EARS-XTSK: Privacy-Preserving Global Explainability in Cross-Silo Federated Two-Tower Recommendation Systems via Server-Side TSK Fuzzy Rule Distribution

Industrial and Scientific Context

Personalized recommendation is the driving factor behind engagement and monetization across streaming, e-commerce, social, and news platforms. In streaming media, recommendation quality directly impacts watch-time retention; in e-commerce, it influences click-through and basket size; in finance, it governs risk-aware product targeting; and in social platforms, it shapes information exposure. Modern stacks typically use a retrieval → ranking cascade, where a Two-Tower (dual-encoder) model supplies scalable candidate generation at web scale. At the same time, GDPR/KVKK, platform risk, and partner sensitivity make centralized data pooling and hence a “all-seeing explainability” approach increasingly untenable. Federated Learning (FL) mitigates this at the decision-making side by aggregating model updates instead of raw data. But explainability in FL is harder than in centralized setups: product teams and auditors need consistent, global explanations, while raw per-user information must remain private. This paper contributes EARS-XTSK, a practical, end-to-end solution:

Our company (adesso Turkey) directs the global explainability (FED-XAI) layer, which is the main scope of this work.

Because we cannot access real data, a faithful synthetic twin had to be developed which matches schemas and feature ranges of two real providers (a large online forum and a Turkish streaming platform).

Partners continue local research on real data for the non-XAI portions as well as local explainability methods, validating model utility and reinforcing the interpretability aspects of the EARS platform. Our server-side FED-XAI then operates on the aggregated Two-Tower model and surfaces global, item-only rationales via Grad×Input + TSK fuzzy fusion, never logging user attributes.

Main contributions of our work can be summarized as follows:
(1) A privacy-preserving, server-side explainability method for cross-silo Two-Tower models. (2) A reproducible pipeline: data generation, vectorization, Two-Tower training, NVFLARE federation, and FED-XAI evaluation/visualization, all schema-compatible with production partners.

Federated Learning for Recommendation Systems

Federated Learning (FL) enables collaborative model training without sharing raw data. Each client learns local parameters and only communicates updates—gradients or weights—to a central server performing an aggregation through certain aggregation algorithms designed for decentralized learning such as Federated Averaging (FedAvg).

For personalization, FL must handle heterogeneous feature spaces and sparse interactions; the Two-Tower architecture has emerged as the industry standard for this setting because it naturally separates user and item representation learning. Let us begin by introducing the mathematics for a typical two-towerm topology.

Formally, each tower learns an embedding function

Where $x_i^{\left( U \right)}$ and $x_j^{\left( I \right)}$ denote user and item features, and the predicted relevance is

With $σ\left( \cdot \right)$ being the sigmoid activation function.

The model is optimized with binary cross-entropy:$L_{ \text{BCE} } = - \text{ } \sum_{(i,j)}{\left[ y_{ij} \text{log} ({ŷ}_{ij})+(1-y_{ij}) \text{log} ({(1-ŷ}_{ij})) \right]}$ (1)

From Federated Learning to Global Explainability

Existing FL systems focus on performance and privacy but seldom address explainability.
Local XAI methods—e.g., SHAP, LIME, grad-CAM—cannot operate at the server level because by design, raw inputs strictly remain exclusive to client-side access.
Global explainability instead interprets the aggregated model to reveal feature-group importance without the need of exposing any private data.
EARS-XTSK implements this concept by performing gradient-based attribution and TSK fuzzy inference directly on the federated global model.

Project Structure and Partners

Two industrial partners provide the real use cases:

Forum Partner (A): a large Turkish online discussion platform representing user-centric data.

Streaming Partner (B): a national video-on-demand provider contributing content-centric metadata.

Due to legal and organizational constraints, adesso Turkey—responsible for the global FED-XAI layer—does not access either partner’s raw data.
To enable development and testing, we built a synthetic yet schema-faithful dataset reproducing their data volumes, structures, and statistical properties.
Local research at each partner validates all pre-XAI stages using real data, ensuring that when our global XAI module is deployed, it will operate seamlessly. A simplified overview of the current system architecture can be found in the Figure 1 provided below:

Research on explainability in federated learning (FL), fuzzy rule-based systems, and global surrogate modeling has expanded rapidly in recent years. Furthermore, the usage of such systems for recommender systems is also becoming one of the frequently investigated topics. The EARS-XTSK framework sits at the intersection of these areas, especially where privacy-preserving cross-silo infrastructures must provide global transparency for deep recommendation models.

