Certified Uncertainty Propagation in One-Shot Federated Bayesian Models via Posterior Event Transport

# Certified Uncertainty Propagation in One-Shot Federated Bayesian Models via Posterior Event Transport
Source: [https://arxiv.org/html/2609.16373](https://arxiv.org/html/2609.16373)
Mohammad Hossein BadieiAbolfazl YaghmaeiHamed Kebriaei†††thanks:†Corresponding author: Hamed Kebriaei\.††thanks:M\. Mohammady, MH\. Badiei, A\. Yaghmaei and H\. Kebriaei are with the School of Electrical and Computer Engineering, College of Engineering, University of Tehran, Tehran, 1417614411, Iran, \(email:[mahyar\.mohammady@ut\.ac\.ir](mailto://[email protected]);[mh\.badiei@ut\.ac\.ir](mailto://[email protected]);[yaghmaei@ut\.ac\.ir](mailto://[email protected]);[kebriaei@ut\.ac\.ir](mailto://[email protected])\)\.††thanks:H\. Kebriaei is also with the School of Computer Science, Institute for Research in Fundamental Sciences \(IPM\), P\.O\. Box 19395\-5746, Tehran, Iran\. The work of Hamed Kebriaei was supported in part by the Institute for Research in Fundamental Sciences \(IPM\) under Grant CS 1404\-04\-190\.

###### Abstract

Probabilistic certification of Bayesian neural networks lower\-bounds the posterior probability that a model satisfies a verifier\-defined safety property\. In one\-shot federated Bayesian learning, however, the deployed model is obtained by aggregating parameters drawn from client\-specific posterior distributions, and local certificates therefore do not directly provide safety guarantees for the aggregated model\. This paper develops a deployment\-consistent certification framework by propagating local posterior events through the deployment aggregation rule, with an exact geometric characterization for Federated Averaging\(FedAvg\)\. Each client constructs pairwise\-disjoint hyper\-rectangular regions in parameter space and computes their posterior probability masses\. The server forms Cartesian products of these regions, maps them through the deployment rule, and retains the probability of a product event only when its complete aggregation image is verified to satisfy the prescribed safety property\. Under independent client posteriors, the probability of each product event factorizes into the product of its local masses, and summing the probabilities of verified disjoint events yields a sound lower bound on the safety probability of the deployed model\. For FedAvg with nonnegative aggregation coefficients, the image of a Cartesian product of axis\-aligned hyper\-rectangles is exactly represented by a weighted hyper\-rectangle, introducing no additional set over\-approximation during aggregation\. We further distinguish the proposed transported\-event certificate from direct certification under the posterior distributions induced by FedAvg and Product\-of\-Gaussians aggregation\. We evaluate the framework on MNIST and Fashion\-MNIST under label\-Dirichlet heterogeneity as controlled one\-shot federated benchmarks\. The transported FedAvg certificate remains non\-vacuous across all evaluated settings, ranging from22\.51%22\.51\\%to46\.89%46\.89\\%, while direct global certificates under the evaluated global posterior laws range from72\.05%72\.05\\%to91\.39%91\.39\\%\. The results further show that predictive accuracy and certifiable safety do not necessarily follow the same trend, and that different global posterior constructions can exhibit different certification behavior across architectures\.

###### Index Terms:

Uncertainty propagation, Bayesian neural networks, one\-shot federated learning, probabilistic safety\.

††impactstatement:This work advances trustworthy federated artificial intelligence by providing deployment\-consistent safety guarantees for one\-shot Bayesian model aggregation\. Existing local certificates do not directly characterize the safety of the final global model because aggregation changes the relevant probability distribution\. The proposed framework closes this gap by transporting certified local posterior events through the actual deployment rule and assigning probability mass only to aggregation outcomes that are verified safe\. The resulting guarantees are formulated for deployment aggregation rules and are exact at the set\-propagation stage for FedAvg with nonnegative weights\. By separating transported certification from direct certification under FedAvg and Product\-of\-Gaussians distributions, the framework also clarifies which safety probability each method certifies\. The empirical analysis provides controlled insight into how heterogeneity, model architecture, client count, and verifier conservatism influence certifiable safety in one\-shot federated settings\.## IIntroduction

Federated learning \(FL\) enables multiple clients to train a shared model without centralizing their raw data, making it suitable for applications constrained by privacy, governance, and communication requirements\. However, federated learning must operate under statistical heterogeneity, since clients often possess limited and non\-identically distributed datasets\. These challenges are particularly significant in one\-shot FL, where each client communicates with the server only once and the deployed model is determined by a single aggregation step without further refinement\[[1](https://arxiv.org/html/2609.16373#bib.bib10),[2](https://arxiv.org/html/2609.16373#bib.bib12),[3](https://arxiv.org/html/2609.16373#bib.bib14)\]\.

Bayesian neural networks \(BNNs\) provide a principled representation of epistemic uncertainty by maintaining posterior distributions over model parameters rather than single point estimates\[[4](https://arxiv.org/html/2609.16373#bib.bib25),[5](https://arxiv.org/html/2609.16373#bib.bib20)\]\. In federated settings, this allows each client to represent uncertainty induced by its local data\. Nevertheless, uncertainty quantification alone does not provide a formal safety guarantee\. For safety\-critical applications, it is necessary to determine the probability that a model drawn from the distribution governing deployment satisfies a prescribed input–output property\[[6](https://arxiv.org/html/2609.16373#bib.bib26)\]\.

These challenges are part of the broader effort toward trustworthy artificial intelligence, where reliability, robustness, uncertainty, and certification are considered essential properties of deployed AI systems\[[7](https://arxiv.org/html/2609.16373#bib.bib11),[8](https://arxiv.org/html/2609.16373#bib.bib13)\]\. Probabilistic certification addresses this requirement by lower\-bounding the posterior probability of models satisfying a verifier\-defined safety specification\. Existing methods for centralized BNNs construct verified regions in weight space and accumulate their posterior probability masses\[[9](https://arxiv.org/html/2609.16373#bib.bib3),[10](https://arxiv.org/html/2609.16373#bib.bib4),[11](https://arxiv.org/html/2609.16373#bib.bib5)\]\. These methods typically employ sound verification techniques, such as interval bound propagation or abstract interpretation, to certify bounded regions of inputs and model parameters\[[12](https://arxiv.org/html/2609.16373#bib.bib8),[13](https://arxiv.org/html/2609.16373#bib.bib9)\]\. In the centralized setting, the relevant probability is defined under a single posterior over the deployed model\.

The certification problem is fundamentally different in one\-shot federated Bayesian learning\. Each client learns a distinct local posterior, while the deployed model is produced by applying a server\-side aggregation rule to jointly sampled client parameters\. Consequently, the relevant deployment distribution depends on both the local posteriors and the aggregation map\. Local certified probabilities cannot, in general, be directly summed or averaged to obtain a valid global guarantee\. A local certificate describes an event in one client’s parameter space, whereas deployment depends on a joint realization across all clients\. Moreover, even when local parameter regions are individually safe, their aggregate may not remain safe because neural\-network safety regions in weight space are generally nonconvex and need not be preserved by aggregation\.

In this paper, we develop a deployment\-consistent framework for probabilistic safety certification in one\-shot federated Bayesian learning\. Each client constructs pairwise\-disjoint hyper\-rectangular regions in parameter space and evaluates their posterior probability masses\. The server forms joint events from combinations of these local regions, propagates them through the aggregation rule, and includes their probability mass only when the complete aggregation image is verified to satisfy the prescribed safety property\. Under independent client posteriors, the probability of each joint event factorizes into the product of its local posterior masses\. Summing the masses of verified disjoint events then yields a sound lower bound on the safety probability of the deployed model\. For FedAvg with nonnegative aggregation weights, the image of a Cartesian product of axis\-aligned hyper\-rectangles is represented exactly by the weighted combination of their endpoints\. Therefore, the aggregation step introduces no additional set over\-approximation, and the conservatism of the certificate arises only from finite posterior coverage and the underlying verification procedure\. We also distinguish the proposed transported\-event certificate from direct server\-side certification\. Direct certification under the FedAvg pushforward distribution targets the same deployment safety probability but may cover different regions of global parameter space\. In contrast, Product\-of\-Gaussians aggregation defines a separate posterior fusion rule and is therefore treated as a distinct global\-posterior baseline\.

The main contributions of our work are as follows:

- •We formulate probabilistic safety for one\-shot federated BNNs under the aggregation\-induced distribution of the deployed model and clarify why local posterior certificates do not directly imply global safety\.
- •We derive a sound local\-to\-global lower bound by propagating disjoint joint posterior events through the deployment aggregation rule and certifying their complete aggregated images\.
- •We establish an exact hyper\-rectangle\-image characterization for FedAvg with nonnegative aggregation weights and evaluate transported and direct certificates on MNIST and Fashion\-MNIST as controlled benchmarks for the communication\-constrained one\-shot setting\.

