Pith. sign in

REVIEW 3 major objections 6 minor 33 references

HASSLE: A Self-Supervised Learning Enhanced Hijacking Attack on Vertical Federated Learning

T0 review · 3 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A passive party in vertical federated learning can infer which training samples carry a chosen label from a single known example, then train an adversarial embedding that makes the model predict that label with over 99% success.

desk verdict Solid, well-evaluated VFL hijacking attack; the single-known-sample LIA needs a robustness experiment before the headline claim fully lands. read the letter →

arxiv 2507.10162 v1 pith:2NI5OT34 submitted 2025-07-14 cs.CR

Weiyang He , Chip-Hong Chang This is my paper
classification cs.CR
keywords verticalfederatedlearninglabelinferenceattackhijackingbackdoorself-supervisedadversarialembeddinggradientleakageSplitVFL
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Vertical federated learning lets several parties train a model together while each keeps its own feature columns private, with only one active party holding the training labels. This paper argues that even under that design, a passive participant can identify which training samples carry a chosen label using a single known example of that label, and can then force the trained model to output that label at will. The proposed attack, HASSLE, reports label-inference precision near 100% on four datasets and attack success above 99% (above 80% on CIFAR-100) in a two-party setting, without degrading normal accuracy. The claim matters because it turns a minimal information leak into a near-complete model hijack, making VFL integrity depend on defenses that resist both label leakage and embedding manipulation.

What carries the argument

The load-bearing object is the returned gradient $dh_i = \partial L/\partial h_i$ that the active party sends back to the passive party. The label inference rests on the identity that, early in training, this gradient is approximately a linear combination of the top model's logit weight vectors in which the ground-truth class's vector has the dominant coefficient; for a one-layer top model, $dh_i = w^\top(s_i - y_i)$, and near-uniform initial predictions make the coefficient of $w_{y_i}$ about $C-1$ times larger than the others. For multilayer ReLU top models, the same correlation survives because samples of one class activate overlapping first-layer neurons and the first-layer columns become approximately orthogonal. The second mechanism is an adversarial embedding $h_{\text{adv}}$ optimized by gradient descent on the returned gradients while it is substituted for benign target-label embeddings during training, plus self-supervised pre-training (MoCo-v2 for images, SCARF for tabular data) that raises the attacker's feature saliency so the top model weights its input more heavily.

What would settle it

Train a two-party SplitVFL on CIFAR-100 with a four-layer MLP top model and a randomly initialized ResNet-18 bottom model, then compute the cosine similarity between returned gradients of samples sharing a label in the first five epochs; if same-label similarity is not significantly higher than cross-label similarity, the gradient-direction premise fails and HASSLE's label inference should fall to roughly chance, matching the paper's reported 41.6% precision at that depth.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that the gradient a passive party receives back from the active party carries a usable label signal even when the top model is a multi-layer network, and that signal can be harvested with only one known instance of the target label. The paper analyzes the returned gradient as a linear combination of top-model weight vectors, showing that in early training the ground-truth class's weight vector dominates the direction; label-specific ReLU activation patterns and near-orthogonal first-layer columns preserve this correlation in deeper top models. On top of that gradient-direction label inference, HASSLE replaces the embeddings of inferred target-label samples with an adversarially optimized embedding and pre-trains its own bottom model with self-supervised learning so the active party's top model relies more heavily on the attacker's features. The result is a two-stage hijack: locate the target-label samples, then train the model to associate the attacker's embedding with the target label. In the two-party setting this yields over 99% attack success on CIFAR-10, ImageNette, NUS-WIDE and Income, and 85% attack success on CIFAR-100.

Load-bearing premise

The label inference module assumes that early in training the direction of the returned gradient is dominated by the ground-truth label's weight vector, which requires near-orthogonal class weight vectors and near-uniform initial predictions; for many-class tasks or deeper top models this correlation fades, and the paper itself reports label inference precision falling to 41.6% on CIFAR-100 with a four-layer top model.

