COMPACT seminar · IRISA Rennes · 28 September 2026

Projection-Based Private Federated Learning on Compact Riemannian Submanifolds

Thibault Pautrel

L2S, CentraleSupélec, Université Paris-Saclay

Collaborators

This is joint work with

Florent Bouchard

L2S, CNRS
Université Paris-Saclay

Guillaume Ginolhac

LISTIC
Université Savoie Mont Blanc

Ammar Mian

LISTIC
Université Savoie Mont Blanc

Aurélien Bellet

Inria
Montpellier

1 The problem EEG trials and covariance matrices Data scattered across sites
2 Riemannian geometry tutorial Manifolds, tangent spaces, metrics Geodesics, exponential, logarithm, retractions Sphere, Stiefel, SPD
3 SPDNet A Riemannian architecture for covariances What is optimised, and where it lives
4 Private Riemannian federated learning Local optimisation and aggregation What shared parameters leak DP-RFedProj and its convergence rate
5 Numerical experiments Datasets and centralised baseline Accuracy against the privacy budget Aggregation cost
6 Conclusion and perspectives What the framework buys, what it costs Cross-subject private learning

Section 1

The problem

EEG trials, covariance matrices, scattered sites, SPDNet

EEG data

Electrodes record the electrical activity of the brain.

Motor imagery: the subject imagines a movement and the signal should tell us which one.

A trial is a matrix $X\in\mathbb{R}^{C\times T}$, with $C$ channels and $T$ timestamps, carrying a label $y$: right hand, left hand, feet, tongue, rest.

Neighbouring electrodes see related signals. That redundancy is the structure we want to exploit.

From raw signals to covariance

The channels are correlated. Important information to predict the class: how pairs of electrodes co-vary over the trial.

SPD matrices

Covariance matrices are structured features.

Definition

$\Sigma\in\mathbb{R}^{C\times C}$ is symmetric positive definite if $\Sigma^{\top}=\Sigma$ and $x^{\top}\Sigma x>0$ for every $x\neq 0$.

Open and unbounded
Convex
Stable under positive scaling

Not a vector space.

Question

What model can we train on these features?

How to classify a covariance matrix?

Naive idea

Classify $\mathrm{vec}(\Sigma)\in\R^{C^2}$

Issue. High dimension. The symmetry is ignored and the SPD constraint is not exploited.

Refined idea

Classify $\mathrm{Vech}(\Sigma)\in\R^{C(C+1)/2}$

Issue. Half the dimension. The positive definite constraint is still ignored.

Main idea

Exploit the geometry of SPD matrices, with a Riemannian architecture.

Section 2 · tutorial

Riemannian geometry

Manifolds, tangent spaces, metrics, geodesics, retractions

No prerequisite.

Manifold, tangent space, metric

Covered by charts $\varphi:U\to\mathbb{R}^d$, with smooth transitions $\psi\circ\varphi^{-1}$. Curved globally, flat locally.

$T_p\mathcal{M}=\{\dot\gamma(0):\gamma(0)=p\}$, the velocities at $p$ of all curves through $p$. A vector space of dimension $d$, attached to $p$.

Metric

An inner product $\langle\cdot,\cdot\rangle_p$ on each $T_p\mathcal{M}$. Riemannian submanifold: the ambient one.

Riemannian gradient

$\operatorname{grad} f(p)=\Pi_{T_p\mathcal{M}}\bigl(\nabla\bar f(p)\bigr)$

Geodesics, exponential, logarithm

Joining two points of $\mathcal{M}$: the straight segment of $\mathbb{R}^n$ leaves the manifold at once.

$\exp_p(v)=\gamma(1)$ for the geodesic with $\dot\gamma(0)=v$, and $\log_p=\exp_p^{-1}$ where defined, with $d(p,q)=\lVert\log_p(q)\rVert_p$.

Geodesic

No tangential acceleration, $\nabla_{\dot\gamma}\dot\gamma=0$, locally length-minimising.

