用于单轮分布式表格学习的测地线-SVDD 潜空间混合增强

# Geodesic-SVDD Latent Mixup for One-Shot Distributed Tabular Learning
Source: [https://arxiv.org/html/2610.33619](https://arxiv.org/html/2610.33619)
## Geodesic\-SVDD Latent Mixup for One\-Shot Distributed Tabular LearningThanks:Code available at:[https://github\.com/andreamoleri/Geodesic\-SVDD](https://github.com/andreamoleri/Geodesic-SVDD)

Andrea Moleri1,2,\*, Christian Internò3,\*, Markus Olhofer1, Barbara Hammer3, and Ali Raza1Affiliation:1Honda Research Institute Europe,2University of Milan\-Bicocca,3Bielefeld University \*These authors contributed equally to this work\.

###### Abstract

Distributed Learning on structured data is a key and widely adopted approach in privacy\-sensitive sectors, ranging from financial fraud prevention to federated healthcare diagnostics\. While Gradient Boosted Decision Trees are widely used in centralized settings due to their efficiency, they are incompatible with standard gradient\-based federated learning protocols because of their non\-differentiability\. Conversely, standard deep classifiers that are amenable to federated optimization often suffer from catastrophic forgetting under label distribution skew\. In this work, to address these gaps we propose Geodesic\-SVDD, a framework for Distributed Spherical Prototype Learning that recasts each client’s task as one\-class density estimation on the hypersphere, so that local models can be aggregated as probabilistic manifolds in a single round\. Specifically, for each client, we employ a Residual Spherical Encoder and Geodesic Latent Mixup that enforces strict hyperspherical constraints \(‖ϕ⁡\(x\)‖≡1\\\|\\phi\(x\)\\\|\\equiv 1\), preventing the manifold collapse observed in linear approximations\. Furthermore, leveraging this insight, we propose a novel One\-Shot “Product of Experts” protocol that enables privacy\-preserving aggregation without iterative synchronization\. Finally, we mechanistically analyze the trade\-off between interpolation strategies, demonstrating that while linear mixup offers an enticing computational shortcut, it destabilizes optimization gradients by orders of magnitude \(109×10^\{9\}\\times\)\. Across five tabular benchmarks and four levels of label skew, Geodesic\-SVDD attains the highest mean AUROC among seven federated methods, outperforms federated tree ensembles by up to 21 AUROC points onCovertype, and its One\-Shot variant matches centralized Deep SVDD under IID and mild skew with a single communication round\.

###### Index Terms:

Tabular Data, Deep SVDD, Federated Learning, Geodesic Mixup, Non\-IID Data, Spherical Manifold\.

## IIntroduction

Distributed Learning, often referred to as Federated Learning \(FL\)\[[1](https://arxiv.org/html/2610.33619#bib.bib13)\]on complex structured data \(e\.g\., tabular\) is a key requirement for safety and privacy sensitive sectors, ranging from classification tasks in financial fraud prevention to federated healthcare diagnostics\. In centralized environments, Gradient Boosted Decision Trees \(GBDTs\) and Isolation Forests are thede factostandard due to their robustness on irregular manifolds\[[2](https://arxiv.org/html/2610.33619#bib.bib17)\]\. However, deploying these models in distributed classification presents what we term the “Federated Tabular Gap\.” Tree ensembles are inherently non\-differentiable and difficult to aggregate privacy\-preservingly without sharing raw data splits or generating synthetic proxies\[[3](https://arxiv.org/html/2610.33619#bib.bib9)\]\. This limits their accuracy on complex benchmarks such asCovertype, as our experiments show \(Sec\.[IV](https://arxiv.org/html/2610.33619#S4)\)\. Deep Learning offers a differentiable alternative via weights aggregation algorithms likeFedAvg\[[1](https://arxiv.org/html/2610.33619#bib.bib13)\]\. However, standard deep classifiers are notoriously brittle underLabel Distribution Skew, where clients possess disjoint subsets of the global classes\[[4](https://arxiv.org/html/2610.33619#bib.bib23)\]\. Averaging the weights of neural networks trained on disjoint manifolds results in destructive interference and leads to poor global generalization performance\[[5](https://arxiv.org/html/2610.33619#bib.bib24)\], which renders the global model unreliable for critical decision\-making\. Furthermore, these methods typically assume fully labeled datasets, which are rarely available in real edge deployment\.

To bridge this gap, we proposeGeodesic\-SVDD, a framework for Distributed Spherical Prototype Learning\. Unlike standard classifiers that partition space with hyperplanes, our approach treats local learning as anunsupervised density estimation problem\[[6](https://arxiv.org/html/2610.33619#bib.bib11)\]\. We map inputs to a compact prototype on a hyperspherical manifold \(𝕊d−1\\mathbb\{S\}^\{d\-1\}\), allowing clients to learn valid feature representations without requiring contrasting class labels\. We then aggregate these local experts via a“Product of Experts”\(PoE\) protocol\[[7](https://arxiv.org/html/2610.33619#bib.bib25)\]\.

Crucially, this architecture eases the traditional trade\-off between communication efficiency\[[8](https://arxiv.org/html/2610.33619#bib.bib22)\]and model robustness\. We demonstrate that by aggregating unsupervised probabilistic manifolds rather than supervised weights, we can approach the performance of centralized baselines using a single\-round One\-Shot protocol\. This capability significantly reduces the communication burden in non\-IID settings, limiting the exposure to iterative gradient leakage\[[9](https://arxiv.org/html/2610.33619#bib.bib20)\]while matching a model trained on pooled data under IID and mild skew\. A critical design choice for algorithmic stability is the enforcement of geometric integrity during local training\. To handle data sparsity, we employGeodesic Latent Mixup\. While our empirical analysis reveals that standard Linear Interpolation\[[10](https://arxiv.org/html/2610.33619#bib.bib1)\]can achieve competitive predictive scores, we demonstrate that such approximations induceManifold Collapse\(midpoint norm0\.710\.71for random pairs\) and severe gradient instability \(109×10^\{9\}\\timesgradient variance\)\. By strictly interpolating along the Riemannian manifold via Spherical Linear Interpolation \(SLERP\)\[[11](https://arxiv.org/html/2610.33619#bib.bib26)\], Geodesic\-SVDD ensures that high detection performance is grounded in valid boundary definitions, a prerequisite for reliable deployment\.

The main contributions of this paper are:

- •Unsupervised One\-Shot Learning:We propose a novel architecture that aggregates unsupervised probabilistic manifolds through a Product of Experts\. With a single communication round, it matches centralized Deep SVDD under IID and mild skew \(mean AUROC within0\.60\.6points\) on tabular benchmarks\.
- •Non\-IID Robustness:Under label skewness, Geodesic\-SVDD \(Iter\) stays within1\.51\.5AUROC points of its IID performance on every benchmark, attains the highest mean AUROC among federated methods, and outperforms federated tree ensembles by up to 21 AUROC points onCovertype\.
- •Geometric Analysis:We demonstrate that linear approximations destabilize optimization \(gradient variance3\.99×10−33\.99\\times 10^\{\-3\}vs\.5\.5×10−125\.5\\times 10^\{\-12\}\) and induce manifold collapse \(midpoint norm0\.710\.71vs\.1\.001\.00for random pairs\), whereas the proposed Geodesic approach enforces strict constraints to ensure gradient stability and valid boundary definitions\.

## IIBackground, Key Challenges and Objectives

We identify three challenges to deploying robust, privacy\-preserving models in non\-IID distributed tabular environments:

#### II\-1The Tabular Task

In centralized settings, Gradient Boosted Decision Trees \(GBDTs\) dominate tabular learning due to their robustness on irregular manifolds\[[2](https://arxiv.org/html/2610.33619#bib.bib17),[12](https://arxiv.org/html/2610.33619#bib.bib18)\]\. However, their non\-differentiability creates a “Federated Tabular Gap,” obstructing gradient aggregation without costly cryptography or synthetic proxies\[[13](https://arxiv.org/html/2610.33619#bib.bib15)\]\. As shown in Sec\.[IV](https://arxiv.org/html/2610.33619#S4), federated tree ensembles plateau at0\.710\.71–0\.760\.76AUROC onCovertype, where our method reaches0\.910\.91\. A differentiable framework recovering tree\-like robustness is therefore required\.

#### II\-2Non\-IID Scenarios

Real\-world federated data frequently exhibitsLabel Distribution Skew\. In extreme cases, clients observe disjoint class subsets, causing standardFedAvgto suffer from weight divergence that grows with the degree of skew\[[14](https://arxiv.org/html/2610.33619#bib.bib8),[15](https://arxiv.org/html/2610.33619#bib.bib16)\]\. To address this, we recast local learning as single\-prototype density estimation, in the spirit ofprototype aggregation\[[16](https://arxiv.org/html/2610.33619#bib.bib19)\]\.

#### II\-3The Constraints of Iterative Communication

Standard iterative FL requires persistent bi\-directional channels, widening the attack surface for deep leakage reconstruction\[[9](https://arxiv.org/html/2610.33619#bib.bib20)\]\. While “One\-Shot” protocols minimize this exposure\[[17](https://arxiv.org/html/2610.33619#bib.bib21)\], aggregating disjoint experts without iterative alignment remains a significant open challenge\.