Federated Learning for Recommenders

Federated Learning (FL) enables collaborative model training without centralizing raw client data. McMahan et al. introduced Federated Averaging (FedAvg), showing that locally trained client models can be aggregated efficiently at the server and that the approach can remain effective under unbalanced and non-IID client data distributions [1]. Bonawitz et al. later proposed practical secure aggregation mechanisms that allow a server to compute aggregate model updates without observing each individual client contribution, strengthening the privacy guarantees of FL systems [2]. In a subsequent system-level study, Bonawitz et al. examined the engineering requirements of deploying FL at scale, including client orchestration, reliability, communication efficiency, and production constraints [3]. Kairouz et al. provide a comprehensive overview of FL research challenges, including statistical heterogeneity, privacy, security, communication bottlenecks, personalization, and robustness, all of which are directly relevant to federated recommender systems [4].FL has also been adapted to recommendation scenarios, where user interaction histories and preference signals are highly sensitive. Ammad-ud-din et al. proposed a federated collaborative filtering approach in which recommendation models are trained without requiring centralized access to user-item interaction data [5]. Qi et al. applied FL to news recommendation and incorporated privacy-preserving mechanisms to reduce the risk of exposing user interests during model learning [6]. Perifanis and Efraimidis introduced Federated Neural Collaborative Filtering, extending neural collaborative filtering into a federated setting and showing how recommender models can be trained while keeping user data decentralized [7]. Sun et al. survey federated recommendation systems and organize the field around data partitioning, privacy protection, communication efficiency, attacks and defenses, personalization, and open deployment challenges [8].

These works demonstrate that FL is a viable training paradigm for privacy-preserving recommendation. However, their primary focus is model utility, privacy protection, and communication efficiency rather than global model interpretation. EARS-XTSK builds on this line of work but targets a different problem: explaining the behavior of a federated global recommender model after aggregation, without requiring access to raw user-side data.

Large-scale recommendation systems commonly use dual-encoder or Two-Tower architectures to support efficient retrieval from large item corpora. Yi et al. studied large-corpus item recommendation with neural retrieval models and addressed sampling bias in candidate generation, highlighting the practical importance of scalable embedding-based recommendation [9]. This architectural logic aligns with EARS-XTSK, where user and item towers are trained locally and then aggregated through FL. However, Two-Tower embeddings are latent and similarity-driven, making their recommendation decisions difficult to interpret without an additional explanation layer.

Explainable AI in Federated Learning

Explainability in FL is more constrained than explainability in centralized machine learning because the explanation process itself must not reveal sensitive client-side information. Abadi et al. introduced deep learning with differential privacy, showing how privacy-preserving noise mechanisms can be incorporated into gradient-based training to limit information leakage [10]. Truex et al. proposed a hybrid privacy-preserving FL approach that combines multiple privacy-enhancing techniques to reduce disclosure risks during collaborative training [11]. Hitaj et al. demonstrated that collaborative deep learning can leak sensitive information through adversarial reconstruction attacks, underscoring the need for privacy-aware model analysis and explanation mechanisms [12].

Recent work has begun to examine the intersection of FL and explainability more directly. Daole et al. introduced OpenFL-XAI, a Python framework for federated learning of explainable artificial intelligence models, emphasizing the practical need for modular tools that combine federation and interpretability [13]. Zhang and Yu proposed LR-XFL, a logical-reasoning-based explainable federated learning framework in which local rule information is used to support more interpretable global reasoning [14]. Lopez-Ramos et al. reviewed the relationship between FL and XAI, concluding that the interaction between federated training dynamics and explanation quality remains an emerging and insufficiently studied area [15].