Editorial extensions

If this is right

  • A passive party with one leaked label sample can map out essentially the entire target class in the training set, so label confidentiality in VFL cannot rest on the assumption that returned gradients hide the label.
  • Hijacking attacks no longer need large auxiliary labeled datasets or late-training injection; early, high-precision label inference plus adversarial embedding yields high attack success at low poisoning rates such as 2.5%.
  • The attack does not sacrifice main task accuracy in the reported experiments, so accuracy-based anomaly detection will not flag it.
  • The threat weakens as the attacker's share of features shrinks: four-party setups or attacker-held feature ratios below 0.3 degrade the attack, which points to influence limitation as a practical line of defense.
  • Among the eight tested defenses, DPSGD, VFLIP and LIMIT reduce the attack most, but none eliminates it, suggesting that VFL integrity needs combined defenses rather than a single countermeasure.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the attack relies on early gradient direction, a defense that deliberately decorrelates per-class gradient directions in the first few epochs, such as adding class-dependent isotropic noise before gradients are returned, should attack the mechanism directly and could preserve utility better than global DP noise.
  • The saliency result implies the active party's own embedding contributes to the hijack; constraining all parties' embedding norms and top-model weight norms from the start may be a cheap general mitigation, though the paper's LIMIT experiments show it does not fully stop the attack.
  • The single-known-sample assumption could be stress-tested by selecting an atypical or adversarial known sample; if the multi-epoch similarity averaging is not robust to such outliers, the practical threat may be smaller than reported.
  • The self-supervised pre-training trick is not specific to VFL and could plausibly boost the influence of a malicious participant in other split-learning or collaborative-training settings, which the paper does not explore.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes HASSLE, a two-phase attack on vertical federated learning. In the label inference phase, a passive adversary with one known sample of a target class computes the cosine similarity between the gradient of that sample and the gradients of all other samples over several early epochs, averages the scores, and selects the top n_t/r instances as target-label samples. In the hijacking phase, the adversary replaces the embeddings of those inferred samples with an adversarial embedding updated by the returned gradients, with the attacker's bottom model initialized by self-supervised learning. Experiments on CIFAR-10, CIFAR-100, ImageNette, NUS-WIDE, and Income report LIA precision at or near 100% and attack success rates above 99% on four datasets and above 80% on CIFAR-100, plus a robustness study against eight defenses.

Significance. If the results hold, HASSLE is a strong and practical attack that advances the state of the art: it requires only one known target-label sample, operates in early training, and combines gradient-based label inference with adversarial embedding poisoning. The paper's strengths include the breadth of the evaluation (five datasets covering image and tabular modalities), sensitivity analyses over attack epochs, filtering ratio, number of parties, embedding dimension, and top-model depth, and the systematic defense evaluation with an explicit taxonomy. The feature-saliency analysis (Fig. 6) provides a plausible mechanism for why SSL pretraining helps. The main reservations concern the strength of the end-to-end claim and the robustness of the single-template inference.

major comments (3)
  1. [IV-A2, Table IV] The hijacking evaluation in Table IV is not end-to-end. Section IV-A2 states that "For a fair comparison among all hijacking attacks, we assume the attacker has the knowledge of p% sample IDs corresponding to the target label after the LIA," so the HASSLE ASR values of 99.6-100% in Table IV are obtained with target-label IDs that are given to the attacker, not with IDs produced by the LIA of Algorithm 1. The abstract's headline claim of "over 99% across four datasets" is therefore supported only for this partially oracle-assisted setting. The full pipeline is evaluated only in Section IV-C (Figs. 7-11), where ASR values are lower in several configurations, for example on CIFAR-100 and in the four-party CIFAR-10 case. Please separate the two claims and report the end-to-end ASR prominently, or restrict the abstract to that number.
  2. [III-C, Algorithm 1, Table III] The single-instance LIA is not tested for robustness to the choice of the known sample. Algorithm 1 uses one known ID I_k, and Table III reports a single precision value per configuration with no seeds or standard deviations. Eqs. (6)-(8) establish only that the gradient direction is label-correlated under uniformity and orthogonality assumptions; they do not show that one instance's gradient is a stable centroid under intra-class variation, which matters for CIFAR-100 (500 samples per class) and for imbalanced tabular data. Please add experiments that vary the known sample (e.g., 10-20 random choices per dataset) and report the mean and standard deviation of LIA precision and end-to-end ASR.
  3. [III-C, Eqs. (6), (8)] The "formal analysis" of the multi-layer case relies on assumptions that are asserted rather than proven: the early-training outputs are approximated as uniform, the weight vectors w_c are "expected to be uniformly distributed in early training," and the columns of w_1^T are "assumed to be highly divergent." Fig. 4 supports the orthogonality claim only for CIFAR-10 at one-third of training, and the paper itself notes the assumption breaks down on CIFAR-100 with deeper top models. The contribution bullet "formally analyze the causation" is stronger than what the derivation delivers; either provide a proof with explicit conditions or present the argument as an empirical heuristic.
minor comments (6)
  1. [III-D1, IV-B2] The equation number (11) is used twice: once for the hijacking objective in Section III-D1 and once for feature saliency in Section IV-B2; the second occurrence should be renumbered.
  2. [Algorithm 1] Line 1 of Algorithm 1 contains a typo: "RAMDOM INIT" should read "RANDOM INIT."
  3. [IV-A1, IV-C1] The text says that image samples are "partitioned horizontally" in Section IV-A1 but later describes "slicing the image samples vertically" in Section IV-C1; the slicing geometry should be described consistently.
  4. [III-C] The sentence "For simplicity and without loss of generality, we assume that the top model has two layers" overstates the case; the later sensitivity analysis in Fig. 9 shows measurable degradation for deeper top models, so this is a simplification, not a WLOG.
  5. [III-D2] Section III-D2 refers to "the abundant unlabeled samples owned by the adversary," but the attack model in Section III-B2 only grants partial features for the training IDs; please clarify whether additional unlabeled data are assumed and, if so, how many samples are used for SSL pretraining.
  6. [II-D, IV-A3] All tables report point estimates without standard deviations or the number of seeds; beyond the robustness experiments requested above, please state the reporting convention in the experimental setup.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: HASSLE's label inference and hijacking components are evaluated empirically with no derivation that reduces to its inputs.