## IIRelated Work

Federated learning constructs a global model from locally trained client models without centralizing raw data, with FedAvg remaining one of the most widely used parameter\-aggregation methods\[[1](https://arxiv.org/html/2609.16373#bib.bib10),[2](https://arxiv.org/html/2609.16373#bib.bib12)\]\. Bayesian extensions of federated learning replace or complement point estimates with posterior distributions to represent uncertainty caused by limited and heterogeneous client data\. Recent studies have explored Bayesian formulations of federated learning to improve uncertainty representation and robustness under heterogeneous client data distributions\[[14](https://arxiv.org/html/2609.16373#bib.bib2),[15](https://arxiv.org/html/2609.16373#bib.bib1)\]\. Bayesian nonparametric federated learning addresses permutation inconsistencies among independently trained neural networks by matching and merging local network components\[[16](https://arxiv.org/html/2609.16373#bib.bib15)\], while posterior averaging interprets federated aggregation as approximate Bayesian inference\[[17](https://arxiv.org/html/2609.16373#bib.bib16)\]\. FedBE instead fits a server\-side distribution over client models and uses samples from this distribution for Bayesian model ensembling\[[18](https://arxiv.org/html/2609.16373#bib.bib17)\]\. More recent approaches combine predictive distributions, layer\-wise posterior approximations, or local Laplace approximations to improve predictive accuracy and uncertainty calibration under statistical heterogeneity\[[19](https://arxiv.org/html/2609.16373#bib.bib18),[20](https://arxiv.org/html/2609.16373#bib.bib19)\]\. Although these methods provide posterior\-aware global predictors, they do not certify the probability that the random model produced by the deployment rule satisfies a verifier\-defined safety specification\.

This limitation is particularly relevant in one\-shot federated learning, where each client communicates with the server only once and the aggregation rule directly determines the deployed model\[[3](https://arxiv.org/html/2609.16373#bib.bib14)\]\. Existing one\-shot methods primarily use parameter aggregation, ensembling, posterior approximation, or knowledge distillation to construct an accurate global predictor from independently trained client models\. In Bayesian one\-shot learning, heterogeneous local datasets induce distinct posterior distributions that must be combined without subsequent communication or correction\. Prior work therefore focuses mainly on predictive performance, calibration, and uncertainty representation\. In contrast, our objective is to characterize the probability that the model induced by a general one\-shot aggregation map satisfies a prescribed safety property\.

Probabilistic verification of Bayesian neural networks addresses safety by measuring the posterior probability assigned to parameter configurations satisfying a specified input–output property\. Wicker et al\. derive sound lower bounds by constructing verified regions in weight space and integrating their posterior probability masses\[[9](https://arxiv.org/html/2609.16373#bib.bib3)\]\. Related studies develop statistical robustness guarantees\[[21](https://arxiv.org/html/2609.16373#bib.bib7)\], unified lower and upper probabilistic certificates\[[10](https://arxiv.org/html/2609.16373#bib.bib4)\], tighter region\-based bounds\[[11](https://arxiv.org/html/2609.16373#bib.bib5)\], and dynamic\-programming methods for Bayesian neural\-network robustness\[[22](https://arxiv.org/html/2609.16373#bib.bib6)\]\. These approaches commonly rely on sound verification techniques, including interval bound propagation and abstract interpretation, to certify bounded sets of inputs and model parameters\[[12](https://arxiv.org/html/2609.16373#bib.bib8),[13](https://arxiv.org/html/2609.16373#bib.bib9)\]\. However, they generally assume a single posterior distribution over the deployed model and do not directly address deployment mechanisms that aggregate random parameters drawn from several client\-specific posteriors\.

Our work focuses on certifying the global model obtained from local Bayesian posteriors, rather than certifying each local posterior separately\. For FedAvg, we consider both transported and direct certification under the induced global distribution\. Product\-of\-Gaussians is included as a separate fusion baseline, allowing us to distinguish between different notions of global Bayesian safety\.

## IIIMethodology

Consider a one\-shot federated learning system comprisingnnclients\. Clienti∈\{1,…,n\}i\\in\\\{1,\\dots,n\\\}holds a private dataset𝒟i\\mathcal\{D\}\_\{i\}and independently trains a local Bayesian neural network\. Following the local training phase, the posterior representation is transmitted from each client to a central server, limited to a single occurrence\. The server then constructs the deployed global model through a single aggregation step\. As an initial step, the derivation is presented for a single safety property\. The same procedure is independently applied to every evaluated property, and the resulting certified probabilities are subsequently averaged\.

### III\-ASafety Certification Objective

For the classification\-robustness property considered in the experiments, letx∈\[0,1\]px\\in\[0,1\]^\{p\}be a reference input of dimensionppwith class labelcc, and define the admissible perturbation region as𝒳:=\{x′∈\[0,1\]p:‖x′−x‖∞≤ϵ\},\\mathcal\{X\}:=\\left\\\{x^\{\\prime\}\\in\[0,1\]^\{p\}:\\left\\lVert x^\{\\prime\}\-x\\right\\rVert\_\{\\infty\}\\leq\\epsilon\\right\\\},where \(ϵ≥0\\epsilon\\geq 0\) denotes the input perturbation radius\. A parameter vector \(θ∈ℝnw\\theta\\in\\mathbb\{R\}^\{n\_\{w\}\}\), where \(nwn\_\{w\}\) denotes the total number of trainable parameters in the neural network, is considered safe if the following condition holds\.\(For compactness, we denote the vector of all \(KK\) class\-specific outputs by \(OPENfθ​\(x′\):=\[fθ,1​\(x′\),…,fθ,K​\(x′\)\]𝖳∈ℝK\)f\_\{\\theta\}\(x^\{\\prime\}\):=\[f\_\{\\theta,1\}\(x^\{\\prime\}\),\\ldots,f\_\{\\theta,K\}\(x^\{\\prime\}\)\]^\{\\mathsf\{T\}\}\\in\\mathbb\{R\}^\{K\}\)\)

Cs​fθ​\(x′\)\+ds⪰0,∀x′∈𝒳,C\_\{\\mathrm\{s\}\}f\_\{\\theta\}\(x^\{\\prime\}\)\+d\_\{\\mathrm\{s\}\}\\succeq 0,\\qquad\\forall x^\{\\prime\}\\in\\mathcal\{X\},\(1\)whereCs∈ℝns×KC\_\{s\}\\in\\mathbb\{R\}^\{n\_\{s\}\\times K\}andds∈ℝnsd\_\{s\}\\in\\mathbb\{R\}^\{n\_\{s\}\}define a set ofnsn\_\{s\}linear inequality constraints on theK−d​i​m​e​n​s​i​o​n​a​lK\-dimensionalclassification logits, with the inequality understood in the component\-wise sense\. Accordingly, the safe parameter set𝒮\\mathcal\{S\}consists of all network parameters whose outputs satisfy the above constraints for every input in𝒳\\mathcal\{X\}\. This constraint is equivalent to requiring that the logit of the true classcc, denotedfθ,c​\(x′\)f\_\{\\theta,c\}\(x^\{\\prime\}\), exceeds the logit of any competing classrr, denotedfθ,r​\(x′\)f\_\{\\theta,r\}\(x^\{\\prime\}\), by at least a marginδ≥0\\delta\\geq 0:

fθ,c​\(x′\)−fθ,r​\(x′\)≥δ,∀x′∈𝒳,∀r≠c\.f\_\{\\theta,c\}\(x^\{\\prime\}\)\-f\_\{\\theta,r\}\(x^\{\\prime\}\)\\geq\\delta,\\qquad\\forall x^\{\\prime\}\\in\\mathcal\{X\},\\quad\\forall r\\neq c\.\(2\)LetΘi\\Theta\_\{i\}denote a random weight vector drawn from the posterior of clientii\. The server applies an aggregation rule

Θg=𝒜⁡\(Θ1,…,Θn\),\\Theta\_\{g\}=\\mathcal\{A\}\(\\Theta\_\{1\},\\ldots,\\Theta\_\{n\}\),\(3\)whereΘg\\Theta\_\{g\}represents the deployed random global model\. The global safety probability of interest is therefore

Psafeg:=Pr⁡\(Θg∈𝒮\)\.P\_\{\\mathrm\{safe\}\}^\{g\}:=\\Pr\\left\(\\Theta\_\{g\}\\in\\mathcal\{S\}\\right\)\.\(4\)The objective is to construct a computable certificateLs​a​f​egL\_\{safe\}^\{g\}such that

Lsafeg≤Psafeg\.L\_\{\\mathrm\{safe\}\}^\{g\}\\leq P\_\{\\mathrm\{safe\}\}^\{g\}\.\(5\)

### III\-BLocal Bayesian Posterior

Each clientiiminimizes a task\-specific loss functionl⁡\(θi,𝒟i\)l\(\\theta\_\{i\};\\mathcal\{D\}\_\{i\}\)to obtain a local maximum a posteriori \(MAP\) estimate, denoted byμi\\mu\_\{i\}\. Parameter uncertainty is represented by a Gaussian posterior:

qi​\(θi\)=p⁡\(θi∣𝒟i\)≈𝒩⁡\(μi,Σi\)\.q\_\{i\}\(\\theta\_\{i\}\)=p\(\\theta\_\{i\}\\mid\\mathcal\{D\}\_\{i\}\)\\approx\\mathcal\{N\}\\left\(\\mu\_\{i\},\\Sigma\_\{i\}\\right\)\.\(6\)The Gaussian approximation may be obtained using a Laplace approximation, variational inference, or another posterior approximation method\. The certification principle developed below is not restricted to a particular Bayesian training procedure\.In the implementation, a diagonal covariance is used:

Σi=diag⁡\(σi,12,…,σi,nw2\)\.\\Sigma\_\{i\}=\\operatorname\{diag\}\\left\(\\sigma\_\{i,1\}^\{2\},\\ldots,\\sigma\_\{i,n\_\{w\}\}^\{2\}\\right\)\.\(7\)This assumption enables the probability mass of an axis\-aligned hyper\-rectangle to be evaluated in closed form\.