### II\-AThe Classical Federated Setting

We consider a distributed classification task withKKheterogeneous clients holding private datasets𝒟k=\{\(xi,yi\)\}i=1Nk\\mathcal\{D\}\_\{k\}=\\\{\(x\_\{i\},y\_\{i\}\)\\\}\_\{i=1\}^\{N\_\{k\}\}\. In safety\-critical scenarios, data is often mutually exclusive \(𝒴i∩𝒴j=∅\\mathcal\{Y\}\_\{i\}\\cap\\mathcal\{Y\}\_\{j\}=\\emptyset\)\. Under this constraint, simple averaging fails as clients solve fundamentally different problems\[[14](https://arxiv.org/html/2610.33619#bib.bib8)\]\. Standard FL seeks a global weight vectorω∗\\omega^\{\*\}by minimizing:

minω⁡ℒF​e​d​\(ω\)=∑k=1KNkN​𝔼\(x,y\)∼𝒟k​\[ℓc​e​\(ℱ⁡\(x,ω\),y\)\]\\min\_\{\\omega\}\\mathcal\{L\}\_\{Fed\}\(\\omega\)=\\sum\_\{k=1\}^\{K\}\\frac\{N\_\{k\}\}\{N\}\\mathbb\{E\}\_\{\(x,y\)\\sim\\mathcal\{D\}\_\{k\}\}\[\\ell\_\{ce\}\(\\mathcal\{F\}\(x;\\omega\),y\)\]\(1\)Under disjoint support, this objective is ill\-posed; optimizingωk\\omega\_\{k\}for𝒴k\\mathcal\{Y\}\_\{k\}effectively maximizes entropy for unseen classes\.

### II\-BOptimization Objective

To resolve the conflict between label skew and weight averaging, we decompose the multiclass problem intoCCdistinctOne\-vs\-Alldensity estimation tasks\.

For a target classct​g​t∈𝒴c\_\{tgt\}\\in\\mathcal\{Y\}, we define a strictlySingle\-Centerobjective\. Let𝒟k\+=\{x∣\(x,y\)∈𝒟k,y=ct​g​t\}\\mathcal\{D\}\_\{k\}^\{\+\}=\\\{x\\mid\(x,y\)\\in\\mathcal\{D\}\_\{k\},y=c\_\{tgt\}\\\}denote the local target subset\. Crucially, labels are used strictly for partitioning, keeping local learning as unsupervised density estimation\[[6](https://arxiv.org/html/2610.33619#bib.bib11)\]\.

We formulate the global inference as anAnomaly Score𝒜⁡\(x\)\\mathcal\{A\}\(x\)derived from aProduct of Experts \(PoE\)aggregation:

𝒜⁡\(x,ct​g​t\)\\displaystyle\\mathcal\{A\}\(x;c\_\{tgt\}\)=−∑k=1Klogp\(x∣θk,𝐜\)\\displaystyle=\-\\sum\_\{k=1\}^\{K\}\\log p\(x\\mid\\theta\_\{k\},\\mathbf\{c\}\)\(2\)where​θk\\displaystyle\\text\{where \}\\theta\_\{k\}=argminθ𝔼x∼𝒟k\+​\[‖ϕ⁡\(x,θ\)−𝐜‖2\]\\displaystyle=\\operatorname\*\{argmin\}\_\{\\theta\}\\mathbb\{E\}\_\{x\\sim\\mathcal\{D\}\_\{k\}^\{\+\}\}\\left\[\\\|\\phi\(x;\\theta\)\-\\mathbf\{c\}\\\|^\{2\}\\right\]\(3\)subject to‖ϕ⁡\(x\)‖2≡1\\\|\\phi\(x\)\\\|\_\{2\}\\equiv 1\. The densityp⁡\(x\)p\(x\)is modeled via a Student\-t kernel \(ν=1\\nu=1\) centered at𝐜\\mathbf\{c\}\. This satisfies two requirements:Single\-Center Compactness\(minimizing distance to𝐜\\mathbf\{c\}without class\-conditional prototypes\) andDecoupled Aggregation\(summing negative log\-densities to form the global score\)\.

## IIIMethodology

Local Client ProcessingServer Aggregation ProtocolsTabular Inputx∈ℝDx\\in\\mathbb\{R\}^\{D\}x1x\_\{1\} x2x\_\{2\} ⋮\\vdots xD−1x\_\{\\scriptscriptstyle D\-1\} xDx\_\{\\scriptscriptstyle D\} WinW\_\{\\text\{in\}\}Proj𝐱\\mathbf\{x\}W1W\_\{1\}σ\\sigmaW2W\_\{2\}σ\\sigma\+Residual Encoderh←h\+ℱ⁡\(h\)h\\leftarrow h\+\\mathcal\{F\}\(h\)h0h\_\{0\}WheadW\_\{\\text\{head\}\}HeadhLh\_\{L\}Normalizez=z^‖z^‖2z=\\frac\{\\hat\{z\}\}\{\\\|\\hat\{z\}\\\|\_\{2\}\}z^\\hat\{z\}ziz\_\{i\}zjz\_\{j\}z~g​e​o\\tilde\{z\}\_\{geo\}Spherical Interpolationziz\_\{i\}zjz\_\{j\}z~l​i​n\\tilde\{z\}\_\{lin\}Linear Interpolationϕ⁡\(x\)\\phi\(x\)One\-Shot Federated \(OSFL\)Iterative Federated \(FL\)Trainθ1\\theta\_\{1\}min⁡𝔼⁡\[ℓg​e​o\]\\min\\mathbb\{E\}\[\\ell\_\{geo\}\]C1Trainθ2\\theta\_\{2\}min⁡𝔼⁡\[ℓg​e​o\]\\min\\mathbb\{E\}\[\\ell\_\{geo\}\]C2Trainθ3\\theta\_\{3\}min⁡𝔼⁡\[ℓg​e​o\]\\min\\mathbb\{E\}\[\\ell\_\{geo\}\]C3Global ServerProduct of Experts \(PoE\)s\(x\)=−∑klogp\(y\|ϕk\)s\(x\)=\-\\sum\_\{k\}\\log p\(y\|\\phi\_\{k\}\)Update𝒲1t\\mathcal\{W\}\_\{1\}^\{t\}𝒲−η∇ℒ1\\mathcal\{W\}\-\\eta\\nabla\\mathcal\{L\}\_\{1\}C1Update𝒲2t\\mathcal\{W\}\_\{2\}^\{t\}𝒲−η∇ℒ2\\mathcal\{W\}\-\\eta\\nabla\\mathcal\{L\}\_\{2\}C2Update𝒲3t\\mathcal\{W\}\_\{3\}^\{t\}𝒲−η∇ℒ3\\mathcal\{W\}\-\\eta\\nabla\\mathcal\{L\}\_\{3\}C3Global ServerFedAvg Aggregation𝒲t\+1←∑kNkN​𝒲kt\\mathcal\{W\}^\{t\+1\}\\leftarrow\\sum\_\{k\}\\frac\{N\_\{k\}\}\{N\}\\mathcal\{W\}\_\{k\}^\{t\}

Fig\. 1:The Geodesic\-SVDD Framework\.\(Top\)Local clients utilize a Residual Spherical Encoder to map sparse tabular features onto the unit hypersphere𝕊d−1\\mathbb\{S\}^\{d\-1\}\. We contrast our Geodesic Mixup \(which maintains unit norm via SLERP\) against Linear Mixup \(which collapses the manifold norm\)\.\(Bottom\)The architecture supports two protocols: privacy\-preserving One\-Shot aggregation via Product of Experts \(PoE\) and iterative Federated Averaging\.As illustrated in Fig\.[1](https://arxiv.org/html/2610.33619#S3.F1), our framework consists of two distinct operational stages:Local Client Processing, where disjoint tabular partitions are mapped to a hyperspherical manifold, andServer Aggregation, which supports both One\-Shot \(PoE\) and Iterative protocols\.

### III\-ALocal Client Processing

Each clientkkpossesses a local dataset𝒟k\\mathcal\{D\}\_\{k\}\. We strictly define the local objective as unsupervised Single\-Center SVDD targeting a unique fixed centercc; labels are utilized solely for partition support to define𝒟k\\mathcal\{D\}\_\{k\}, ensuring that the global ensemble \(Eq\.[2](https://arxiv.org/html/2610.33619#S2.E2)\) aggregates compatible density estimates rather than discriminative boundaries\. The goal is to map discrete, sparse tabular featuresx∈ℝDx\\in\\mathbb\{R\}^\{D\}into a compact latent representationϕ⁡\(x\)\\phi\(x\)on the unit hypersphere𝕊d−1\\mathbb\{S\}^\{d\-1\}\. This formulation recasts the objective from discriminative boundary learning toone\-class density estimation

#### III\-A1Residual Spherical Encoder

Standard deep networks map data to an unconstrained Euclidean spaceℝd\\mathbb\{R\}^\{d\}\. To enforce geometric rigor, we employ a dedicated encoder architecture \(Fig\.[1](https://arxiv.org/html/2610.33619#S3.F1), Top\-Left\)\. First, a linear projectionWi​nW\_\{in\}expands the input to the hidden dimensionh0h\_\{0\}\. This is passed through a sequence ofLLResidual Blocks\. The update rule for thell\-th block is defined ashl\+1=hl\+ℱ⁡\(hl,W1,W2\)h\_\{l\+1\}=h\_\{l\}\+\\mathcal\{F\}\(h\_\{l\};W\_\{1\},W\_\{2\}\), whereℱ\\mathcal\{F\}represents the non\-linear residual path containing LayerNorm, GELU activations \(σ\\sigma\), and dropout\. Finally, the representation is projected by a headWh​e​a​dW\_\{head\}to a pre\-normalized vectorz^\\hat\{z\}\.

