Federated and Privacy-Preserving Cross-Project Defect Prediction With Heterogeneous Features

Abstract

Organizations are often reluctant to share defect-labeled source code because of privacy and intellectual property concerns, yet effective cross-project defect prediction (CPDP) depends on learning from diverse projects. This paper introduces FedCPDP, a federated and privacy-preserving framework that enables collaborative defect prediction without exchanging raw project data and without requiring a common feature schema. The approach employs feature hashing to unify heterogeneous metric spaces, integrates federated proximal optimization with representation alignment to mitigate distribution shift, and incorporates differential privacy mechanisms to safeguard sensitive updates. To further enhance robustness, FedCPDP explores adaptive server aggregation strategies (attention and graph-based) and seed ensembling, while addressing class imbalance through focal loss and threshold optimization. The framework is evaluated on thirty benchmark datasets across five CPDP families under leave-one-project-out validation, using both threshold-free and effort-aware metrics. Results show that FedCPDP improves F1 by up to 10-15% over FedAvg and 6-8% over FedDPI, while achieving 8-10% higher $\boldsymbol{P_{opt}}$ under effort-aware evaluation. These gains are statistically significant, confirming that FedCPDP consistently outperforms state-of-the-art methods while uniquely supporting heterogeneous features and offering explicit privacy guarantees. These findings establish FedCPDP as a practical step toward enabling secure and deployable defect prediction in multi-organizational settings.