###### Assumption 1\(Independent Deployment Draws\)\.

At deployment, each client’s local parameters are drawn independently, whereΘi∼qi\\Theta\_\{i\}\\sim q\_\{i\}andq⁡\(θ1,…,θn\)=∏i=1nqi​\(θi\)q\(\\theta\_\{1\},\\dots,\\theta\_\{n\}\)=\\prod\_\{i=1\}^\{n\}q\_\{i\}\(\\theta\_\{i\}\)\.

Assumption[1](https://arxiv.org/html/2609.16373#Thmassumption1)allows the probability of any joint event across clients to be factorized as the product of the corresponding local posterior probabilities\. When the joint probabilities are directly available, the set‑based safety argument remains valid without this independence assumption\.

### III\-CLocal Hyper\-rectangle Construction

Each client constructs a finite collection of candidate regions in its local weight space\. For a posterior samplewi,k∗∼𝒩⁡\(μi,Σi\)w\_\{i,k\}^\{\*\}\\sim\\mathcal\{N\}\(\\mu\_\{i\},\\Sigma\_\{i\}\), clientiiforms the hyper\-rectangle:

Hi,k=∏d=1nw\[wi,k,d∗−γσi,d,;wi,k,d∗\+γσi,d\],H\_\{i,k\}=\\prod\_\{d=1\}^\{n\_\{w\}\}\\left\[w\_\{i,k,d\}^\{\*\}\-\\gamma\\sigma\_\{i,d\},;w\_\{i,k,d\}^\{\*\}\+\\gamma\\sigma\_\{i,d\}\\right\],\(8\)whereγ\>0\\gamma\>0controls the expansion factor defining the size of the candidate region\. Sampling the center from the posterior directs the search toward regions of relatively high probability mass\. Scaling the interval widths by the local posterior standard deviations also accounts for differences in uncertainty across model parameters\.

Each client retains a pairwise\-disjoint collection𝒞i=\{Hi,1,…,Hi,k\}\\mathcal\{C\}\_\{i\}=\\\{H\_\{i,1\},\\ldots,H\_\{i,k\}\\\}\. Pairwise disjointness is imposed because posterior masses of overlapping regions cannot be added directly without correcting for repeated mass\. Rejecting an overlapping candidate may reduce certified coverage but does not affect the validity of the final lower bound\.

For a diagonal Gaussian posterior and a hyper\-rectangle denoted by its lower and upper dimensional boundsli,k,dl\_\{i,k,d\}andui,k,du\_\{i,k,d\}:

Hi,k=∏d=1nw\[ℓi,k,d,ui,k,d\],H\_\{i,k\}=\\prod\_\{d=1\}^\{n\_\{w\}\}\[\\ell\_\{i,k,d\},u\_\{i,k,d\}\],\(9\)its local posterior mass is

pi,k:=qi​\(Hi,k\),\\displaystyle p\_\{i,k\}:=q\_\{i\}\(H\_\{i,k\}\),\(10\)Equivalently, the mass may be written using the error function \(erf\) as:

pi,k=∏d=1nw12​\[erf⁡\(ui,k,d−μi,d2​σi,d\)−erf⁡\(ℓi,k,d−μi,d2​σi,d\)\]\.p\_\{i,k\}=\\prod\_\{d=1\}^\{n\_\{w\}\}\\frac\{1\}\{2\}\\biggl\[\\operatorname\{erf\}\\\!\\left\(\\frac\{u\_\{i,k,d\}\-\\mu\_\{i,d\}\}\{\\sqrt\{2\}\\,\\sigma\_\{i,d\}\}\\right\)\-\\operatorname\{erf\}\\\!\\left\(\\frac\{\\ell\_\{i,k,d\}\-\\mu\_\{i,d\}\}\{\\sqrt\{2\}\\,\\sigma\_\{i,d\}\}\\right\)\\biggr\]\.\(11\)

### III\-DSafety Verification via IBP

Interval bound propagation \(IBP\) is used to verify bounded input and weight regions\. For scalar weightsw∈\[wL,wU\]w\\in\[w^\{L\},w^\{U\}\]and inputsx∈\[xL,xU\]x\\in\[x^\{L\},x^\{U\}\], the output interval\[tm​i​n,tm​a​x\]\[t\_\{min\},t\_\{max\}\]of their product is given by:

tmin\\displaystyle t\_\{\\min\}=min⁡\{wL​xL,wL​xU,wU​xL,wU​xU\},\\displaystyle=\\min\\\{w^\{L\}x^\{L\},\\;w^\{L\}x^\{U\},\\;w^\{U\}x^\{L\},\\;w^\{U\}x^\{U\}\\\},\(12\)tmax\\displaystyle t\_\{\\max\}=max⁡\{wL​xL,wL​xU,wU​xL,wU​xU\}\.\\displaystyle=\\max\\\{w^\{L\}x^\{L\},\\;w^\{L\}x^\{U\},\\;w^\{U\}x^\{L\},\\;w^\{U\}x^\{U\}\\\}\.\(13\)The interval bounds are propagated recursively through all network layers, yielding certified lower and upper bounds on each output logit\. For a candidate parameter hyper\-rectangleH⊆ℝnwH\\subseteq\\mathbb\{R\}^\{n\_\{w\}\}and an admissible input set𝒳\\mathcal\{X\}, letz¯r​\(H,𝒳\)\\underline\{z\}\_\{r\}\(H,\\mathcal\{X\}\)andz¯r​\(H,𝒳\)\\overline\{z\}\_\{r\}\(H,\\mathcal\{X\}\)denote the IBP lower and upper bounds, respectively, for the output logit associated with classrr\. These bounds satisfy

z¯r​\(H,𝒳\)≤fθ,r​\(x′\)≤z¯r​\(H,𝒳\),∀θ∈H,∀x′∈𝒳\.\\underline\{z\}\_\{r\}\(H,\\mathcal\{X\}\)\\leq f\_\{\\theta,r\}\(x^\{\\prime\}\)\\leq\\overline\{z\}\_\{r\}\(H,\\mathcal\{X\}\),\\quad\\forall\\theta\\in H,\\forall x^\{\\prime\}\\in\\mathcal\{X\}\.\(14\)Letccdenote the reference class\. The parameter regionHHis certified safe whenever the smallest possible logit of classccremains at leastδ\\deltalarger than the largest possible logit of every competing class:

z¯c​\(H,𝒳\)−z¯r​\(H,𝒳\)≥δ,∀r∈\{1,…,K\}∖\{c\}\.\\underline\{z\}\_\{c\}\(H,\\mathcal\{X\}\)\-\\overline\{z\}\_\{r\}\(H,\\mathcal\{X\}\)\\geq\\delta,\\qquad\\forall r\\in\\\{1,\\ldots,K\\\}\\setminus\\\{c\\\}\.\(15\)Therefore, every network parameterized by a weight vector inHHassigns classcca logit margin of at leastδ\\deltaover all competing classes for every admissible input in𝒳\\mathcal\{X\}\.

Local IBP verification may be used to screen candidate cells before they are communicated\. However, local safety alone does not imply global safety after aggregation\. Therefore, each combined global region must be verified again after the aggregation step\.

###### Assumption 2\(Correctness of the Verifier\)\.

For any parameter regionHH, if the verifier declaresHHto be safe \(denoted bySAFE​\(H\)=1\\text\{SAFE\}\(H\)=1\), then every parameter vector inHHsatisfies the safety requirement:

SAFE⁡\(H\)=1⟹H⊆𝒮,\\operatorname\{SAFE\}\(H\)=1\\quad\\Longrightarrow\\quad H\\subseteq\\mathcal\{S\},\(16\)where𝒮\\mathcal\{S\}denotes the true safe parameter set\.

The verifier may reject some regions that are actually safe because its bounds are conservative\. This may reduce the certified probability and make the resulting lower bound less tight\. However, every region accepted by the verifier is guaranteed to be safe\.