These studies establish that FL and XAI can be combined, especially through rule-based or interpretable-by-design approaches. Nevertheless, existing FL-XAI research does not directly address the setting of EARS-XTSK: a server-side global explanation module for a deep federated Two-Tower recommender, where the server receives aggregated model parameters but cannot access raw user records. EARS-XTSK therefore extends this literature by producing global fuzzy-rule explanations from the aggregated recommender model while preserving strict separation from private client-side data.

Explainability in Deep Learning

Deep learning explainability provides the methodological basis for the attribution component of EARS-XTSK. Guidotti et al. survey black-box explanation methods and classify them across local explanations, global explanations, rule extraction, surrogate modeling, and feature-importance analysis [16]. Ribeiro et al. introduced LIME, a model-agnostic method that explains individual predictions by fitting local surrogate models around the instance being explained [17]. Lundberg and Lee proposed SHAP, which unifies additive feature-attribution methods through a Shapley-value-based theoretical framework and provides consistency properties for feature importance [18]. Sundararajan et al. introduced Integrated Gradients, an attribution method for differentiable models grounded in sensitivity and implementation-invariance axioms [19].

Gradient-based explanation methods are especially relevant for neural recommendation models because they can be computed directly from differentiable architectures. Simonyan et al. introduced saliency maps for neural networks by using gradients to identify input dimensions that strongly influence model outputs [20]. Ancona et al. analyzed gradient-based attribution methods and clarified the relationships among gradient, Gradient×Input, Integrated Gradients, DeepLIFT, and related techniques [21]. EARS-XTSK adopts Gradient×Input because it is computationally lightweight, compatible with neural Two-Tower models, and feasible for server-side evaluation over privacy-filtered or synthetic records.

However, raw attribution vectors are often too high-dimensional and technical for direct use by product teams, auditors, or end users. For this reason, EARS-XTSK does not stop at feature-level saliency. Instead, it uses Gradient×Input as an intermediate attribution mechanism and then transforms attribution patterns into TSK fuzzy-rule explanations that provide more compact and human-readable global interpretation.

TSK Fuzzy Systems and Interpretable Surrogates

Fuzzy systems provide a natural foundation for converting continuous model behavior into interpretable linguistic rules. Zadeh introduced fuzzy set theory, establishing the idea that elements can belong to sets with graded membership rather than binary inclusion [22]. Takagi and Sugeno introduced fuzzy identification of systems, where fuzzy antecedents are combined with functional consequents to model nonlinear systems in an interpretable rule-based form [23]. Sugeno and Kang further developed structure identification for fuzzy models, contributing to the systematic construction of fuzzy model structures from data [24]. Wang and Mendel proposed a method for generating fuzzy rules by learning from examples, showing how rule bases can be constructed from observed data rather than manually specified alone [25].

These foundational works support the use of TSK fuzzy systems as interpretable surrogates for complex model behavior. In EARS-XTSK, fuzzy membership functions map latent similarity and attribution-derived signals into linguistic regions such as low, medium, and high contribution. This allows the system to summarize the global behavior of a federated Two-Tower model without exposing raw user-side features.

Recent fuzzy explainability work further supports this design choice. Aghaeipoor et al. proposed fuzzy rule-based explainer systems for deep neural networks, demonstrating how fuzzy rules can support both local explainability and broader global understanding of black-box neural models [26]. Ribeiro et al. introduced Anchors, a model-agnostic explanation method that produces high-precision propositional rules for individual predictions [27]. Lou et al. proposed intelligible models for classification and regression, showing that generalized additive structures can provide interpretable feature-level effects while maintaining predictive performance [28]. Caruana et al. later demonstrated the practical value of intelligible additive models in healthcare risk prediction, where interpretability is essential for high-stakes decision-making [29].EARS-XTSK follows the same broader interpretability principle but applies it to a different technical setting. Rather than replacing the recommender with an inherently interpretable model, it preserves the deep federated Two-Tower architecture and adds a server-side TSK fuzzy-rule layer that acts as an interpretable global surrogate over the aggregated model’s behavior.