Retraction

$R_p(v)=\Pi(p+v)$, matching $\exp_p$ to first order: $\lVert R_p(tv)-\exp_p(tv)\rVert=O(t^{2})$. Absil and Malick, 2012

Examples

Sphere $S^{n-1}$

Stiefel $\mathrm{St}(n,p)$

SPD $\mathcal{S}_C^{++}$

Set

$\{x:\lVert x\rVert = 1\}$

$\{X: X^\top X = I_p\}$

$\{\Sigma = \Sigma^\top \succ 0\}$

Tangent space

$\{v : x^\top v = 0\}$

$\{\Delta : X^\top\Delta + \Delta^\top X = 0\}$

$\mathcal{S}_C$, all symmetric

Metric

induced, $u^\top v$

induced or canonical

affine-invariant, $\operatorname{tr}(\Sigma^{-1}U\Sigma^{-1}V)$

$\exp$

$\cos\lVert v\rVert\, x + \sin\lVert v\rVert\,\tfrac{v}{\lVert v\rVert}$

closed form, two matrix exponentials

$\Sigma^{1/2}\exp\!\big(\Sigma^{-1/2}U\Sigma^{-1/2}\big)\Sigma^{1/2}$

$\log$

closed form

no closed form

closed form

Gradient

$\nabla f - (x^\top\nabla f)x$

$\nabla f - X\operatorname{sym}(X^\top\nabla f)$

$\Sigma\operatorname{sym}(\nabla f)\Sigma$

Retraction

normalise

polar factor of $X+\Delta$

$\Sigma + U$ when it stays positive

Section 3

SPDNet

A Riemannian architecture for covariance features

Where we stand

The features are covariances
One trial gives $\Sigma\in\mathcal{S}^{++}_C$.
Flattening ignores the constraint
$\mathrm{vec}(\Sigma)$ or $\mathrm{Vech}(\Sigma)$ drop the positive definiteness.
We now have the tools
Tangent spaces, metrics, geodesics, retractions.

Idea

Build the classifier as a Riemannian architecture, acting on $\Sigma$ directly.

SPDNet Huang and Van Gool, 2017

SPDNet: What is optimised?

Layers without learnable parameters

ReEig

spectral rectification, a fixed map

LogEig

tangent space at $I$, a fixed map

Vech

upper triangle of the matrix, a fixed linear map into $\mathbb{R}^{d_L(d_L+1)/2}$

Parametrised layers

BiMap_1..L

$X_k = W_k\,X_{k-1}\,W_k^{\top}$

$W_k\in\mathrm{St}(d_{k-1},d_k)$, orthonormal columns. One weight per BiRe block, so $L$ of them.

Fully connected

$\hat{y}=\mathrm{softmax}\bigl(\xi\,\mathrm{Vech}(X_L)+\beta\bigr)$

$\xi\in\mathbb{R}^{K\times d_L(d_L+1)/2}$ and $\beta\in\mathbb{R}^{K}$, free parameters with no constraint.

Consequence

Two optimisers in the same model. Riemannian on Stiefel for the $W_k$, and plain Euclidean for $\xi$ and $\beta$.

Section 4

Private Riemannian
federated learning

Federated learning, privacy, and the proposed algorithm

The data is scattered

EEG encodes mental state. It is personal data, so raw trials never leave the site that recorded them.

Question

Can we train one model on all data without moving any of it?

Federated learning

One shared objective,
no shared data

$\displaystyle\arg\min_{\theta}\Bigl\{F(\theta):=\tfrac{1}{N}\sum_{i=1}^{N} F_i(\theta,\mathcal{D}^{(i)})\Bigr\}$

$F_i(\theta,\mathcal{D}^{(i)})=-\dfrac{1}{|\mathcal{D}^{(i)}|} \sum_{\ell=1}^{|\mathcal{D}^{(i)}|}\log\bigl[h_{\theta}(z_{i,\ell})\bigr]_{y_{i,\ell}}$

Initialise $\theta_0$. Then repeat for $T$ communication rounds.

Broadcast
The server sends $\theta_t$ to a subset $S_t$ of clients.
Local optimisation
Each selected client runs $E$ epochs on its own data from $\theta_t$.
$\displaystyle\theta_t^{(i)}\approx\arg\min_{\theta} F_i\bigl(\theta,\mathcal{D}^{(i)}\bigr)$
Upload
Each client returns $\theta_t^{(i)}$. The data never moves.
Aggregation
The server forms the next model.
$\displaystyle\theta_{t+1}\leftarrow\operatorname{Agg} \bigl(\theta_t,\theta_t^{(i)}\bigr)$

Riemannian Federated Learning

Now: $\theta\in\mathcal{M}$, a compact submanifold of $\mathbb{R}^{d\times p}$.

