Towards Understanding Generalization of Federated Adversarial Learning: Perspective of Algorithmic Stability

Federated Adversarial Learning (FAL) enhances model robustness by integrating adversarial training into the federated learning framework. Despite recent advances proposing efficient FAL algorithms, existing work has mainly focused on convergence properties, with limited understanding of their generalization capabilities. To address this, we present the unified theoretical framework for analyzing FAL generalization through the lens of algorithmic stability. We first analyze general FAL algorithms based on stochastic gradient descent (SGD) and derive perturbation-dependent generalization bounds, which reveal that stronger adversarial attacks can lead to degraded generalization. To mitigate the impact of adversarial perturbations, we leverage Moreau envelope optimization and establish a perturbation-independent bound, demonstrating its efficacy in simultaneously enhancing both robustness and generalization. Finally, we extend our analysis to the practical black-box setting, demonstrating that zeroth-order optimization techniques can effectively maintain both robustness and generalization even without local gradient access.

Federated Learning (FL) enables decentralized clients to collaboratively train machine learning models without sharing raw data, thereby preserving user privacy. To counter malicious security threats, Federated Adversarial Learning (FAL) embeds adversarial training directly into this distributed framework to enhance robustness. However, while prior FAL research predominantly explores optimization convergence, the generalization capabilities of these robust models against unseen attacks remain poorly understood. To resolve this theoretical barrier, we establish a unified framework to analyze FAL generalization through the lens of algorithmic stability. We first demonstrate that standard stochastic gradient descent (SGD) yields perturbation-dependent bounds, proving that intense adversarial attacks inherently degrade generalization performance. To mitigate this vulnerability, we introduce FalME; by leveraging Moreau envelope optimization, it guarantees a perturbation-independent bound that simultaneously enhances robustness and generalization. Finally, we extend our framework to practical black-box deployments via FalZO, demonstrating that zeroth-order techniques successfully preserve both properties without local gradient access.