Model Interpretation Techniques for Recommenders

Explainable recommendation has been widely studied in centralized settings. He et al. introduced Neural Collaborative Filtering, replacing traditional matrix factorization interaction functions with neural architectures capable of learning nonlinear user-item interactions [30]. Although this work is not primarily an explainability method, it is important because it shows how latent neural representations became central to modern recommendation, thereby motivating the need for post-hoc interpretation techniques. Wang et al. proposed explainable reasoning over knowledge graphs for recommendation, using path-based reasoning to connect users and items through interpretable relational structures [31]. Xian et al. introduced reinforcement knowledge graph reasoning, where an agent learns paths over a knowledge graph to generate both recommendations and inspectable reasoning chains [32]. Chen et al. proposed visually explainable recommendation, using visual attention mechanisms to connect recommendation decisions to interpretable image regions [33].

These approaches show how modern recommendation models motivate different forms of interpretation: neural collaborative filtering highlights the opacity of learned user-item interaction functions, while graph-based and visually grounded recommenders provide explanations through graph paths, reasoning chains, attention mechanisms, or visual evidence.EARS-XTSK therefore addresses a distinct form of recommender interpretability. Its goal is not to explain a centralized recommender using complete user histories, but to explain an aggregated federated Two-Tower model through privacy-preserving global summaries. By combining Gradient×Input with TSK fuzzy rules, EARS-XTSK produces recommendation explanations that are compatible with cross-silo deployment constraints and item-side-only logging.

Synthetic Data, Privacy, and Governance

Synthetic data are useful when real data cannot be shared because of legal, privacy, or organizational constraints. Gonçalves et al. studied the generation and evaluation of synthetic patient data and emphasized that synthetic data should be assessed in terms of both utility and privacy risk [34]. Van Breugel et al. cautioned that synthetic data can introduce real downstream errors if treated as a perfect substitute for real data, highlighting the importance of clearly distinguishing between schema-faithful development data and behaviorally equivalent real-world data [35].

This distinction is central to EARS-XTSK. The synthetic EARS dataset is not used to claim that synthetic user behavior perfectly reproduces partner behavior. Instead, it functions as a schema-faithful engineering and validation substrate that enables the development, testing, and reproducibility of the FED-XAI workflow without requiring access to private partner records.

The implementation layer of EARS-XTSK is also shaped by practical FL deployment requirements. Roth et al. introduced NVIDIA FLARE as a framework for moving federated learning from simulation to real-world multiparty collaboration, supporting heterogeneous workflows and privacy-preserving distributed model development [36]. The official NVIDIA FLARE documentation defines the framework’s job orchestration, aggregation, component, and deployment mechanisms, which directly inform the practical organization of the EARS-XTSK federated training and server-side explainability pipeline [37].

Overall, the reviewed literature supports the individual components of EARS-XTSK: federated training, privacy-preserving recommendation, neural attribution, fuzzy-rule explanation, recommender interpretability, synthetic-data-based development, and FL orchestration. The gap lies in their integration. EARS-XTSK contributes a unified framework for privacy-preserving global explainability in cross-silo federated Two-Tower recommendation, where server-side Gradient×Input attributions are transformed into TSK fuzzy rules without exposing raw user data.

Synthetic Data Generation

Design and Metadata Sources

The dataset generator algorithm synthesizes user–item interactions using the OMDb API for realistic, verifiable and exhaustive movie/series metadata.
It defines 10 demographic user classes distinguished by age, gender, and urbanity, each with preferred genre tags guiding positive and negative sample creation. There are five classes for each gender. Each gender has one outlier’s class as well as the four main socioeconomical and geolocational breakdown-based classes.

User and Item Representation

Each user vector encodes:

Gender (0 = female, 1 = male)

Normalized age Location index normalized to [0, 1].

Which implies Item tower concatenates the following features with given dimensions:

Hence, we obtain: = 929 + with typical – 40 and hence .

Interaction Labelling

Our test dataset contains ~ 2000 users. Each user interacts with a random number of items between 5 and 50; for each positive interaction, a configurable ratio of negatives is also sampled. The final dataset provides the foundation for both centralized and federated experiments.