Crucially, we enforce the manifold constraint via an explicit normalization layer:

z=ϕ⁡\(x\)=z^‖z^‖2,where​z^=Wh​e​a​d⋅hLz=\\phi\(x\)=\\frac\{\\hat\{z\}\}\{\\\|\\hat\{z\}\\\|\_\{2\}\},\\quad\\text\{where \}\\hat\{z\}=W\_\{head\}\\cdot h\_\{L\}\(4\)This ensures that all valid latent points lie strictly on the surface of the sphere \(‖z‖≡1\\\|z\\\|\\equiv 1\), converting the optimization problem to a geodesic distance minimization\.

#### III\-A2Geodesic vs\. Linear Interpolation

To robustly define decision boundaries on this manifold under data sparsity, we employ latent mixup\. As depicted in Fig\.[1](https://arxiv.org/html/2610.33619#S3.F1)\(Top\-Right\), standard linear interpolation \(LERP\[[10](https://arxiv.org/html/2610.33619#bib.bib1),[18](https://arxiv.org/html/2610.33619#bib.bib3)\]\) takes the chordal pathz~l​i​n=λ​zi\+\(1−λ\)​zj\\tilde\{z\}\_\{lin\}=\\lambda z\_\{i\}\+\(1\-\\lambda\)z\_\{j\}\. This operation violates the manifold geometry, as‖z~l​i​n‖<1\\\|\\tilde\{z\}\_\{lin\}\\\|<1for anyλ∈\(0,1\)\\lambda\\in\(0,1\), collapsing the synthetic sample into the interior of the sphere\.

To preserve geometric integrity, we employSpherical Linear Interpolation\(SLERP\[[11](https://arxiv.org/html/2610.33619#bib.bib26)\]\), which traverses the geodesic arc:

z~g​e​o=sin⁡\(\(1−λ\)​Ω\)sin⁡\(Ω\)​zi\+sin⁡\(λ​Ω\)sin⁡\(Ω\)​zj\\tilde\{z\}\_\{geo\}=\\frac\{\\sin\(\(1\-\\lambda\)\\Omega\)\}\{\\sin\(\\Omega\)\}z\_\{i\}\+\\frac\{\\sin\(\\lambda\\Omega\)\}\{\\sin\(\\Omega\)\}z\_\{j\}\(5\)whereΩ=arccos⁡\(zi⋅zj\)\\Omega=\\arccos\(z\_\{i\}\\cdot z\_\{j\}\)\. This ensures‖z~g​e​o‖≡1\\\|\\tilde\{z\}\_\{geo\}\\\|\\equiv 1, maintaining the encoder’s output constraint\.

### III\-BServer Aggregation Protocols

The framework supports two aggregation strategies \(Fig\.[1](https://arxiv.org/html/2610.33619#S3.F1), Bottom Panel\) tailored to different safety and bandwidth constraints\.

#### III\-B1Protocol A: One\-Shot Federated \(OSFL\)

Clients independently train their local modelsθk\\theta\_\{k\}to minimize the geodesic error\. To ensure global alignment without iterative synchronization, the optimization targetccis pre\-computed via a warm\-up phase\. This requires a one\-time exchange of latent feature statistics \(𝔼⁡\[ϕ⁡\(x\)\]\\mathbb\{E\}\[\\phi\(x\)\]\) based on the shared random initialization, ensuring the global center is centrally aligned before local training begins\. Specifically, clients compute local feature means using the shared random initializationθi​n​i​t\\theta\_\{init\}\. These are aggregated at the server to form the fixed centerc←μ¯‖μ¯‖c\\leftarrow\\frac\{\\bar\{\\mu\}\}\{\\\|\\bar\{\\mu\}\\\|\}, whereμ¯=1K​∑k=1K𝔼x∼𝒟k\+​\[ϕ⁡\(x,θi​n​i​t\)\]\\bar\{\\mu\}=\\frac\{1\}\{K\}\\sum\_\{k=1\}^\{K\}\\mathbb\{E\}\_\{x\\sim\\mathcal\{D\}\_\{k\}^\{\+\}\}\[\\phi\(x;\\theta\_\{init\}\)\]\. The server then aggregates the trained “experts” into a global density estimator using a Product of Experts \(PoE\) rules\(x\)=−∑k=1Klogp\(x∣θk\)s\(x\)=\-\\sum\_\{k=1\}^\{K\}\\log p\(x\\mid\\theta\_\{k\}\)\. This sums the log\-likelihoods \(densities\) of the disjoint experts, forming a union of manifolds without requiring weight alignment\.

#### III\-B2Protocol B: Iterative Federated \(FL\)

For scenarios permitting bi\-directional communication, we employ standard weight averaging\. Crucially, strictly adhering to the One\-vs\-All protocol, the single target prototypeccis “fixed” \(c←μ¯‖μ¯‖c\\leftarrow\\frac\{\\bar\{\\mu\}\}\{\\\|\\bar\{\\mu\}\\\|\}\) on the hypersphere prior to training, as explicitly defined in Algorithm[1](https://arxiv.org/html/2610.33619#alg1)\. This ensures that all clients map their disjoint data partitions to a consistent global coordinate system for the target class, preventing the rotation misalignment common in standard FL\. In roundtt, the server averages client weightsWktW^\{t\}\_\{k\}to produce a global modelWt\+1W^\{t\+1\}\. This aligns the local coordinate systems but increases the gradient attack surface\.

Algorithm 1Geodesic\-SVDD: Unified Training Protocol1:Datasets

\{𝒟k\}k=1K\\\{\\mathcal\{D\}\_\{k\}\\\}\_\{k=1\}^\{K\}, Target Class

yt​g​ty\_\{tgt\}
2:Config:

𝒢∈\{Slerp,Lerp\}\\mathcal\{G\}\\in\\\{\\textsc\{Slerp\},\\textsc\{Lerp\}\\\},

𝒫∈\{OneShot,Iterative\}\\mathcal\{P\}\\in\\\{\\textsc\{OneShot\},\\textsc\{Iterative\}\\\}
3:Anomaly Decision

y^∈\{0,1\}\\hat\{y\}\\in\\\{0,1\\\}for Target Class

yt​g​ty\_\{tgt\}
4:Filter Support:

𝒟k\+←\{x∣\(x,y\)∈𝒟k,y=yt​g​t\}\\mathcal\{D\}\_\{k\}^\{\+\}\\leftarrow\\\{x\\mid\(x,y\)\\in\\mathcal\{D\}\_\{k\},y=y\_\{tgt\}\\\}
5:Server:Init

θg\\theta\_\{g\};Clients:Compute global center

𝐜\\mathbf\{c\}
6:Warm\-up:

7:

𝐜←μ¯‖μ¯‖\\mathbf\{c\}\\leftarrow\\frac\{\\bar\{\\mu\}\}\{\\\|\\bar\{\\mu\}\\\|\}where

μ¯=1K​∑k=1K𝔼x∼𝒟k\+​\[ϕ⁡\(x,θi​n​i​t\)\]\\bar\{\\mu\}=\\frac\{1\}\{K\}\\sum\_\{k=1\}^\{K\}\\mathbb\{E\}\_\{x\\sim\\mathcal\{D\}\_\{k\}^\{\+\}\}\[\\phi\(x;\\theta\_\{init\}\)\]
8:// Defined in Fig\. 1 \(Top Right\)

9:functionMix\(

zi,zj,λz\_\{i\},z\_\{j\},\\lambda\)

10:if

𝒢==Slerp\\mathcal\{G\}==\\textsc\{Slerp\}then⊳\\trianglerightGeodesic Path

11:

Ω←arccos⁡\(zi⋅zj\)\\Omega\\leftarrow\\arccos\(z\_\{i\}\\cdot z\_\{j\}\)
12:return

sin⁡\(\(1−λ\)​Ω\)sin⁡\(Ω\)​zi\+sin⁡\(λ​Ω\)sin⁡\(Ω\)​zj\\frac\{\\sin\(\(1\-\\lambda\)\\Omega\)\}\{\\sin\(\\Omega\)\}z\_\{i\}\+\\frac\{\\sin\(\\lambda\\Omega\)\}\{\\sin\(\\Omega\)\}z\_\{j\}
13:else⊳\\trianglerightLinear Chord

14:return

λ​zi\+\(1−λ\)​zj\\lambda z\_\{i\}\+\(1\-\\lambda\)z\_\{j\}
15:endif

16:endfunction

17:// Local Training Objective \(Eq\.[3](https://arxiv.org/html/2610.33619#S2.E3)\)

18:functionClientUpdate\(

θ,𝒟k\+\\theta,\\mathcal\{D\}\_\{k\}^\{\+\}\)

19:for

e=1​…​Ee=1\\dots Edo

20:forbatch

x∼𝒟k\+x\\sim\\mathcal\{D\}\_\{k\}^\{\+\}do

21:

z←ϕ⁡\(x,θ\)=z^/‖z^‖2z\\leftarrow\\phi\(x;\\theta\)=\\hat\{z\}/\\\|\\hat\{z\}\\\|\_\{2\},

z^=Enc​\(x,θ\)\\hat\{z\}=\\text\{Enc\}\(x;\\theta\)
22:

zp​a​i​r←Permute​\(z\)z\_\{pair\}\\leftarrow\\text\{Permute\}\(z\), sample

λ∼Beta​\(κ,κ\)\\lambda\\sim\\text\{Beta\}\(\\kappa,\\kappa\)
23:

z~←Mix​\(z,zp​a​i​r,λ\)\\tilde\{z\}\\leftarrow\\textsc\{Mix\}\(z,z\_\{pair\},\\lambda\)
24:

ℒ←‖z~−𝐜‖2\\mathcal\{L\}\\leftarrow\\\|\\tilde\{z\}\-\\mathbf\{c\}\\\|^\{2\}⊳\\trianglerightSingle\-Center Loss

25:

θ←θ−η​∇θℒ\\theta\\leftarrow\\theta\-\\eta\\nabla\_\{\\theta\}\\mathcal\{L\}
26:endfor

