.om
FedProx
g5
83.81 23
23.05_1.
90.38
80.92.
82.32
65.21
64.37
63.03_oo
FedPer
89.67
89,73
87, 27.86
91. 44
91. 11.6
90.59
66.87
64.99
64.66=e1
GCFL
89.07=am
90.03
89.08
91.99
92,06-12x
90.79
66,80es.1
65.09+aus
65.08
FedGNN
88. 28.
88. 18
16
90 20
12:2mmm
81.002a4s
65,47
64.2
-3.80
FedGTA
85.06
84,27+am1
79.46-uuz
89. 00.70
76.53=321
82.02
65.42
64. 64,22+aus
63,75=ma
FedSage+
85.04
80,50
70.42.uws
90.77
80.58
65.69
64.52
63.31
FED PUB
90.25
89.731ax
88,20_o18
93.20
92.46_e.
90.59.44
67.6218
66.35
63,90_.or
FedAux
90.38
89.92:a.s
88,35
93.37
92.30
90,91:aa
68.83
68.50
65,52=110
Theorem 3.3 (Global linear convergence). Let v10) = (0(.) a be the local parameters of client Gk
at the communication round t, and (t()) = (v(0) .... (00) collects all local parameters. Assuming
1) every local objective is L -smooth: VRR V. [[V vL2 (WWIl S
& - V/ll: |:; 2)
the stochastic gradients are unbiased (EE [gn.] = V(x) and variance-bunnded (E |19x - 1x -
(²), where gke := (( means the local gradients; 3) each local objective satisfies the μ-PL condition (23]: 4) let (2(t)= = wolille. E RR the spectral gap p := sup, (2()) 1 11 T 1.
K
Let each client perform Q local updates per round, and the learning rate 0 < S 22 initial parameters (1))= (0(0), a ()),, have:
With any
EE [ (V(0)) c.] S ( (1-Tp) (c (c(w0))-'))
n
21
(12)
2/x
M(l p(1-p)2²
where C(V): ΣK == (M)) is the global objective with client sampling probability Pk (w.l.o.g. Pi is the weighted optimal value.
- Pi
Pk= = 1/K). L=
The proof is in Appendix C..3 In Theorem 3.3 the first term decays linearly; the second is the
classical SGD variance term; the third is the personalization error and vanishes as - 0. Thus FedAux can linearly descend to neighborhood of the global optimum.
4
Experiments
4.1 Experimental Setup
Datasets and Experimental Settings Following previous works 44 3
we construct dis- tributed subgraphs from benchmark datasets by partitioning each original graph into multiple sub- graphs corresponding to individual clients. Specifically, we perform experiments on six widely used datasets, including four citation networks (Cora, CiteSeer, Pubmed [25], and ogbn-arxte arxiv (10) and
two product co-purchas purchase networks (Amazon- -ompuut and Amazon-Phoot [9 26 ). We employ METIS [2] as our default graph partitioning algorithm, which allows explicit specification of the desired number of subgraphs without overlapping. Based on these datasets, we follow the standard
experimental setup used in personalized subgraph federated learning literature 3 42). Specifically,
7

---

13
13
08
3.8
68
Clecstc
10
Clestic
Cleats
988
B4
22
64
02
62
1.10 14
10
(a) Embedding Similarity
(b) APV-based Similarity
(c) Weight Similarity
(d) Functional Similarity
Figure 3: Client similarity based on different measures. Darker colors indicate higher similarity.
for dataset splitting, randomly sample 20% of nodes from each subgraph for training, validation, and testing, respectively. The only exception is the agbn-arxiv dataset, due to its signif- icantly larger size. For this dataset, randomly select 5% of the nodes for training, half of the remaining nodes for validation, and the rest for testing. Dataset statistics and implementation details can be found in Appendix
Baselines FedAux is compared against several representative federated learning (FL) methods, including general FL baselines: FedAvg (00), FedProx [14), and FedPer [2] as well as specialized graph-based FL models [ Additionally, we consider a local variant of our model (Local), where FedAux is trained independently at each client without parameter sharing.
GCFL [35]. FedGNN (34], FedGTA [16), FedSage+[40) and FED-PUB 3
4.2
Main Results
Table 2: Degree of non-IIDness. Pubmed ex- hibits the lowest non-IIDness, and Amazon- Photo has the highest.
As summarized in Table FedAux is the only algo- rithm that wins every dataset-client-count combi- nation, indicating that the APV-driven personaliza- tion generalizes from small citation graphs (Cora, CiteSeer) to large-scale, high- nigh-dimensional graphs (ogbn-arxiv). Specifically, relative to the strongest competitor in each column, FedAux achieves curacy improvements ranging from 0.2% to 2.4%. The margin over the canonical FedAvg is more pronounced, with an average gain of 4.5%, un- derscoring that the proposed auxiliary projection mechanism confers benefits well beyond classical weighted averaging. Further, to quantify statistical heterogeneity (i.e., degree of non-IIDness),
Pubmed
Non-IIDness 5 Clients
10 Clients
20 Clients
0.1316
0.1500
0.1725
Amazon-Phote
Non-IIDness 5 Clients
10 Clients
20 Clients
0.3398
0.3668
0.4307
adopt = JSD + MMD where the Jensen-Shannow Shannon Divergence (JSD) captures -istr-distribution skew and the Maximum Mean Discrepancy (MMD) captures disparities subgraph structure (formal definition in Appendix D.3). Higher values of indicate stronger -on-IIDeess. As reported in Table 5 of Appendix [D3]] rises monotonically for every dataset as the federation enlarges from 5 to 20 clients, confirming that our partition protocol indeed induces progressively harsher heterogeneity. This trend is mirrored in the performance of all methods, whose accuracies decline with larger client counts. Nevertheless, the drop for FedAux is consistently the smallest: Cora, accuracy falls by only 2.9%, while FedAvg and FedProx lose nearly 7%. To highlight the contrast, we single out most IID dataset Pubmed and the most non-IID dataset Amazon-Phote in Table The results under these settings show that FedAux remains the top performer in both extremes, indicating that our model is merely tuned for gentle partitions but retains its edge under pronounced non-IID conditions.
4.3 Model Analysis
Effectiveness of APV-based Client Similarity Estimation To intuitively show that the auxiliary projection vector APV can accurately capture the latent similarity among clients under non- IIDness, we construct synthetic graph (See Appendix [D.4] that jointly embodies the two types of heterogeneity:
'ee exclude weakly privacy-protecte baselines such as FedGCN 37 GraphFL 32 and FedStar 33 as
these methods leak node embeddings. connectivities, local gradients.
8

---

Table Attack AUC of MIA.
Dutaset
FedGNN
FedGTA
FedAux
Cora
0.56
0.54
Pubmed
0.58
0.55
0.52
ogba-arxiv
0.55
0.53
0.49
(a) Cora
(b) Puhmed
(c) Amazon-
Figure 4: Transferability of APV.
Poltun
Loo Ao
5.0
(a) Cora with clients
(b) ogbn-arxiv with 10 clienis
Cora clients
(b) Corn
Figure 6: Averaged local accuracy concerning communication rounds.
Figure 5: Server-side clustering cost.
label heterogeneity and subgraph (structural and feature) heterogeneity. Results in Fig. demonstrate that the APV-based client similarity can best recover the ground-truth client relationships. Each APV converges to the principal axis of its client's embedding distribution, yielding highly aligned directions within the same group and near-orthogonal directions across different groups (Theorem 3.1. Thus APV can serve privacy-preserving yet information-rich descriptor in subgraph FL.
Membership Inference Attacks (MIA) We add comprehensive empirical privacy evaluation via MIAs to rigorously test whether our APV-based framework leaks sensitive information. We assume honest-bute bueecs-out-cuuious server with full access the entire history of client's APV a₃ and its GNN parameters 0g. The goal of the server is to decide whether a probe embedding Aprob originated from client Gk. using only (ax, 0g), while raw data, node embeddings, and gradients are never shared. Following the standard MIA methodology [21. 27], the server trains an attack classifier gl: (ax,, 0k. hiros) implemented as two-layer MLP with hidden size 64, output the probability that hpob belongs to the training set of Gk. The attack is trained by maximum likelihood on held-out mixture of member against non non-meminn member probes. In Table we compare FedAux against representative subgraph FI. baselines on three datasets using identical client partitions to those in our main experiments, and report the Attack AUC (lower values indicate better privacy) averaged over five random seeds. The results show that MIAs against FedAux achieve AUCs in the range [0.49, 0.52], which indistinguishable from random guessing. This demonstrates that APVs do not leak sensitive membership information and actually provide stronger privacy than baselines.
Transferability of APV To examine whether APV can generalize beyond FedAux and serve plug-and-pla personalization module, we integrate it into representative subgraph FL baselines. Specifically, we replace FED-PUB's functional embedding similarity with APV, and jointly train APV with FedGTA and FedSage+. All variants are trained under the same 10-client non-IlI split on three datasets. Fig. shows that APV consistently improves each baseline across datasets. For example, FedGTA with APV achieves 1 1%-2% higher accuracy than its original counterpart. These improvements confirm that APV functions as a generic, lightweight, and privacy-preserye similarity proxy that can be seamlessly integrated with diverse subgraph FL frameworks.
To perform personalized FL, FED-PUB uses soft clustering by running proxy graph through each client model and comparing embeddings. GCFL applies hard clustering, grouping clients with Stoer- Stoer-Wagner cut on cross-round gradients. Our APV-based method only computes similarity between the uploaded vectors, requiring extra forward passes, gradient logging or cut computation, so server overhead is minimal. As Fig. 5 illlustrates, the APV method attains the fastest clustering time and the lowest peak memory, making it more efficient at scale.
Clustering Efficiency on Server