### III\-EOne\-Shot FedAvg Deployment

We instantiate the general deployment map using FedAvg:

Θg=∑i=1nαi​Θi,αi≥0,∑i=1nαi=1\.\\Theta\_\{g\}=\\sum\_\{i=1\}^\{n\}\\alpha\_\{i\}\\Theta\_\{i\},\\qquad\\alpha\_\{i\}\\geq 0,\\qquad\\sum\_\{i=1\}^\{n\}\\alpha\_\{i\}=1\.\(17\)The coefficientsαi\\alpha\_\{i\}may be uniform or proportional to the local dataset sizes\. Consider one selected cell from every client, indexed by the tuplek=\(k1,…,kn\)k=\(k\_\{1\},\\ldots,k\_\{n\}\)\. The corresponding joint event isEk=\{Θ1∈H1,k1,…,Θn∈Hn,kn\}E\_\{k\}=\\\{\\Theta\_\{1\}\\in H\_\{1,k\_\{1\}\},\\ldots,\\Theta\_\{n\}\\in H\_\{n,k\_\{n\}\}\\\}\. Under Assumption[1](https://arxiv.org/html/2609.16373#Thmassumption1), its probability is:

Pr⁡\(Ek\)=∏i=1npi,ki\.\\Pr\(E\_\{k\}\)=\\prod\_\{i=1\}^\{n\}p\_\{i,k\_\{i\}\}\.\(18\)Because the FedAvg weights are nonnegative, the complete image of the joint hyper\-rectangle is exactly:

Gk=∏d=1nw\[∑i=1nαi​ℓi,ki,d,∑i=1nαi​ui,ki,d\]\.G\_\{k\}=\\prod\_\{d=1\}^\{n\_\{w\}\}\\left\[\\sum\_\{i=1\}^\{n\}\\alpha\_\{i\}\\ell\_\{i,k\_\{i\},d\},\\sum\_\{i=1\}^\{n\}\\alpha\_\{i\}u\_\{i,k\_\{i\},d\}\\right\]\.\(19\)Equation \([19](https://arxiv.org/html/2609.16373#S3.E19)\) is exact rather than an outer approximation\. Thus, the FedAvg operation introduces no additional interval relaxation when the local regions are axis\-aligned hyper\-rectangles and the aggregation weights are nonnegative\. A tuple is accepted only when its complete aggregated image satisfiesSAFE⁡\(Gk\)=1\.\\operatorname\{SAFE\}\(G\_\{k\}\)=1\.Consider the following:

𝒦safe=\{k:SAFE⁡\(Gk\)=1\}\\mathcal\{K\}\_\{\\mathrm\{safe\}\}=\\left\\\{k:\\operatorname\{SAFE\}\(G\_\{k\}\)=1\\right\\\}\(20\)denote the set of accepted tuples\.

### III\-FDeployment\-Consistent Safety Certificate

The global safe set is the verifier\-defined set𝒮\\mathcal\{S\}\. It is not defined as the union of the local certified sets; instead, local regions are combined through the deployment rule, and their aggregated images are verified directly\.

###### Theorem 1\(FedAvg Safety Lower Bound\)\.

Suppose that the client posterior samples are independent, the retained local weight regions are pairwise disjoint, and the verifier satisfies Assumption[2](https://arxiv.org/html/2609.16373#Thmassumption2)\. Then,

LsafeFA:=∑𝒌∈𝒦safe∏i=1npi,kiL\_\{\\mathrm\{safe\}\}^\{\\mathrm\{FA\}\}:=\\sum\_\{\\boldsymbol\{k\}\\in\\mathcal\{K\}\_\{\\mathrm\{safe\}\}\}\\prod\_\{i=1\}^\{n\}p\_\{i,k\_\{i\}\}\(21\)is a valid lower bound on the probability that the model deployed by FedAvg is safe\. In particular,

LsafeFA≤Pr⁡\(∑i=1nαi​Θi∈𝒮\)=PsafegL\_\{\\mathrm\{safe\}\}^\{\\mathrm\{FA\}\}\\leq\\Pr\\\!\\left\(\\sum\_\{i=1\}^\{n\}\\alpha\_\{i\}\\Theta\_\{i\}\\in\\mathcal\{S\}\\right\)=P\_\{\\mathrm\{safe\}\}^\{g\}\(22\)where𝒦safe\\mathcal\{K\}\_\{\\mathrm\{safe\}\}denotes the set of client\-region combinations whose complete FedAvg images are certified safe, andpi,kip\_\{i,k\_\{i\}\}is the posterior probability of the selected region at clientii\.

###### Proof\.

For each tuplek=\(k1,…,kn\)∈𝒦safek=\(k\_\{1\},\\ldots,k\_\{n\}\)\\in\\mathcal\{K\}\_\{\\mathrm\{safe\}\}, consider the joint event

Ek:=\{Θi∈Hi,ki,i=1,…,n\},E\_\{k\}:=\\left\\\{\\Theta\_\{i\}\\in H\_\{i,k\_\{i\}\},i=1,\\ldots,n\\right\\\},\(23\)whereHi,kiH\_\{i,k\_\{i\}\}is the selected parameter region of clientii\. By the definition of𝒦safe\\mathcal\{K\}\_\{\\mathrm\{safe\}\}, the complete FedAvg image of the regions associated withkkhas been verified to lie inside the safe set𝒮\\mathcal\{S\}\. Hence, wheneverEkE\_\{k\}occurs, the aggregated parameter vector satisfies:

∑i=1nαi​Θi∈𝒮\.\\sum\_\{i=1\}^\{n\}\\alpha\_\{i\}\\Theta\_\{i\}\\in\\mathcal\{S\}\.\(24\)Therefore,

Ek⊆\{∑i=1nαiΘi∈𝒮\},∀k∈𝒦safe\.E\_\{k\}\\subseteq\\left\\\{\\sum\_\{i=1\}^\{n\}\\alpha\_\{i\}\\Theta\_\{i\}\\in\\mathcal\{S\}\\right\\\},\\qquad\\forall k\\in\\mathcal\{K\}\_\{\\mathrm\{safe\}\}\.\(25\)Taking the union over all verified tuples gives

⋃k∈𝒦safeEk⊆\{∑i=1nαiΘi∈𝒮\}\.\\bigcup\_\{k\\in\\mathcal\{K\}\_\{\\mathrm\{safe\}\}\}E\_\{k\}\\subseteq\\left\\\{\\sum\_\{i=1\}^\{n\}\\alpha\_\{i\}\\Theta\_\{i\}\\in\\mathcal\{S\}\\right\\\}\.\(26\)Consequently,

Pr⁡\(⋃k∈𝒦safeEk\)≤Pr⁡\(∑i=1nαi​Θi∈𝒮\)\.\\Pr\\left\(\\bigcup\_\{k\\in\\mathcal\{K\}\_\{\\mathrm\{safe\}\}\}E\_\{k\}\\right\)\\leq\\Pr\\left\(\\sum\_\{i=1\}^\{n\}\\alpha\_\{i\}\\Theta\_\{i\}\\in\\mathcal\{S\}\\right\)\.\(27\)Because the retained parameter regions of each client are pairwise disjoint, two distinct tuples correspond to disjoint joint events\. Thus,

Pr⁡\(⋃k∈𝒦safeEk\)=∑k∈𝒦safePr⁡\(Ek\)\.\\Pr\\left\(\\bigcup\_\{k\\in\\mathcal\{K\}\_\{\\mathrm\{safe\}\}\}E\_\{k\}\\right\)=\\sum\_\{k\\in\\mathcal\{K\}\_\{\\mathrm\{safe\}\}\}\\Pr\(E\_\{k\}\)\.\(28\)Moreover, under the independence of the client posterior draws, the probability of each joint event factorizes as

Pr⁡\(Ek\)\\displaystyle\\Pr\(E\_\{k\}\)=Pr⁡\(Θ1∈H1,k1,…,Θn∈Hn,kn\)\\displaystyle=\\Pr\\left\(\\Theta\_\{1\}\\in H\_\{1,k\_\{1\}\},\\ldots,\\Theta\_\{n\}\\in H\_\{n,k\_\{n\}\}\\right\)=∏i=1nPr⁡\(Θi∈Hi,ki\)\\displaystyle=\\prod\_\{i=1\}^\{n\}\\Pr\\left\(\\Theta\_\{i\}\\in H\_\{i,k\_\{i\}\}\\right\)=∏i=1npi,ki\.\\displaystyle=\\prod\_\{i=1\}^\{n\}p\_\{i,k\_\{i\}\}\.\(29\)
Substituting \([29](https://arxiv.org/html/2609.16373#S3.E29)\) into \([28](https://arxiv.org/html/2609.16373#S3.E28)\) yields

Pr⁡\(⋃k∈𝒦safeEk\)=∑k∈𝒦safe∏i=1npi,ki=LsafeFA\.\\Pr\\left\(\\bigcup\_\{k\\in\\mathcal\{K\}\_\{\\mathrm\{safe\}\}\}E\_\{k\}\\right\)=\\sum\_\{k\\in\\mathcal\{K\}\_\{\\mathrm\{safe\}\}\}\\prod\_\{i=1\}^\{n\}p\_\{i,k\_\{i\}\}=L\_\{\\mathrm\{safe\}\}^\{\\mathrm\{FA\}\}\.\(30\)
Combining \([27](https://arxiv.org/html/2609.16373#S3.E27)\) and \([30](https://arxiv.org/html/2609.16373#S3.E30)\), we obtain

LsafeFA≤Pr⁡\(∑i=1nαi​Θi∈𝒮\)=Psafeg\.L\_\{\\mathrm\{safe\}\}^\{\\mathrm\{FA\}\}\\leq\\Pr\\left\(\\sum\_\{i=1\}^\{n\}\\alpha\_\{i\}\\Theta\_\{i\}\\in\\mathcal\{S\}\\right\)=P\_\{\\mathrm\{safe\}\}^\{g\}\.\(31\)Hence,LsafeFAL\_\{\\mathrm\{safe\}\}^\{\\mathrm\{FA\}\}is a valid lower bound on the deployment safety probability\. ∎

Algorithm[1](https://arxiv.org/html/2609.16373#alg1)summarizes the complete operational procedure for executing this framework\.