27:endfor

28:return

θ\\theta
29:endfunction

30:// Unified Global Inference \(Eq\.[2](https://arxiv.org/html/2610.33619#S2.E2)\)

31:functionNLL\(

x,θ,𝐜x,\\theta,\\mathbf\{c\}\)

32:

d2←‖ϕ⁡\(x,θ\)−𝐜‖2d^\{2\}\\leftarrow\\\|\\phi\(x;\\theta\)\-\\mathbf\{c\}\\\|^\{2\}
33:return

log⁡\(1\+d2\)\\log\(1\+d^\{2\}\)⊳\\trianglerightNeg\. Log\-Likelihood \(Student\-t\)

34:endfunction

35:if

𝒫==OneShot\\mathcal\{P\}==\\textsc\{OneShot\}then

36:Parallel:

θk←ClientUpdate​\(θi​n​i​t,𝒟k\+\)\\theta\_\{k\}\\leftarrow\\textsc\{ClientUpdate\}\(\\theta\_\{init\},\\mathcal\{D\}\_\{k\}^\{\+\}\)
37:Ensemble:

Θ←\{θ1​…​θK\}\\Theta\\leftarrow\\\{\\theta\_\{1\}\\dots\\theta\_\{K\}\\\}
38:Score:

𝒜⁡\(x\)←∑θ∈ΘNLL​\(x,θ,𝐜\)\\mathcal\{A\}\(x\)\\leftarrow\\sum\_\{\\theta\\in\\Theta\}\\textsc\{NLL\}\(x,\\theta,\\mathbf\{c\}\)⊳\\trianglerightSum of NLLs

39:else

40:for

t=1​…​Tt=1\\dots Tdo

41:Parallel:

θkt←ClientUpdate​\(θg,𝒟k\+\)\\theta\_\{k\}^\{t\}\\leftarrow\\textsc\{ClientUpdate\}\(\\theta\_\{g\},\\mathcal\{D\}\_\{k\}^\{\+\}\)
42:Server:

θg←∑NkN​θkt\\theta\_\{g\}\\leftarrow\\sum\\frac\{N\_\{k\}\}\{N\}\\theta\_\{k\}^\{t\}
43:endfor

44:Score:

𝒜⁡\(x\)←NLL​\(x,θg,𝐜\)\\mathcal\{A\}\(x\)\\leftarrow\\textsc\{NLL\}\(x,\\theta\_\{g\},\\mathbf\{c\}\)⊳\\trianglerightSingle Model NLL

45:endif

46:Decision:return

11if

𝒜⁡\(x\)\>τ\\mathcal\{A\}\(x\)\>\\tauelse

00

## IVExperiments

We conducted a comprehensive empirical evaluation to testGeodesic\-SVDDin different distributed tabular scenarios\.

### IV\-AExperimental Setup

#### IV\-A1Datasets

We utilized five standard tabular benchmarks representing diverse complexities:Iris\[[19](https://arxiv.org/html/2610.33619#bib.bib28)\],Breast Cancer\[[20](https://arxiv.org/html/2610.33619#bib.bib31)\],Titanic\[[21](https://arxiv.org/html/2610.33619#bib.bib29)\],Adult\[[22](https://arxiv.org/html/2610.33619#bib.bib30)\], andCovertype\[[23](https://arxiv.org/html/2610.33619#bib.bib6)\]\.Covertypeis the largest and most complex benchmark \(581,012 samples, 54 features, 7 classes\) and serves as a stress test for manifold learning\. Features were processed viaStandardScaler, except for Titanic and Adult which utilizedRobustScalerto handle outliers in skewed numerical features\.

#### IV\-A2Non\-IID Setting

We simulate a Cross\-Silo setting withK=3K=3organizations\. To model non\-IID distributions, we partition data using a Dirichlet distributionDir​\(α\)\\text\{Dir\}\(\\alpha\)over the label space\. We evaluate four increasingly difficult scenarios:IID\(Uniform\),Mild Skew\(α=0\.5\\alpha=0\.5\),Moderate Skew\(α=0\.1\\alpha=0\.1\), andExtreme Skew\(α=0\.01\\alpha=0\.01\)\. In theα=0\.01\\alpha=0\.01case, clients possess near\-mutually exclusive classes, representing the “disjoint support” defined in Eq\. \(1\)\.

#### IV\-A3Baselines & Metrics

We compare against:

- •Centralized SVDD\[[6](https://arxiv.org/html/2610.33619#bib.bib11)\]/ k\-NN\[[24](https://arxiv.org/html/2610.33619#bib.bib12)\]:Reference models trained on pooled \(IID\) data, using Deep SVDD for manifold density and k\-Nearest Neighbors for non\-parametric density estimation\.
- •FedAvg:To separate the performance benefits of our architecture from our training strategy, we evaluate two variants of this baseline\. The first employs a standard MLP as the feature extractor, while the second utilizes theexact feature extractorof our proposed method\. Both optimize the spherical SVDD objective\[[6](https://arxiv.org/html/2610.33619#bib.bib11)\]via standard weight averaging\[[1](https://arxiv.org/html/2610.33619#bib.bib13)\], allowing to isolate gains derived specifically from our aggregation method versus the SVDD loss\.
- •Fed\-Forest:A federated Isolation Forest\[[25](https://arxiv.org/html/2610.33619#bib.bib14)\]in which each client trains isolation trees locally and the server pools them into a global ensemble\.
- •Fed\-XGB:each client trains XGBoost\[[26](https://arxiv.org/html/2610.33619#bib.bib4)\]to separate its local data from locally generated synthetic negatives \(feature\-wise permutations and uniform samples\); the server averages the clients’ scores \(our implementation\)

We adopt aOne\-vs\-Allevaluation protocol\. For a dataset with classes𝒞\\mathcal\{C\}, we conduct\|𝒞\|\|\\mathcal\{C\}\|distinct experiments\. In each experiment, a single classc∈𝒞c\\in\\mathcal\{C\}is designated as thenormalclass, and the models are trained exclusively on samples wherey=cy=c\(one\-class setting\)\. During evaluation, samples from classccare labeled negative \(0\), while samples from all other classes \(y≠cy\\neq c\) are labeled positive \(anomalous, 1\)\. We report the macro\-average ofAUROC, Accuracy, Precision, Recall, and F1 across these experiments\. Threshold\-dependent metrics are computed at the optimal operating point determined via Youden’s J statistic\[[27](https://arxiv.org/html/2610.33619#bib.bib10)\]on a held\-out server\-side validation set containing both in\-distribution and out\-of\-distribution samples\. Results are averaged over 5 independent seeded runs \(mean±std\\text\{mean\}\\pm\\text\{std\}\)\. Unlike supervised baselines that leverage contrasting labels to learn discriminative boundaries, our method operates as aOne\-Class Classifier\. We solve the strictly harder problem ofdensity estimationwithout access to negative samples during local training\.

### IV\-BResults

We compare Geodesic\-SVDD against federated tree ensembles \(Fed\-Forest, Fed\-XGB\) and three FedAvg variants \(Tables[I](https://arxiv.org/html/2610.33619#S4.T1)and[II](https://arxiv.org/html/2610.33619#S4.T2)\)\. Tree ensembles are competitive only on low\-dimensional data: Fed\-Forest reaches0\.960\.96–0\.970\.97AUROC onIrisand leads onAdult, where all methods except Fed\-XGB lie between0\.580\.58and0\.660\.66AUROC with standard deviations of up to 20 points, but it plateaus at0\.710\.71onCovertype\. Fed\-XGB, which relies on locally generated synthetic negatives, is the weakest method overall, with0\.720\.72AUROC onCovertypeatα=0\.01\\alpha=0\.01and below0\.500\.50onAdult\.Geodesic\-SVDD \(Iter\)is the most consistent method across datasets and skew levels: it attains the best or second\-best score in 57 of the 100 metric columns, more than any baseline \(FedAvg \(No SM\): 40\)\. OnCovertypeatα=0\.01\\alpha=0\.01, it reaches0\.910\.91AUROC, 18–20 points above both tree ensembles, with a recall of0\.800\.80versus0\.710\.71\(Fed\-Forest\) and0\.570\.57\(Fed\-XGB\) \(Fig\.[2](https://arxiv.org/html/2610.33619#S4.F2)\)\. OnTitanic, it is the best federated method at every skew level \(0\.750\.75AUROC\)\. The strongest baseline, FedAvg \(No SM\), leads onIrisand matches Geodesic\-SVDD \(Iter\) onCovertypeto within one AUROC point\. Notably, FedAvg \(FE\), which shares our encoder but not our geodesic mixup, drops from0\.910\.91to0\.850\.85AUROC onCovertypeatα=0\.1\\alpha=0\.1, whereas Geodesic\-SVDD \(Iter\) holds0\.910\.91, suggesting that geodesic latent mixup stabilises training under label skew\.