---

Fig. 6 compares the convergence behavior of FedAux and FedAvg. Notably, FedAux converges by the 60th communication round in both the 10-client and 20-client settings. Since the latter involves higher level of data heterogeneity, it indicates that FedAux maintains consistent convergence speed even as the degree of non-IIDness increases.
Convergence Rates
In Appendix E we conduct an ablation study to investigate the impact of our proposed continuous aggregation scheme, which encodes local node relationships in the ID space induced by the APV, as well as the effect of the server-side APV-based personalized federated aggregation. We also conduct experiments to analyze the sensitivity to hyperparameters.
5 Related Work
For general Federated Learning, FedAvg 20 first demonstrated that deep models can be trained on decentralized data with iterative model averaging. Subsequent work revealed that statistical and systems heterogeneity slow or destabilize FedAvg's convergence, which has been formally addressed by proximal correction []4], variance reduction [1]. and data-distribution smoothing through a small globally shared subset of samples 43 Optimization refinements such normalized aggregation [33 adaptive server updates (24) and dynamic regularization M further tighten convergence guarantees under extreme non- settings. Beyond single global model, personalization frameworks, e.g.. Ditto [15.. which jointly optimizes a shared model and client-specific objectives, explicitly trade off fairness, robustness, and local adaptation. These advances establish the algorithmic and theoretical foundations on which federated graph learning is built.
For Graph Federated Learning 36 17 39 (38. at the node level, FedGCN 37 illustrates that one-shot encrypted exchange can suffice federate GCNs while maintaining accuracy and privacy; GCFL (35] clusters clients by gradient dynamics to mitigate structural and feature shift across graphs. To combat cross-domain heterogeneity, FedStar (30) extracts a domain-invariant topology that generalizes across diverse graphs, and FedGraph 9 augments local data by requesting node
information from other clients. When each participant owns only a fragment of a larger network, subgraph federated learning methods such as FedSage/FeddSge+ [40] generate virtual neighbours to repair missing cross-subgraph edges. FED-PUB (3] proposes to generate functional embeddings to evaluate the similarity between clients for personalized aggregation. These models collectively highlight an open challenge for personalized graph FL., i.e., accurate client similarity measures, which our proposed FedAux addresses through end-to-end learning of auxiliary projection vectors.
Several new methods further extend personalization but come with non-trivial trade-offs. FedSSP 33 transmits spectral components that are invariant across domains but can leak sensitive local spectral information. FedEEo 41 shares ego-network embeddings, which directly expose structural patterns. PFGNAS 8 leverages prompt-based neural architecture search without server-side similarity esti- personalization introduces prohibitive cost. FedGrAINS (5)
mation, but its reliance on personalizes within each client by learning with GFlowNet. thereby avoiding server-side mixing, but at the expense of training an additional model with high compute and memory overhead. While the aforementioned methods contribute interesting ideas, they either compromise privacy guarantees (e.g., FedSSP, FedEgo) or impose heavy computational costs (e.g.. PFGNAS, FedGrAINS), limiting their practicality. In contrast, our method learns Auxiliary Projection Vectors (APV) in an end-to-end manner: lightweight, privacy-preserving client signatures that avoid raw data or embedding leakage, yet enable effective similarity-aware aggregation for personalized subgraph FL.
6 Conclusion
We present FedAux, a personalized subgraph federated learning framework that augments each local GNN with learnable auxiliary projection vectors (APVs). Specifically, besides the global GNN parameters, the server initializes and distributes APVs to each client, enabling effective and privacy- preserving characterization of local subgraph structures. By continuously projecting node embeddings onto ID space induced by these APVs, local models adaptively refine the APVs to optimally capture node relationships within each client's subgraph. After each communication round, the server leverages similarity between client APVs to perform personalized model aggregation. Extensive experiments across multiple datasets with varying numbers of clients validate the effectiveness of APVs as informative descriptors for personalized subgraph FL.
10

---

Acknowledgements
The research supported, in part, by the Ministry of Education, Singapore, under its Academic Research Fund Tier 1 (RG101/24).
References
[1] Acar, D. E., Zhao, Y., Matas, R., Mattina, M., Whatmough, P., and Saligrama, Fed- erated learning based on dynamic regularization. In International Conference on Learning Representations, 2021.
[2] Arivazhagan, M. G., Aggarwal, V., Singh, A. K., and Choudhary, S. Federated learning with personalization layers. arXiv preprint arXiv: 1912.008/8 2019.
[3] Back, J., Jeong, W., Jin, J., Yoon, J., and Hwang, S. Personalized subgraph federated learning. In International conference on machine learning, pp. 1415. PMLR, 2023.
[4] Bellman, R. Dynamic programming. science, 153(3731):34 37, 1966.
[5] Ceyani, E., Xie, H., Buyukates, B., Yang, C.,, and Avestimehr, S. Fedgrains: Personalized subgraph federated learning with adaptive neighbor sampling. In Proceedings of the 2025 SIAM International Conference on Data Mining (SDM), pp. 598-607. SIAM, 2025.
[6] Csiszár, I. and Körner, Information theory: coding theorems for discrete memoryless systems. Cambridge University Press, 2011.
[7] Delfour, and Zolésio, J.-P. Shapes and geometriex: metrics, analysis, differential calculus, and optimization. SIAM, 2011.
[8] Fang, H., Gao, Y., Zhang. P., Yao, J., Chen, H., and Wang. H. Large language models enhanced personalized graph neural architecture search in federated learning. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pp. 16514-16522, 2025.
[9] He, C., Balasubramanian, K., Ceyani, E., Yang, C.,, Xie, H., Sun, L., He, I.., Yang, L.,, Yu, S., Rong, Y., Zhao, P., Huang. J., Annavaram, M., and Avestimehr, S. Fedgraphnn: A federated learning system and benchmark for graph neural networks, 2021.
[10] Hu, W., Fey, M., Zitnik, M., Dong, Y.. Ren, H., Liu, B., Catasta, M., and Leskovec, J. Open graph benchmark: Datasets for machine learning on graphs. Advances neural information processing systems, 33:221 11-22113-2213,, 2020.
[11] Karimireddy, S. P., Kale, S., Mohri, M., Reddi, S., Stich, S., and Suresh, A. T. Scaffold: Stochastic controlled averaging for federated learning. In International conference on machine learning, pp. 5132-5143. PMLR, 2020.
[12] Karypis, G. Metis: Unstructured graph partitioning and sparse matrix ordering system. Technical report, 1997.
[13] Krasulina, T. The method of stochastic approximation for the determination of the least eigenvalue of a symmetrical matrix. USSR Computational Mathematics and Mathematical Physics, 96)) 189- 1969.
[14] Li, T., Sahu, A. K., Zaheer, M., Sanjabi, M., Talwalkar, A., and Smith, V. Federated optimization in heterogeneous networks. Proceedings of Machine learning and systems, 2:429 -5099 2020.
[15] Li, T., Hu, S., Beirami, A., and Smith, V. Ditto: Fair and robust federated learning through personalization. International conference on machine learning, pp. 6357-6368. PMLR. 2021.
[16] Li, X., Wu, 7., Zhang, W., Zhu, Y., Li, R.-H. and Wang, G. Fedgta: Topology-aware averaging for federated graph learning. Proc. VLDB Endow., pp. 41-50, 2023.
11

---

[17] Li, Z., Wang, X., Chen, H.-Y., Shen, H. W., and Chao, W.-L. H. Fedne: Surrogate asssoate federated neighbor embedding for dimensionality reduction. Advances in Neural Information Processing Systems, 37:133948-11339
2024.
[18] Liu, M., Wang, Z., and Ji, S. Non-local graph neural networks. IEEE transactions pattern analysis and machine intelligence, 44(12);
2021.
[19] McAuley, J., Targett, C., Shi, Q and Van Den Hengel, A. Image- based recommendations on styles and substitutes. In Proceedings of the 38th international ACM SIGIR conference on research and development in information retrieval, pp. 43-52, 2015.
[20] McMahan, B., Moore, E., Ramage, D., Hampson, S., and y Arcas, B. A. Communication- efficient learning of deep networks from decentralized data. In Artificial intelligence and statistics, pp. 1273-1282 PMLR, 2017.
[21] Nasr, M., Shokri, R., and Houmansadr, A. Comprchensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In 2019 IEEE symposium on security and privacy (SP), pp. 739-753. IEEE, 2019.
[22] Oja, E. Simplified neuron model as principal component analyzer. Journal of mathematical biology, 15:267-273, 1982.
[23] Polyak, B. T. Gradient methods for minimizing functionals. Zhurnal vychislitel noi matematiki matematicheskoi fiziki, 3(4):643-653, 1963.
[24] Reddi, J., Charles, Z., Zaheer, M., Garrett, Z., Rush, K., Konečný, J., Kumar, S., and
McMahan, H. B. Adaptive federated optimization. In International Conference on Learning Representations, 2021.
[25] Sen, P., Namata, G., Bilgic, M., Getoor, L., Galligher, B., and Eliassi-Rad, T. Collective classification in network data. Al magazine, 29(3):93 9-39, 2008.
[26] Shehur, O., Mumme, M., Bojchevski, A., and Günnemann, S. Pitfalls of graph neural network evaluation. arXiv preprint 1rXiv:181I.05866 2018.
[27] Shokri, R., Stronati, M., Song, C., and Shmatikov, V. Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pp. 3-18. IEEE, 2017.
[28] Suzumura, T., Zhou, Y., Baracaldo, N., Ye, G., Houck, K., Kawahara, R., Anwar, A., Stavarache, L. L., Watanabe, Y., Loyola, P., et al. Towards federated graph learning for collaborative financial crimes detection. arXiv preprint arXiv: 1e9..,2944.. 2019.
[29] Tan, A. Z., Yu, H., Cui, L., and Yang, Q. Towards personalized federated learning. IEEE Iransactions on neural networks and learning systems, 34(12):9587-9603 2022.
[30] Tan, Y., Liu, Y., Long, G., Jiang, J., Lu, Q., and Zhang, C. Federated learning on non-iid graphs via structural knowledge sharing. In Proceedings of the AAAI conference on artificial intelligence, 2023.
[31] Tan, Z., Wan, G., Huang, W., and Ye, M. Fedssp: Federated graph learning with spectral knowledge and personalized preference. Advances in Neural Information Processing Systems, 37:34561-34588 2024.
[32] Wang, B., Li, A., Pang, M., Li, H., and Chen, Y. Graphfi: A federated learning framework for semi-supervised node classification on graphs. 2022 IEEE International Conference on Data Mining (ICDM), pp. 498-507, IEEE, 2022.
[33] Wang, J., Liu, Q.. Liang, H. Joshi, G., and Poor, H. V. Tackling the objective inconsistency problem in heterogeneous federated optimization. Advances in neural information processing systems, 33:7611-766 2020.
[34] Wu, C., Wu, F., Cao, Y., Huang, Y., and Xie, X. Fedgon: Federated graph neural network for privacy-preserving recommendation. arXiv preprint arXiv:2102.049910 2021.
12

---

[35] Xie, H., Ma, J., Xiong, L.,, and Yang. C. Federated graph classification over non-iid graphs. In Thirty-Fifte Conference on Neural Information Processing Systems, 2021.
[36] Xie, H., Xiong, L., and Yang, C. Federated node classification over graphs with latent link-type heterogeneity, In Proceedings of the ACM Web Conference 2023, pp. 556-566, 2023.
[37] Yao, Y., Jin, W., Ravi, S., and Joe- Wong, C. Fedgen: convergence tradeoff's in federated training of graph convolutional networks. Advances in neural information processing systems, 2023.
[38] Ye, Ni, Z., Wu, F., Chen, S., and Wang, Personalized federated learning with inferred collaboration graphs. In International Conference on Machine Learning, pp. 39801-39817. PMLR, 2023.
[39] Yue, I.,, Liu, Q. Gao, W., Liu, Y., Zhang, K., Du, Y., Wang, L.., and Yao, Federated self- explaining gnns with anti-shortcut augmentations. In Forty-first International Conference on Machine Learning, 2024.
[40] Zhang, K., Yang, C., Li, X., Sun, L., and Yiu, S. M. Subgraph federated learning with missing neighbor generation. Advances in Neural Information Processing Systems, 34:6671-6633 2021.
[41] Zhang, T., Mai, C., Chang, Y., Chen, C., Shu, L., and Zheng, Z. Fedego: privacy-preserving personalized federated graph learning with ego-graphs. ACM Transactions on Knowledge Discovery from Data, 18(2):1-27, 2023.
[42] Zhang, Z., Hu, Q. Yu, Y., Gao, W., and Liu, Q. Fedgt: federated node classification with scalable graph transformer. arXiv preprint arXiv:2401 15203, 2024.
[43] Zhao, Y., Li, M., Lai, L., Suda, N., Civin, D., and Chandra, V. Federated learning with non-iid data, arXiv preprint arXiv: 10l.00880000882, 2018.
[44] Zhuo, W. and Tan, G. Efficient graph similarity computation with alignment regularization. Advances in Neural Information Processing Systems, 35:30181-30192, 2022.
[45] Zhuo, W., Liu, Z.,, Hooi, B., He, B., Tan, G., Fathony, R., and Chen, Partitioning message passing for graph fraud detection. In The Twelfth International Conference on Learning Representations, 2024. URL. httpss: htttts::/oppnreeeee http://pppprrreeeeeeee/rrrrrrrrr net//forrumt?dBBBBUrrrUuuuu
[46] Zhuo, W. Yu, H., Tan, G., and Li, X. Commute graph neural networks. In Forty-second International Conference on Machine Learning, 2025. URL /ttps://op net/ formm71d-29Leyyb111
13