Local optimisation

$\displaystyle\theta_t^{(i)}\approx\arg\min_{\theta\in\mathcal{M}} F_i\bigl(\theta,\mathcal{D}^{(i)}\bigr)$

Aggregation

$\displaystyle\theta_{t+1}\leftarrow\operatorname{Agg} \bigl(\theta_t,\theta_t^{(i)}\bigr)\in\mathcal{M}$

Local optimisation client side

Euclidean

$x_{\text{next}}\leftarrow x-\eta\,\nabla f_i(x;\mathcal{B}_j)$

Riemannian

$x_{\text{next}}\leftarrow R_x\bigl(-\eta\operatorname{grad}f_i(x;\mathcal{B}_j)\bigr) \in\mathcal{M}$

The ambient step leaves $\mathcal{M}$.

Keep only the part $\mathcal{M}$ can follow, the Riemannian gradient $\xi=-\eta\operatorname{grad}f_i(x)\in T_x\mathcal{M}$.

A retraction $R_x$ turns that direction into a point of $\mathcal{M}$.

Projection-based retraction

$R_x(\xi)=\Pi(x+\xi)$, valid on any compact submanifold.

Aggregation existing answers

Fréchet mean

$\theta_{t+1}\leftarrow\arg\min_{\theta\in\mathcal{M}}\tfrac1k\sum_i d(\theta,\theta_t^{(i)})^2$

Issue: no closed form, only an iterative flow.

KFAvg

$\theta_{t+1}\leftarrow\exp_{\theta_t}\Bigl(\tfrac1k\sum_i \log_{\theta_t}(\theta_t^{(i)})\Bigr)$

Issue: $\exp$ and $\log$ often unknown or expensive.

RetAvg

$\theta_{t+1}\leftarrow R_{\theta_t}\Bigl(\tfrac1k\sum_i R^{-1}_{\theta_t}(\theta_t^{(i)})\Bigr)$

Issue: $R$ and $R^{-1}$ rarely both available.

Aggregation what we propose

Computationally cheap, geometry-preserving aggregations

RLAvg

$\theta_{t+1}\leftarrow R_{\theta_t}\Bigl(\tfrac1k\sum_i L_{\theta_t}(\theta_t^{(i)})\Bigr)$

Idea: replace $R^{-1}$ by the lifting $L_{\theta_t}(\theta)=P_{\theta_t}(\theta-\theta_t)$.

ProjAvg

$\theta_{t+1}\leftarrow\Pi\Bigl(\tfrac1k\sum_i\theta_t^{(i)}\Bigr)$

Idea: average in the ambient space, then project back.

Keeping data on the client is not enough

A client sends a submission $\Delta^{(i)}$, built from $\theta_t$ and its local iterate. That submission is a known, deterministic function of its records.

The server observes $\Delta^{(i)}$. It also knows $\theta_t$, the model and the protocol, because it chose them.

So it can guess a record and compute the submission that guess would produce.

Then it minimises the distance between the two submissions, over the guess.

Reconstruction attacks Zhu et al., 2019 and membership inference Shokri et al., 2017 are exactly this, at scale.

Threat model

The server follows the protocol exactly. It simply keeps everything it sees.

Honest, and curious.

$\mathcal{V}_T=\bigl(\{(\theta_t,S_t,\{\Delta^{(i)}\}_{i\in S_t})\}_{t=0}^{T-1},\theta_T\bigr)$

Protecting records

Two databases over the same cohort of clients.

Record-adjacent, $D\bowtie D'$: one client's dataset differs by a single substituted record.

Everything else is untouched, including the other clients.

Differential privacy

$(\varepsilon,\delta)$-DP (Dwork et al., 2006)

A randomised $\mathcal{A}$ is $(\varepsilon,\delta)$-DP if, for every record-adjacent pair $D\bowtie D'$ and every measurable set $E$, $$\Pr\bigl(\mathcal{A}(D)\in E\bigr)\le e^{\varepsilon}\,\Pr\bigl(\mathcal{A}(D')\in E\bigr)+\delta .$$

$E$: any set of outcomes the server may test.