Two-Tower Representation Learning Model Architecture

Implemented in Keras 3, the Two-Tower model comprises: (2) Where is the ReLU and L2 normalization enforces . The final prediction follows Eq. (1). Training uses Adam optimizer with learning rate and mini-batch 32.

Caching and Vocabularies

Each embedding call is cached to embed_cache.pkl; supporting JSONs store vocabularies (vocab_genre.json, vocab_location.json) and scaling parameters (age_minmax.json, year_minmax.json). This process, combined with seed generation logic, lays the groundwork for reliable and fast metadata reproducibility across experiments where different parametrical settings are tested.

Federated Learning Setup

Federated Averaging

Each client $c$ trains their two-tower model locally and sends their respective weights $w_c$ and sample counts $n_c$. The server then computes the weighted mean:

This is implemented through InTimeAcccumulateWeightedAggregator in NVFLARE 2.5.

Persistor, Client Executors, Staging and Orchestration and Resulting Algorithm

The Simple Persistor saves each aggregated model as
global_round_XXXX_YYYYMMDDThhmmssZ.h5 with a companion manifest provided in Figure 3 below:

Each client loads its shard, trains for a specified number of epochs and batch size, then returns a Shareable whose payload is a dictionary {w_0, …, w_k}. Meanwhile, The Bash scripts and job-driven (rather than command-driven) architecture of our repository automate workspace creation, template seeding, and simulation launch. The process can be summarized in an algorithmic representation provided in Figure 4 below:

Federated Explainability (FED-XAI)

In a nutshell, the FED-XAI module operates after federated training has produced a sequence of aggregated global models. Its goal is to evaluate the latest global model and to generate privacy-preserving, rule-based global explanations using two complementary mechanisms:

Gradient × Input local attribution

TSK-FRBS (Takagi–Sugeno–Kang Fuzzy Rule-Based System) global similarity-based reasoning

The workflow can be decomposed into stages and can be illustrated as shown in Figure 5 below:

Rationale

While each client can interpret its local model, only the server-aggregated model reflects collective behavior. FED-XAI thus computes explanations at the server on the aggregated surface, without ever receiving the raw inputs.

Gradient x Input Attribution

For each test sample $(x^{\left( U \right)},x^{\left( I \right)})$, we compute

And define saliency vectors

The concatenated explanation $e$ then becomes

Feature-group contributions are obtained by summing $|{ \text{s} }_{U,I}|$ over predefined index ranges.

TSK Fuzzy-Rule Scoring

To translate embedding similarity into interpretable linguistic scores, we employ a TSK Fuzzy Rule-Based System which carries out the following operations:

Compute cosine similarity

Define fuzzy sets (triangles)

Apply TSK consequents

Defuzzify

Privacy-Preserving Logging

Each explanation log $L_i$ contains:

If --privacy-user-strict is active, as it is the case within the EARS platform’s privacy-first design, user identifiers and labels are replaced by null.

Evaluation Protocol, Results and Discussion

The evaluation consists of three axes:

FL Performance: metrics (AUC, Acc, BCE) across 50 FL rounds.

XAI Performance: Visualization and Discussion of the Explanations

Privacy verification: Ensure absence of raw user metadata in any server-side artifact or explainibility module.

• The BCE Loss, AUC and Accuracy vs. FL Rounds plots are provided in figures 6 and 7 below. The figures show that there are modest yet clear improvements in all three metrics over a 50-round federated learning simulation. The modesty of the improvements is due to the following factors:

• When weight drift was investigated, the following results were obtained: Norm round 1: 48.25, Norm round 50: 319.81, Delta norm: 298.63, Mean absolute per-weight change: 0.267, Cosine similarity round1 vs round50: ≈ 0.50 (substantial rotation). This shows that the weights change substantially, but only their effects on global evaluation metrics stay modest. This is caused by the fact that the initial, client-side models were already near a performance ceiling. Also, parametric optimization, especially the number of allowed local epoches and enabling decaying learning rate based on round count was observed to be able to substantially increase the effect of aggreagation on global evaluation metrics. Hence, since the main scope of our work is Federated Explainability and not Federated Learning, the current results were found to be sufficient for us to be able to move on with the next step.