---

NeurIPS Paper Checklist
1. Claims
Question:
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes].
Justification: In the abstract and Introduction, we have highlighted the contributions of our work, such as lines 54-70 70.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes].
Justification:
See Appendix
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes].
14

---

Justification: All theorems are in Section 3.3 All assumptions and proofs are shown in Appendix C
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes].
Justification: We provide the implementation details in Appendix D Besides, we provide the source code of our work.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
15

---

Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes].
Justification: We have added the link to the source code of our work. Besides, we provide a detailed README file reproduce our experimental results.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips... cc/
for more details.
While encourage the release of code and data, understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https
//nips.cc/pbble. wwtpc//ggieeeeeeee Sodi:////uuddee/deeuuuubbiii
(CodeSubiisss wwtplubmmmsssiioo ssiiiiolcccy for more details.
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes].
Justification: See Appendix D
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes].
Justification: See Table
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi-
dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for
example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
16

---

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
should be clear whether the error bar is the standard deviation or the standard error of the mean.
It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables figures symmetric error bars that would yield results that are out range (c.g. negative emror rates).
If error bars reported in tables plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes].
Justification: See Appendix
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't 't make it into the paper).
9. Code ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics
Answer: [Yes].
Justification:
Our research conforms with the NeurlPS Code of Ethics.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special cireumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., if there is special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [NA].
Justification:
There are no negative societal impacts of our work.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
17

---

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA].
Justification: No risks.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g.. code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes].
Justification: All datasets used in this paper are public, and we have properly cited the original paper.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the Datasets.papersstt paperswi thcode. cww/ datasets package should be provided. For popular datasets,
has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
18

---

If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA].
Justification:
The paper does not release new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/mmoel as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA].
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question:
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA].
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
16. Declaration of LLM usage
19

---

Question: Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods this research? Note that if the LLM used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality the research, declaration is not required.
Answer: [NA].
Justification: The core method development in this research does not involve LLMs any important, original, or non-standard components.
Guidelines:
The answer NA
that the method development in this research does involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy for what should or should be described.
20

---

A More Discussion of Related Work
In subgraph federated learning, each client holds a local subgraph GR of a global graph G. These subgraphs can vary substantially in their feature distributions, structural/toologiin properties, and label distributions. Thus, simply applying FedAvg may fail converge properly or yield a suboptimal global model, because clients often learn different parameters tailored to their local subgraphs, and blindly averaging those parameters disregards the non-IID nature of the data. To address this, recent studies move beyond basic FedAvg by introducing personalized or locality-awer aggregation schemes that better handle heterogeneous subgraph data.
GCFL 35 compares each client's parameter updates before and after communication. If client's update deviates substantially from the majority, it is deemed too different and is excluded from the dominant aggregation cluster. However, GCFL relies on hard clustering, which cannot capture finer-grained similarities across clients. Moreover, depends on manually tuned hyperparameters to control how different a client must be before exclusion, leaving it unclear how large a deviation is tolerable without enough knowledge about the data. FED-PUB [3), on the other hand, constructs proxy graph at the server and evaluates model outputs from each client on the proxy graph to measure their similarity. Clients with similar outputs on the proxy graph are deemed more alike and thus aggregated more closely. Yet building a suitable proxy graph as the middleware to measure the similarity between clients is nontrivial, because it requires simulating the real graph data on the server.
In this work, we propose orthogonal approach measure and aggregate models on the server. Specifically, beyond distributing a global GNN, the server also provides a global Auxiliary Projection Vector (APV) to each client the start of every communication round, as shown on the left of Fig. [ During local training, the APV is jointly optimized with the client's GNN parameters to form a mie-iimesionnl space onto which node embeddings are projected. This procedure tailors the APV. which adjusts the shape of this space, to the unique distribution of each subgraph by preserving its distinctive patterns. Once training concludes, clients upload their updated GNN parameters and local APV to the server, which then compares these learned APVs to gauge similarity and detect finer-gre -ner-grained, continuous heterogeneity across clients. By discarding the hard clustering thresholds used in GCFL and removing the need for proxy dataset used in FED-PUB, our method offers more flexible and efficient strategy to identify and aggregate similar subgraphs.
Another advantage of our method lies in its privacy-preserving design. We argue that sharing detailed node embeddings, as in FedGCN (37), leak private subgraph information, as adversaries on the server could compute pairwise similarities among embeddings to reconstruct local connectivity. Moreover, due high dimensionality and lack of explicit structural encoding, directly comparing parameter matrices to measure raw data similarity is both unreliable and computationally unstable. In contrast, our proposed APV is compact parameter vector that preserves essential node relationships without exposing the actual node embeddings, offering stronger privacy guarantees and structure- awareness. Additionally, its dimeenniioonal nature makes similarity computation more efficient and robust.
B
Pseudo Code of FedAux
The overall training algorithm is shown in Algorithm |
C
Proofs
C.1 Proof of Theorem 3.1
The proof relies on two mild structural assumptions, both typical in optimization analyses of deep models.
Assumption C.1 (Centred embeddings). h == 1. E, h = O, where N is the number of nodes in the current client.
Assumption C.2 (Linear classifier Jacobian). Let gs == Zz, a). Assuming that the mapping gi is linear: gi W for some matrix W e IRd x
21

---

Algorithm 1: FedAux: Subgraph FL with Differentiable Auxiliary Projections
Input: number of clients K; global communication rounds T; local steps per round Q: learning rates 1j similarity temperature a
Init: server initializes global GNN weights g(0) and APV a (0) ~ (O0 Ia each client G3 sets
(0)) ( a
(0)
Fa (0)
for t 1 do
// Server Clients
broadcast [(0 ag l=== to each client [G&)
(t- (t-1) )]
// Local training on each client Ga (runs parallel) for each client E Gx) do in parallel
(0k.a)) (0(-)), a ))
for q - to Q do
local GNN forward pass with (t-1)
fo (1;) learn node embeddings
Eq.
compute similarity scores $k (f-1) with (t-1) (t-11) .a ) $k.
compute kernel weights K( Sk.j -
(1-1)
compute kernel-based aggregated embeddings 2 "R,i forward through the classifier; compute loss Log;
(t-1) with Eq. 6
concatenate (t-1) " ||[0;--);
11
update (o(-)) a ()-1)) w.r.t. Lce with learning rate n7;
12
end 13
upload (0(1-1) , .0
(t-1)) to server;
14
15
end
// Server-side personalised aggregation
compute Whi1 (t-1) with Eq.
16
17
for each client G do
18
Ei= wkl
K
[t- g
19
a
(1)
E Wht ai
K
(t-1) (t-1),
20
end
send (oL) a (t) back to client Ge:
21
end
Output: personalized models { a ( for K clients
Theorem holds exactly for tiner-sofftma classifier and a first-order approximation for MLPs. Then we introduce the auxiliary lemmata.
Lemma C.3 (Gradient of similarity score). For node Us Ba
Bs: = h4 s,a holds.
Proof. = a h; with ||a|| 1. Hence
ds. h, Because we will always re-project the unit Ba
sphere after every update, the tangential component h2 s;a the effective gradient, and the radial component vanishes.
Lemma C.4 (Gradient of kernel entry).
aKi; da
2/ (si - 85) Kij [(h: - -h,) (s: - ,5) a).
Proof. Apply the chain rule to Kij = k((s;, 85) = exp (- [-3 (s, s,))) and invoke Theorem C.3 for 0s. - 8j)/da.
Lemma C.5 (Gradient of the kernel-smoothed embedding). Define the normalized kernel weights:
Kij Mi
Big
Σ Big 1.
(13)
22

---

Then we have
N
0z:
2
Σ
Big (s: - 85) (h, - 2x) @ [(hs - -hy) (s; 185-s)) 8j) s))aa,
(14)
da
σ²
1=1
where & denotes the outer product.
Proof. Let D; = - Kighi based on Eq.
6 we have zi
D. M.
Using the quotient rule, we have:
0z: aD;
Dj a.M M? da
(15)
da
M, da
Then we compute the two gradients in Eq. 15 The gradient of the Dj w.r.t. a is aD:
8a
=
N (Kaa Ej=1 da h1, where 0kst has been given by Theorem C.4 Thus have:
da
0D. da
o² (ss -)) Kighy [(h; - h2) - (s; - -8))a)
(16)
The Gradient of M, can represented as:
0M,
KKg 2
N
Σ (s: 3y) Kiy [(h, h1)) (s: 5,)aa) a).
(17)
da
da
o²
==1
We can substitute Eq.
(6 and Eq.
into the quotient rule Eq. 15
dz,
2
N
(s; 8,) Kig hy [(h, - h2) - (ss - 8,)aa (15--8)00
da
M,
j=1
(18)
+ 0² M?
2 1
Σ Kighi
Σ (=1
(s; - 8²) Kit [1h: - h2) - (s, (s)-s))al]
Given Eq.
13
Eq.
(88
can be rewritten
0z,
Big (st -8) hy [(h; - h1) (ss (s)= a]
Da
σ²
==1
(19)
Σ Bi (8: se) [(hs he) (s+ se) a17)
Σ
Bight
σ²
By re-indexing + j. Eq.
19
can be represented as:
dzi
Big (st - -s-- (h; z;) [(h; - 11) (s; - -8,) a]
(20)
Da
1=1
which is exactly the Eq. 14 completing the derivation.
C.1.1 Proof of Theorem
3.1
Proof. Using Theorem C.2 and Theorem
C.5
we can perform chain-rule expansion of V.C as:
Oz
N
NN
Oz;
V.C
9i
W
(21)
N
da
N
da
Substituting Eq. [4] into Eq.
gives:
2
VaL
Big (s:
3;) [/h h2) (s: 55) (h, 2,) Wz.
(22)
2
23

---

For small 0, Pi is sharply peaked at j = i. Given Eij := 8j, since Bi S e e0///// all terms with * are exponentially suppressed, and the dominant contribution arises from the linearization around Eij = 0. Then we conduct Taylor expansion to first order in Cig:
N
N
2 V VoL = No
Byegl (4)
(4 Wh.)] + (0(0)
(23)
==
In Big-O notation, the symbol O (at)) as - 0+ means that there exists a constant > and neighbourhood (0, oo) such that 10 (a") S car. Using Theorem C.I and symmetry of the inner summation one obtains the compact matrix form of the above formula:
N
- Ca Ca R()))
VoL= = o²
h
a + R(o) = -- o²
(24)
N
with |[(()]]] O (o"). This proves Eq.
Since a is re-normalised after every update, the effective tangential gradient 7 VaC- Note that Ca scalar, so subtracting the radial part yields the tangential gradient -Ca (a T Ca) a. A projected gradient descent step with learning rate therefore becomes:
(a T VaC)a.
a - 11aa-1 (a 7) Ca (a Ca) a) = 1I---1 -1::=-ll1----- ((-))
(25)
which is exactly the discrete-time Oja 22 update Eq. (TOp.
Let Amax the largest eigenvalue of C, with unit-norm eigenvector Umax- Standard theory of Oja's
algorithm [13 22
states:
Every cigenvector C is a fixed point of Eq. 10
All eigenvectors other than Um are unstable, and Umax are globally asymptotically stable provided 0 r 2/Xmax-
Hence gradient descent drives toward U Because the kernel and the classifier do not depend on the sign of a, both directions are equivalent, and choosing the
suffices. Li
C.1.2 Interpretation Theorem
3.1
Rayleigh-quotient maximization Oja learning rule is stochastic gradient ascent on the Rayleigh quotient R(a) = a Ca over the unit sphere. Theorem 3.1 therefore formalizes the intuition that the APV aligns with the direction of maximum embedding variance.
Role of the bandwidth a The leading term Eq. (10 multiplied by 1/0². A smaller bandwidth increases the gradient magnitude, accelerating alignment but reducing smoothness; conversely, larger slows convergence while preserving differentiabilityy
Compatibility with the global optimization Once the APV converges to Umax, the kernel weights Kij depend only (hi, Umax) (hj, Umax), which maximally separates nodes along the most informative one-dimensional projection. This precisely captures the fidelity property we desire.
C.2 Proof of Theorem 3.2
The proof is based on three lemmata.
Lemma C.6 (Weight concentration), For each row i of the kernel matrix K. we have:
lim Kaj 8ijs a
(26)
where dig is the Kronecker delta.
24