Target: the whole transcript $\mathcal{V}_T$.

Gradient privatisation in Euclidean spaces

minibatch gradient

$\displaystyle \widehat{\nabla} f(x,\mathcal{B}) =\frac1B\sum_{z\in\mathcal{B}}\nabla f(x,z)$

clipped

$\displaystyle \widehat{\nabla}^{C} f(x,\mathcal{B}) =\frac1B\sum_{z\in\mathcal{B}} \textcolor{#009E73}{\operatorname{clip}_C}\bigl(\nabla f(x,z)\bigr)$

$\textcolor{#009E73}{\operatorname{clip}_C}(v) =v\,\min\bigl(1,\,C/\lVert v\rVert\bigr)$

If $\mathcal{B}'$ replaces $z$ by $z'$, then $$\bigl\lVert\widehat{\nabla}^{C} f(x,\mathcal{B}) -\widehat{\nabla}^{C} f(x,\mathcal{B}')\bigr\rVert\le\frac{2C}{B}$$ whatever the two records are.

privatised

$\displaystyle \textcolor{#6B3FA0}{\tilde{\nabla} f(x,\mathcal{B})} =\widehat{\nabla}^{C} f(x,\mathcal{B}) +\mathcal{N}\!\Bigl(0,\sigma^{2}I\Bigr)$

and so is the update

$\displaystyle \theta_{s+1}\leftarrow\theta_s-\eta\, \textcolor{#6B3FA0}{\tilde{\nabla} f(\theta_s,\mathcal{B}_s)}$

$\tau$ steps $\mapsto$ client $i$ submission $\Delta^{(i)}$.

The same mechanism, on a manifold

the gradient is tangent

$\operatorname{grad} f(\theta,z)\in T_\theta\mathcal{M}$

clipping, in the metric at θ

$\displaystyle \operatorname{clip}^{\theta}_C(v) =v\,\min\bigl(1,\,C/\lVert v\rVert_\theta\bigr)$

$$\bigl\lVert\widehat{\operatorname{grad}}^{C} f(\theta,\mathcal{B}) -\widehat{\operatorname{grad}}^{C} f(\theta,\mathcal{B}')\bigr\rVert_\theta \le\frac{2C}{B}.$$

Tangent Gaussian noise

$\langle\cdot,\cdot\rangle_\theta$- orthonormal basis of $T_\theta\mathcal{M}$: $\bigl(E_1(\theta),\dots,E_d(\theta)\bigr)$ and draw $$\xi=\sum_{k} w_k\,E_k(\theta), \quad w_k\overset{\text{iid}}{\sim}\mathcal{N}\bigl(0,\sigma^2\bigr)$$

privatised Riemannian gradient

$\displaystyle \widetilde{\operatorname{grad}} f(\theta,\mathcal{B}) =\widehat{\operatorname{grad}}^{C} f(\theta,\mathcal{B})+\xi \ \in T_\theta\mathcal{M}$

What we propose: ambient operation then projection

$\mathcal{M}$ is a compact submanifold of $\mathbb{R}^{d\times p}$, carrying the inherited metric. .

gradient

$\operatorname{grad} f(\theta,z)=P_\theta\bigl(\nabla f(\theta,z)\bigr)$

clipping

$\lVert v\rVert_\theta=\lVert v\rVert$ for every $v\in T_\theta\mathcal{M}$

The clipping ball no longer depends on $\theta$.

The Euclidean sensitivity $2C/B$ carries over unchanged.

noise

$\xi=P_\theta(Z),\qquad Z\sim\mathcal{N}\bigl(0,\sigma^2 I\bigr)$

It coincides with the intrinsic definition.

$\tilde g\gets\frac1B\sum_{\ell} \operatorname{clip}_C\bigl(P\,\nabla f(\theta;z_{\ell})\bigr) +P\,\xi,\quad \xi\sim\mathcal{N}(0,\sigma^2 I)$

How to calibrate the noise ?