Algorithm Explanation:The algorithmic procedure is divided into a parallelizable client\-side discretization phase and a server\-side aggregation phase\. During the local phase \(Lines 1\-12\), each clientiiiterates up to a sampling budgetNN, drawing a stochastic center pointwi,k∗w\_\{i,k\}^\{\*\}directly from its posterior distributionqiq\_\{i\}\(Lines 3\-4\)\. A hyperrectangleHi,kH\_\{i,k\}is then constructed by scaling the interval widths around the center by the local posterior standard deviations using the expansion factorγ\\gamma\(Line 5\)\. To ensure probabilities can be summed linearly without inclusion\-exclusion corrections, the algorithm checks if the proposed region intersects with any previously stored sets in𝒞i\\mathcal\{C\}\_\{i\}\(Line 7\)\. If it is completely disjoint, the exact probability masspi,kp\_\{i,k\}is evaluated and the region is stored \(Lines 8\-9\)\. In the server phase \(Lines 13\-22\), the server constructs a set𝒦\\mathcal\{K\}of combination tuples representing the Cartesian product of local regions provided by the clients \(Line 13\)\. For every unique combination tuplekk, the server constructs the complete aggregate imageGkG\_\{k\}using the FedAvg map \(Lines 15\-16\)\. The verifier checks if the entire aggregated geometric region is safe \(Line 17\)\. If accepted, the tuple is added to the safe tracking set𝒦s​a​f​e\\mathcal\{K\}\_\{safe\}, and its joint probability which has been calculated as the independent product of local masses, is accumulated into the total safety boundLs​a​f​eF​AL\_\{safe\}^\{FA\}\(Lines 18\-19\)\.

Algorithm 1Deployment\-Consistent FedAvg Safety Certificate1:Local posteriors

\{qi\}i=1n\\\{q\_\{i\}\\\}\_\{i=1\}^\{n\}, FedAvg coefficients

\{αi\}i=1n\\\{\\alpha\_\{i\}\\\}\_\{i=1\}^\{n\}, input region

𝒳\\mathcal\{X\}, expansion factor

γ\\gamma, local sampling budget

NN
2:Certified lower bound

Ls​a​f​eF​AL\_\{safe\}^\{FA\}
3:for

i=1​…​ni=1\\dots ndo

4:

𝒞i←∅\\mathcal\{C\}\_\{i\}\\leftarrow\\emptyset
5:for

k=1​…​Nk=1\\dots Ndo

6:Sample

wi,k∗∼qiw\_\{i,k\}^\{\*\}\\sim q\_\{i\}
7:Construct

Hi,kH\_\{i,k\}using Eq\. \([8](https://arxiv.org/html/2609.16373#S3.E8)\)

8:Optionally screen

Hi,kH\_\{i,k\}using local IBP

9:if

Hi,kH\_\{i,k\}is retained and disjoint from all regions in

𝒞i\\mathcal\{C\}\_\{i\}then

10:

pi,k←qi​\(Hi,k\)p\_\{i,k\}\\leftarrow q\_\{i\}\(H\_\{i,k\}\)
11:

𝒞i←𝒞i∪\{\(Hi,k,pi,k\)\}\\mathcal\{C\}\_\{i\}\\leftarrow\\mathcal\{C\}\_\{i\}\\cup\\\{\(H\_\{i,k\},p\_\{i,k\}\)\\\}
12:endif

13:endfor

14:endfor

15:Construct a set

𝒦\\mathcal\{K\}of at most

BBunique tuples; enumerate all tuples when feasible, otherwise prioritize them by

∏i=1npi,ki\\prod\_\{i=1\}^\{n\}p\_\{i,k\_\{i\}\}
16:

𝒦s​a​f​e←∅\\mathcal\{K\}\_\{safe\}\\leftarrow\\emptyset,

Ls​a​f​eF​A←0L\_\{safe\}^\{FA\}\\leftarrow 0
17:foreach

k=\(k1,…,kn\)∈𝒦k=\(k\_\{1\},\\dots,k\_\{n\}\)\\in\\mathcal\{K\}do

18:Construct

GkG\_\{k\}using Eq\. \([19](https://arxiv.org/html/2609.16373#S3.E19)\)

19:if

SAFE​\(Gk\)==1\\text\{SAFE\}\(G\_\{k\}\)==1then

20:

𝒦s​a​f​e←𝒦s​a​f​e∪\{k\}\\mathcal\{K\}\_\{safe\}\\leftarrow\\mathcal\{K\}\_\{safe\}\\cup\\\{k\\\}
21:

Ls​a​f​eF​A←Ls​a​f​eF​A\+∏i=1npi,kiL\_\{safe\}^\{FA\}\\leftarrow L\_\{safe\}^\{FA\}\+\\prod\_\{i=1\}^\{n\}p\_\{i,k\_\{i\}\}
22:endif

23:endforreturn

Ls​a​f​eF​AL\_\{safe\}^\{FA\}

### III\-GDirect Certification Under Global Posterior Laws

In addition to the transported certificate, we consider direct certification under a global distribution defined in the deployed parameter space\. This approach constructs and verifies weight regions directly under the selected global posterior, rather than transporting combinations of local regions through the aggregation map\. Assume that the client parameters are independently distributed as

Θi∼𝒩\(μi,Σi\),i=1,…,n\.\\Theta\_\{i\}\\sim\\mathcal\{N\}\(\\mu\_\{i\},\\Sigma\_\{i\}\),\\qquad i=1,\\ldots,n\.\(32\)For FedAvg,

ΘgFA=∑i=1nαi​Θi,∑i=1nαi=1,\\Theta\_\{g\}^\{\\mathrm\{FA\}\}=\\sum\_\{i=1\}^\{n\}\\alpha\_\{i\}\\Theta\_\{i\},\\qquad\\sum\_\{i=1\}^\{n\}\\alpha\_\{i\}=1,\(33\)the induced global distribution is Gaussian:

qgFA=𝒩⁡\(μgFA,ΣgFA\),q\_\{g\}^\{\\mathrm\{FA\}\}=\\mathcal\{N\}\\left\(\\mu\_\{g\}^\{\\mathrm\{FA\}\},\\Sigma\_\{g\}^\{\\mathrm\{FA\}\}\\right\),\(34\)with

μgF​A=∑i=1nαi​μi,ΣgF​A=∑i=1nαi2​Σi\.\\mu\_\{g\}^\{FA\}=\\sum\_\{i=1\}^\{n\}\\alpha\_\{i\}\\mu\_\{i\},\\quad\\Sigma\_\{g\}^\{FA\}=\\sum\_\{i=1\}^\{n\}\\alpha\_\{i\}^\{2\}\\Sigma\_\{i\}\.\(35\)
Let\{Cj,tFA\}t=1Tj\\\{C\_\{j,t\}^\{\\mathrm\{FA\}\}\\\}\_\{t=1\}^\{T\_\{j\}\}be a collection of pairwise\-disjoint global hyper\-rectangles constructed underqgFAq\_\{g\}^\{\\mathrm\{FA\}\}for safety propertyjj\. Each region is retained only if it is verified to satisfy the prescribed safety specification over its complete extent\. The corresponding direct FedAvg certificate is

Lsafe,jdir,FA:=∑t=1TjqgFA​\(Cj,tFA\)≤qgFA​\(𝒮j\)=Psafe,jg\.L\_\{\\mathrm\{safe\},j\}^\{\\mathrm\{dir,FA\}\}:=\\sum\_\{t=1\}^\{T\_\{j\}\}q\_\{g\}^\{\\mathrm\{FA\}\}\\left\(C\_\{j,t\}^\{\\mathrm\{FA\}\}\\right\)\\leq q\_\{g\}^\{\\mathrm\{FA\}\}\(\\mathcal\{S\}\_\{j\}\)=P\_\{\\mathrm\{safe\},j\}^\{g\}\.\(36\)The transported and direct FedAvg certificates therefore lower\-bound the same deployment\-level safety probability\. They differ, however, in the regions used to construct the bound\. The transported certificate begins with events under the local client posteriors and verifies their images after aggregation, whereas the direct certificate searches for safe regions directly under the FedAvg\-induced global distribution\. Since these procedures generally cover different subsets of the relevant probability space, neither certificate is guaranteed to dominate the other\.