full rationale

The derivation chain is self-contained. The label inference module uses one known target-label sample's returned gradient as a template and ranks other training samples by averaged cosine similarity; its correctness is measured against ground-truth labels (Table III, Fig. 5), not defined by the known sample itself. The direction-label correlation is derived from the top-model gradient decomposition in Eqs. (3), (6), and (8) under stated assumptions (near-uniform early outputs, divergent weight directions), and the resulting precision numbers are empirical measurements rather than identities. The adversarial embedding is optimized against actual returned gradients through the objective in Eq. (11), and the attack success rate is measured on test samples; this is an attack construction, not a prediction fitted to the success metric. Hyperparameters such as r and E_a are dataset-specific run settings, and the paper provides sensitivity analyses (Figs. 8, 9, 10, 11) rather than tuning them to force the headline results. The only apparent author self-citation, He et al. [17], is used as a comparison baseline for the mean-shift attack, not as justification for HASSLE's central claims. No definitional equivalence, imported uniqueness theorem, ansatz-by-citation, or renaming of a known result was found. The main caveat, that the single known instance may not be representative across intra-class variation, is an empirical robustness concern, not a circularity.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The attack relies on four stated assumptions: one known label sample, uniform early predictions, near-orthogonal first-layer weights, and class-conditional ReLU activation. Two hyperparameters (r, E_a) and the poisoning ratio are tuned per dataset and directly affect the reported success rates.

free parameters (3)
  • Filtering ratio r = 4 (CIFAR-10, CIFAR-100, ImageNette, NUS-WIDE), 8 (Income)
    Controls how many top-scoring samples are selected; tuned per dataset to balance LIA precision and poisoning rate.
  • Attack epoch E_a = 7, 13, 10, 5, 2 for CIFAR-10, CIFAR-100, ImageNette, NUS-WIDE, Income (Table II)
    Determines when label inference ends and poisoning begins; selected per dataset to allow enough gradient evidence while leaving training epochs for poisoning.
  • Poisoning ratio = 2.5%, 0.25%, 2.5%, 5%, 6.25% for CIFAR-10, CIFAR-100, ImageNette, NUS-WIDE, Income
    Set based on LIA output and r; affects attack success and stealthiness.
assumptions (4)
  • domain assumption In early VFL training, the top model's predicted distribution is approximately uniform for any input.
    Used in Eq. (6) to argue that the gradient direction is dominated by the ground-truth logit weight vector.
  • domain assumption The column vectors in the first-layer weight matrix of a modestly trained top model are nearly orthogonal.
    Required in Eq. (9) to preserve label-direction correlation through the linear transformation.
  • domain assumption Samples from the same class activate similar subsets of ReLU neurons in the top model, preserving label-gradient correlation.
    Used in Section III-C to extend the single-layer analysis to ReLU networks.
  • domain assumption The adversary can obtain the training-sample ID of one instance of the target label (e.g., via phishing or collusion).
    It is the only auxiliary label information assumed; if unavailable, the label inference attack cannot start.