---

Proof. Since all scores are distinct, setting A; == minj
|s; -sy1 > 0. For j o i we have:
(s. - s,)²
x² -00- 0)
Kig Kii
A Ø²
exp
S exp
(27)
Hence for all j A Kay S e-Ai/0² 0 + 0+. Since each row of K. is probability
distribution, the diagonal entry must satisfy Ku = - Eizi Rij + 1.
Lemma C.7 (Pointwise convergence of smoothed embeddings).
lim 2 h4s Vi 1...,, .V a
(28)
Proof. We can rewrite 2; as:
N Σ
aighi Kuth + Σ Kighy
(29)
jf1
By Theorem C.6 the non-diagonal weights vanish and Kis + 1. Therefore + hi-
Lemma C.8 (Matrix convergence in Frobenius norm).
lim o
Z H
=.
(30)
Proof. Note that both matrices Z and H have the same ordering т of rows. From Theorem C.7 each corresponding row converges as [T<()) - h + for every t. Since N is finite, the Frobenius norm also converges to O.
C.2.1 Proof of Theorem
3.2
Proof. The Conv1D operator Convw is linear and its Lipschitz constant with respect to the Frobe- nius norm LIPw = (Er= [ 1/2
then for any two sequences X' and y we have:
[Covw (X) C I LIPw/IX -V1l
(31)
Applying this bound with X Z and y H yields:
[onvw (Z) Conv ( < LIPw 7
H p.
(32)
Theorem C.8 states that the right-hand side of Eq. 332
converges to 0, thus the left-hand side must converge to zero as well, establishing the claimed limit.
C.3 Proof of Theorem 3.3
C.3.1 Local Training Analysis
For client G& any communication round and inner step q (1,.... Q}. let V =0 a at any communication round. Given the assumption that the local objective La is differentiable and --smooth: WV, v, V L (+))
Vill. where the smoothness holds for cross-entropy composed with neural networks whose activations are Lipschitz, we have:
< L1 (V)Il
L 1xl1,
La (v/)) S La (v)) + (VL* (V+), V' Ux)
11/
WV V/
(33)
2
Take 1A WG and V' V v 1g6
L. (v)) La ( 17 V (vg-))
9%
9-1
Lnz
9 1|
(34)
Due to the unbiasedness assumption, i.e., E[gh] VLx, we have:
E ( g (V E ( 1|
(35)
25

---

Also by the bounded-variance assumption, i.e. Ey 119x
VC+lI
S 53
we have:
2g
| = | + E
|00
VL
Ass. I
VL ç²
(36)
Then we can insert Eq. 35) and Eq. 336 into Eq.
34
and take expectation as follows:
[| +
Eg [Cn (VR) S Lx V/2 - VV
2
(37)
Lx (w2-1) - -11 || 2
LnP2²
|VL2| +
2
Because v 1 1/22 we have 1 - L1122 2 1/2, hence:
LTP
Bg [Cx (VD) - L*
VL (1%
(38)
2
2
Based on the assumption that each local objective Ls satisfies the p-PL
(Polyak-Lojaaiewicz))
condition 23 iff
(Zx )| 24 (Ca( -f2)
(39)
Plug Eq.
39 into Eq.
338
Eg C& (V)) Li] (1 nn) Cx 1 (
Cx
(40)
2
We define the gap as 4 9-1 == Lx (10 - Li Taking the total expectation and iterating Eq. times, we have:
440
Q
Lnp5²
A
S (1 81
mp)
(41)
The geometric sum is:
Q Σ
(1 - mu1r
(1
nuy
(42)
7744
j=1
Therefore, the following inequality holds:
(1 + n
E
A
< (1-
(43)
24
which is the per-client local-training contraction.
C.3.2 Effect of Global Kernel-Based Aggregation
Define vlo (toc,(t-1) Ve which means the local client parameters after Q local training iterations.
Let ((t-1) = ((t)) 11-1) where ft (!-11) La (o Li. Recall our proposed
personalized aggregation scheme in Eq. (8, can be rewritten as:
K
(t-1) (oo.((t-1)
WH
(44)
Since each new parameter convex combination Eq. (44) based on the Jensen's 's inequality and L--smothhness assumption in Eq. (33) the following inequality holds:
C
Σ
(t-1) Wil
La LA (L..))))))))
(45)
'Here we slightly abuse the notation which was previously introduced in Section C.I.I with a different meaning.
26

---

Let = [p Eq. 45
subtracts L and multiply by Pk. and sum over k, we can reach:
(( L S (1111)
(46)
Let the global average gap as F(-11 = p p((11)) and r(t-1) = f(- fu-1111 Since row-
stochasticity implies f2 1 1, we have:
p (((()))((--)) = f(t-1) +p (D(-
(47)
Hence:
C (v01)) L - f(-1)+ +p (((--))((--1) -
1 = (2(1-1) ;
11
(48)
K
Note that p rr(t-1) by definition of f(t-1), Applying Cauchy-Schward Schwarz we have:
p V (t-1))
$ | v 1)
(49)
Due to the assumption that | 1|2 S p and ||p||2 1 which is probability vector, have:
p (((-))(((-1) s (t-1))
(50)
Next bound ||<"-"11e by the mean gap as:
Σ [ - )) )
=
( 2
max f (1-1)
Σ ft ((1-1)
(51)
(t-1)
maxk Jk
ppt((=)))
mink
ming Pk
Let 1/ //mingg pk S VK, we can combine Eq. 50 and Eq. 51
to get the following inequality:
p T 1) pcv fit-1),
(52)
Then by squaring both sides of Eq. 52 and use v s 1 + F, we have:
1 + f(-D) < 2p²c² p((-1),
v
S p²cc
(53)
where the last inequality employs f(1-1) < (1
p) f(t which is trivial for 0 < p < 1. Taking (53 in to Eq. (48) to obtain:
expectations, we can substitute Eq.
2p²
c (1(t))
C* I
1+ 1 p
E g(t- 13
(54)
Given Eq. 43 and f(t E+PrE |k( 11. we can bound (e1)((-11] by:
by:
aann (Ex ( (i) + n2 < q/))
E [((
(55)
24r
By taking a weighted sum of the above formula over all K clients with weights Pk. we obtain:
E ]ū= & (1 8 (c (w(--1)- - -c*) + n2222
(56)
2μ
27

---

One-round contraction
By plugging Eq. (56) into Eq. (54), we have:
E c (w()) L- s S (n- 1 1-p) (c (c(11--)) (²) + n2
2p²
(1
1+ 2p²
2/
(57)
Since
+ 20" =1 +
2p
--p and p 1, the following inequality holds:
I-p
1-p
E [ (Vic))
L. S main ( (wull-1)) L² + 12
21,
+ 1(1 pp)
(58)
2μ
where the last term absorbs the factor from (1 p)
Across T' communication rounds Eq. (58) as:
By setting y = (1 -nnj) where < < 1, we can unroll
C
v (3)
2- 5 (c (110)) (2(11)) -
--- + n
T-1
7p + M(1 - pp)² 1=0
21 T-1
Σ y/.
(59)
2/
1=0
Since the geometric sums satisfy Ei=o T I I-y while 1 - = 1 (1- nu) 2 7H4 we have:
(60)
mp
f=0
By inserting the above inequality into Eq.
(59)
and simplify, we can easily get:
28
E C ( c+]
TT (c (0) L-
+
(61)
2μ
1(1 p)
Recovering n" = (1 - nu gives exactly Eq. 122 in Theorem 3.3 which concludes the proof.
D Experimental Details
D.1 Dataset Statistics
Table 4 summarizes the statisties of the datasets used in our experiments. includes the total number of nodes, edges, node classes, and feature dimensions for each dataset. Specifically, we use four citation graph datasets (Cora, CiteSeer, Pubmed, and ogbn-arxiv) and two product co-purchase graph datasets Crozzonn-C and Amazon-Photo).
Table 4: Dataset statistics
Datasets
Nodes
Edges
Classes
Features
Cora
2,708
5,429
7
1,433
CiteSeer
3,327
4,732
6
3,703
Pubmed
19,717
44,324
3
500
Amazon- ComztenComputtr
13,752
491,722
10
767
Amazon-Photo
7,650
238,162
8
745
ogbn-arxiv
169,343
2,315,598
40
128
D.2 Implementation Details
Following the standard FL settings, our FedAux, both the local client models and the global server model adopt the same backbone architecture. We employ MaskedGCN 3 to generate node embeddings and sweep the number of GCN layers over I. E (1,2,3). The hidden dimension is selected from d' (64, 128, 256), and dropout probabilities are 0.5. The auxiliary projection vector a is initialized from a Gaussian distribution in æ. The similarity-temperatue parameter set to 10, and the bandwidth a is fixed to 1. For the FL schedule, we run T = 100 communication rounds with Q = local epoch on the smaller citation datasets (Cora, CiteSeer, Pubmed). On all other datasets, we set the total number of rounds to T = 200 and the number of local epochs per round to Q All experiments are executed on workstation equipped with an NVIDIA Tesla V100 SXM2 GPU (32 GB) running CUDA 12.4.
28