We also consider Product\-of\-Gaussians \(PoG\) fusion as a separate global posterior baseline:

qgPoG​\(θ\)∝∏i=1nqi​\(θ\)\.q\_\{g\}^\{\\mathrm\{PoG\}\}\(\\theta\)\\propto\\prod\_\{i=1\}^\{n\}q\_\{i\}\(\\theta\)\.\(37\)For Gaussian local factors, the resulting distribution is

qgPoG=𝒩⁡\(μgPoG,ΣgPoG\),q\_\{g\}^\{\\mathrm\{PoG\}\}=\\mathcal\{N\}\\left\(\\mu\_\{g\}^\{\\mathrm\{PoG\}\},\\Sigma\_\{g\}^\{\\mathrm\{PoG\}\}\\right\),\(38\)where

ΣgPoG\\displaystyle\\Sigma\_\{g\}^\{\\mathrm\{PoG\}\}=\(∑i=1nΣi−1\)−1,\\displaystyle=\\left\(\\sum\_\{i=1\}^\{n\}\\Sigma\_\{i\}^\{\-1\}\\right\)^\{\-1\},\(39\)μgPoG\\displaystyle\\mu\_\{g\}^\{\\mathrm\{PoG\}\}=ΣgPoG​∑i=1nΣi−1​μi\.\\displaystyle=\\Sigma\_\{g\}^\{\\mathrm\{PoG\}\}\\sum\_\{i=1\}^\{n\}\\Sigma\_\{i\}^\{\-1\}\\mu\_\{i\}\.\(40\)
Let\{Cj,tPoG\}t=1TjPoG\\\{C\_\{j,t\}^\{\\mathrm\{PoG\}\}\\\}\_\{t=1\}^\{T\_\{j\}^\{\\mathrm\{PoG\}\}\}denote pairwise\-disjoint regions constructed underqgPoGq\_\{g\}^\{\\mathrm\{PoG\}\}and verified safe for propertyjj\. The direct PoG certificate is

Lsafe,jdir,PoG:=∑t=1TjPoGqgPoG​\(Cj,tPoG\)≤qgPoG​\(𝒮j\)\.L\_\{\\mathrm\{safe\},j\}^\{\\mathrm\{dir,PoG\}\}:=\\sum\_\{t=1\}^\{T\_\{j\}^\{\\mathrm\{PoG\}\}\}q\_\{g\}^\{\\mathrm\{PoG\}\}\\left\(C\_\{j,t\}^\{\\mathrm\{PoG\}\}\\right\)\\leq q\_\{g\}^\{\\mathrm\{PoG\}\}\(\\mathcal\{S\}\_\{j\}\)\.\(41\)
The PoG certificate characterizes safety under the PoG fusion distribution\. It should not be interpreted as a certificate for FedAvg deployment, since FedAvg and PoG define different random global models and, consequently, different safety probabilities\.

## IVExperiments

We conduct a controlled evaluation of three quantities that have distinct probabilistic meanings: direct certification under a selected global posterior, the transported FedAvg certificate derived from local posterior events, and Monte Carlo acceptance of the input verifier\. The experiments examine whether the transported certificate is non\-vacuous, how certification varies with architecture and data partitioning, and whether FedAvg and Product\-of\-Gaussians \(PoG\) fusion exhibit consistent differences\.

### IV\-AExperimental setup

We evaluate MNIST\[[23](https://arxiv.org/html/2609.16373#bib.bib22)\]and Fashion\-MNIST\[[24](https://arxiv.org/html/2609.16373#bib.bib23)\]using random subsets of 12,000 training examples and 2,000 test examples\. The training subset is partitioned amongn∈\{2,3,5\}n\\in\\\{2,3,5\\\}clients using label\-Dirichlet sampling\[[25](https://arxiv.org/html/2609.16373#bib.bib24)\]with

α∈\{0\.5,0\.6,0\.7,0\.9,1,2,5,7,10\}\.\\alpha\\in\\\{0\.5,0\.6,0\.7,0\.9,1,2,5,7,10\\\}\.Smaller values ofα\\alphaproduce more label\-skewed client datasets\. All clients share the same network parameterization and initialization\. We consider fully connected Bayesian neural networks with hidden architectures1×641\\times 64,1×1281\\times 128, and2×642\\times 64, using ReLU activations\.

Each client trains a diagonal mean\-field posterior for five epochs using Adam\[[26](https://arxiv.org/html/2609.16373#bib.bib21)\], a learning rate of10−310^\{\-3\}, batch size 128, a standard\-normal prior, and a Bayes\-by\-Backprop objective with KL coefficient10−410^\{\-4\}\[[5](https://arxiv.org/html/2609.16373#bib.bib20)\]\. The post\-training diagonal standard deviation is fixed to10−510^\{\-5\}\. The experiment is therefore designed as a controlled study of aggregation geometry and certificate construction rather than a study of posterior calibration\. The selected posterior scale enables a consistent analysis of deployment\-consistent certification behavior across federated configurations\. Implementation parameters are detailed in Table[I](https://arxiv.org/html/2609.16373#S4.T1)\.

TABLE I:Implementation parameters used in the reported experiments\.Training subset12,000Test subset2,000Local epochs5Batch size128Learning rate10−310^\{\-3\}KL coefficient10−410^\{\-4\}Posterior scale10−510^\{\-5\}Properties/config\.50Input radius10−310^\{\-3\}Logit margin0Centers/γ\\gamma200γ\\gammavalues3–7Direct MC/property300Aggregate MC/property3,000Cells/client/property8Tuple budget/property20,000We compare two global laws\. Equal\-weight FedAvg usesαi=1/n\\alpha\_\{i\}=1/nand the corresponding Gaussian pushforward\. PoG uses the uncorrected product of the local Gaussian approximations and is treated as a precision\-fusion baseline\. Direct certificates are constructed independently under both global laws\. The transported local\-event certificate is reported only for FedAvg, because the implemented interval transport uses the FedAvg parameter map\. For each configuration, 50 correctly classified test inputs define pointwise robustness properties with input radiusϵ=10−3\\epsilon=10^\{\-3\}and logit marginδ=0\\delta=0\. Candidate weight boxes are generated from 200 posterior samples for each

γ∈\{3,4,5,6,7\}\.\\gamma\\in\\\{3,4,5,6,7\\\}\.At most eight pairwise\-disjoint cells are retained per client and property\. The FedAvg transport procedure evaluates at most 20,000 unique cell tuples per property\. Direct MC–IBP uses 300 global posterior samples; the separate aggregated\-sampling diagnostic uses 3,000 samples\.

Accuracy is evaluated using the posterior\-mean network\. For a selected global law, the direct certificate is the posterior mass of the disjoint global boxes verified by IBP\. The quantity stored by the implementation asempirical\_safetyis reported here as MC–IBP: it is the fraction of sampled weight vectors whose complete input region is accepted by IBP\. It is not an exact safety probability and is not a formal upper bound\. All property\-level quantities are first macro\-averaged within each configuration\. Tables report the mean and sample standard deviation across the available client\-count and Dirichlet configurations\. These deviations describe variation across federation settings; they are not confidence intervals over independent training repetitions\.

### IV\-BSimulation results and discussion

Table[II](https://arxiv.org/html/2609.16373#S4.T2)reports predictive accuracy, local certification, direct global certification, MC–IBP acceptance, and runtime for PoG and equal\-weight FedAvg\. The transported certificate is reported only for FedAvg, because the implemented local\-event transport follows the FedAvg parameter map\. All probability values are macro\-averaged over the selected robustness properties and are reported as percentages\. The standard deviations summarize variation across client\-count and Dirichlet\-partition configurations rather than repeated training seeds\.

TABLE II:PoG and FedAvg results under different heterogeneity regimes\. Non\-IID and IID groups are formed according to the Dirichlet concentration parameter, and entries report mean±\\pmstandard deviation across the corresponding configurations\.The three reported certification quantities have different probabilistic interpretations\. Local certification evaluates individual client posteriors, whereas transported certification evaluates whether joint local events remain safe after aggregation\. Direct certification instead searches safe regions directly under the induced global posterior\. Figure[1](https://arxiv.org/html/2609.16373#S4.F1)illustrates this distinction\.