Fig\. 2:Performance Profile \(Covertype,α=0\.01\\alpha=0\.01\)\.A radar chart comparison of Geodesic\-SVDD against the federated baselines; centralized k\-NN \(IID\) is shown for reference\. Our method maintains balanced precision and recall, whereas Fed\-XGB and FedAvg \(SM\) fall below0\.600\.60recall\.Fig\. 3:Resilience to Non\-IID Label Skew\.Performance \(AUC\) across five benchmarks with increasing non\-IID partition skew\. Centralized references are trained on pooled IID data and drawn as flat lines\.We analyzed the operational trade\-off between the privacy\-preservingOne\-Shot \(OSFL\)protocol and standardIterative Averaging\. As shown in Table[I](https://arxiv.org/html/2610.33619#S4.T1)and[II](https://arxiv.org/html/2610.33619#S4.T2), the OSFL protocol \(R=1R=1\) matches centralized Deep SVDD under IID and mild skew \(α=0\.5\\alpha=0\.5\), with a mean AUROC of0\.840\.84and0\.830\.83versus0\.840\.84\. OnBreast Cancer, for example, OSFL attains0\.990\.99AUROC, on par with centralized training\. This makes OSFL a strong choice for high\-security environments where bi\-directional communication increases the attack surface\. Figure[3](https://arxiv.org/html/2610.33619#S4.F3)illustrates the performance trajectory as heterogeneity increases\. While tree baselines remain flat but low \(e\.g\.,0\.710\.71for Fed\-Forest onCovertype\), the One\-Shot approach degrades under strong skew, dropping from0\.920\.92\(IID\) to0\.760\.76\(α=0\.01\\alpha=0\.01\) onCovertypeand from0\.750\.75to0\.590\.59onTitanic\. Switching to theIterativeprotocol recovers this loss, maintaining0\.910\.91and0\.750\.75AUROC, respectively, even under extreme skew\. This establishes a clear hierarchy: employ OSFL for bandwidth efficiency in low\-skew settings, and Iterative Averaging for partition alignment in high\-skew regimes\.

### IV\-CStatistical Significance Analysis

To assess robustness beyond individual datasets, we rank the seven federated methods by seed\-averaged AUROC overN=20N=20scenarios \(5 datasets×\\times4 skew levels\); centralized references are excluded, as they have no non\-IID counterpart\. TheFriedman testrejects equal performance \(χF2=45\.6\\chi^\{2\}\_\{F\}=45\.6,p<10−7p<10^\{\-7\}\), and theNemenyi post\-hoc test\(α=0\.05\\alpha=0\.05\) yieldsC​D=2\.01CD=2\.01\[[28](https://arxiv.org/html/2610.33619#bib.bib7)\]\(Fig\.[4](https://arxiv.org/html/2610.33619#S4.F4)\)\.

Fig\. 4:Critical Difference Diagram \(Friedman–Nemenyi,α=0\.05\\alpha=0\.05\)\.Average AUROC ranks over 20 scenarios \(lower is better\)\. Both Geodesic\-SVDD variants rank in the top three; only Fed\-XGB is significantly worse \(C​D=2\.01CD=2\.01\)\.Geodesic\-SVDD \(Iter\)achieves the highest mean AUROC across all scenarios \(83\.5\) and ranks second \(3\.00\), statistically tied with FedAvg \(No SM\) \(2\.80\) and ahead of every other baseline\. Since rank tests count sub\-point gaps as full wins, we also apply the Bayesian signed\-rank test\[[29](https://arxiv.org/html/2610.33619#bib.bib5)\]with a region of practical equivalence of±1\\pm 1AUROC point: Geodesic\-SVDD \(Iter\) is practically superior to FedAvg \(SM\), Fed\-Forest and Fed\-XGB \(P≥0\.98P\\geq 0\.98\), never inferior to FedAvg \(FE\) \(P<0\.01P<0\.01\), and has the lowest worst\-case probability of being outperformed by any competitor \(0\.18, vs\. 0\.34 for FedAvg \(No SM\)\)\. Crucially,Geodesic\-SVDD \(OS\)ranks third \(3\.45\) with a*single*communication round, within the critical difference of the best iterative methods; its gap to the iterative protocol is not significant and concentrates at high skew \(α≤0\.1\\alpha\\leq 0\.1, Table[II](https://arxiv.org/html/2610.33619#S4.T2)\)\.

### IV\-DEfficiency vs\. Accuracy Trade\-off

While predictive performance is paramount, one of the primary motivations for the One\-Shot protocol is communication efficiency in bandwidth\-constrained settings\. We quantify the communication cost relative to the model sizeMM\(in MB\)\. StandardFedAvgand Iterative Geodesic\-SVDD require2×R2\\times Rtransmissions \(upload/download\) per client, resulting in a total communication cost of𝒞i​t​e​r=2⋅R⋅K⋅M\\mathcal\{C\}\_\{iter\}=2\\cdot R\\cdot K\\cdot M\. In contrast, our One\-Shot protocol requires a single upload, reducing cost to𝒞O​S=K⋅M\\mathcal\{C\}\_\{OS\}=K\\cdot M\. We exclude the warm\-up phase communication overhead from this analysis, as transmitting a singledd\-dimensional latent statistics vector \(𝔼⁡\[ϕ⁡\(x\)\]\\mathbb\{E\}\[\\phi\(x\)\]\) is asymptotically negligible compared to the full model sizeMM\. For a standard training session ofR=50R=50rounds, Geodesic\-SVDD \(OS\) reduces communication overhead by a factor of100×100\\times\. As seen in Table[I](https://arxiv.org/html/2610.33619#S4.T1), on theBreast Cancerdataset, this100×100\\timesreduction in bandwidth costs no AUROC under IID \(0\.9920\.992vs\.0\.9910\.991for the iterative protocol\) and at most1\.21\.2points under extreme skew \(0\.9780\.978vs\.0\.9900\.990\)\. However, on complex manifolds likeCovertype\(Fig\.[3](https://arxiv.org/html/2610.33619#S4.F3)\), iterative alignment is necessary at high skew: atα=0\.01\\alpha=0\.01, it recovers 15 of the 16 AUROC points lost by the One\-Shot protocol \(0\.76→0\.910\.76\\to 0\.91\)\.

### IV\-EAblation: The Geometry of Latent Interpolation

Finally, we isolate the impact of our geometric constraints by comparing Spherical \(SLERP\) against standard Linear \(LERP\) interpolation\. Table[III](https://arxiv.org/html/2610.33619#S4.T3)presents a compelling geometric paradox: on downstream predictive tasks,Linear\-SVDDachieves scores \(AUROC0\.9200\.920\) statistically indistinguishable fromGeodesic\-SVDD\(0\.9210\.921\)\. From a purely utilitarian perspective, the linear approximation appears sufficient\. However, a deeper structural analysis reveals that Linear Mixup achieves this via “lucky” regularization, masking two critical failures on the𝕊d−1\\mathbb\{S\}^\{d\-1\}manifold that we quantify as follows:

- •Protocol 1: Manifold Collapse \(d=128d=128\)\.To quantify topological violation, we sampledN=1000N=1000pairs from an isotropic distribution on the hypersphere \(z∼𝒰⁡\(𝕊d−1\)z\\sim\\mathcal\{U\}\(\\mathbb\{S\}^\{d\-1\}\)\) derived from standard normal vectorszraw∼𝒩⁡\(0,Id\)z\_\{\\text\{raw\}\}\\sim\\mathcal\{N\}\(0,I\_\{d\}\)\. We measured the Euclidean norm of the interpolated samples at the midpoint \(λ=0\.5\\lambda=0\.5\)\. Linear paths collapsed the latent norm to‖z~‖≈0\.705±0\.03\\\|\\tilde\{z\}\\\|\\approx 0\.705\\pm 0\.03, systematically projecting valid data into the low\-density interior \(the SVDD “anomaly zone”\), whereas SLERP preserves‖z~‖≡1\.0\\\|\\tilde\{z\}\\\|\\equiv 1\.0\.
- •Protocol 2: Angular Velocity Instability \(109×10^\{9\}\\times\)\.To quantify optimization stability, we measured the angular velocity variance \(σω2=Var​\[∂Ω∂λ\]\\sigma^\{2\}\_\{\\omega\}=\\text\{Var\}\[\\frac\{\\partial\\Omega\}\{\\partial\\lambda\}\]\) along the interpolation pathλ∈\[0,1\]\\lambda\\in\[0,1\]\. We simulated trajectories between semi\-antipodal feature vectors \(θ≈160∘\\theta\\approx 160^\{\\circ\}\)\. While Geodesic interpolation maintains constant velocity \(σgeo2≈5\.5×10−12\\sigma^\{2\}\_\{\\text\{geo\}\}\\approx 5\.5\\times 10^\{\-12\}\), Linear interpolation stagnates near the poles and accelerates violently at the midpoint\. This results in a velocity variance ofσlin2≈3\.99×10−3\\sigma^\{2\}\_\{\\text\{lin\}\}\\approx 3\.99\\times 10^\{\-3\}, representing a109×10^\{9\}\\timesinstability gap in the geometric gradient\.

Consequently, while Linear Mixup works on static benchmarks where data is locally clustered,SLERPis essential to ground high detection performance in mathematically stable boundary definitions rather than distributional artifacts\.