---

Table 5: The degree of non-IIDness.
Cora
CiteSeer
Pubmed
Non-IIDness
5 Clients
10 Clients
20 Clients
5 Clients
10 Clients
20 Clients
5 Clients
10 Clients
20 Clients 0.1725
062667
0.3092
0.3760
0. 1848
0.2292
0.2572
0.1316
0.1500
Amazon-Compunt
mmazzon-Photo
ogbn-arxiv
Non-IIDness
5 Clients
10 Clients
20 Clients
5 Clients
10 Clients
20 Clients
5 Clients
10 Clients
20 Clients
0.2774
0,3582
0.3931
0.3600
0.4314
0.4840
0.3398
0.3668
0.4307
D.3 Quantifying Non-IIDness in Federated Graph Datasets
To compare how much statistical heterogeneity (i.e., von-lIDness) each dataset induces under a given partition scheme, it is useful to measure how far the local data distribution each client deviates from the global distribution and how dispersed local distributions are from one another. Below are three complementary. fully formalized metrics that can be computed once the graph has been split into K client subgraphs (G Gk).
Label-distribution divergence Let P(y) be the global class prior and Pk the class prior in client Gg- We use the average local label prior and the global label prior as follows:
(JS) divergence measure the gap between each
1 K
JSD
KL (PAIIR)) + KL (P])
(62)
where R4 ] (P&s + P) denotes the mid-point distribution between P3 and with R E EY) = (v) + P())]. Pinsker's inequality [6] gives that JSD E [0, log 2]. A small JSD indicates that each client's label distribution closely matches the global prior, so the partition is effectively IID. As the JSD increases, local class proportions deviate more sharply from the global mixture, making individual clients progressively sless-s and therefore increasingly subject statistical non- IIDness.
gabggrap-ddisrihuttin discrepancy Label skew alone may underestimate heterogeneity when covariate shift is strong. To quantify covariate-shif--nnuee the embedding distribution of each client deviates from that of every other client in an embedding space that reflects graph structure and attributes. We first obtain node embeddings for all nodes with simple neighbor aggregation Z& A ).N, in each client. Let Z₁ be the empirical distribution of embeddings held by client Gg. We define the coaph-iittrbutton discrepancy of a K- K-client partition the mean pair-wise maximum mean discrepancy (MMD)
heterogeneity, we measure how far
MMD = K(K -
Σ IsK<IsK
Σ WEV.
Φ (ZM,))
1
Σ eEE
o (2)
(63)
VE
[
where <6-) is the canonical feature map of Gaussian RBF kernel with the bandwidth fixed with the median pairwise distance ensure comparability across datasets. Eq. (63) evaluates to zero when all clients share an identical embedding distribution (IID) and increases monotonically with covariate divergence.
Based on the above two perspectives, we can quantify the degree of non-IlDness by summing JSD and MMD as & JSD MMD, where higher & indicates higher degree of non-IIDDess. We show the degree of non-IlDness of all datasets under different numbers of clients in Table
D.4 Synthetic Graph for Client Similarity Estimation
We first generate an SBM graph with 3000 nodes that are uniformly divided into K = 20 equal-sized blocks as clients. Inter-client edges are added with probability pinter 0.02. To inject structural non-IIDness, the 20 clients are grouped into five super-clusters {9.}a_] (four clients per group). For every client belonging G, we draw intra-client edges with probability pintra 0.15 x i, so clients
29

---

Table 6: Ablation studies on the federated node classification task under 10 clients.
Baseline
Cora
Pubmed
Amazzon-oomutte
ogbn-arxiv
hedd
80.29
83.06
18.10
66.53.012
(ii) FedAVgnas
78.98
83.97
84.3 +0.00
65.09
FedAux
82.05
85,43
89.92
68.50
81.26
82.53 80.38
78.12
78.45
78.33
78.50
79.30
80.10
85
-11
90.5
84.57
84.49
84.01
80.01
81.94
82.05
80
80.20
81.00
81.60
80.0
10
81.37
79.55
78.50
79.55
80.20
79.80
80.50
81.20
64
(a) clients
clients
(c) 20 clients
Figure 7: Classification accuracy (%) ) for different GCN configurations.
within the same group are structurally IID, while clients across groups are non-lID. To inject label and feature non-IIDness, receive label - 1 with high probability 0.8, and the remaining 0.2 mass distributed uniformly the other four labels. Each node's feature vector is the one-hot encoding of its label. In this way, clients in the same group are IID in both label and feature space, while clients from different groups exhibit pronounced distributional shifts. This controlled setting allows the learned APVs can cluster clients that are genuinely similar. We directly compute the similarity between clients' prcaanpooling embeddings without considering privacy in Fig. Balas the ground-truie similarity. Fig. 33 3d are similarities computed by APVs, learnable weights of the readout layer, and functional embedding
assign 5 labeled classes all nodes. Nodes owned by the group G3
test whether
E
More Experiments
E.1
Ablation Study
We conduct an ablation study in Table validate motivation and design, with the following two ablations: (i) replacing our proposed continuous aggregation scheme over the ag-space defined in Eq. (6) with the ConviD operation applied on the hard-sorted embeddings introduced by (18), yielding a variant FedAuXhard- and (ii) removing our server-side APV-based personalized aggregation, instead using simple averaging aggregate local models into a global model, leading the baseline FedAvgmask. Note that the FedAvgmask variant differs from the standard FedAvg used in Table where FedAvgmask adopts MaskedGCN [ as the GNN backbone, whereas the standard FedAvg utilizes a conventional GCN architecture. Compared with FedAuxpard our FedAux consistently obtains higher accuracy. This empirical gain confirms our claim that although the hard-sorting scheme proposed by [18) does allow gradient flow to optimize the APV, the underlying discrete permutation remains non-differentiable and therefore restricts the capacity of the APV adapt. By using our proposed continuous aggregation with a fully differentiable kernel operator, FedAux enables smoother gradient flow, allowing the APV and the local GNN to co-evolve optimally. Besides, FedAux and FedAvgmask both adopt MaskedGCN as backbone, while FedAux personalized aggregates local models based on the APV similarity, while FedAvgmask aggregates local models to a single global model. Results show that FedAux outperforms FedAvgmask on all datasets, which demonstrates that exploiting APV-based personalized aggregation allows the federation to respect non-III data distributions and learn more effective client-specific models.
30

---

10
Accuncc
Accnmey
10
0.1
10
01
10
011
10
(a) Cora
(b) Pubmed
(c) Amazon-Computer
Figure 8: Sensitivity of FedAux on the similarity temperature parameter a.
E.2 Hyperparameter Analysis
Impact of Model Depth and Hidden Dimension In our model, the number of GCN layers selected from
(1,2.3). and the dimension of the hidden layers is selected from d' {64, 128, 256}. In Fig. 7 we show all the hyperparameter combinations on the Cora dataset for different client counts. It evident that FedAux consistently achieves the highest performance with L == 2 across all federated settings. For the hidden dimension, when the number of clients is not large, FedAux requires relatively small hidden dimension, while with 20 clients, a hidden dimension of 256 yields the best results.
Impact of Similarity Temperature In Eq. 7 the similarity temperature parameter a is in- troduced to modulate the sharpness of the similarity distribution. To evaluate the sensitivity of FedAux to this hyperparameter, we test a E {0.1, 1, 10) across varying numbers of clients and report the resulting accuracy in Fig. X The results show that while some configurations achieve optimal accuracy at different values of ar, for example, a = 0.1 is optimal for 20 clients on Cora and 10 is optimal for 20 clients Pubmed, directly setting performance across different datasets and client counts.
consistently provides satisfactory
F
Limitations and Future Work
The main limitation of our work is that while the kernel-based continuous aggregation scheme lets each client learn a fully differentiable, data-driven ordering on the APV, it requires evaluating the pairwise kernel for every node pair in the local client subgraph. Thus, the per-elient computational cost scales quadratically. O(N2), which is acceptable for small and medium subgraphs but can dominate run-time on very large clients. Our future work focuses on addressing this scalability bottleneck. One promising direction is to approximate the dense kernel with low-rank factorizations, such Nyström approximation, so that complexity scales linearly in N₁. with controllable error. We stress that our core contribution is privacy-preserving via the APV, and reducing local computational load complementary line of future research.
preserving mechanism for personalized clustering clients
31