Fig\. 1:FedAvg bound hierarchy over dataset–architecture pairs, comparingLl​o​cL^\{loc\},Lt​rL^\{tr\},Ld​i​rL^\{dir\}, and MC\-IBP acceptance\.Figure[1](https://arxiv.org/html/2609.16373#S4.F1)summarizes the relative behavior of the local, transported, and direct certification bounds across different dataset and architecture configurations\.

a\) Direct certification:Direct certificates are non\-vacuous for every dataset, architecture, and global law in Table[II](https://arxiv.org/html/2609.16373#S4.T2)\. Figure[2](https://arxiv.org/html/2609.16373#S4.F2)shows a clear positive association between direct certification and MC–IBP, with all evaluated points above the equality line\. The certified posterior mass ranges from72\.05%72\.05\\%to91\.39%91\.39\\%for PoG and from72\.58%72\.58\\%to91\.20%91\.20\\%for FedAvg\. MC–IBP is larger than the corresponding direct certificate in the reported configurations, with differences between5\.475\.47and13\.2513\.25percentage points\. This ordering is consistent with finite safe\-cell coverage and the stronger requirement imposed by region\-based certification: a box contributes only when every weight vector inside it is verified\. The difference should not be interpreted as an error bound on the true safety probability, because MC–IBP is itself based on an incomplete verifier and a finite posterior sample\. The smallest direct\-to\-MC differences occur for the1×641\\times 64architecture\. The largest differences occur for the2×642\\times 64model on Fashion\-MNIST\. The effect is not completely monotone across architectures: for example, PoG on MNIST exhibits a smaller difference for2×642\\times 64than for1×1281\\times 128\. The results therefore indicate architecture\-dependent certifiability, but do not support a claim that depth alone determines certificate tightness\.

Fig\. 2:Direct certified mass versus MC–IBP acceptance across all evaluated configurations\. The dashed line denotes equality\.b\) Transported FedAvg certificate:The transported certificate is positive in all six dataset–architecture FedAvg configurations, ranging from22\.51%22\.51\\%to46\.89%46\.89\\%\. It is more conservative than the direct FedAvg certificate because certified mass must be represented by retained local cells, included in the searched tuple set, and verified after transporting the complete Cartesian product through the FedAvg map\. The transported certificate also varies substantially more across federation configurations\. Its standard deviation ranges from18\.0918\.09to33\.0633\.06percentage points, whereas the standard deviation of the direct FedAvg certificate ranges from4\.024\.02to13\.5913\.59points\. This larger variability indicates that transported coverage is more sensitive than direct global certification to the federation configuration, the retained local cells, and whether their complete aggregation images remain verifiable\. Finite tuple evaluation may introduce further variability\. Using the aggregate means, the transported certificate ratio relative to the direct FedAvg certificate ranges approximately from31%31\\%to57%57\\%\. The smallest ratio occurs for MNIST2×642\\times 64, while the largest occurs for Fashion\-MNIST1×1281\\times 128\. These ratios are descriptive measures of the selected certificate constructions and should not be interpreted as the fraction of the true safe probability recovered by the method\. To further examine this sensitivity, Fig\.[3](https://arxiv.org/html/2609.16373#S4.F3)reports the transported\-to\-direct certificate ratio,100×Ltr/Ldir100\\times L^\{\\mathrm\{tr\}\}/L^\{\\mathrm\{dir\}\}, as a function of the Dirichlet concentration parameter and the number of participating clients\. The retention ratio generally improves asα\\alphaincreases, indicating that less heterogeneous client data lead to better agreement between the transported and direct FedAvg certificates\. In contrast, increasing the number of clients consistently reduces the recovered fraction of direct certified mass\. This pattern suggests that the gap between transported and direct certification is shaped not only by verifier conservatism, but also by the geometric compatibility of certified local regions after aggregation\. As the number of clients grows, the Cartesian product of retained local events becomes more difficult to verify after transport, leading to a larger loss in certified mass\.

Fig\. 3:Transport retention ratio \(100​Ltr/Ldir100L^\{\\mathrm\{tr\}\}/L^\{\\mathrm\{dir\}\}\) versus Dirichlet concentration for different federation scales\. Thin dashed curves show individual dataset–architecture configurations, while the bold curves with error bars show the mean and standard deviation across all six configurations\.c\) Architecture and certification:The1×1281\\times 128architecture yields the highest mean predictive accuracy under both global laws and on both datasets\. It does not, however, yield the largest certified posterior mass\. The smaller1×641\\times 64network achieves the strongest direct certificate in all four dataset–method comparisons\. Increasing width from1×641\\times 64to1×1281\\times 128improves accuracy but typically reduces direct certification by several percentage points\. The2×642\\times 64architecture produces a larger reduction in certified mass and, for FedAvg, the smallest transported certificate on MNIST\. This pattern is consistent with the behavior of interval verification\[[12](https://arxiv.org/html/2609.16373#bib.bib8),[13](https://arxiv.org/html/2609.16373#bib.bib9)\]: in a larger parameter space, axis\-aligned cells may capture less useful posterior mass while remaining certifiable, and additional layers compound dependency loss between uncertain weights and hidden activations\. The experiment does not fully separate width and depth effects, but it shows that predictive accuracy and certifiable posterior mass need not improve together\.

d\) Dataset effects:Fashion\-MNIST reduces mean accuracy by approximately1111–1414percentage points relative to MNIST\. The corresponding reduction in direct certification is smaller\. For the one\-layer architectures, the decrease is typically33–55points; for2×642\\times 64, the direct FedAvg certificate is nearly unchanged across the two datasets\. This contrast does not imply that the two datasets have comparable global safety\. Properties are defined only for selected correctly classified inputs, and results are macro\-averaged across those properties\. The observation instead shows that test accuracy and the posterior mass satisfying the selected local robustness specifications measure different aspects of model behavior\.

e\) PoG and FedAvg:Neither global law dominates across all architectures and metrics\. For1×641\\times 64, their direct certificates are nearly identical: the difference is below0\.250\.25points on both datasets\. For1×1281\\times 128, PoG provides higher accuracy, direct certification, and MC–IBP on MNIST and Fashion\-MNIST\. Its direct\-certificate advantage is3\.863\.86points on MNIST and3\.513\.51points on Fashion\-MNIST\. The ordering changes for2×642\\times 64\. FedAvg obtains higher accuracy and MC–IBP on both datasets\. PoG retains a2\.272\.27\-point direct\-certificate advantage on MNIST, but is0\.530\.53points lower on Fashion\-MNIST\. These architecture\-dependent differences do not support a uniform ranking between the two fusion rules\. Because the posterior standard deviation is fixed after local training, the results should not be interpreted as evidence that one method provides better Bayesian uncertainty calibration\. They only compare predictive behavior and certification under the global Gaussian laws used in this controlled study\.

f\) Federation configuration and computational cost:The pooled statistics do not establish a monotone relationship between certification and either client count or the Dirichlet concentration parameter\. Increasing the number of clients can contract the FedAvg pushforward covariance, which may improve direct certification, while simultaneously decreasing tuple masses and enlarging the Cartesian tuple space\. These effects act in opposite directions and cannot be separated from the aggregated table alone\. The1×1281\\times 128architecture is the most computationally expensive\. The PoG runtime for Fashion\-MNIST1×1281\\times 128has a particularly large standard deviation,1593\.97±2664\.921593\.97\\pm 2664\.92seconds, indicating a strongly skewed runtime distribution or expensive outlying configurations\. Mean runtime alone is therefore insufficient for claiming a consistent computational advantage between PoG and FedAvg\.

## VConclusion

We formulated probabilistic safety certification for one\-shot federated Bayesian neural networks under the probability law induced by the deployment rule\. The proposed construction transports disjoint local posterior events through the aggregation map and includes their probability only when the complete image is verified safe\. For FedAvg with nonnegative weights, the image of axis\-aligned cells is exact, so the aggregation step itself introduces no additional geometric relaxation\. The experiments produce non\-vacuous transported certificates across all reported dataset–architecture FedAvg aggregates and show that predictive accuracy, direct certified mass, and transported coverage need not follow the same ordering, while neither FedAvg nor PoG uniformly dominates across architectures\. Although the theoretical construction is not restricted to the evaluated networks, extending the current implementation to larger models will require tighter weight\-space verification and scalable handling of local\-event combinations\.

## VIFuture Work

While the proposed framework provides a mathematically sound and exact geometric certificate for one\-shot FedAvg deployment, evaluating the full Cartesian product of local posterior events introduces a combinatorial challenge\. The joint tuple space grows exponentially with the number of participating clients, which limits exhaustive evaluation to smaller federated settings\. Future work will therefore focus on replacing exhaustive tuple evaluation with more scalable search strategies without sacrificing the theoretical guarantees\. Promising directions include distributed primal\-dual optimization, multi\-agent reinforcement learning, and stochastic generalized Nash equilibrium methods to identify and prune unverifiable parameter combinations before server\-side aggregation\.

