抑制噪声导致的原型退化：面向隐私保护的个性化联邦微调
Taming Noise-Induced Prototype Degradation for Privacy-Preserving Personalized Federated Fine-Tuning
为视觉多域个性化联邦微调提供客户端隐私插件：按维度类别方差分配各向异性噪声、并用蒸馏引导裁剪正则化把特征范数压到裁剪阈值附近，可直接替换 ProtoPFL 中的各向同性高斯扰动以改善隐私-效用权衡。
原文依据 we propose VPDR, a client-side privacy plug-in that seamlessly integrates into existing ProtoPFLs
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论基于原型的个性化联邦学习（ProtoPFL）通过传输紧凑的类别原型实现高效的多域适配，但直接共享原型会带来隐私风险。一种常见防御是在原型计算前对每个样本做 l_2 裁剪以约束敏感度，随后加入各向同性高斯噪声以满足本地差分隐私（LDP）。然而，各向同性高斯原型扰动（IGPP）往往会过度扰动具有判别性的维度，且难以在裁剪阈值与表征保真度之间取得平衡。本文提出 VPDR，一种可无缝集成到现有 ProtoPFL 中的客户端隐私插件。受「逐维类别方差反映判别性」这一观察的启发，我们引入方差自适应原型扰动（VPP），对判别性子空间分配更少的噪声，在保证隐私的同时保留语义可分性。我们进一步提出蒸馏引导的裁剪正则化（DCR），使特征范数能够自适应地集中在预定义裁剪阈值附近，同时保持预测一致性。理论分析表明，在相同隐私约束下，我们的分组机制所提供的隐私保证不弱于各向同性基线。在多域基准上的大量实验表明，VPDR 取得了更优的隐私-效用权衡，在不牺牲对真实攻击的鲁棒性的前提下，于个性化联邦微调中优于 IGPP。
英文原文摘要 1535 字符
Prototype-based Personalized Federated Learning (ProtoPFL) enables efficient multi-domain adaptation by communicating compact class prototypes, but directly sharing them poses privacy risks. A common defense involves per-example l_2 clipping before prototype computation to bound sensitivity, followed by isotropic Gaussian noise to enforce Local Differential Privacy (LDP). However, Isotropic Gaussian Prototype Perturbation (IGPP) typically over-perturbs discriminative dimensions and struggles to balance the clipping threshold with representation fidelity. In this paper, we propose VPDR, a client-side privacy plug-in that seamlessly integrates into existing ProtoPFLs. Motivated by the observation that dimension-wise class variance reflects discriminability, we introduce Variance-adaptive Prototype Perturbation (VPP), which allocates less noise to discriminative subspaces, preserving semantic separability while ensuring privacy. We further develop Distillation-guided Clipping Regularization (DCR), which enables feature norms to adaptively concentrate near the predefined clipping threshold while maintaining prediction consistency. Theoretical analysis shows that our groupwise mechanism provides privacy guarantees no weaker than the isotropic baseline under the same privacy constraints. Extensive experiments on multi-domain benchmarks demonstrate that VPDR achieves a superior privacy-utility trade-off, outperforming IGPP in personalized federated fine-tuning without sacrificing robustness against realistic attacks.