CN2-SD adapts propositional rule search to subgroup quality [1], while surveys consolidate subgroup and contrast-set discovery [2], [10]. Diversity-oriented selection addresses redundant outputs [11]. WRAcc combines population coverage and outcome-rate deviation, and its count inputs motivate calibrated releases. Subgroup search is adaptive and combinatorial, while its output is a ranked set of symbolic descriptions. A private federated implementation must calibrate both the selection of descriptions and their numeric evaluations. The reviewed centralized methods motivate the search machinery; an exhaustive absence claim about all private subgroup methods is not established by this review.

Differential privacy protects a specified unit against changes in the released transcript [6], [12]. Institutions here act as curators of many records, rather than local-DP respondents holding a single record [13]. Composition is needed for every adaptive release [14]. Federated model-training studies use distinct record-level or client-level threat models [15], [16]; their guarantees cannot be transferred to subgroup selection without a new analysis. Membership-inference attacks on trained model outputs [17] offer a related motivation; their results do not measure leakage from the subgroup descriptions and counts released in this campaign.

Personalised differential privacy relaxes the single-budget assumption. Conservative-or-liberal personalisation lets individuals be protected at different strengths while retaining usable semantics [8], and individual privacy accounting tracks per-example losses that differ because of participation patterns [7]. The fairness literature supplies a normative complement: treating participants identically is not always treating them equitably, and awareness of relevant differences can be a design requirement [9]. These threads, however, address fixed estimators or model training. Our contribution is to carry personalisation into an adaptive search process where the query set is endogenous—the analyst does not know in advance which subgroup statistics will be asked—and where the aggregation of heterogeneous-noise releases feeds back into the search trajectory.

Federated learning studies coordination and heterogeneity [3], [4], [18], including proximal optimization [19] and matched averaging [20]. Secure aggregation can hide weighted client vectors under stated cryptographic assumptions [21], but a server cannot simultaneously observe each private budget report and have that report hidden by aggregation. This design treats budget choices and agreed auxiliary information as public; protecting them is a separate extension.

Table 1 positions the design among the reviewed methods. FedPSD combines client-specific count noise, candidate search, and precision weighting. End-to-end privacy and population-representative scoring remain conditional on the entire release pipeline and the selected estimand.

The first research question concerns statistical faithfulness under heterogeneous noise: RQ1—when clients calibrate noise to their own declared budgets, how faithfully does the federated subgroup ranking track the ranking a no-privacy federation would produce, and how does this fidelity degrade as the dispersion of budgets across clients grows? Faithfulness is measured by rank correlation and by precision and recall against planted ground truth, since a protocol that returns the right subgroups in the wrong order is still of limited governance value. The question isolates the estimation layer from the search layer by holding the proposal mechanism fixed.

The second research question concerns the allocation of discovery effort: RQ2—can a routing policy that steers confirmatory queries toward clients with remaining budget recover discovery power that uniform-budget operation loses, and what coverage bias does such routing introduce into the discovered set? Routing is attractive because budgets are public and unused budget is wasted budget, yet it risks producing subgroups that describe generous clients' populations disproportionately. The question therefore pairs a power metric with a fairness metric, and treats the pair as a frontier to be traced rather than a point to be claimed.

The third research question concerns population representativeness: RQ3—does precision weighting of heterogeneous-noise releases systematically shift the discovered subgroups toward high-budget clients' populations, and to what extent can a post-stratification correction restore population-representative discovery before variance erodes the ranking? Representativeness matters because subgroup descriptions feed resource-allocation decisions, and a budget-weighted view of the world can misdirect them. Three hypotheses make these questions testable.

H1. Inverse-variance aggregation of personalised releases preserves ranking fidelity better than uniform averaging, with the advantage growing in budget dispersion.

H2. Budget-aware routing increases the number of confirmed subgroups at a fixed total discovery cost, at the price of measurable coverage bias toward high-budget populations.