TABLE I:Comparative Performance \(Part I\): IID and Mild Non\-IID Scenarios\.
Mean±\\pmStd\. Dev\. \(in %\)\. Best federated result per column inbold, second bestunderlined; centralized baselines are not ranked\.Teal rowsindicate our method\.DatasetMethodIID \(Uniform\)Dirichlet \(α=0\.5\\alpha=0\.5\) \[Mild\]AUCAccPrecRecF1AUCAccPrecRecF1IrisCentralized SVDD90\.10±\\pm11\.082\.70±\\pm14\.891\.80±\\pm13\.783\.20±\\pm15\.386\.00±\\pm12\.3– Centralized Baselines –Centralized k\-NN96\.00±\\pm4\.0088\.00±\\pm8\.0097\.00±\\pm4\.0087\.00±\\pm6\.0091\.00±\\pm6\.00FedAvg \(FE\)90\.40±\\pm10\.182\.00±\\pm13\.691\.10±\\pm8\.4082\.70±\\pm12\.185\.50±\\pm11\.691\.30±\\pm8\.8082\.40±\\pm13\.693\.40±\\pm5\.2081\.10±\\pm15\.484\.90±\\pm12\.9FedAvg \(No SM\)98\.32±\\pm1\.8593\.33±\\pm4\.8496\.71±\\pm2\.3793\.15±\\pm6\.1694\.58±\\pm4\.2198\.20±\\pm1\.8992\.44±\\pm5\.2996\.74±\\pm2\.3491\.86±\\pm6\.7493\.73±\\pm4\.83FedAvg \(SM\)96\.84±\\pm2\.5088\.89±\\pm6\.4595\.31±\\pm3\.5487\.77±\\pm6\.3490\.91±\\pm5\.2796\.08±\\pm2\.8587\.56±\\pm7\.3996\.79±\\pm2\.4184\.42±\\pm8\.8189\.56±\\pm6\.22Fed\-Forest96\.99±\\pm3\.0990\.89±\\pm6\.7295\.24±\\pm5\.6791\.34±\\pm9\.7092\.83±\\pm5\.7096\.18±\\pm4\.6992\.89±\\pm4\.3795\.43±\\pm4\.0194\.07±\\pm5\.6794\.61±\\pm3\.35Fed\-XGB73\.77±\\pm18\.174\.89±\\pm12\.683\.24±\\pm12\.377\.07±\\pm22\.178\.28±\\pm16\.777\.94±\\pm21\.274\.00±\\pm15\.981\.05±\\pm24\.375\.96±\\pm26\.876\.30±\\pm23\.0Geodesic \(OS\)91\.60±\\pm8\.5083\.30±\\pm11\.695\.40±\\pm4\.3080\.10±\\pm13\.185\.70±\\pm10\.491\.50±\\pm8\.5084\.20±\\pm10\.696\.10±\\pm2\.9080\.20±\\pm13\.986\.00±\\pm10\.2Geodesic \(Iter\)90\.50±\\pm9\.2083\.10±\\pm12\.594\.80±\\pm4\.8081\.10±\\pm13\.385\.30±\\pm11\.890\.60±\\pm9\.7084\.40±\\pm13\.094\.80±\\pm4\.9082\.60±\\pm14\.286\.30±\\pm12\.5BreastCCentralized SVDD99\.00±\\pm0\.7095\.70±\\pm2\.5096\.30±\\pm1\.2094\.60±\\pm5\.2095\.40±\\pm2\.60– Centralized Baselines –Centralized k\-NN82\.00±\\pm10\.077\.00±\\pm6\.0075\.00±\\pm4\.0083\.00±\\pm4\.0078\.00±\\pm1\.00FedAvg \(FE\)99\.20±\\pm0\.0096\.40±\\pm0\.8097\.20±\\pm0\.8095\.20±\\pm1\.8096\.10±\\pm0\.6099\.10±\\pm0\.0096\.40±\\pm0\.8097\.00±\\pm0\.3095\.50±\\pm1\.4096\.20±\\pm0\.50FedAvg \(No SM\)98\.65±\\pm0\.2094\.56±\\pm1\.0594\.32±\\pm1\.4494\.24±\\pm0\.3194\.16±\\pm0\.9398\.41±\\pm0\.0393\.86±\\pm0\.7093\.06±\\pm2\.2893\.63±\\pm0\.7693\.25±\\pm1\.54FedAvg \(SM\)98\.71±\\pm0\.0195\.00±\\pm0\.7995\.70±\\pm0\.6993\.86±\\pm0\.9994\.65±\\pm0\.8898\.83±\\pm0\.0795\.26±\\pm1\.4096\.58±\\pm0\.8893\.79±\\pm0\.7095\.09±\\pm0\.11Fed\-Forest91\.41±\\pm5\.4885\.18±\\pm5\.0985\.68±\\pm7\.4883\.74±\\pm6\.4784\.30±\\pm4\.6189\.89±\\pm7\.0683\.68±\\pm5\.7483\.59±\\pm8\.4683\.41±\\pm5\.4383\.14±\\pm4\.87Fed\-XGB64\.36±\\pm26\.268\.16±\\pm19\.669\.17±\\pm7\.6875\.42±\\pm35\.565\.03±\\pm27\.564\.51±\\pm26\.465\.61±\\pm18\.557\.62±\\pm24\.864\.57±\\pm34\.958\.45±\\pm29\.4Geodesic \(OS\)99\.20±\\pm0\.1096\.10±\\pm0\.1096\.60±\\pm0\.3094\.40±\\pm3\.7095\.30±\\pm1\.8098\.60±\\pm0\.3095\.30±\\pm0\.9095\.00±\\pm1\.2093\.00±\\pm4\.2093\.90±\\pm2\.80Geodesic \(Iter\)99\.10±\\pm0\.0096\.10±\\pm0\.5096\.80±\\pm0\.2094\.80±\\pm2\.0095\.70±\\pm1\.0099\.10±\\pm0\.0096\.50±\\pm0\.4096\.90±\\pm0\.0095\.30±\\pm1\.9096\.00±\\pm1\.00TitanicCentralized SVDD74\.40±\\pm2\.6071\.80±\\pm2\.1068\.80±\\pm8\.5075\.40±\\pm8\.9071\.70±\\pm7\.40– Centralized Baselines –Centralized k\-NN58\.00±\\pm14\.058\.00±\\pm12\.065\.00±\\pm2\.0045\.00±\\pm14\.046\.00±\\pm14\.0FedAvg \(FE\)69\.90±\\pm3\.1065\.00±\\pm3\.7067\.80±\\pm7\.4061\.00±\\pm6\.9062\.50±\\pm0\.9070\.50±\\pm3\.0066\.70±\\pm3\.2069\.90±\\pm8\.6061\.80±\\pm7\.4063\.70±\\pm0\.50FedAvg \(No SM\)64\.05±\\pm10\.761\.87±\\pm9\.2069\.53±\\pm4\.5646\.42±\\pm13\.053\.58±\\pm8\.3564\.52±\\pm10\.461\.83±\\pm8\.0267\.04±\\pm5\.0950\.95±\\pm12\.955\.95±\\pm6\.79FedAvg \(SM\)65\.44±\\pm0\.8762\.06±\\pm1\.9162\.01±\\pm7\.2161\.81±\\pm0\.9258\.98±\\pm3\.4163\.13±\\pm2\.1860\.53±\\pm1\.9859\.91±\\pm6\.6464\.99±\\pm1\.9758\.75±\\pm4\.53Fed\-Forest63\.11±\\pm12\.557\.94±\\pm11\.863\.01±\\pm8\.8946\.47±\\pm27\.347\.63±\\pm20\.362\.41±\\pm12\.256\.34±\\pm11\.364\.08±\\pm7\.4138\.47±\\pm23\.342\.49±\\pm18\.5Fed\-XGB57\.86±\\pm9\.8956\.22±\\pm9\.6464\.39±\\pm9\.4840\.15±\\pm20\.744\.40±\\pm15\.157\.91±\\pm11\.155\.80±\\pm10\.366\.62±\\pm13\.036\.63±\\pm20\.941\.17±\\pm18\.1Geodesic \(OS\)74\.90±\\pm1\.4071\.50±\\pm0\.5070\.10±\\pm7\.9072\.20±\\pm2\.7070\.70±\\pm5\.2071\.90±\\pm1\.2068\.90±\\pm1\.2068\.60±\\pm10\.872\.10±\\pm3\.1069\.10±\\pm4\.20Geodesic \(Iter\)74\.90±\\pm1\.4071\.20±\\pm0\.8069\.80±\\pm8\.9073\.10±\\pm0\.5070\.90±\\pm4\.9075\.10±\\pm1\.2071\.60±\\pm1\.6069\.80±\\pm9\.0073\.40±\\pm2\.9071\.10±\\pm6\.20AdultCentralized SVDD62\.90±\\pm17\.668\.90±\\pm1\.4061\.40±\\pm30\.644\.50±\\pm21\.151\.50±\\pm25\.0– Centralized Baselines –Centralized k\-NN65\.00±\\pm1\.0074\.00±\\pm5\.0075\.00±\\pm7\.0052\.00±\\pm22\.060\.00±\\pm18\.0FedAvg \(FE\)61\.00±\\pm18\.968\.70±\\pm0\.1060\.10±\\pm32\.540\.00±\\pm23\.647\.70±\\pm27\.760\.80±\\pm19\.669\.50±\\pm0\.0059\.80±\\pm32\.739\.70±\\pm25\.347\.40±\\pm28\.9FedAvg \(No SM\)62\.53±\\pm18\.070\.08±\\pm0\.6760\.77±\\pm32\.039\.10±\\pm25\.547\.18±\\pm28\.962\.55±\\pm18\.169\.30±\\pm0\.1260\.25±\\pm32\.540\.05±\\pm24\.247\.98±\\pm27\.9FedAvg \(SM\)60\.08±\\pm0\.3054\.36±\\pm4\.6961\.54±\\pm26\.851\.83±\\pm12\.947\.49±\\pm4\.4964\.80±\\pm1\.9961\.58±\\pm2\.1963\.00±\\pm25\.855\.37±\\pm2\.1353\.43±\\pm12\.6Fed\-Forest65\.31±\\pm7\.4870\.64±\\pm2\.1163\.91±\\pm22\.551\.80±\\pm18\.557\.15±\\pm20\.364\.83±\\pm7\.6470\.26±\\pm1\.4761\.94±\\pm23\.853\.56±\\pm19\.257\.37±\\pm21\.3Fed\-XGB40\.86±\\pm4\.5152\.67±\\pm23\.466\.51±\\pm18\.210\.44±\\pm5\.4017\.34±\\pm8\.4346\.88±\\pm10\.154\.59±\\pm19\.163\.48±\\pm22\.028\.42±\\pm28\.430\.50±\\pm19\.5Geodesic \(OS\)63\.30±\\pm16\.668\.90±\\pm1\.4061\.60±\\pm30\.046\.20±\\pm19\.752\.60±\\pm24\.063\.30±\\pm16\.768\.90±\\pm0\.6061\.70±\\pm29\.946\.00±\\pm19\.952\.50±\\pm24\.1Geodesic \(Iter\)62\.60±\\pm17\.769\.20±\\pm0\.3061\.70±\\pm30\.842\.20±\\pm21\.950\.00±\\pm25\.762\.60±\\pm17\.669\.20±\\pm0\.5061\.60±\\pm31\.142\.10±\\pm21\.450\.00±\\pm25\.3CovertypeCentralized SVDD92\.10±\\pm9\.2085\.60±\\pm10\.794\.40±\\pm9\.2083\.10±\\pm14\.488\.20±\\pm12\.1– Centralized Baselines –Centralized k\-NN97\.00±\\pm3\.0092\.00±\\pm5\.0097\.00±\\pm5\.0091\.00±\\pm5\.0094\.00±\\pm5\.00FedAvg \(FE\)91\.00±\\pm9\.7084\.50±\\pm11\.194\.60±\\pm9\.0081\.20±\\pm15\.887\.00±\\pm13\.188\.80±\\pm13\.383\.40±\\pm13\.295\.70±\\pm6\.7077\.50±\\pm23\.183\.70±\\pm19\.8FedAvg \(No SM\)91\.45±\\pm8\.7884\.42±\\pm10\.394\.72±\\pm8\.5381\.43±\\pm14\.587\.33±\\pm12\.091\.70±\\pm9\.2585\.14±\\pm10\.894\.86±\\pm8\.3581\.92±\\pm15\.487\.61±\\pm12\.6FedAvg \(SM\)75\.90±\\pm13\.565\.83±\\pm15\.194\.78±\\pm8\.7458\.09±\\pm22\.569\.31±\\pm20\.178\.21±\\pm13\.268\.84±\\pm13\.793\.15±\\pm10\.962\.77±\\pm20\.073\.08±\\pm18\.1Fed\-Forest71\.14±\\pm8\.2369\.77±\\pm10\.288\.86±\\pm15\.468\.87±\\pm12\.277\.41±\\pm13\.170\.51±\\pm7\.8171\.15±\\pm11\.688\.84±\\pm15\.370\.68±\\pm13\.378\.42±\\pm13\.5Fed\-XGB76\.30±\\pm13\.965\.66±\\pm12\.190\.27±\\pm15\.158\.89±\\pm20\.770\.34±\\pm20\.175\.76±\\pm12\.565\.68±\\pm11\.091\.13±\\pm13\.659\.38±\\pm18\.771\.12±\\pm18\.0Geodesic \(OS\)92\.00±\\pm8\.8085\.10±\\pm10\.494\.30±\\pm9\.5082\.90±\\pm13\.588\.00±\\pm11\.790\.40±\\pm8\.7083\.50±\\pm10\.294\.10±\\pm9\.6081\.20±\\pm13\.487\.00±\\pm11\.6Geodesic \(Iter\)91\.10±\\pm9\.3084\.60±\\pm10\.794\.20±\\pm9\.6082\.10±\\pm14\.487\.50±\\pm12\.491\.30±\\pm9\.5084\.70±\\pm10\.994\.50±\\pm9\.2081\.70±\\pm15\.287\.30±\\pm12\.7