Reviews:
[{"review_id": "ZtyGBZgmka", "reviewer": "Reviewer_aUZ1", "summary": "This paper tackles the non-IID challenge in federated learning on graph-structured data by proposing FedAux, a personalized subgraph FL framework. The core idea is to use learnable auxiliary projection vectors (APVs) to project node embeddings into a 1D latent space, enabling each client to generate a compact, privacy-preserving signature. These APVs guide similarity-based aggregation on the server without sharing raw data or embeddings.", "questions": "See the above", "limitations": "yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n\n1. The paper introduces a novel and theoretically grounded mechanism — the auxiliary projection vector (APV) — which enables clients to share compact, privacy-preserving subgraph representations while avoiding raw data or embedding leakage.\n\n2. The proposed FedAux framework is validated both theoretically (with convergence guarantees and principal component analysis) and empirically, demonstrating clear performance improvements over strong baselines on diverse graph datasets with varying non-IID conditions.\n\nWeaknesses:\n\n1. While the APV is theoretically shown to converge to the principal direction of local embeddings, the paper does not clarify how robust this alignment remains when local data is extremely sparse or weakly informative — in such cases, the APV may fail to capture meaningful non-IID structural differences across clients, limiting its intended role as a reliable similarity proxy for personalized aggregation.\n\n2. The paper lacks a detailed empirical analysis of how the APV specifically contributes to the final performance, and does not discuss alternative design choices for APVs or how different projection strategies might affect generalization under realistic non-IID settings. This leaves open questions about the stability and robustness of the APV mechanism when deployed in practical, more complex graph scenarios.\n\n3. The paper does not provide a clear and rigorous discussion of whether and how the learned APVs might leak sensitive structural or semantic information about local subgraphs, leaving it unclear whether the APV truly guarantees privacy preservation beyond the absence of raw data or embeddings. A more formal privacy analysis would strengthen the claim that FedAux meets strict privacy requirements in practical federated settings.", "was_revised": true, "final_justification": "Thank you for your response regarding my concerns. Maybe the APV will become a helpful supplemental method in federated graph learning. I keep my recommendation as \"borderline accept\".", "rebuttal": "We greatly appreciate your detailed feedback. We hope our response below effectively addresses your concerns, and will incorporate your suggestions in the revised manuscript.\n\n**W1: The paper does not clarify how robust the alignment between the APV and the principal direction of local embeddings remains when local data is extremely sparse or weakly informative.**\n\n**A1:** Your concern hinges on the Auxiliary Projection Vector (APV) being fit to raw, potentially sparse and weakly informative node features. In our framework, however, **the APV is learned on top of the GNN embeddings**, rather than raw inputs. As formally established in Theorem 3.1, the APV $\\boldsymbol{a}$ provably converges to the principal eigenvector of the covariance matrix $\\mathbf{C}$ constructed from GNN embeddings $h$, not from the original features $x$. These GNN embeddings (i) aggregate multi‑hop neighborhoods, so even if its own features are zero or missing, it inherits rich structural and attribute cues from surrounding nodes; (ii)  share a globally trained backbone $\\theta$ that injects a strong inductive bias across clients, and (iii) are supervised by the task loss. Consequently, even when a client's raw graph is sparse or noisy, the embedding distribution it presents to the APV is already denoised [1], regularized, and aligned to the task. This end-to-end feedback shapes the global direction of maximal variance in the embedding space to align with discriminative axes, not with arbitrary noise.\n\nOn the other hand, constructing the APV directly on the raw features can indeed yield an unreliable APV, because the raw feature matrix may be low-rank, e.g., many nodes share identical (weakly informative) or zero vectors (sparse), so its covariance can collapse onto a few spurious directions, obscuring meaningful structure. In contrast, in our paper, our APVs are defined over GNN embedding matrix, which typically has a higher effective rank because message passing mixes features across neighbors and injects learned nonlinear transformations. Therefore, even if the original feature matrix is rank-deficient, the GNN embedding matrix can approach full-rank, yielding a covariance with a larger eigengap and, consequently, more stable and informative APVs. \n\n[1] A Unified View on Graph Neural Networks as Graph Signal Denoising. CIKM 2021\n\n**W2: The paper lacks a detailed empirical analysis of how the APV specifically contributes to the final performance, and does not discuss alternative design choices for APVs or how different projection strategies might affect generalization under realistic non-IID settings.**\n\n**A2:** Thank you for these valuable suggestions. Actually, we have done some analysis on APVs' contributions in our paper, but we agree that further exploration would be beneficial. In Figure 3 of our paper, we already analyzed the effectiveness of APVs by comparing them against alternative client similarity metrics, such as embedding-based, weight-based, and functional similarity measures. These results demonstrated that APV-based similarity most accurately recovers ground-truth client relationships, enabling superior personalized aggregation by leveraging knowledge from genuinely similar clients. \n\nTo further isolate and quantify **APV's specific contribution**, firstly, we remove the APV entirely from our model, which disables the model from supporting personalized federated learning, resulting in a baseline called $\\text{FedAux}\\_{o}$. Besides, we can fix the APV $a_k$ of each client as random unit vector to verify the benefit of learned alignment, yielding a baseline $\\text{FedAux}\\_{random}$.  We present the experiments on datasets of varying scale (all six datasets) under a setting of 10 federated clients. The table below summarizes the results clearly indicating APV's marginal benefits. These ablations confirm that personalized federated aggregation driven by learnable APVs significantly outperforms naive aggregation ($\\text{FedAux}_{o}$), and also clearly demonstrates the necessity and effectiveness of optimizing APVs over random initialization. \n\n|                                                         | Cora  | CiteSeer | Pubmed | Amazon-Computer | Amazon-Photo | ogbn-arxiv |\n| ------------------------------------------------------- | ----- | -------- | ------ | --------------- | ------------ | ---------- |\n| $\\text{FedAux}\\_{o}$ (Remove APVs from $\\text{FedAux}$) | 69.19 | 63.61    | 82.71  | 79.54           | 83.15        | 64.44      |\n| $\\text{FedAux}\\_{random}$                               | 68.17 | 62.97    | 80.22  | 75.31           | 84.17        | 64.29      |\n| $\\text{FedAux}$ (learnable APVs, ours)                  | 82.05 | 73.16    | 85.43  | 89.92           | 92.30        | 68.50      |\n\nFor the second concern regarding **alternative APV projection designs and their generalization**, we clarify that our APV is designed as a simple but effective 1D embedding space. Local node embeddings are projected onto this space, and by jointly training the GNN parameters and the APV, we learn optimal embeddings that efficiently capture local node relationships. Meanwhile, such relationships can be preserved on the refined APV by sorting, without leakage gradients, embeddings or any model parameters. Thus our proposed APV can be an informative and privacy-preserving similarity proxy on the server-side. We specifically chose a 1D APV with cosine similarity projection due to its computational and communication efficiency, avoiding over-parameterized projection spaces that can be difficult to regularize and compare meaningfully across heterogeneous clients. Nevertheless, we fully acknowledge the reviewer's insightful suggestion to explore alternative APV configurations. Accordingly, we have evaluated the following alternative APV configurations: \n\n* Replacing the simple inner-product similarity (in page 3, line 112) with a more expressive bilinear projection defined as $s_{k,i} = \\hat{h}\\_{k,i}W^b_ka_k$. This approach introduces additional learnable parameters, potentially increasing expressiveness. \n\n* Extending the APV mapping to intermediate hidden embeddings within each GNN layer (instead of only the final layer), thus such layer-wise mapping potentially captures finer-grained local structures. \n\nWe conducted experiments under realistic non-IID scenarios to evaluate these designs, and summarize the results in the table below. These results demonstrate that the layer-wise mapping does not yield performance improvements, indicating that capturing finer-grained intermediate embeddings may not be necessary or helpful under practical non-IID conditions. Meanwhile, bilinear projection achieves performance comparable to our simpler inner-product APV but incurs significantly higher computational complexity and communication overhead. Thus, considering the trade-offs between performance, computational efficiency, and communication cost, our original APV design (FedAux) provides the best overall generalization and efficiency in practical federated graph learning scenarios.\n\n|                              | Cora  | CiteSeer | Pubmed | Amazon-Computer | Amazon-Photo | ogbn-arxiv |\n| ---------------------------- | ----- | -------- | ------ | --------------- | ------------ | ---------- |\n| FedAux + bilinear projection | 83.15 | 73.04    | 85.52  | 90.11           | 92.16        | 68.37      |\n| FedAux + layer-wise mapping  | 79.47 | 70.58    | 85.17  | 86.54           | 92.08        | 65.38      |\n| FedAux                       | 82.05 | 73.16    | 85.43  | 89.92           | 92.30        | 68.50      |\n\n**W3: Lack of a discussion of whether and how the learned APVs might leak sensitive structural or semantic information about local subgraphs.**\n\n**A3:** Thank you for pointing this out. Our learned APVs do not leak sensitive information from the local subgraph clients. We can solve your concern from two complementary perspectives: intuitive and theoretical. \n\n**Intuitively**, the learned APV represents an optimal 1D space where node embeddings are projected for sorting to capture the node relationships. Crucially, the server only sees such a 1D space (i.e., the APV itself), not the individual node embeddings or their precise coordinates. Thus, although the APV captures relational properties in the embedding space, it does not encode detailed per-node structural or feature information. The server cannot reconstruct local graph structures, node attributes, labels, or embedding values, because no gradients, embeddings, labels, or raw graph structures are transmitted between client and server. Thus, the APV intuitively serves as a safe, privacy-preserving proxy for evaluating client similarity on the server, strictly adhering to federated learning principles: data stays local, and only minimal global parameters (the APVs and the GNN parameters) are shared. \n\n**Theoretically**, we can analyze the non-identifiability of local data from a single APV. Let $H$ be a client's embedding matrix, and $C = \\frac{1}{N}H^\\top H$ is its covariance. According the Theorem 3.1 in our paper, the APV $a$ corresponds to the leading eigenvector of $C$. For any orthogonal matrix $Q$ that satisfies $Qa  = a$, which is any rotation that fixes $a$, there exists $\\tilde{H} = HQ$, such that $\\tilde{C} = \\frac{1}{N}\\tilde{H}^\\top\\tilde{H}$ has the same leading eigenvector $a$. Hence, local data cannot be uniquely reconstructed from the APV $a$. In a nutshell, such analysis indicates that the mapping from local data to the APV $a$ is highly non-injective, and the APVs are insufficient to reconstruct node embeddings or the underlying graph. Hence, the APV can be used as a privacy preserving similarity proxy on the server. We will include this privacy-guarantees analysis with formal proof in the revised version of the paper to rigorously address the reviewer's valid privacy concerns."}, {"review_id": "9emCtreAfH", "reviewer": "Reviewer_DA8p", "summary": "This paper proposed a new personalized subgraph federated learning framework with Auxiliary projections without sharing raw data or node embeddings in clients. Each client jointly trains a local GNN and a learnable auxiliary projection vector (APV), which can differentially projects node embeddings onto a 1D space and capture client-specific information. APVs serve as compact signatures that the server uses to compute inter-client similarities and perform similarity-weighted parameter mixing, yielding personalized models while preserving cross-client knowledge transfer. The experimental results across diverse graph benchmarks demonstrate that the proposed method substantially outperformed existing baselines in both accuracy and personalization performance.", "questions": "There are no experiments about the privacy preservation of APV-based federated learning, which can be evaluated by verifying the efficiency of some membership inference attacks in the server.", "limitations": "There are no experiments about the privacy preservation of APV-based federated learning, which can be evaluated by verifying the efficiency of some membership inference attacks in the server.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n1.\tThis paper proposed a new personalized subgraph federated learning framework with Auxiliary projections without sharing raw data or node embeddings in clients. Each client jointly trains a local GNN and a learnable auxiliary projection vector (APV), which serve as compact signatures that the server uses to compute inter-client similarities and perform similarity-weighted parameter mixing, yielding personalized models while preserving cross-client knowledge transfer. This idea seems to be interesting.\n2.\tThis paper evaluated the proposed method on 6 widely used datasets, and the experimental results across diverse graph benchmarks demonstrate that the proposed method substantially outperformed existing 8 baselines in both accuracy and personalization performance. \n3.\tThis paper also provided theoretical analysis on fidelity of APV introduced in the method.\n\nWeaknesses:\n1. There are no experiments about the privacy preservation of APV-based federated learning, which can be evaluated by verifying the efficiency of some membership inference attacks in the server.", "was_revised": true, "final_justification": "I will keep my rating score as the borderline accept as the authors provided additional MIA-based privacy evaluations.", "rebuttal": "We sincerely thank the reviewer for the valuable and constructive feedback. In this response, we provide answers to the point in the review.