Limitations of the $(\varepsilon,\delta)$ approach

a single pair

summarises the mechanism by one point

loose generic composition

holds for the worst mechanism those pairs could describe

the price

more noise than needed, at the same certified budget

Trade-off function

The server tests $z$ against $z'$. $$\mathcal{T}(P,Q)(\alpha)=\inf_{\phi}\bigl\{\mathbb{E}_Q[1-\phi] \ :\ \mathbb{E}_P[\phi]\le\alpha\bigr\}.$$ (best miss rate at false alarm level $\alpha$)

$f$-DP

$\mathcal{T}\bigl(\mathcal{A}(D),\mathcal{A}(D')\bigr)\ge f$ for every $D\bowtie D'$: no test does better than $f$.

$\mu$-GDP

$f=G_\mu(\alpha)=\Phi\bigl(\Phi^{-1}(1-\alpha)-\mu\bigr)$: $\mathcal{N}(0,1)$ against $\mathcal{N}(\mu,1)$, $\Phi$ the normal cdf.

$\mu$: the gap in units of noise. Larger $\mu$, weaker guarantee.

Our guarantee proof schema

Reading the budget

$\displaystyle \mu_{\mathrm{tot}} =\frac{2C\sqrt{T\tau}}{m_\star\,\sigma}\bigl(1+O(\mu_0)\bigr)$

Grows as $\sqrt{T\tau}$

Every local step is a release. Rounds and local work cost the same, at fixed $T\tau$.

Clip over noise

Only the ratio $C/\sigma$ matters, not either alone.

Damped by $m_\star$

The smallest client sets the budget, through its subsampling rate.

The batch size cancels

At leading order, $B$ leaves the expression. It buys variance, not privacy.

DP-RFedProj record-level DP Riemannian federated learning

input: $n$ clients, $k$ per round, $\tau$ local steps, batch $B$, $T$ rounds, client optimisers $\textsc{Opt}^{(i)}$, clip $C$, noise $\sigma$

Initialise $\theta_0\in\mathcal{M}$
for $t=0,\dots,T-1$ round
Draw $S_t\subset[n]$, $|S_t|=k$, and broadcast $\theta_t$
for each $i\in S_t$ in parallel
$\theta_{t,0}^{(i)}\gets\theta_t$
for $j=0,\dots,\tau-1$
$\tilde g_{t,j}^{(i)}\gets\frac1B\sum_{\ell} \operatorname{clip}_C\bigl(P\,\nabla f(\theta_{t,j}^{(i)};z_{i,\ell})\bigr) +P\mathcal{N}(0,\sigma^2 I)$
$\bigl(u_{t,j}^{(i)},s\bigr)\gets\textsc{Opt}^{(i)}\bigl(\tilde g_{t,j}^{(i)},s\bigr)$ any optimiser
$\theta_{t,j+1}^{(i)}\gets\Pi\bigl(\theta_{t,j}^{(i)}-u_{t,j}^{(i)}\bigr)$
$\Delta^{(i)}\gets\textsc{Agg.Sub}\bigl(\theta_t,\theta_{t,\tau}^{(i)}\bigr)$, send it see table
$\Delta_t\gets\frac1k\sum_{i\in S_t}\Delta^{(i)}$
$\theta_{t+1}\gets\textsc{Agg.Out}\bigl(\theta_t,\Delta_t\bigr)$
return $\theta_T$

aggregation primitives
Scheme	$\textsc{Agg.Sub}(\theta_t,\theta_{t,\tau}^{(i)})$	$\textsc{Agg.Out}(\theta_t,\Delta_t)$
KFAvg	$\mathrm{Log}_{\theta_t}\bigl(\theta_{t,\tau}^{(i)}\bigr)$	$\mathrm{Exp}_{\theta_t}(\Delta_t)$
RetAvg	$\mathrm{R}^{-1}_{\theta_t}\bigl(\theta_{t,\tau}^{(i)}\bigr)$	$\mathrm{R}_{\theta_t}(\Delta_t)$
ProjAvgours	$\theta_{t,\tau}^{(i)}$	$\Pi(\Delta_t)$
RLAvgours	$P_{\theta_t}\bigl(\theta_{t,\tau}^{(i)}-\theta_t\bigr)$	$\Pi(\theta_t+\Delta_t)$

where it applies
Parameter space	Metric	Privacy	Conv. rate
sphere, Stiefel, Grassmann	induced	✓	✓
flat, including $\log\mathcal{S}_n^{++}$	Euclidean	✓	✗
$\mathcal{S}_n^{++}$	affine-invariant	not runnable