## References

- \[1\]B\. McMahan, E\. Moore, D\. Ramage, S\. Hampson, and B\. A\. y Arcas\(2017\)Communication\-efficient learning of deep networks from decentralized data\.InArtificial intelligence and statistics,pp\. 1273–1282\.Cited by:[§I](https://arxiv.org/html/2609.16373#S1.p1.1),[§II](https://arxiv.org/html/2609.16373#S2.p1.1)\.
- \[2\]P\. Kairouz and H\. B\. McMahan\(2021\)Advances and open problems in federated learning\.Foundations and trends in machine learning14\(1\-2\),pp\. 1–210\.Cited by:[§I](https://arxiv.org/html/2609.16373#S1.p1.1),[§II](https://arxiv.org/html/2609.16373#S2.p1.1)\.
- \[3\]N\. Guha, A\. Talwalkar, and V\. Smith\(2019\)One\-shot federated learning\.arXiv preprint arXiv:1902\.11175\.Cited by:[§I](https://arxiv.org/html/2609.16373#S1.p1.1),[§II](https://arxiv.org/html/2609.16373#S2.p2.1)\.
- \[4\]A\. Kendall and Y\. Gal\(2017\)What uncertainties do we need in bayesian deep learning for computer vision?\.Advances in neural information processing systems30\.Cited by:[§I](https://arxiv.org/html/2609.16373#S1.p2.1)\.
- \[5\]C\. Blundell, J\. Cornebise, K\. Kavukcuoglu, and D\. Wierstra\(2015\)Weight uncertainty in neural network\.InInternational conference on machine learning,pp\. 1613–1622\.Cited by:[§I](https://arxiv.org/html/2609.16373#S1.p2.1),[§IV\-A](https://arxiv.org/html/2609.16373#S4.SS1.p2.1)\.
- \[6\]X\. Zhang, Y\. Li, W\. Li, K\. Guo, and Y\. Shao\(2022\)Personalized federated learning via variational bayesian inference\.InInternational Conference on Machine Learning,pp\. 26293–26310\.Cited by:[§I](https://arxiv.org/html/2609.16373#S1.p2.1)\.
- \[7\]A\. Rawal, J\. McCoy, D\. B\. Rawat, B\. M\. Sadler, and R\. S\. Amant\(2021\)Recent advances in trustworthy explainable artificial intelligence: status, challenges, and perspectives\.IEEE Transactions on Artificial Intelligence3\(6\),pp\. 852–866\.Cited by:[§I](https://arxiv.org/html/2609.16373#S1.p3.1)\.
- \[8\]D\. Pfau and A\. Jung\(2025\)Engineering trustworthy ai: a developer guide for empirical risk minimization\.IEEE Transactions on Artificial Intelligence\.Cited by:[§I](https://arxiv.org/html/2609.16373#S1.p3.1)\.
- \[9\]M\. Wicker, L\. Laurenti, A\. Patane, and M\. Kwiatkowska\(2020\)Probabilistic safety for bayesian neural networks\.InConference on uncertainty in artificial intelligence,pp\. 1198–1207\.Cited by:[§I](https://arxiv.org/html/2609.16373#S1.p3.1),[§II](https://arxiv.org/html/2609.16373#S2.p3.1)\.
- \[10\]M\. Wicker, A\. Patane, L\. Laurenti, and M\. Kwiatkowska\(2024\)Adversarial robustness certification for bayesian neural networks\.InInternational Symposium on Formal Methods,pp\. 3–28\.Cited by:[§I](https://arxiv.org/html/2609.16373#S1.p3.1),[§II](https://arxiv.org/html/2609.16373#S2.p3.1)\.
- \[11\]B\. Batten, M\. Hosseini, and A\. Lomuscio\(2024\)Tight verification of probabilistic robustness in bayesian neural networks\.InInternational Conference on Artificial Intelligence and Statistics,pp\. 4906–4914\.Cited by:[§I](https://arxiv.org/html/2609.16373#S1.p3.1),[§II](https://arxiv.org/html/2609.16373#S2.p3.1)\.
- \[12\]S\. Gowal, K\. Dvijotham, R\. Stanforth, R\. Bunel, C\. Qin, J\. Uesato, R\. Arandjelovic, T\. Mann, and P\. Kohli\(2018\)On the effectiveness of interval bound propagation for training verifiably robust models\.arXiv preprint arXiv:1810\.12715\.Cited by:[§I](https://arxiv.org/html/2609.16373#S1.p3.1),[§II](https://arxiv.org/html/2609.16373#S2.p3.1),[§IV\-B](https://arxiv.org/html/2609.16373#S4.SS2.p6.1)\.
- \[13\]M\. Mirman, T\. Gehr, and M\. Vechev\(2018\)Differentiable abstract interpretation for provably robust neural networks\.InInternational Conference on Machine Learning,pp\. 3578–3586\.Cited by:[§I](https://arxiv.org/html/2609.16373#S1.p3.1),[§II](https://arxiv.org/html/2609.16373#S2.p3.1),[§IV\-B](https://arxiv.org/html/2609.16373#S4.SS2.p6.1)\.
- \[14\]X\. Yu, A\. Tashakori, L\. Zou, and Z\. J\. Wang\(2025\)Pfedbl: federated bayesian learning with personalized prior\.IEEE Transactions on Artificial Intelligence7\(1\),pp\. 455–470\.Cited by:[§II](https://arxiv.org/html/2609.16373#S2.p1.1)\.
- \[15\]P\. Li, Q\. Hu, and X\. Wang\(2025\)Federated learning meets bayesian neural network: robust and uncertainty\-aware distributed variational inference\.Neural Networks185,pp\. 107135\.Cited by:[§II](https://arxiv.org/html/2609.16373#S2.p1.1)\.
- \[16\]M\. Yurochkin, M\. Agarwal, S\. Ghosh, K\. Greenewald, N\. Hoang, and Y\. Khazaeni\(2019\)Bayesian nonparametric federated learning of neural networks\.InInternational conference on machine learning,pp\. 7252–7261\.Cited by:[§II](https://arxiv.org/html/2609.16373#S2.p1.1)\.
- \[17\]M\. Al\-Shedivat, J\. Gillenwater, E\. Xing, and A\. Rostamizadeh\(2020\)Federated learning via posterior averaging: a new perspective and practical algorithms\.arXiv preprint arXiv:2010\.05273\.Cited by:[§II](https://arxiv.org/html/2609.16373#S2.p1.1)\.
- \[18\]H\. Chen and W\. Chao\(2020\)Fedbe: making bayesian model ensemble applicable to federated learning\.arXiv preprint arXiv:2009\.01974\.Cited by:[§II](https://arxiv.org/html/2609.16373#S2.p1.1)\.
- \[19\]M\. Hasan, G\. Zhang, K\. Guo, X\. Chen, and P\. Poupart\(2024\)Calibrated one round federated learning with bayesian inference in the predictive space\.InProceedings of the AAAI conference on artificial intelligence,Vol\.38,pp\. 12313–12321\.Cited by:[§II](https://arxiv.org/html/2609.16373#S2.p1.1)\.
- \[20\]X\. Liu, L\. Liu, F\. Ye, Y\. Shen, X\. Li, L\. Jiang, and J\. Li\(2024\)Fedlpa: one\-shot federated learning with layer\-wise posterior aggregation\.Advances in Neural Information Processing Systems37,pp\. 81510–81548\.Cited by:[§II](https://arxiv.org/html/2609.16373#S2.p1.1)\.
- \[21\]L\. Cardelli, M\. Kwiatkowska, L\. Laurenti, N\. Paoletti, A\. Patane, and M\. Wicker\(2019\)Statistical guarantees for the robustness of bayesian neural networks\.arXiv preprint arXiv:1903\.01980\.Cited by:[§II](https://arxiv.org/html/2609.16373#S2.p3.1)\.
- \[22\]S\. Adams, A\. Patane, M\. Lahijanian, and L\. Laurenti\(2023\)BNN\-dp: robustness certification of bayesian neural networks via dynamic programming\.InInternational Conference on Machine Learning,pp\. 133–151\.Cited by:[§II](https://arxiv.org/html/2609.16373#S2.p3.1)\.
- \[23\]Y\. LeCun, L\. Bottou, Y\. Bengio, and P\. Haffner\(1998\)Gradient\-based learning applied to document recognition\.Proceedings of the IEEE86\(11\),pp\. 2278–2324\.Cited by:[§IV\-A](https://arxiv.org/html/2609.16373#S4.SS1.p1.1)\.
- \[24\]H\. Xiao, K\. Rasul, and R\. Vollgraf\(2017\)Fashion\-mnist: a novel image dataset for benchmarking machine learning algorithms\.arXiv preprint arXiv:1708\.07747\.Cited by:[§IV\-A](https://arxiv.org/html/2609.16373#S4.SS1.p1.1)\.
- \[25\]T\. H\. Hsu, H\. Qi, and M\. Brown\(2019\)Measuring the effects of non\-identical data distribution for federated visual classification\.arXiv preprint arXiv:1909\.06335\.Cited by:[§IV\-A](https://arxiv.org/html/2609.16373#S4.SS1.p1.1)\.
- \[26\]D\. P\. Kingma and J\. Ba\(2014\)Adam: a method for stochastic optimization\.arXiv preprint arXiv:1412\.6980\.Cited by:[§IV\-A](https://arxiv.org/html/2609.16373#S4.SS1.p2.1)\.