TABLE II:Comparative Performance \(Part II\): Moderate and Extreme Non\-IID Scenarios\.
Same format as Table[I](https://arxiv.org/html/2610.33619#S4.T1): best federated result per column inbold, second bestunderlined\.TABLE III:Comparison of Linear \(LERP\) vs\. Geodesic \(SLERP\)\.↑\\uparrowHigher is better,↓\\downarrowLower is better\.

## VConclusion

In this work, we addressed the fundamental incompatibility between state\-of\-the\-art tabular learning and Federated Learning—the “Federated Tabular Gap\.” We introducedGeodesic\-SVDD, a framework forDistributed Spherical Prototype Learningthat recasts federated tabular learning as one\-class density estimation on the hypersphere\. Our results indicate that this recasting is what neutralizes label skew: under a single\-center objective, iterative weight averaging remains stable even when clients hold nearly disjoint classes, with Geodesic\-SVDD \(Iter\) staying within1\.51\.5AUROC points of its IID performance on every benchmark\. By mapping each client’s data to a compact prototype on a hyperspherical manifold \(𝕊d−1\\mathbb\{S\}^\{d\-1\}\), the same formulation enables aProduct of Experts \(PoE\)aggregation protocol that requires a single upload per client\. In the One\-Shot setting, this additive density estimation lets the global model form a “Union of Manifolds” from a single upload per client, matching centralized Deep SVDD under IID and mild skew\. With iterative alignment, Geodesic\-SVDD attains the highest mean AUROC among the seven federated methods we evaluate and outperforms federated tree ensembles by up to 21 AUROC points onCovertype\.

Our results suggest a clear decision rule for practitioners based on the “Privacy\-Utility\-Skew” triangle:High\-Security / Low\-Bandwidth \(One\-Shot\):In scenarios where iterative communication is prohibitive \(e\.g\., cross\-silo financial fraud detection\), our One\-Shot protocol offers a highly efficient solution\. By uploading a single, valid probabilistic manifold, clients match centralized Deep SVDD on IID and mild\-skew data without ever exposing gradient updates\.Extreme Heterogeneity \(Iterative\):In “worst\-case” regimes where clients hold mutually exclusive classes \(Extreme Skew,α=0\.01\\alpha=0\.01\), the iterative alignment of these manifolds becomes necessary, recovering the One\-Shot losses \(e\.g\., from0\.760\.76to0\.910\.91AUROC onCovertype\)\.

While our focus is on the architectural framework, our ablation study highlights a critical implementation detail\. Although linear approximations \(Linear\-SVDD\) can empirically match the predictive performance of rigorous geodesic interpolation, they do so at the cost of numerical stability \(109×10^\{9\}\\timesgradient variance\)\. For safety\-critical systems, strictly enforcing the Riemannian geometry via SLERP is required to guarantee reliable convergence, ensuring that the theoretical “normality” constraints of the SVDD objective are never violated\.

Finally, future work will explore extending this spherical prototype approach to encompassRiemannian Differential Privacy\[[30](https://arxiv.org/html/2610.33619#bib.bib2)\]\. Standard DP mechanisms require artificial gradient clipping to bound sensitivity, often introducing bias that degrades utility\. In contrast, our latent space is naturally compact \(‖ϕ⁡\(x\)‖≡1\\\|\\phi\(x\)\\\|\\equiv 1\), meaning the sensitivity of any query is strictly bounded by the geodesic diameter of the manifold \(π\\pi\)\[[31](https://arxiv.org/html/2610.33619#bib.bib27)\]\. We hypothesize that leveraging this intrinsic geometric bound—coupled with Riemannian Gaussian noise injection—will yield a superior privacy\-utility trade\-off compared to extrinsic Euclidean clipping methods\.