Convergence assumptions

Projection

$\Pi(y)=\arg\min_{\theta\in\mathcal{M}}\lVert y-\theta\rVert$

Local solver, RSGD

$\theta_{j+1}=\Pi\bigl(\theta_j-\alpha\,\tilde{\operatorname{grad}}f(\theta_j,\mathcal{B}_j)\bigr)$

Aggregation

$\Pi\bigl(\Delta_t\bigr)$ or $\Pi\bigl(\theta_t+\Delta_t\bigr)$

ProjAvg and RLAvg, same rate

Proximal smoothness

Nearest point is unique.

Smoothness, per sample

Every individual loss has Lipschitz ambient gradient.

Bounded minibatch dispersion

Within a client, the per-sample gradients do not spread arbitrarily far from the client's own gradient.

Bounded heterogeneity

Across clients, the local gradients do not spread arbitrarily far from the global one.

Convergence the rate

$\displaystyle \frac1T\sum_{t=0}^{T-1}\mathbb{E}\bigl\lVert\operatorname{grad}F(\theta_t)\bigr\rVert^2 = O\!\left(\frac{1}{\sqrt{T}}\Bigl[\,1 + \tfrac1k\tfrac{n-k}{n-1}\,\bigl(\text{heterogeneity}+\text{clipping spread}\bigr)^2 + \tfrac{1}{k\tau}\bigl(\text{minibatch noise}+d_{\mathcal{M}}\cdot\sigma^2\bigr)\Bigr] + \ \text{clipping bias}^2\right)$

Optimisation, $O(1/\sqrt{T})$, free of $k$, $\tau$ and of the privacy parameters.
Heterogeneity. The price of partial participation.
Minibatch noise. Damped by the cohort and the local trajectory.
DP noise. Scales with the intrinsic dimension $d_{\mathcal{M}}$.
Clipping bias, a floor. It does not vanish with $T$ unless clipping is inactive.

What this buys

Method	Manifold	Privacy	Convergence regime	Geometric ops
RFedSVRGLi and Ma, 2022	general	✗	multi-step with one client, or one step with all	$\mathrm{Exp},\mathrm{Log}$, transport
AGSHuang et al., 2024	general	✗	multi-step, partial	$\mathrm{R}$, transport
PriRFedHuang et al., 2026	general	✓	multi-step with one client, or one step with all	$\mathrm{R}$, $\mathrm{R}^{-1}$
projection-basedZhang et al., 2024 · Wang et al., 2025	compact	✗	multi-step, full	$\Pi$ only
oursDP-RFedProj	compact	✓	multi-step and partial	$\Pi$ only

What is new

Multiple local step+ partial participation + privacy

What it costs

Compactness

Section 4

Numerical experiments

Three EEG datasets, two architectures, four privacy budgets

EEGNet Lawhern et al., 2018

A compact convolutional network, applied to the raw trial instead of its covariance.

Two architectures: Riemannian vs. Euclidean

SPDNet

Input

the covariance matrix $\Sigma\in\mathcal{S}^{++}_C$

Trunk

$L$ BiRe blocks, then LogEig and Vech

Parameters

$W_k$ on Stiefel, plus a Euclidean head. Two optimisers.

EEGNet

Input

the raw trial $X\in\mathbb{R}^{C\times\mathcal{T}}$

Trunk

two convolution blocks, each with pooling and dropout

Parameters

all free and Euclidean. One optimiser.

Datasets MOABB benchmark, Chevallier et al., 2024

BNCI2014_001

Weibo2014

Cho2017

Subjects

Channels

Classes

Native rate (Hz)

250

200

512

$\mathcal{T}$

513

384

Trials per class

144

100

Centralised baseline

Reading

Pooled in one place, EEGNet is ahead on all three datasets. Whiskers are one standard deviation over ten seeds.

