Title: Subgraph Federated Learning via Spectral Methods
Venue: NeurIPS 2025
Accepted: yes
Keywords: Subgraph Federated Learning

Graph neural networks

Federated Learning

Interconnected Graphs

Laplacian Smoothing
Abstract: We consider the problem of federated learning (FL) with graph-structured data distributed across multiple clients. In particular, we address the common scenario of interconnected subgraphs, where interconnections between clients significantly influence the learning process. Existing approaches suffer from critical limitations, either requiring the exchange of sensitive node embeddings, thereby posing privacy risks, or relying on computationally-intensive steps, which hinders scalability.

To tackle these challenges, we propose FedLap, a novel framework that leverages global structure information via Laplacian smoothing in the spectral domain to effectively capture inter-node dependencies while ensuring privacy and scalability. We provide a formal analysis of the privacy of FedLap, demonstrating that it preserves privacy. Notably, FedLap is the first subgraph FL scheme with strong privacy guarantees. Extensive experiments on benchmark datasets demonstrate that the proposed method achieves competitive or superior utility compared to existing techniques.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes two methods FEDLAP and FEDLAP+, for Subgraph Federated Learning (SFL) which has gained interest in recent years (some NeurIPS and ICLR papers on this in recent years, for example). In the setting considered in this paper, graph-structured data is partitioned across multiple clients, each with a disjoint subgraph. The central challenge addressed is how to capture global graph structure to improve learning performance without violating privacy or incurring excessive communication costs.\n\nSome key features of the method:\n- a graph Laplacian regularizer in the loss function to balance nodes with labels and without labels\n- use truncated eigenvectors of the Laplacian to reduce communication and enhance privacy.\n- as an offline part of the algorithm, a novel decentralized Arnoldi iteration to compute the spectral components in a privacy-preserving way. A formal privacy analysis is provided for this method.\n\nThere is a comprehensive experimental comparison across six benchmark datasets which shows that FEDLAP offers competitive or superior accuracy with better communication efficiency.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\n\n- A formal privacy analysis for the offline phase (Theorem 1 and Corollary 1), seems to be the first one for SFL methods (e.g. baselines FEDSTRUCT and FEDGCN lack rigorous privacy proofs).\n\n- significantly reduces communication overhead through the offline sharing of eigenvectors\n\n- The experimental results demonstrate competitive or superior accuracy compared to SOTA methods\n\nWeaknesses:\n\n- The privacy analysis is not entirely rigorous in my opinion: looking at the proofs in the appendix, the results assume randomness of the adjacency matrices. This then gives in the limit those normal distributions stated in Theorem 1. I see here two problems: a) the assumptions of the randomness of $A$ is not clearly stated in the main text and b) the results does not exactly hold for finite $n$. \n\n- It is also not clearly stated what does the privacy guarantee of Thm. 1 mean. It is kind of differential privacy guarantee (privacy loss random variable for edge-DP), however it is not clearly stated.\n\n- No convergence guarantees for the proposed method\n\nQUESTIONS:\n- The privacy analysis assumes a random adjacency matrix, right? More specifically, an adjacency matrix where each element in Bernoulli(p) distributed. Could you extend the analysis to static non-random graphs?\n\n- What does the guarantee exactly tell: are the rest of the edges random and the result protect a specific fixed edge?\n\n- Can you say anything rigorous about the case of finite $n$? Does the privacy analysis require $n \\rightarrow \\infty $ ?\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-06-21"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe authors propose a method which is able to cater for graph-structured data in the federated learning domain. It claims that it improves on the state of the art on both communication and overall performance.\n\nSTRENGTHS AND WEAKNESSES:\nThe paper tackles an important and unsolved problem: how to efficiently train in the FL domain when using graph-structured data, which is an important use-case.\n\nThe paper strengths can be summarised as follows:\n\n- The performance is appealing and is compared against a number of competing methods\n- The code is provided for the reviewing process\n- The evaluation is extensive in terms of overall results regarding performance\n\nHowever the paper suffers from severe flaws which I am outlining below:\n\n- Claims of strong / formal privacy -- to me this is the biggest problem with this paper. Normally, privacy definitions are quite strict and the notion of \"not being able to infer the connections of nodes\" is not a form of _strong_ privacy or any formal definition of it. I would argue the method provides _no_ privacy at all apart from being unable to infer who your neighbors are.\n- Little light on the details regarding experimentation hardware used and potential scalability of the method (although results are extensive in terms of numbers).