## References

- \[1\]\(2017\)Communication\-efficient learning of deep networks from decentralized data\.InArtificial Intelligence and Statistics,Cited by:[§I](https://arxiv.org/html/2610.33619#S1.p1.1),[2nd item](https://arxiv.org/html/2610.33619#S4.I1.i2.p1.1)\.
- \[2\]L\. Grinsztajn, E\. Oyallon, and G\. Varoquaux\(2022\)Why do tree\-based models still outperform deep learning on typical tabular data?\.InNeurIPS Datasets and Benchmarks Track,Cited by:[§I](https://arxiv.org/html/2610.33619#S1.p1.1),[§II\-1](https://arxiv.org/html/2610.33619#S2.SS0.SSS1.p1.1)\.
- \[3\]T\. Li, A\. K\. Sahu, A\. Talwalkar, and V\. Smith\(2020\)Federated learning: challenges, methods, and future directions\.IEEE signal processing magazine37\(3\),pp\. 50–60\.Cited by:[§I](https://arxiv.org/html/2610.33619#S1.p1.1)\.
- \[4\]P\. Kairouz, H\. B\. McMahan, B\. Avent, A\. Bellet, M\. Bennis, A\. N\. Bhagoji, K\. Bonawitz, Z\. Charles, G\. Cormode, R\. Cummings,et al\.\(2021\)Advances and open problems in federated learning\.Foundations and Trends® in Machine Learning14\(1–2\),pp\. 1–210\.Cited by:[§I](https://arxiv.org/html/2610.33619#S1.p1.1)\.
- \[5\]J\. Kirkpatrick, R\. Pascanu, N\. Rabinowitz, J\. Veness, G\. Desjardins, A\. A\. Rusu, K\. Milan, J\. Quan, T\. Ramalho, A\. Grabska\-Barwinska,et al\.\(2017\)Overcoming catastrophic forgetting in neural networks\.Proceedings of the national academy of sciences114\(13\)\.Cited by:[§I](https://arxiv.org/html/2610.33619#S1.p1.1)\.
- \[6\]L\. Ruff, R\. Vandermeulen, N\. Goernitz, L\. Deecke, S\. A\. Siddiqui, A\. Binder, E\. Müller, and M\. Kloft\(2018\)Deep one\-class classification\.InInternational Conference on Machine Learning,Cited by:[§I](https://arxiv.org/html/2610.33619#S1.p2.1),[§II\-B](https://arxiv.org/html/2610.33619#S2.SS2.p2.1),[1st item](https://arxiv.org/html/2610.33619#S4.I1.i1.p1.1.1),[2nd item](https://arxiv.org/html/2610.33619#S4.I1.i2.p1.1)\.
- \[7\]G\. E\. Hinton\(2002\)Training products of experts by minimizing contrastive divergence\.Neural computation14\(8\),pp\. 1771–1800\.Cited by:[§I](https://arxiv.org/html/2610.33619#S1.p2.1)\.
- \[8\]C\. Internò, E\. Raponi, M\. Olhofer, A\. Raza, T\. Bäck, N\. v\. Stein, Y\. Jin, and B\. Hammer\(2026\)Pruning federated models through loss landscape analysis and client agreement scoring\.IEEE Internet of Things Journal13\(14\),pp\. 31283–31293\.External Links:[Document](https://dx.doi.org/10.1109/JIOT.2026.3686028)Cited by:[§I](https://arxiv.org/html/2610.33619#S1.p3.1)\.
- \[9\]L\. Zhu, Z\. Liu, and S\. Han\(2019\)Deep leakage from gradients\.InAdvances in neural information processing systems,Vol\.32\.Cited by:[§I](https://arxiv.org/html/2610.33619#S1.p3.1),[§II\-3](https://arxiv.org/html/2610.33619#S2.SS0.SSS3.p1.1)\.
- \[10\]H\. Zhang, M\. Cisse, Y\. N\. Dauphin, and D\. Lopez\-Paz\(2018\)Mixup: beyond empirical risk minimization\.InInternational Conference on Learning Representations \(ICLR\),Cited by:[§I](https://arxiv.org/html/2610.33619#S1.p3.1),[§III\-A2](https://arxiv.org/html/2610.33619#S3.SS1.SSS2.p1.1)\.
- \[11\]K\. Shoemake\(1985\)Animating rotation with quaternion curves\.InProceedings of the 12th annual conference on Computer graphics and interactive techniques,pp\. 245–254\.Cited by:[§I](https://arxiv.org/html/2610.33619#S1.p3.1),[§III\-A2](https://arxiv.org/html/2610.33619#S3.SS1.SSS2.p2.1)\.
- \[12\]V\. Borisov, T\. Leemann, K\. Seßler, J\. Haug, M\. Pawelczyk, and G\. Kasneci\(2024\)Deep neural networks and tabular data: a survey\.IEEE Transactions on Neural Networks and Learning Systems35\(6\),pp\. 7499–7519\.External Links:ISSN 2162\-2388,[Link](http://dx.doi.org/10.1109/TNNLS.2022.3229161),[Document](https://dx.doi.org/10.1109/tnnls.2022.3229161)Cited by:[§II\-1](https://arxiv.org/html/2610.33619#S2.SS0.SSS1.p1.1)\.
- \[13\]K\. Cheng, T\. Fan, Y\. Jin, Y\. Liu, T\. Chen, D\. Papadopoulos, and Q\. Yang\(2021\)Secureboost: a lossless federated learning framework\.IEEE Intelligent Systems36\(6\),pp\. 87–98\.Cited by:[§II\-1](https://arxiv.org/html/2610.33619#S2.SS0.SSS1.p1.1)\.
- \[14\]Y\. Zhao, M\. Li, L\. Lai, N\. Suda, D\. Civin, and V\. Chandra\(2018\)Federated learning with non\-iid data\.arXiv preprint arXiv:1806\.00582\.External Links:[Link](https://arxiv.org/abs/1806.00582)Cited by:[§II\-2](https://arxiv.org/html/2610.33619#S2.SS0.SSS2.p1.1),[§II\-A](https://arxiv.org/html/2610.33619#S2.SS1.p1.1)\.
- \[15\]C\. Internò, M\. Olhofer, Y\. Jin, and B\. Hammer\(2024\)Federated loss exploration for improved convergence on non\-iid data\.In2024 International Joint Conference on Neural Networks \(IJCNN\),Vol\.,pp\. 1–8\.External Links:[Document](https://dx.doi.org/10.1109/IJCNN60899.2024.10651455)Cited by:[§II\-2](https://arxiv.org/html/2610.33619#S2.SS0.SSS2.p1.1)\.
- \[16\]Y\. Tan, G\. Long, L\. Liu, T\. Zhou, Q\. Lu, J\. Jiang, and C\. Zhang\(2022\)FedProto: federated prototype learning across heterogeneous clients\.InProceedings of the AAAI Conference on Artificial Intelligence,Vol\.36,pp\. 8432–8440\.External Links:[Document](https://dx.doi.org/10.1609/aaai.v36i8.20819)Cited by:[§II\-2](https://arxiv.org/html/2610.33619#S2.SS0.SSS2.p1.1)\.
- \[17\]N\. Guha, A\. Talwalkar, and V\. Smith\(2019\)One\-shot federated learning\.InarXiv preprint arXiv:1902\.11175,Cited by:[§II\-3](https://arxiv.org/html/2610.33619#S2.SS0.SSS3.p1.1)\.
- \[18\]V\. Verma, A\. Lamb, C\. Beckham, A\. Najafi, I\. Mitliagkas, D\. Lopez\-Paz, and Y\. Bengio\(2019\)Manifold mixup: better representations by interpolating hidden states\.InProceedings of the 36th International Conference on Machine Learning \(ICML\),PMLR, Vol\.97,pp\. 6438–6447\.Cited by:[§III\-A2](https://arxiv.org/html/2610.33619#S3.SS1.SSS2.p1.1)\.
- \[19\]R\. A\. Fisher\(1936\)Iris\.Note:UCI Machine Learning RepositoryDOI: https://doi\.org/10\.24432/C56C76Cited by:[§IV\-A1](https://arxiv.org/html/2610.33619#S4.SS1.SSS1.p1.1)\.
- \[20\]W\. Wolberg, O\. Mangasarian, N\. Street, and W\.H\. Street\(1993\)Breast Cancer Wisconsin \(Diagnostic\)\.Note:UCI Machine Learning RepositoryDOI: https://doi\.org/10\.24432/C5DW2BCited by:[§IV\-A1](https://arxiv.org/html/2610.33619#S4.SS1.SSS1.p1.1)\.
- \[21\]Kaggle\(n\.d\.\)Titanic \- machine learning from disaster\.External Links:[Link](https://www.kaggle.com/competitions/titanic/data)Cited by:[§IV\-A1](https://arxiv.org/html/2610.33619#S4.SS1.SSS1.p1.1)\.
- \[22\]B\. Becker and R\. Kohavi\(1996\)Adult\.Note:UCI Machine Learning RepositoryDOI: https://doi\.org/10\.24432/C5XW20Cited by:[§IV\-A1](https://arxiv.org/html/2610.33619#S4.SS1.SSS1.p1.1)\.
- \[23\]J\. Blackard\(1998\)Covertype\.Note:UCI Machine Learning RepositoryDOI: https://doi\.org/10\.24432/C50K5NCited by:[§IV\-A1](https://arxiv.org/html/2610.33619#S4.SS1.SSS1.p1.1)\.
- \[24\]T\. Cover and P\. Hart\(1967\)Nearest neighbor pattern classification\.IEEE Transactions on Information Theory13\(1\)\.Cited by:[1st item](https://arxiv.org/html/2610.33619#S4.I1.i1.p1.1.1)\.
- \[25\]F\. T\. Liu, K\. M\. Ting, and Z\. Zhou\(2008\)Isolation forest\.In2008 Eighth IEEE International Conference on Data Mining,Vol\.,pp\. 413–422\.External Links:[Document](https://dx.doi.org/10.1109/ICDM.2008.17)Cited by:[3rd item](https://arxiv.org/html/2610.33619#S4.I1.i3.p1.1)\.
- \[26\]T\. Chen and C\. Guestrin\(2016\)XGBoost: a scalable tree boosting system\.InProceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining,pp\. 785–794\.Cited by:[4th item](https://arxiv.org/html/2610.33619#S4.I1.i4.p1.1)\.
- \[27\]M\. Ruopp, N\. Perkins, B\. Whitcomb, and E\. Schisterman\(2008\)Youden index and optimal cut\-point estimated from observations affected by a lower limit of detection\.Biometrical Journal50\(3\)\.External Links:[Document](https://dx.doi.org/10.1002/bimj.200710415)Cited by:[§IV\-A3](https://arxiv.org/html/2610.33619#S4.SS1.SSS3.p1.2)\.
- \[28\]J\. Demšar\(2006\)Statistical comparisons of classifiers over multiple data sets\.Journal of Machine Learning Research7\(1\),pp\. 1–30\.Cited by:[§IV\-C](https://arxiv.org/html/2610.33619#S4.SS3.p1.1)\.
- \[29\]A\. Benavoli, G\. Corani, J\. Demšar, and M\. Zaffalon\(2017\)Time for a change: a tutorial for comparing multiple classifiers through bayesian analysis\.Journal of Machine Learning Research18\(77\),pp\. 1–36\.External Links:[Link](http://jmlr.org/papers/v18/16-305.html)Cited by:[§IV\-C](https://arxiv.org/html/2610.33619#S4.SS3.p2.1)\.
- \[30\]M\. Reimherr, K\. Bharath, and C\. Soto\(2021\)Differential privacy over Riemannian manifolds\.InAdvances in Neural Information Processing Systems \(NeurIPS\),Vol\.34\.Cited by:[§V](https://arxiv.org/html/2610.33619#S5.p4.1)\.
- \[31\]Z\. Huang, W\. Huang, P\. Jawanpuria, and B\. Mishra\(2024\)Federated learning on riemannian manifolds with differential privacy\.External Links:2404\.10029,[Link](https://arxiv.org/abs/2404.10029)Cited by:[§V](https://arxiv.org/html/2610.33619#S5.p4.1)\.