H3. A post-stratification correction reduces coverage bias at a quantified increase in estimator variance, yielding a representativeness-fidelity frontier that practitioners can traverse with a single tuning parameter.

Client i holds a table T_i with public, fixed n_i records and binary outcome y. The conditional count mechanism uses replace-one-record adjacency within a client, with fixed public budgets and a fixed or separately privatized description universe. Each pair of subgroup counts has L1 sensitivity at most two. If sizes, bin thresholds, selected features, budgets, or proposed descriptions depend on protected data, their publication or effect on the transcript also requires accounting. The campaign uses such uncharged data-dependent inputs, so the complete E_i record-level guarantee is not established.

The quality of a subgroup description S under the weighted relative accuracy measure is given in Eq. (1), where n(S) is the number of records satisfying S, p(S) the outcome rate inside S, and p_0 the overall outcome rate. The measure rewards subgroups that combine deviation from the baseline with non-negligible coverage; it is the standard reference quality in the subgroup literature [1], [2].

n(S) 0

qWRAcc(S) = [p(S) − p ]. (1)

For a fixed description S, the released vector contains its size n_i(S) and positive-outcome count u_i(S). Both coordinates have scalar sensitivity one, but the pair has L1 sensitivity at most two. Allocate a pair budget eps_i(t,S) and use independent Laplace noise of scale 2/eps_i(t,S), as in Eq. (2). This gives a conditional pair guarantee under the fixed auxiliary assumptions, before composing other releases.

′ ′ 2

(n ̃ᵢ(S), ũᵢ(S)) = (nᵢ(S) + ηᵢ, uᵢ(S) + η ᵢ), ηᵢ, η ᵢ ∼ Laplace ( ). (2)

εᵢ(t, S) The target is a useful ranked subgroup set under a ledger, communication budget, and specified population estimand. Count-pair budgets sum over candidates and rounds, as in Eq. (3); candidate discovery and preprocessing costs must be included separately. Adaptive candidate choices are post-processing only when they use public information or the preceding private transcript. The ledger for counts alone is not a guarantee for a larger transcript.

Eᵢ, pre + Eᵢ, proposal + Σₜ ΣS∈Qₜ εᵢ(t, S) + Eᵢ, other ≤ Eᵢ. (3)

The design uses proposal, calibrated count release, aggregation, and optional routing. Privacy-free internal computation becomes a release when data-dependent descriptions or control choices cross the client boundary.

Proposal expands the description beam internally. A description transmitted because it scores well on private data requires a private selection mechanism and ledger charge, or a public fixed candidate route.

Personalised release: For every candidate in the union beam, each client releases the noisy size and outcome-count pair of Eq. (2), drawing the per-query budget from its ledger according to a declared spending policy. Aggregation: The coordinator combines releases into federated quality estimates using inverse-variance weights, ranks the beam, and prunes to width B.

Routing: Confirmatory re-queries for the most promising candidates are steered toward clients with remaining budget, and each client's residual ledger is reported for the next round.

Descriptions are conjunctions of agreed categorical conditions or bins, with a maximum depth. A client may compute freely inside its boundary, but exporting the locally preferred description is data-dependent disclosure. The executed local-proposal beam is therefore a simulation component with an unaccounted release, rather than an established private selector [1].

A union beam can combine publicly generated refinements, privately selected local proposals, and previous private outputs. Diversity pruning on an already private transcript is post-processing [11]. The private proposal mechanism and preprocessing contract are prerequisites to an end-to-end guarantee and are not implemented or accounted for in the reported campaign.

Eq. (4) gives inverse-noise-variance weights for normalized client rates when each count has the same scalar sensitivity and per-query budget convention: dividing a Laplace count by n_i gives variance proportional to 1/(n_i eps_i)^2. These weights minimize noise variance only for unbiased estimates of a common rate. Non-IID clients have different rates, so the weighted mixture changes the estimand. Population WRAcc instead requires totals n_hat(S)=sum_i n_tilde_i(S), u_hat(S)=sum_i u_tilde_i(S), public N=sum_i n_i, and a protected or public population baseline. A weighted mixture can be scored, but must not be labelled an unbiased pooled-population estimate or a generally optimal nonlinear WRAcc estimator.