\n\n**W1: There are no experiments about the privacy preservation of APV-based federated learning, which can be evaluated by verifying the efficiency of some membership inference attacks (MIAs) in the server.**\n\n**A1:** Thank you for highlighting this important aspect. To address your concern, we conducted comprehensive empirical experiments on privacy evaluation via membership inference attacks (MIAs) as you suggested, which rigorously evaluate the privacy preservation capabilities of our APV-based federated learning method. Specifically, we adopt a strong white-box threat model, where the honest-but-curious server is granted full access to the history of received APV $a_k$ and the GNN weights $\\theta_k$ on the client $G_k$. The server attempts to predict whether a given node embedding originated from a specific client based solely on the APVs and GNN parameters received from that client. \n\nFollowing the standard practice on MIAs [1] [2], the server trains a logistic‑regression attack model $g_k(a_k,\\theta_k, h_{prob})$, defined as a two-layer MLP with hidden size 64, that takes the APV $a_k$ and GNN parameters $\\theta_k$ as inputs, and outputs the probability that a probe embedding $h_{prob}$ was in client $G_k$'s training set. The optimization objective is to maximize the likelihood on a held-out set of member against non-member examples. We compare our APV-based FedAux method against subgraph federated learning baselines, including FedGNN, FedGTA, and FedSage+. In the table below, we report Attack  AUC over five random seeds on Cora, Pubmed, and a large-scale ogbn-arxiv dataset. We find that MIAs against APV-based FedAux yield consistently low attack AUC scores in [0.49, 0.52], essentially random guessing, which demonstrates that our proposed APV does not leak sensitive membership information, providing stronger privacy than the baseline subgraph FL models. \n\n| Dataset        | FedGNN | FedGTA | FedSage+ | FedAux   |\n| -------------- | ------ | ------ | -------- | -------- |\n| **Cora**       | 0.56   | 0.54   | 0.53     | **0.51** |\n| **Pubmed**     | 0.58   | 0.55   | 0.54     | **0.52** |\n| **ogbn-arxiv** | 0.55   | 0.53   | 0.52     | **0.49** |\n\nWe have included this detailed privacy evaluation in the revised paper.\n\n[1] Membership Inference Attacks against Machine Learning Models. S&P 2017.\n\n[2] Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning. S&P 2019."}, {"review_id": "q0iZQFRs42", "reviewer": "Reviewer_U8fG", "summary": "This work proposes FedAux, an aggregation strategy designed to advance the field of personalized Federated Graph Learning (FGL). The core innovation of FedAux lies in the introduction of Auxiliary Projection Vectors (APV), which differentiably project node embeddings onto a one-dimensional space. These projections serve as auxiliary representations of clients’ data distributions and are utilized during server-side training to compute inter-client similarities. The resulting similarity scores are then used to derive personalized aggregation weights, enabling the construction of tailored global models for each client. Furthermore, this work provides theoretical proofs to validate the effectiveness of APV in capturing client-specific data distributions, along with convergence guarantees for the proposed method.", "questions": "see weakness", "limitations": "see weakness", "rating": 2, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strength: \n1.The theoratical prof of the APV and the discussion of methodology is comprehensive and necessary. \n2.The explanation of method design is accessible to readers with limited domain knowledge, and often highlight the key takeaways to offer intuitive insights. \nExtensive appendix well supports the main contents, especially to the extra profs of theorem, which is commendable. \n\nWeakness\nContribution is lacking \n1.While the motivation of this work is clear as it stated in Introduction, couple flaws are noticable: \n1.The motivation for this work is drawn from the limitations of representative approaches such as GCFL and FedPUB; however, it lacks a comprehensive discussion of more recent advances in personalized Federated Graph Learning. \n2.While the rationale behind the design of the proposed method is clearly articulated, the scope of the research appears limited. Notably, the method relies heavily on the effectiveness of the Auxiliary Projection Vector (APV), which essentially performs a sorting operation on nodes within each client’s subgraph. Given that the APV is subsequently used as an auxiliary mechanism to compute inter-client similarity—based on data distribution—and to determine aggregation weights, the experimental evaluation should encompass both homogeneous and heterogeneous global graph scenarios. However, the current experiments are restricted to homogeneous graphs, which may fundamentally contribute to the method’s favorable performance. Although the use of METIS and corresponding non-IID evaluation metrics is acknowledged, extending the evaluation to heterogeneous graph settings would enhance the generalizability and practical impact of the proposed method.\n2.A natural question that arises when reading this paper is whether FedAux or its core component, APV, can be integrated with alternative backbone models or other Federated Graph Learning (FGL) methods to enhance their performance. Such an investigation would help to demonstrate the broader applicability and utility of FedAux beyond the current experimental setting. \nPresentation-wise \nThis section concerns with the coherence of the paper organization \n1.The contribution section should provide a concise summary of the impact and significance of the proposed method, rather than offering a detailed explanation of the model’s training pipeline.\n2.The organization of the locations of tables and figures can be optimized to make it more reader friendly. For instance, Figure 1 should be located closer to the Section 3, and Table 1 should be located on the same page with detailed experimental evaluation. \n3.Figure 3 is not referenced or discussed in the main text, which may confuse readers who are unclear about its purpose or relevance to the overall narrative.\nExperiments \n1.Figure 4: The comparison appears limited due to the inclusion of only a few baseline methods, which may be insufficient to convincingly demonstrate the effectiveness of the proposed approach.\n2.Figure 5: Similar to Figure 4, this figure suffers from the same limitation—namely, the lack of comprehensive baseline comparisons—which undermines the strength of the evaluation.", "was_revised": false, "final_justification": "", "rebuttal": "Thanks for your insightful review. We have summarized all your feedback into 7 key questions and addressed them below.\n\n**W1: It lacks a comprehensive discussion of more recent advances in personalized Federated Graph Learning.**\n\n**A1:** Indeed, several new approaches have emerged beyond GCFL and FED-PUB. However, our work specifically targets privacy-preserving personalized subgraph FL, where only model parameters are exchanged, and no embeddings, gradients, or raw data are communicated. This setting is practically significant yet rarely respected in many recent works. For example, FedSSP (Tan et al., NeurIPS 2024) transmits spectral components that, while invariant across domains, inherently encode graph structure and can leak sensitive local spectral information; FedEgo (Zhang et al., KDD 2023) shares ego-network embeddings, which directly expose local structural patterns; PFGNAS (Fang et al., AAAI 2025) introduces a prompt-based neural architecture search without requiring server-side similarity estimation. However, its reliance on LLM-based personalization incurs substantial compute overhead (200+ GPU hours for 20 clients), making it impractical in many FL scenarios; FedGrAINS (Ceyani et al, SDM 2025) personalizes within each client by learning, without imposing any new server-side similarity or mixing scheme. Although FedGrAINS avoids data leakage during communication, every client must train a secondary GFlowNet alongside its GNN, incurring extra compute and memory. Differently, our model performs federated aggregation on the server-side, and the additional parameter APV is just a learnable vector rather than a complete network. While these methods contribute interesting ideas, they either compromise privacy guarantees or introduce heavy computational costs, limiting their applicability in our strict setting. GCFL and FED-PUB, on the other hand, align closely with our privacy and communication constraints and adopt similar high-level strategies: **measuring inter-client similarity using only model-level signals to perform personalized federated aggregation**. Therefore, our discussion emphasizes these two as the most relevant baselines. \n\nWe have included a more comprehensive discussion of recent personalized graph FL methods in our revised paper, and clearly position FedAux as a complementary, orthogonal approach that simultaneously satisfies privacy, efficiency, and personalization requirements.\n\n**W2: The scope of the research appears limited. Extending the evaluation to heterogeneous graph settings would enhance the generalizability and practical impact.** \n\n**A2:** Our main evaluation strictly follows the benchmark protocol of existing work FED‑PUB and FedGTA, the de‑facto standard for personalized subgraph FL, to ensure a fair comparison. However, we agree with your point that real-world FL settings often involve clients drawn from different global networks or from graphs with multiple communities, therefore, it is precisely in this heterogeneous context that a learned APV should excel. Thus, we have now extended our evaluation to heterogeneous graph scenarios. Specifically, we conduct experiments on two widely used heterogeneous graphs, DBLP and IMDB, containing multiple types of nodes and edges. Each client owns an induced subgraph. For adapting to this experimental scenario, given a heterograph $G = (V, E, R)$ whose node set $V = \\cup_{t \\in T}V_t$ is split across types $t \\in T$. We first convert the heterograph to a single adjacency that preserves multi-relation connectivity. Then run METIS on this adjacency to obtain 20 subgraphs. In each subgraph, we then recover the heterogeneous node and relation types to generate a sub-heterograph as a local client. To learn the node embeddings, we replace the GNN model with HAN (Wang, et al, WWW 2019) to learn the node embeddings in each client, and the remaining modules are kept unchanged. Note that the heterogeneous subgraph FL is an under-explored topic, and existing models such as FED-PUB, GCFL or FedGTA are non-trivial to be directly applied under the heterogeneous setting. Thus, we use the standard FL models with HAN as baselines, and report the node classification results in the table below. The new evidence shows that FedAux generalizes seamlessly to the heterogeneous client setting. We have added detailed experimental settings and analysis to our revised manuscript. \n\n| Method     | DBLP             | IMDB             |\n| ---------- | ---------------- | ---------------- |\n| FedAvg     | 78.46 ± 0.30     | 63.18 ± 0.46     |\n| FedProx    | 79.04 ± 0.25     | 63.83 ± 0.32     |\n| FedPer     | 74.12 ± 0.39     | 64.72 ± 0.46     |\n| **FedAux** | **82.90 ± 0.28** | **67.56 ± 0.30** |\n\n**W3: Can the APV be integrated with alternative backbone models or other Federated Graph Learning (FGL) methods to enhance their performance?**\n\n**A3:** Indeed. As demonstrated in the previous response, our APV mechanism for computing client similarity can be readily applied to heterogeneous graphs simply by swapping in a heterogeneous‑GNN backbone. Likewise, we expect FedAux to generalize to other graph modalities, such as spatial-temporal graphs and knowledge graphs. Since FL benchmarks for these graph types are lacking and partitioning them under FL settings is non-trivial, we leave this for future work. On the other hand, APV is compatible with existing FGL frameworks and can be incorporated to boost their performance. For instance, replacing FED‑PUB's functional‑embedding similarity with our APV yields a variant we denote FED-PUB$_{apv}$. We have also jointly trained APV with GraphGTA and FedSage+ to assess the transferability of our design. All variants were trained under the same 10‑client non‑IID split.  As shown in the table below, the APV‑enhanced models consistently outperform their original counterparts.\n\n|                  | Cora      | Pubmed    | Amazon-Computer |\n| ---------------- | --------- | --------- | --------------- |\n| FED-PUB          | 81.45     | 86.09     | 89.73           |\n| FED-PUB$_{apv}$  | **82.02** | **86.45** | **91.02**       |\n| GraphGTA         | 68.33     | 82.79     | 84.27           |\n| GraphGTA$_{apv}$ | **70.12** | **84.01** | **86.15**       |\n| FedSage+         | 69.05     | 82.62     | 80.50           |\n| FedSage+$_{apv}$ | **71.00** | **84.10** | **81.93**       |\n\n**W4: The contribution section should provide a concise summary of the impact and significance.**\n\n**A4:** We agree that the current Contribution section overly emphasizes procedural details. It has been revised for conciseness and to highlight the novelty and significance of our work. Specifically, the revised version now clearly emphasizes: (1) The introduction of a lightweight and privacy-preserving auxiliary projection mechanism (APV) to enable personalized subgraph FL; (2) The use of APV for inter-client similarity estimation under strict privacy constraints, enabling data-aware aggregation without embedding or gradient sharing; (3) Theoretical guarantees, including convergence and fidelity of the APV; (4) Extensive experiments demonstrating consistent gains across six benchmarks, along with communication efficiency and robustness under non-IID conditions.\n\n**W5: The organization of the locations of tables and figures can be optimized.**\n\n**A5:** Thank you for these suggestions to improve the readability. We have re-organized the manuscript.\n\n**W6: Figure 3 is not referenced or discussed in the main text.**\n\n**A6:** We apologize for this oversight. Actually, in the current manuscript, the experiments in Figure 3 have been discussed in the **“Effectiveness of APV‑based Client Similarity Estimation”** subsection on page 8. We will add a clear in-text reference in the revised manuscript. \n\n**W7: The comparison appears limited due to the inclusion of only a few baseline methods in Figure 4 and Figure 5.