XAI Performance

• The following figures (Figure 8 and 9) provide two different item suggestions for two different users along with the visualizations of TSK explanations. Here, we can see that each recommendation has occurred due to different amounts of contribution from different user or item properties. For instance, the recommendation of Psycho (1960) was based more on locational features and movie titles (titles are the short descriptions of the movies, not their actual titles). Its more detailed summary shows half as less contribution. Age and gender were the trailing factors for this recommendation. The remaining fields provided lower contributions. The movie’s drama genre was also a large contributor. It can be deduced that such a user would like content in Drama genre. The Space Dandy (2014) recommendation, on the other hand, was based primarily on gender field. Also, this time, the summary had nearly as much effect as the title field. The trailing contributors are age and location data, as well as the genres of the item. It can be deduced that a user with similar characteristics to this user would like to watch Comedy and Animation genres.

• After temporarily lifting the privacy checks and verifying with said users’ metadata in the original dataset, it has been seen that the users in fact contain similar items watched in alignment with the below recommendations. Hence, despite the privacy constraints, EARS-XTSK Federated Explainability scheme is able to deliver accurate and detailed feature importance information that can easily be converted into linguistic, end-user friendly insights for a recommender engine.

Privacy Verification

• Thanks to our privacy-preserving logging approach, no sensitive user raw data was observed to be accessible by the global explainability module. The variable names, types, descriptions and their privacy status are provided in Table 2 below:

• Practical Implications

• Industrial Readiness

• Because NVFLARE already supports on-prem orchestration and secure aggregation, EARS-XTSK can be deployed without major backend/infrastructure changes.
  The explainability outputs (TSK scores + Grad×Input vectors) are JSON-serializable and can feed any BI or compliance dashboard.

• Regulatory Alignment

• Under GDPR Art. 22 and KVKK Art. 11, users have the right to “meaningful information about the logic involved.”
  Our fuzzy linguistic rules (“Low / Medium / High similarity”) satisfy this requirement while maintaining zero access to personal data.

• Integration w/ Partner Environments

• The same pipeline can run inside each partner’s secure enclave, returning only aggregated global models to adesso Turkey.
  Hence, the explainability analysis remains compliant yet operationally consistent across real and synthetic domains.

Discussion

This paper presented EARS-XTSK, an end-to-end, privacy-preserving, globally explainable recommender system architecture.
By uniting:

A synthetic data generator matching industrial schemas,Cross-silo Two-Tower training under NVFLARE FedAvg, andA novel server-side TSK fuzzy-rule explainability module grounded in grad×input attributions,we achieve interpretable global reasoning without accessing any raw user data.
The framework demonstrates that federated architectures can provide not only accuracy but also compliance-grade transparency.

Industrial Readiness

Because NVFLARE already supports on-prem orchestration and secure aggregation, EARS-XTSK can be deployed without major backend/infrastructure changes.
The explainability outputs (TSK scores + Grad×Input vectors) are JSON-serializable and can feed any BI or compliance dashboard.

Regulatory Alignment

Under GDPR Art. 22 and KVKK Art. 11, users have the right to “meaningful information about the logic involved.”
Our fuzzy linguistic rules (“Low / Medium / High similarity”) satisfy this requirement while maintaining zero access to personal data.

Integration w/ Partner Environments

The same pipeline can run inside each partner’s secure enclave, returning only aggregated global models to adesso Turkey.
Hence, the explainability analysis remains compliant yet operationally consistent across real and synthetic domains.

• Future work is currently in progress and contains trainable neuro-fuzzy consequents jointly optimized with the global model, secure aggregation of client-side local explainability histograms, differential-privacy calibration for explanation vectors and domain-specific visual dashboards for analysts that employs fine-tuned LLMs, aiming to generate end user-friendly, verbal explanations as to why a certain item has been recommended to them.

This work is conducted under the EARS Project (Environment Adaptive Recommendation System), an ITEA project whose FED-XAI sections are being coordinated by adesso Turkey with contributions from partner organizations in the media and online-community sectors.
We thank all collaborators for providing project coordination, use-case, data and client schemas alongside validation support.