(nᵢ εᵢ(t, S))

wᵢ(t) = 2. (4)

Σⱼ (nⱼ εⱼ(t, S)) û(S) − p ̂0n ̂(S)

q ̂ ( ) = . (5)

population S

Budgets are allocated per count pair and composed over every candidate and round. Any adaptive spending policy must be determined by public information or privatized prior outputs and obey a privacy filter [7], [14]. Public per-client budget reports are visible to the coordinator; secure aggregation [21] can instead hide individual preweighted statistic vectors, but does not by itself protect released descriptions, preprocessing, or a data-derived allocation.

Algorithm 1. FedPSD discovery round t.

Input: tables T_i, ledger E_i, beam width B, target y, beam Q_t 1: for all clients i = 1..m concurrently do 2: expand a public candidate beam or use a separately privatized local selector 3: for each candidate S in union beam Q_t do 4: allocate eps_i(t,S), accounting for the whole pair and reserved stages 5: release (n_tilde_i(S), u_tilde_i(S)) via Eq. (2) 6: end for 7: report public residual ledger; privatize data-dependent metadata if required 8: end for 9: server: score the specified population totals or precision mixture; state estimand 10: rank Q_t by q_hat; prune to top-B beam; apply diversity selection 11: route confirmatory re-queries for top candidates to clients with remaining budget (public information only) 12: update ledgers; broadcast next beam Q_{t+1} Output: ranked subgroup set with noisy qualities and budget reports

Routing based on public residual budgets and preceding private outputs can be post-processing as a choice rule. The new confirmatory answers still consume budget. Selecting clients changes population coverage; a minimum-client fairness cap does not establish an unbiased population estimate or a formal fairness guarantee.

Precision weighting favours lower-noise normalized client rates, whereas population weighting uses alpha_i=n_i/N. An interpolated weight w_i(beta)=(1-beta)w_i+beta alpha_i, for beta in [0,1], defines an explicit mixture of estimands, not a generic bias-free post-stratification theorem. Restoring a target population also requires compatible subgroup and outcome totals and a matching baseline. Neither routing nor this interpolation was evaluated.

Candidate evaluation costs O(n_i |Q_t| c), with additional proposal, selection, and noise work. Communication includes statistics, description identifiers, budget metadata, and any cryptographic overhead; ranking costs at least O(|Q_t| log|Q_t|) without a specialized top-B selector. Zero-size clients are excluded from rate normalization, and an all-zero weight denominator requires a declared fallback. Post-processing may project noisy counts to 0<=u_tilde<=n_tilde<=n_i, but clipping introduces estimator bias and the actual implementation convention must be reported. Record independence is relevant to statistical modelling, not required by the DP definition.

FedPSD has identifiable failure modes, and the evaluation is constructed to surface them rather than conceal them. Each condition below names the mechanism at risk, so that a negative result can be attributed precisely. None of these conditions is hypothetical; each corresponds to a plausible deployment scenario in a multi-site consortium.

Ledger exhaustion: A client that spends its ledger early drops out of confirmations, degrading coverage of its population even if proposal succeeded.

Winner's-curse selection: Ranking on noisy estimates systematically promotes descriptions whose noise realisation was favourable, inflating reported quality; the protocol reports bias diagnostics alongside rankings. Coverage collapse: Under extreme budget dispersion, routing and precision weighting jointly concentrate discovery on a few generous clients, which the coverage-bias metric is designed to detect.

Schema mismatch: Unaligned binning across clients silently merges distinct subpopulations; the protocol requires an agreed discretisation contract as a precondition.