\n\nQUESTIONS:\nBased on my prior comments I would like the authors to answer the following questions:\n\n- Can you please expand a bit more on the privacy? Normally, such methods require a form of statistical privacy (e.g. DP) to avoid data leaks and inference attacks. At the very least some sort of formal encryption or similar. As presented, I currently lack understanding on why the definition provided can be considered a form of \"strong\" or \"formal\" privacy definition.\n- Can you please elaborate a bit in terms of the hardware resources required? I feel it is quite important given the context of the paper.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-07-03"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper presents  framework, FEDLAP,  for subgraph federated learning that addresses the challenge of learning from graph-structured data distributed across multiple clients while preserving privacy. \n\nThe key contribution lies in leveraging Laplacian smoothing in the spectral domain to capture inter-node dependencies without requiring the exchange of sensitive node embeddings or computationally expensive structural information sharing that existing methods rely on. \n\nThe authors propose two variants: FEDLAP, which uses Laplacian regularization to implicitly enforce structural similarity among neighboring nodes, and FEDLAP+, which operates in the spectral domain using truncated eigendecomposition to reduce communication overhead and enhance privacy.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths:** This paper makes several significant contributions to subgraph federated learning that address real limitations in existing work. The theoretical foundation is solid, with FEDLAP being the first SFL method to provide formal privacy guarantees through rigorous analysis of potential attacks using log-likelihood ratios and KL divergence bounds. \n\n**Weaknesses:** Despite its strengths, the paper has several limitations that could impact its practical adoption. The privacy analysis, while theoretically sound, relies on strong assumptions (known connection probabilities, access to spectral matrices) that may not hold in practice, and the actual attack performance shown in Figure 4 is weaker than theoretical predictions, suggesting the bounds may be loose. The method's performance is inconsistent across graph types—while FEDLAP excels on homophilic graphs, it significantly underperforms on heterophilic graphs like Chameleon, limiting its general applicability. \n\nThe decentralized Arnoldi iteration requires homomorphic encryption, which adds computational overhead and implementation complexity that isn't fully characterized in terms of practical costs. The communication analysis, while showing theoretical improvements, doesn't account for the encryption overhead or provide empirical measurements of actual network traffic. \n\nAdditionally, the truncation parameter r requires careful tuning and domain knowledge about graph structure (number of communities), which may not be readily available in practice. \n\nThe experimental setup is somewhat limited, focusing primarily on semi-supervised node classification with only 10% labeled nodes, and doesn't explore other important graph learning tasks or more challenging federated settings with severe data heterogeneity.\n\nQUESTIONS:\nNo more questions, please check the weakness.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-03"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes FEDLAP and its spectral variant FEDLAP+, novel frameworks for subgraph federated learning that leverage Laplacian smoothing in both spatial and spectral domains to capture global graph structure while preserving privacy. By avoiding the exchange of sensitive node features and using a decentralized Arnoldi iteration for efficient spectral decomposition, the approach reduces communication overhead and enhances scalability. The authors provide formal privacy guarantees and demonstrate through extensive experiments that FEDLAP achieves competitive or superior accuracy compared to existing SFL methods, especially on large or heterophilic graphs.\n\nSTRENGTHS AND WEAKNESSES:\n1. This paper presents a novel, privacy-preserving approach to subgraph federated learning using Laplacian smoothing and spectral methods.  It offers strong theoretical grounding, including formal privacy guarantees, and demonstrates competitive or superior performance across multiple datasets.  The proposed method reduces communication overhead and scales well.\n2. The privacy analysis relies on idealized assumptions, and the method is mainly tested on node classification, limiting its generality. FEDLAP underperforms on heterophilic graphs, and the computational cost of spectral decomposition is not fully discussed.\n\nQUESTIONS:\n1. The privacy guarantees rely on strong assumptions, such as attackers having access to certain spectral components. Could the authors elaborate on how realistic these assumptions are in practice? \n2. While FEDLAP+ improves performance on heterophilic graphs, the base FEDLAP model performs poorly in such settings. Could the authors provide more insight into this limitation?\n3. The spectral truncation parameter  𝑟 plays a key role in FEDLAP+.  Can the authors provide more guidance on how to choose it across different datasets?\n4. In real-world federated settings, the graph structure may evolve over time. How adaptable is FEDLAP/FEDLAP+ to dynamic graphs? Can the spectral components be incrementally updated, or must the entire process be rerun? \n5. On Chameleon, FEDSTRUCT outperforms FEDLAP. Could the authors explain the limitations of Laplacian smoothing in these cases, and whether hybrid approaches (combining spectral and feature-level smoothing) might help?\n\nLIMITATIONS:\nYES", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-07-03"}