**\n\n**A7:** We respectfully argue that it is appropriate to limit the baselines in Figure 4 to FED-PUB and GCFL, and we clarify the reasoning here. The goal of this experiment is to compare the clustering efficiency on the server. However, other popular graph FL methods, such as FedSage+, FedGNN, and FedGTA, do not implement server-side clustering or similarity-based aggregation, making it impossible to conduct meaningful clustering efficiency comparisons with these approaches. Additionally, several recent personalized graph FL methods (e.g., FedEgo and FedSSP) require sharing local information, such as embedding and spectrum, with the server, which violates the strict privacy requirements that our work aims to preserve. To ensure a fair and meaningful evaluation, we therefore focus our main comparison in Figure 4 on FED-PUB and GCFL, which are most aligned with our approach in terms of both methodology and privacy guarantees.\n\nFor Figure 5, we initially used FedAvg as the sole baseline, because removing the APV module from our proposed FedAux degenerates it to FedAvg. This one-to-one ablation isolates the contribution of APV, and highlights its effect on convergence speed. Nevertheless, we totally agree with your suggestion that including additional baselines provides a more comprehensive evaluation. Accordingly, we have measured the convergence points for more baselines in the table below (evaluated per 10 communication rounds). **In our revised manuscript, we have incorporated the convergence rate curves of other baselines into Figure 5**. \n\n|         | 10 Clients | 20 Clients |\n| ------- | ---------- | ---------- |\n| FedAvg  | 60         | 60         |\n| FED-PUB | 50         | 40         |\n| GCFL    | 70         | 90         |\n| FedGTA  | 70         | 70         |\n| FedAux  | 60         | 60         |"}, {"review_id": "EvdQFG0tfm", "reviewer": "Reviewer_cYxa", "summary": "This paper proposes FedAux, a novel framework for personalized federated learning (FL) on graphs where each client holds a local subgraph from a global graph. The key idea is to introduce a learnable auxiliary projection vector (APV) per client, which projects node embeddings to a 1D latent space. Through a soft-sorting mechanism and 1D convolution (or kernel smoothing), each client generates a compact summary of its local graph structure. These APVs are sent to the server for computing inter-client similarity to enable personalized aggregation without sharing raw data or embeddings.", "questions": "See above.", "limitations": "Yes.", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths\n\n1. Strong Novelty and Motivation:\n\nThe paper tackles a real and under-explored problem: non-IID subgraph federated learning with privacy constraints.\n\nThe proposed use of differentiable 1D auxiliary projections (APVs) is new, elegant, and well-motivated.\n\n2. Compact and Privacy-Preserving Representation:\n\nAPVs serve as low-dimensional summaries of each client's subgraph, without leaking node features or embeddings.\n\nThis makes the method scalable and communication-efficient, and compliant with strong privacy assumptions.\n\n3. Solid Theoretical Foundations:\n\nThe APV is proven to converge to the first principal component of node embeddings (Theorem 3.1).\n\nThe equivalence between soft aggregation and hard sorting is also well-analyzed (Theorem 3.2).\n\nA global linear convergence guarantee is provided (Theorem 3.3), which is rare in graph FL work.\n\n4. Comprehensive Experiments:\n\nExperiments span 6 real-world datasets with varying heterogeneity (Cora, CiteSeer, Pubmed, ogbn-arxiv, Amazon).\n\nFedAux consistently outperforms strong baselines such as FedAvg, FedPer, GCFL, FED-PUB, etc.\n\nDetailed analysis on non-IIDness, convergence, similarity visualization, and ablation studies are included.\n\n5. Efficient Server-side Aggregation:\n\nUnlike previous clustering-based personalization methods, FedAux only computes pairwise cosine similarities between APVs, leading to much lower memory and time overhead.\n\nWeaknesses\n\n1. No Explicit Evaluation on Real Privacy Attacks:\n\nAlthough APV is designed to be privacy-preserving, no empirical privacy evaluation (e.g., membership inference, reconstruction) is included.\n\nThis weakens the privacy claim, even if the design is principled.\n\n2. Scalability on Large Graphs:\n\nThe kernel-based aggregation step has O(N²) cost per client (w.r.t. node count), which may not scale well for clients with large subgraphs.\n\nNo empirical analysis or ablation on scalability vs. subgraph size is presented.\n\n3. Limited Diversity in FL Protocols:\n\nThe method is only evaluated under full-participation FL. It is unclear whether FedAux can work under partial participation or asynchronous FL, which are more practical settings.", "was_revised": true, "final_justification": "I maintain my position.", "rebuttal": "We sincerely appreciate the time and efforts you've dedicated to reviewing and providing invaluable feedback to enhance the quality of this paper. We provide a point-to-point reply below for the mentioned concerns.   \n\n**W1: No Explicit Evaluation on Real Privacy Attacks. Although APV is designed to be privacy-preserving, no empirical privacy evaluation (e.g., membership inference, reconstruction) is included.**\n\n**A1:** Thank you for highlighting this important aspect. We have added a comprehensive empirical privacy evaluation via **membership inference attacks** (MIAs), exactly as you suggested, to rigorously test whether our APV-based framework leaks sensitive information. We assume an honest‑but‑curious server with full access to the entire history of a client's APV $a_k$ and its GNN parameters $\\theta_k$. The server's goal is to decide whether a probe embedding $h_{prob}$ originated from client $G_k$, using only $(a_k, \\theta_k)$, while raw data, node embeddings, and gradients are never shared. Following the standard MIA methodology [1] [2], the server trains an attack classifier $g_k(a_k,\\theta_k, h_{prob})$ implemented as a two‑layer MLP (hidden size 64), to output the probability that $h_{prob}$ belongs to client $G_k$'s training set. The attack is trained by maximum likelihood on a held‑out mixture of member against non‑member probes. We compare FedAux against representative subgraph FL baselines FedGNN, FedGTA, and FedSage+ on Cora, PubMed, and OGBN‑Arxiv, using exactly the same client partitions as in our main experiments. We report Attack AUC (↓ better privacy) averaged over five random seeds. \n\n| Dataset  | FedGNN | FedGTA | FedSage+ | FedAux |\n| -| -| -| -| -|\n| **Cora**       | 0.56   | 0.54   | 0.53     | **0.51**      |\n| **Pubmed**     | 0.58   | 0.55   | 0.54     | **0.52**      |\n| **ogbn‑arxiv** | 0.55   | 0.53   | 0.52     | **0.49**      |\n\nAcross all datasets, MIAs against FedAux achieve AUCs in $[0.49, 0.52]$, i.e., indistinguishable from random guessing, demonstrating that APVs do not leak sensitive membership information and, in fact, offer stronger privacy than baseline subgraph FL methods.\n\nFor the privacy evaluation by **reconstruction**, the server attempts to rebuild client-side data from what it sees. However, a meaningful reconstruction attack is practically infeasible when the server's view is restricted to the Auxiliary Projection Vectors (APVs) $a_k$ and GNN parameters $\\theta_k$ in our model. It is because although APV acts as a space to preserve local node relationships by node embedding projection and sorting, the precise coordinates of node embeddings in this space are not available for the server. Thus, recovering the $N_k$ high-dimensional embeddings or an $N_k \\times N_k$ adjacency from a single vector $a_k$ is an underdetermined inverse problem with infinitely many solutions. Even if an adversary imposes additional priors (e.g., sparsity, degree distributions), inferring a matching adjacency or feature matrix requires solving a non-convex, combinatorial optimization (e.g., matching covariance eigen-structure), which is NP-hard in general. Our membership-inference experiments already show that no sensitive information about individual nodes can be extracted from APVs. Reconstruction, as an exponentially harder task, would necessarily fail if membership inference (a weaker attack) yields only random-guess performance.\n\n[1] Membership Inference Attacks against Machine Learning Models. S&P 2017.\n\n[2] Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning. S&P 2019.\n\n**W2: Scalability on Large Graphs.**\n\n**A2:** We acknowledge that in our current design, the full kernel-based aggregation in Eq.(6) of our paper $z_{k, i} = \\frac{1}{M_i}\\sum^{N_k}\\_{j=1} \\kappa(s_{k,i}, s_{k,j}) h_{k,j}$ has complexity $O(N_k^2)$. It is because we expect that the learned APV as a shared similarity proxy can fully preserve the relationships in the local client structure, while not leaking any sensitive information of the client. Thus, this quadratic cost ensures maximum expressivity that every node can perform differentiable soft-sort against every other. However, in practice, clients with large subgraphs may encounter a scalability problem. Although our paper's main purpose is to propose a powerful and privacy-preserving model for subgraph FL, rather than improving the scalability, your suggestion is still valuable for enhancing our model. To address your concern, we propose a simple windowed-kernel variant that trades a small amount of expressivity for near-linear complexity. Specifically, we improve the kernel-based aggregation in Eq.(6) by a neighbor-specific kernel aggregation as $z_{k, i}=\\frac{1}{M_i^{(m)}} \\sum\\_{j \\in \\mathcal{N}\\_i^{(m)}} \\kappa (s_{k, i}, s_{k, j}) h_{k, j}$, where $\\mathcal{N}_i^{(m)}$ is the set of the $m$ nearest neighbors of node $v_i$ in the sorted APV space. For example, the $\\frac{m}{2}$ ranks immediately above and below $v_i$. By such construction,  $\\left|\\mathcal{N}\\_i^{(K)}\\right|=m \\ll N_k$, so the per-client cost reduces from $O(N_k^2)$ to $O(N_k \\log N_k)$. Intuitively, this leverages the fact that a Gaussian kernel $\\kappa(s_i, s_j)$ decays rapidly with $|s_i - s_j|$, so distant nodes contribute only negligible weight and can be safely omitted. \n\nBelow, we present a new empirical analysis on scalability w.r.t. the subgraph size in the table below. We benchmark the original full kernel-based aggregation with $O(N_k^2)$ (denoted as $\\text{FedAux}\\_{full}$) and FedAux with our newly proposed neighbor-specific kernel aggregation $\\text{FedAux}\\_{neigh}$ ($m = 8$) on three public datasets (Cora, PubMed and ogbn-arxiv) that span three orders of magnitude in node count with 5 clients: \n\n| dataset    | avg nodes / client | $\\text{FedAux}\\_{full}$ running time  / epoch (ms) | $\\text{FedAux}\\_{neigh}$ running time / epoch (ms) | speed‑up  | Reduced GPU Memory | accuracy ($\\text{FedAux}\\_{full}$) | accuracy ( $\\text{FedAux}\\_{neigh}$) |\n| -- | - | -| - | --------- | ------------------ | - | - |\n| Cora       | 542                | 12 ± 1   | **11 ± 1**     | **1.1 ×** | 17.6%              | 84.57                              | 83.20                                |\n| PubMed     | 3,943              | 331 ± 4           | **74 ± 2**              | **4.5 ×** | 21.3%              | 88.10                              | 88.02                                |\n| ogbn‑arxiv | 33,869             | 2,253 ± 11           | **281 ± 9**       | **8.0 ×** | 41.9%              | 68.83                              | 68.29                                |\n\nWe have the following observations. Firstly, even with the current full-kernel model, it can complete the client training on all datasets in an acceptable time (less than 10,000 ms per epoch). Our newly proposed $\\text{FedAux}\\_{neigh}$ is much more efficient as the size of the client increases. Secondly, since the neighbor-specific kernel computation keeps only $m$ neighbors per node, the memory consumption can be significantly optimized. Thirdly, across all datasets, the efficient variant $\\text{FedAux}\\_{neigh}$ loses less than $1\\%$ accuracy versus the full kernel. Thus, our neighbor-specific kernel aggregation retains all predictive performance but restores practical scalability. We will add these analyses to the revised version of the paper.\n\n**W3: Limited Diversity in FL Protocols.**\n\n**A3:** We agree that evaluating our model beyond full participation is essential. In our revision, we have added more evaluation of our model under both partial participation and asynchronous protocols. For the **partial participation**, on PubMed dataset, we use $K = 20$ clients, but in each round only a random subset of size $\\lceil p K\\rceil$ participates, with ratios $p \\in \\\\{0.25, 0.5, 0.75\\\\}$. Other hyperparameters are kept the same as in the full-participation experiments in our paper. In the table below, we show the results under a partial participation setting, and additional results on more benchmark datasets have been updated in our revised paper. The results show that even with only 25% clients per round, FedAux still maintains a strong performance margin, demonstrating its robustness to partial updates.\n\n| Participation $p$ | 0.25      | 0.50      | 0.75      | 1.00      |\n| ----------------- | --------- | --------- | --------- | --------- |\n| FedAvg            | 79.12     | 79.85     | 80.41     | 80.97     |\n| FED-PUB           | 82.36     | 83.10     | 83.75     | 84.66     |\n| FedAux            | **82.61** | **83.45** | **84.56** | **84.87** |\n\nBesides, we simulate a simple bounded-delay  **asynchronous FL** for evaluation. Specifically, at each communication round, a subset of clients is selected, but some fraction $\\delta$ of their updates are delayed by one round before being incorporated into the server's aggregation. We test $\\delta \\in \\\\{0.2, 0.5\\\\}$ with full participation $p=1$. Results are presented in the table below, which shows that even under asynchronous conditions with delayed updates, FedAux remains stable and continues to outperform baselines. It demonstrates that the learned APVs evolve smoothly and enable robust, similarity-aware aggregation even when client updates arrive out of order.\n\n| Delay rate $\\delta$ | 0.20      | 0.50      | 0.00 (sync) |\n| ------------------- | --------- | --------- | ----------- |\n| FedAvg              | 79.10     | 78.25     | 80.97       |\n| FED-PUB             | 83.21     | 82.45     | 84.66       |\n| FedAux              | **84.30** | **83.80** | **84.87**   |"}]

Author rebuttal:

Meta-review: This paper addresses the non-IID challenge in graph federated learning. To tackle this, the authors propose Federated Learning with Auxiliary Projections (FedAux) and provide a theoretical analysis of its convergence. Empirical evaluations across several datasets demonstrate competitive performance.

In the rebuttal, the authors clarify the contribution of APV, the research goal of privacy-preserving personalized subgraph FL, and include additional experiments on a heterogeneous dataset (though I recommend adding more baseline comparisons) as well as privacy evaluations.

The research goal is important within the FL field, but the scope is rather narrow, and the improvements in the main results are not particularly significant. Overall, I consider this a borderline paper.
Decision: Accept (poster)