how reviews work

0 comments
Cite this review

Pith. "Pith review of HASSLE: A Self-Supervised Learning Enhanced Hijacking Attack on Vertical Federated Learning." pith.science (2026). https://pith.science/paper/2NI5OT34

@misc{pith2026250710162,
  author       = {Pith},
  title        = {Pith review of: HASSLE: A Self-Supervised Learning Enhanced Hijacking Attack on Vertical Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2NI5OT34}},
  note         = {Machine review of arXiv:2507.10162}
}
read the original abstract

Vertical Federated Learning (VFL) enables an orchestrating active party to perform a machine learning task by cooperating with passive parties that provide additional task-related features for the same training data entities. While prior research has leveraged the privacy vulnerability of VFL to compromise its integrity through a combination of label inference and backdoor attacks, their effectiveness is constrained by the low label inference precision and suboptimal backdoor injection conditions. To facilitate a more rigorous security evaluation on VFL without these limitations, we propose HASSLE, a hijacking attack framework composed of a gradient-direction-based label inference module and an adversarial embedding generation algorithm enhanced by self-supervised learning. HASSLE accurately identifies private samples associated with a targeted label using only a single known instance of that label. In the two-party scenario, it demonstrates strong performance with an attack success rate (ASR) of over 99% across four datasets, including both image and tabular modalities, and achieves 85% ASR on the more complex CIFAR-100 dataset. Evaluation of HASSLE against 8 potential defenses further highlights its significant threat while providing new insights into building a trustworthy VFL system.

Figures

Figures reproduced from arXiv: 2507.10162 by the authors.

Figure 1
Figure 1. The forward/backward process of VFL framework and [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Different partitions between HFL and VFL. Income is [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. General framework of HASSLE. B. Attack Model 1) Adversary’s Goal: The attacker’s objective is to force the model to predict an adversary-designated target label when an attack embedding is submitted. The classification accuracy of the model should not be impaired when a normal embedding is submitted. Furthermore, the adversary’s action should be inconspicuous to avoid being detected by the active party. 2) Adversary… view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: (a) Heatmap of neuron activation counts at the first [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 5
Figure 5. Figure 5: Comparison of the LIA precision in each epoch before [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 8
Figure 8. Figure 8: LIA precision and ASR of HASSLE under different [PITH_FULL_IMAGE:figures/full_fig_p010_8.png]
Figure 7
Figure 7. Figure 7: LIA precision and ASR of HASSLE under different [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]
Figure 9
Figure 9. Figure 9: LIA precision and ASR of HASSLE under different [PITH_FULL_IMAGE:figures/full_fig_p011_9.png]
Figure 10
Figure 10. Figure 10: LIA precision and ASR of HASSLE under different [PITH_FULL_IMAGE:figures/full_fig_p011_10.png]
Figure 12
Figure 12. Figure 12: (a) t-SNE visualization and (b) PCA visualization of [PITH_FULL_IMAGE:figures/full_fig_p012_12.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

33 extracted references · 23 canonical work pages

  1. [1]

    1–88, May 2016

    European Parliament and Council of the European Union, “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation),” Official Journal of the European Union, L119, pp. 1–...

    work page 2016

  2. [2]

    California Consumer Privacy Act of 2018,

    California State Legislature, “California Consumer Privacy Act of 2018,” California Civil Code, § 1798.100–1798.199, Jun. 2018. [Online]. Available: https://leginfo.legislature.ca.gov/

    work page 2018

  3. [3]

    Federated learning for open banking,

    G. Long, Y . Tan, J. Jiang, and C. Zhang, “Federated learning for open banking,” in Federated learning: privacy and incentive. Springer, 2020, pp. 240–254

    work page 2020

  4. [4]

    Implementing vertical federated learning using autoen- coders: Practical application, generalizability, and utility study,

    D. Cha et al. , “Implementing vertical federated learning using autoen- coders: Practical application, generalizability, and utility study,” JMIR medical informatics, vol. 9, no. 6, p. e26598, 2021

    work page 2021

  5. [5]

    Federated learning application on telecommunication- joint healthcare recommendation,

    Y . Song et al. , “Federated learning application on telecommunication- joint healthcare recommendation,” in 2021 IEEE 21st Int. Conf. on Commun. Techn. (ICCT). Tianjin, China: IEEE, 2021, pp. 1443–1448

    work page 2021

  6. [6]