Federated accuracy full participation, 10 seeds

What the numbers say

Without privacy, EEGNet wins
57.0 against 53.2 on BNCI2014_001, 47.0 against 42.8 on Weibo2014, 67.7 against 60.8 on Cho2017.
With privacy, the order reverses
At $\varepsilon=20$ on Weibo2014, ProjAvg reaches 24.3 while EEGNet falls to 17.4, barely above the chance level of 14.3.
Among aggregations, the cheap ones hold up
ProjAvg and RLAvg match or beat RetAvg under every budget, for one projection per round.

Learning curves BNCI2014_001, $\varepsilon = 20$, full participation

Reading

The three SPDNet arms rise together and keep rising. EEGNet needs far more rounds and plateaus lower. PriRFed stalls just above chance.

Aggregation cost per round, log scale

Section 5

Conclusion
and perspectives

What the framework buys, what it costs, and what comes next

Conclusion

DP-RFedProj

Record-level private federated learning on compact submanifolds, with closed-form projections for aggregation.

The accounting detaches from the geometry
A fixed ambient metric makes the privacy analysis independent of the manifold, the aggregator and the local optimiser.
The analysis covers the regime we actually run
Many local steps, partial participation, heterogeneous clients.
Privacy reverses the ranking
On EEG motor imagery, the Riemannian architecture wins once noise is added, and projection-based aggregation matches the retraction-based one at a fraction of the compute.

Limitation: geometry

The framework needs a compact submanifold under the Euclidean-induced metric.

Iterate-dependent metrics with no ambient projection are left out (SPD-AI).

Perspectives

References

Riemannian federated learning

Li and Ma. Federated learning on Riemannian manifolds. 2022.

Huang et al. Riemannian federated learning via averaging gradient streams. 2024.

Zhang et al. Nonconvex federated learning on compact smooth submanifolds. 2024.

Wang et al. Zeroth-order federated learning on compact submanifolds. 2025.

Huang et al. PriRFed. 2026.

McMahan et al. Communication-efficient learning from decentralized data. 2017.

Privacy, geometry, EEG

Dwork et al. Calibrating noise to sensitivity in private data analysis. 2006.

Dong, Roth and Su. Gaussian differential privacy. 2022.

Han et al. Differentially private Riemannian optimization. 2024.

Zhu et al. Deep leakage from gradients. 2019.

Absil and Malick. Projection-like retractions on matrix manifolds. 2012.

Huang and Van Gool. A Riemannian network for SPD matrix learning. 2017.

Lawhern et al. EEGNet. 2018.

Chevallier et al. The largest EEG-based BCI reproducibility study. 2024.

Thank you

Questions

Thibault Pautrel

L2S, CentraleSupélec, Université Paris-Saclay

Projection-Based Private Federated Learning on Compact Riemannian Submanifolds

Collaborators

Contents

The problem

EEG data

From raw signals to covariance

SPD matrices

How to classify a covariance matrix?

Riemannian geometry

Manifold, tangent space, metric

Geodesics, exponential, logarithm

Examples

SPDNet

Where we stand

SPDNet Huang and Van Gool, 2017

SPDNet: What is optimised?

Private Riemannianfederated learning

The data is scattered

Federated learning

Riemannian Federated Learning

Local optimisation client side

Aggregation existing answers

Aggregation what we propose

Keeping data on the client is not enough

Threat model

Protecting records

Differential privacy

Gradient privatisation in Euclidean spaces

The same mechanism, on a manifold

What we propose: ambient operation then projection

How to calibrate the noise ?

Our guarantee proof schema

Reading the budget

DP-RFedProj record-level DP Riemannian federated learning

Convergence assumptions

Convergence the rate

What this buys

Numerical experiments

EEGNet Lawhern et al., 2018

Two architectures: Riemannian vs. Euclidean

Datasets MOABB benchmark, Chevallier et al., 2024

Centralised baseline

Federated accuracy full participation, 10 seeds

What the numbers say

Learning curves BNCI2014_001, $\varepsilon = 20$, full participation

Aggregation cost per round, log scale

Conclusionand perspectives

Conclusion

Perspectives

References

Questions

Private Riemannian
federated learning

Conclusion
and perspectives