The source reports UCI Adult subsamples of 5,000 rows with 3,999 train and 1,001 test rows, and the scikit-learn breast-cancer dataset with 569 rows, 454 train and 115 test rows [22], [23]. Reported training baseline rates are 0.259 and 0.628. In the loader, target 1 denotes benign and target 0 malignant; the latter rate therefore cannot be labelled malignant without confirming an explicit recoding. Numeric tertiles and categorical support screening use pooled training data; breast-cancer feature screening uses supervised pooled WRAcc to select six features. These preprocessing operations do not use the held-out test split as described, but their data-dependent information is uncharged for privacy and requires a protected preprocessing stage or independently public inputs.

The source partitions training data into eight clients with a Dirichlet construction, occasionally producing empty clients. Adult's largest client holds 47.6 +/- 5.8% of rows, versus 24.1 +/- 3.4% on breast cancer. The centralized and local beam searches use depth three; federated variants use depth two. Uniform settings 1,4,16 allocate count-noise scale 2 Q_pre/eps, with Q_pre=111 on Adult and 83 on breast cancer. FedPSD uses eps_i=clip(c n_i,1,16), with c chosen to make sum_i n_i eps_i/N=4. This equality is a scalar resource convention; clients and records have unequal protection and the maximum eps_i exceeds 4. Precision weighting and raw-data best local proposals from three highest-budget clients distinguish the evaluated variant. The uncharged proposals, preprocessing and allocation inputs prevent a complete privacy guarantee even if the count-query cap is respected.

The reported Adult allocation places 4.3 +/- 1.5 clients at budget 1 and has a maximum 6.25 +/- 0.41; breast-cancer allocations span 1.17 to 6.02. Results summarize ten seeded resamplings per corpus with held-out top-10 WRAcc, Jaccard against the centralized heuristic search, and transmitted-statistic counts. A centralized beam is not an exhaustive oracle, and different depth and candidate routes affect overlap and quality. Runtime, randomization, actual query caps, zero-client handling, clipping, and the allocation solver require code and per-run outputs for verification. The source reports an implementation in Python with NumPy, SciPy [24], and scikit-learn [23], completed in 2.9 s for the twenty federations; its runtime and computations await the code and per-run results for verification.

Table 3 reports mean held-out WRAcc. On Adult, the means are 0.0877 for centralized search, 0.0763 for local-only, 0.0708 for uniform 16, 0.0503 for FedPSD, 0.0346 for uniform 4, and 0.0166 for uniform 1. FedPSD has higher WRAcc than uniform 4 on ten Adult seeds and six breast-cancer seeds, according to the source, with mean relative differences of about 45.4 and 14.5%. The breast-cancer uniform-1 mean is -0.0042; this describes the selected subgroup set under the noisy pipeline, not proof that noise alone causes an outcome. Local proposals, candidate depth, weights, and preprocessing affect the rankings, so attributing a particular description to a noise mechanism requires controlled ablations.

The reported Jaccard overlaps with the centralized top ten are 0.196 for FedPSD and 0.095 for uniform 4 on Adult, and 0.166 versus 0.158 on breast cancer. Local-only has overlaps of 0.374 and 0.620. The centralized reference uses deeper descriptions, averaging 2.02 conditions on Adult versus 1.68 for FedPSD and 1.44 for uniform 4. Depth is a possible source of residual differences, but no matched-depth ablation quantifies its contribution.

This scalar match does not equate worst-case record protection, and uncharged preprocessing and proposals prevent an end-to-end privacy interpretation (Fig. 1).

Local-only releases exact counts; uniform and personalized labels identify noise settings rather than verified end-to-end private pipelines (Fig. 2).

Table 4 compares aggregation and proposal variants. Removing precision weighting lowers mean Adult WRAcc from 0.0503 to 0.0127 and breast-cancer WRAcc from 0.0559 to 0.0254. At the count-noise convention, budget-1 Adult clients have scale 222 while a budget of 6.25 gives scale about 35.5. Weighting attenuates noisy normalized rates but also changes population representation, so this ablation does not establish optimality or unbiasedness. Removing local proposals yields 0.0472 on Adult and 0.0598 on breast cancer; no paired significance or equivalence result is supplied for that ablation. Uniform budget 8 under the same machinery gives 0.0625 and 0.0721, at twice the scalar volume-weighted budget; whether that allocation is permissible depends on each client's constraints.