    Survey on federated learning threats: Concepts, taxonomy on attacks and defences, experimental study and challenges,

    N. Rodr ´ıguez-Barroso, D. Jim ´enez-L´opez, M. V . Luz´on, F. Herrera, and E. Mart ´ınez-C´amara, “Survey on federated learning threats: Concepts, taxonomy on attacks and defences, experimental study and challenges,” Information Fusion, vol. 90, pp. 148–173, 2023

    work page 2023

  7. [7]

    Label inference attacks against vertical federated learning,

    C. Fu, X. Zhang, S. Ji, J. Chen, J. Wu, S. Guo, J. Zhou, A. X. Liu, and T. Wang, “Label inference attacks against vertical federated learning,” in 31st USENIX security symposium (USENIX Security 22) , 2022, pp. 1397–1414

    2022

  8. [8]

    ADI: Adversarial Dominating Inputs in Vertical Federated Learning Systems

    Q. Pang, Y . Yuan, S. Wang, and W. Zheng, “Adi: Adversarial dom- inating inputs in vertical federated learning systems,” arXiv preprint arXiv:2201.02775, 2022

    work page Pith review arXiv 2022

Show all 33 references
  1. [9]

    Badvfl: Backdoor attacks in vertical federated learning,

    M. Naseri, Y . Han, and E. De Cristofaro, “Badvfl: Backdoor attacks in vertical federated learning,” in 2024 IEEE Symposium on Security and Privacy (SP). IEEE, 2024, pp. 2013–2028

    2024

  2. [10]

    Vertical federated learning: Concepts, advances, and challenges,

    Y . Liu, Y . Kang, T. Zou, Y . Pu, Y . He, X. Ye, Y . Ouyang, Y .-Q. Zhang, and Q. Yang, “Vertical federated learning: Concepts, advances, and challenges,” IEEE Transactions on Knowledge and Data Engineering , 2024

    2024

  3. [11]

    Defending batch-level label inference and replacement attacks in vertical federated learning,

    T. Zou, Y . Liu, Y . Kang, W. Liu, Y . He, Z. Yi, Q. Yang, and Y .-Q. Zhang, “Defending batch-level label inference and replacement attacks in vertical federated learning,” IEEE Transactions on Big Data , 2022

    2022

  4. [12]

    Label leakage and protection in two-party split learning,

    O. Li, J. Sun, X. Yang, W. Gao, H. Zhang, J. Xie, V . Smith, and C. Wang, “Label leakage and protection in two-party split learning,” in International Conference on Learning Representations , 2022. [Online]. Available: https://openreview.net/forum?id=cOtBRgsf2fO

    2022

  5. [13]

    Practical and general backdoor attacks against vertical federated learning,

    Y . Xuan, X. Chen, Z. Zhao, B. Tang, and Y . Dong, “Practical and general backdoor attacks against vertical federated learning,” in Joint European Conference on Machine Learning and Knowledge Discovery in Databases. Springer, 2023, pp. 402–417

    2023

  6. [14]

    {VILLAIN}: Backdoor attacks against vertical split learning,

    Y . Bai, Y . Chen, H. Zhang, W. Xu, H. Weng, and D. Goodman, “{VILLAIN}: Backdoor attacks against vertical split learning,” in 32nd USENIX Security Symposium (USENIX Security 23) , 2023, pp. 2743– 2760

    2023

  7. [15]

    Label leakage and protection from forward embedding in vertical federated learning,

    J. Sun, X. Yang, Y . Yao, and C. Wang, “Label leakage and protection from forward embedding in vertical federated learning,” arXiv preprint arXiv:2203.01451, 2022

    2022 arXiv

  8. [16]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, “Explaining and harnessing adversarial examples,” arXiv preprint arXiv:1412.6572 , 2014

    2014 arXiv

  9. [17]

    Backdoor attack against split neural network-based vertical federated learning,

    Y . He, Z. Shen, J. Hua, Q. Dong, J. Niu, W. Tong, X. Huang, C. Li, and S. Zhong, “Backdoor attack against split neural network-based vertical federated learning,” IEEE Transactions on Information Forensics and Security, vol. 19, pp. 748–763, 2023

    2023

  10. [18]

    Lr-ba: Backdoor attack against vertical federated learning using local latent representations,

    Y . Gu and Y . Bai, “Lr-ba: Backdoor attack against vertical federated learning using local latent representations,” Computers & Security , vol. 129, p. 103193, 2023

    2023

  11. [19]

    Hijack vertical federated learning models as one party,

    P. Qiu, X. Zhang, S. Ji, C. Li, Y . Pu, X. Yang, and T. Wang, “Hijack vertical federated learning models as one party,” IEEE Transactions on Dependable and Secure Computing , 2024

    2024

  12. [20]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky, G. Hinton et al. , “Learning multiple layers of features from tiny images,” 2009

    2009

  13. [21]

    Imagenette dataset,

    FastAI, “Imagenette dataset,” https://github.com/fastai/imagenette, 2019, accessed: 2024-11-16

    2019

  14. [22]

    Nus-wide: a real-world web image database from national university of singapore,

    T.-S. Chua, J. Tang, R. Hong, H. Li, Z. Luo, and Y . Zheng, “Nus-wide: a real-world web image database from national university of singapore,” in Proceedings of the ACM international conference on image and video retrieval, 2009, pp. 1–9

    2009

  15. [23]

    Becker and R

    B. Becker and R. Kohavi, “Adult,” UCI Machine Learning Repository, 1996, DOI: https://doi.org/10.24432/C5XW20

    1996 doi

  16. [24]

    Improved baselines with mo- mentum contrastive learning,

    X. Chen, H. Fan, R. Girshick, and K. He, “Improved baselines with mo- mentum contrastive learning,” arXiv preprint arXiv:2003.04297 , 2020

    2003 arXiv

  17. [25]

    Scarf: Self-supervised contrastive learning using random feature corruption,

    D. Bahri, H. Jiang, Y . Tay, and D. Metzler, “Scarf: Self-supervised contrastive learning using random feature corruption,” in International Conference on Learning Representations , 2022. [Online]. Available: https://openreview.net/forum?id=CuV qYkmKb3

    2022

  18. [26]

    Scikit-learn: Machine learning in Python,

    F. Pedregosa, G. Varoquaux, A. Gramfort, V . Michel, B. Thirion, O. Grisel, M. Blondel, P. Prettenhofer, R. Weiss, V . Dubourg, J. Vander- plas, A. Passos, D. Cournapeau, M. Brucher, M. Perrot, and E. Duch- esnay, “Scikit-learn: Machine learning in Python,” Journal of Machine ...

    2011

  19. [27]

    Grad-cam: Visual explanations from deep networks via gradient-based localization,

    R. R. Selvaraju, M. Cogswell, A. Das, R. Vedantam, D. Parikh, and D. Batra, “Grad-cam: Visual explanations from deep networks via gradient-based localization,” in Proceedings of the IEEE International Conference on Computer Vision (ICCV) , Oct 2017

    2017

  20. [28]

    Deep learning with differential privacy,

    M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” in Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, 2016, pp. 308–318

    2016

  21. [29]

    Scalable distributed dnn training using commodity gpu cloud computing,

    N. Str ¨om, “Scalable distributed dnn training using commodity gpu cloud computing,” in Interspeech 2015 , 2015. [Online]. Avail- able: https://www.amazon.science/publications/scalable-distributed-dnn- training-using-commodity-gpu-cloud-computing

    2015

  22. [30]

    Anti-backdoor learning: Training clean models on poisoned data,

    Y . Li, X. Lyu, N. Koren, L. Lyu, B. Li, and X. Ma, “Anti-backdoor learning: Training clean models on poisoned data,” Advances in Neural Information Processing Systems , vol. 34, pp. 14 900–14 912, 2021

    2021

  23. [31]

    Adversarial neuron pruning purifies backdoored deep models,

    D. Wu and Y . Wang, “Adversarial neuron pruning purifies backdoored deep models,” Advances in Neural Information Processing Systems , vol. 34, pp. 16 913–16 925, 2021

    2021

  24. [32]

    Vflip: A backdoor defense for vertical federated learning via identification and purification,

    Y . Cho, W. Han, M. Yu, Y . Lee, H. Bae, and Y . Paek, “Vflip: A backdoor defense for vertical federated learning via identification and purification,” in European Symposium on Research in Computer Security. Springer, 2024, pp. 291–312

    2024

  25. [33]

    Certified adversarial robustness via randomized smoothing,

    J. Cohen, E. Rosenfeld, and Z. Kolter, “Certified adversarial robustness via randomized smoothing,” in international conference on machine learning. PMLR, 2019, pp. 1310–1320

    2019

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.