Table 5 reports quality under nominal allocation settings. Adult's personalized WRAcc of 0.0503 recovers about 29.6% of the gap between uniform 4 (0.0346) and the centralized reference (0.0877); the corresponding breast-cancer fraction is about 10.3% using rounded means. It reaches 71.0% of Adult uniform-16 quality and about 64.3% on breast cancer. Linear interpolation between uniform budgets 4 and 16 gives approximately 9.2 for Adult, but log-axis interpolation gives a different value and neither is a measured effective privacy budget. The two-corpus difference is consistent with size skew, but no factorial experiment separates size skew, population heterogeneity, budget dispersion, and estimand change.

The source reports two-sided Wilcoxon tests on twenty seed-by-corpus blocks [25], Friedman over four method labels [26], and Holm correction over three contrasts [27]; Demsar's independent-dataset comparison framework [28] does not turn these resamples into twenty independent datasets. The pooled FedPSD-uniform4 contrast is W=50, p=0.040, with 16 of 20 favourable blocks, while the reported Friedman statistic is 50.85. These are exploratory summaries conditional on two fixed corpora and repeated, overlapping splits. The pooled p-value is not an Adult-specific result, and preregistration, raw pairing, ties/zeros and test implementation require documentation.

At the scalar volume-weighted budget convention, personalized allocation with precision weighting has higher mean WRAcc than uniform4 on both reported corpora, most clearly on Adult. The pooled W=50, p=0.040 does not establish a corpus-specific significance test or a causal mechanism for skew. At budget 1 Adult mean WRAcc remains positive at 0.0166, while breast-cancer mean is -0.0042; the claim that both corpora fall below baseline is unsupported. Statistics sent rise from 1170 to 1245 on Adult and 706 to 826 on breast cancer, or about 6.4% and 17.0%; these counts do not represent comparable full network bytes across raw-record and count-based baselines.

Local-only has higher mean WRAcc than every noisy federated variant and releases exact selected counts; it is a nonprivate reference with an undercount convention, not a valid privacy baseline. The centralized depth-three beam gives the highest observed mean here, but is not a mathematical upper bound. Uniform16 and the same-machinery uniform8 ablation show that allocation constraints matter. Adult FedPSD standard deviation is 2.21 times uniform4's (0.0177/0.0080), implying about 4.90 times the variance, not twice the variance. Routing and population correction are untested; private preprocessing, proposal selection, data-derived allocations, and transcript-wide composition remain unresolved.

The source reports a small campaign dated 2026-10-11. Execution and regeneration require the experiment artifacts; the present manuscript provides summary evidence rather than an independently reproduced result.

The measured variant omits privacy charges for description proposals and pooled preprocessing, and does not establish the declared whole-record budgets. Candidate caps, baseline release, fixed-size adjacency, zero-client handling, noisy-count projection, and public allocation inputs must be audited. Precision weighting changes the population represented by discovered subgroups. The centralized heuristic reference, unequal description depths, two corpora, and overlapping resamples also restrict interpretation. Client-level institutional protection remains outside the design.

A uniform budget can simplify governance and may be required by client-specific constraints; personalized budgets permit alternative allocations when those clients explicitly authorize them [8]. Formal guarantees depend on complete release accounting rather than an equitable-treatment slogan [9]. Syntactic anonymity and differential privacy address different threat models [29], [30]. Symbolic descriptions may assist governance, but the current campaign attaches noisy point scores rather than certified quality bounds. If the complete mechanism satisfies the client-specific guarantees, a record at client i is protected at its own E_i, and a uniform worst-case statement uses max_i E_i. Publishing a budget vector clarifies this heterogeneity but cannot repair uncharged releases. The size-weighted mean is a reporting convention rather than an adversary's privacy parameter. Governance validity and authorization of the allocation require a real consortium study.