Pith. sign in

REVIEW 5 major objections 6 minor 1 cited by

Federated Hybrid Training and Self-Adversarial Distillation: Towards Robust Edge Networks

T0 review · 5 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A two-branch hybrid adversarial loss plus a global feature alignment term lets federated models defend against adversarial examples while keeping clean accuracy near standard-training levels.

desk verdict A plausible incremental combo of hybrid AT and feature distillation for robust FL, with consistent but under-supported empirical gains and a few reproducibility gaps. read the letter →

arxiv 2412.19354 v1 pith:MA66IYR2 submitted 2024-12-26 cs.CV cs.LG

Yu Qiao , Apurba Adhikary , Kitae Kim , Eui-Nam Huh , Zhu Han , Choong Seon Hong This is my paper · ORCID
classification cs.CVcs.LG
keywords federatedlearningadversarialtrainingknowledgedistillationnon-IIDdatarobustnessedgecomputing
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that a federated model can be made resistant to adversarial attacks without paying the usual steep penalty in clean accuracy, by combining two local-training modifications. The first is hybrid adversarial training, which treats adversarial examples as an extra data augmentation stream and weights the clean and adversarial losses. The second is augmentation-invariant self-adversarial distillation, which pulls each client's adversarial features toward an averaged global clean feature for the same class. On MNIST, Fashion-MNIST, SVHN, Office-Amazon, and CIFAR-10 under non-IID splits, FedBAT reports higher clean and robust accuracy than the compared federated adversarial-training baselines. If correct, it gives edge deployments a way to defend against attacks while keeping the model usable on ordinary inputs.

What carries the argument

The load-bearing mechanism is the pairing of two local objectives with a server-side averaging step. The hybrid adversarial loss $\mathcal{L}_{\mathrm{FHA}}=(1-\lambda)\mathcal{L}_i+\lambda\mathcal{L}_i^{\mathrm{adv}}$ treats adversarial examples as an augmentation branch that balances clean accuracy and robustness. The self-adversarial distillation loss $\mathcal{L}_{\mathrm{ASD}}=\|f^e_i(\hat{\boldsymbol{x}}_i^{\mathrm{adv}})-\bar{X}\|_2^2$ measures the squared distance between a client's adversarial augmented features and the global augmented clean representation $\bar{X}$, which is the mean over clients of per-class averaged local augmented features. The global average is what is supposed to supply the less-biased distillation target.

What would settle it

Train FedBAT but in each round compute the global feature mean $\bar{X}$ from a single randomly chosen client's local features instead of the full average. If the reported clean and robust accuracy gains vanish, the less-biased-global-mean assumption is falsified.

Watch

Extended reading notes

Core claim

The central claim is that the accuracy-robustness trade-off in federated adversarial training can be shifted by connecting adversarial training to data augmentation and by regularizing local adversarial features with a global, class-wise clean-feature target. Concretely, FedBAT minimizes $\mathcal{L}_i^{\mathrm{adv}} = (1-\lambda)\mathcal{L}_i + \lambda\mathcal{L}_i^{\mathrm{adv}} + \|f^e_i(\hat{\boldsymbol{x}}_i^{\mathrm{adv}}) - \bar{X}\|_2^2$, where the first two terms form the hybrid adversarial loss and the last term aligns local adversarial augmented features with the global averaged clean augmented representation of the same semantic class. The paper argues this alignment makes local updates less biased under non-IID data and makes adversarial representations consistent with clean ones, and reports consistent gains over several federated defense baselines across five datasets, for example $+5.40\%$ clean and $+4.58\%$ robust accuracy over FedPGD on Fashion-MNIST.

Load-bearing premise

The load-bearing premise is that the global augmented clean representation, obtained by averaging local per-class features across clients, is less biased than each client's local representation and thus a reliable distillation target for local adversarial features.

Editorial extensions

If this is right

  • On Fashion-MNIST with Dir(0.5), FedBAT reports +5.40% clean accuracy and +4.58% robust accuracy over FedPGD, showing the hybrid loss can recover much of the clean-accuracy drop from adversarial training.
  • Across five datasets, FedBAT reports the best clean and robust accuracy among the compared methods under six attack types, including AutoAttack.
  • FedBAT remains ahead of baselines as data heterogeneity varies (Dirichlet parameter 0.1 to 3.0) and as client count grows to 40, suggesting the gains are not tied to one heterogeneity level.
  • Robustness gains persist in a large-scale setting with 100 clients and 10% participation per round, indicating the method scales to partial participation.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The global feature average in Eq. (11) is a potentially weak link under partial participation: if only a few clients report features for a class in a given round, the 'global' target is really a small-sample average, so the benefit may depend on participation frequency. A testable extension is to weight or robustly aggregate the local feature means.
  • Because the distillation target is a per-class mean of augmented clean features, the method is effectively doing variance reduction around a shared anchor; this suggests it could be combined with other non-IID remedies such as prototype anchoring or logit calibration, and its gains would be expected to grow when client feature drift is large.
  • The paper's trade-off curves plateau for loss ratio $\rho \ge 1$, implying the method is insensitive to the balance hyperparameter once robustness dominates; a practical implication is that $\lambda$ needs little per-task tuning beyond the plateau region.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes FedBAT, a federated adversarial training framework that combines a hybrid adversarial training loss (FHA) with an augmentation-invariant self-adversarial distillation (ASD) regularizer. FHA interpolates between clean cross-entropy loss and adversarial cross-entropy loss via a trade-off coefficient λ, while ASD aligns local adversarial feature embeddings with class-wise global clean feature averages computed by averaging per-client augmented features at the server. The paper claims that this joint design simultaneously improves clean accuracy and robust accuracy under non-IID data and adversarial attacks. Experiments on MNIST, Fashion-MNIST, SVHN, Office-Amazon, and CIFAR-10 compare FedBAT against FedPGD, MixFAT, CalFAT, DBFAT, and other baselines, reporting gains in both clean and robust accuracy. An ablation study attributes the gains to the combination of hybrid-AT and ASD.

Significance. The empirical scope is a strength: the paper evaluates five datasets, six attack types, several Dirichlet heterogeneity levels, client counts up to 40, a 100-client scalability setting, and a four-configuration ablation. The core idea of using global clean feature prototypes as distillation targets for local adversarial features is well motivated and worth pursuing. However, the paper does not provide code, error bars, or a validation-based hyperparameter selection protocol, and the algorithmic specification contains sequencing gaps that prevent reproduction as stated. The central empirical claim is defensible, but the current presentation does not yet establish it rigorously.

major comments (5)
  1. [Section IV-E, Algorithm 1] The pseudocode is not executable as written. At line 5, LocalUpdate(θ_t) is called without the global feature set \bar{X}, but line 8 computes \bar{X} only after all local updates have finished, and line 21 inside LocalUpdate uses \bar{X} to compute L_ASD. Therefore the current round's global features are never available to the clients. Furthermore, there is no model-parameter aggregation step: line 10 computes only the scalar loss L_adv, not an updated global parameter vector θ_{t+1} from the returned θ_t^i. The prose in Section IV-E states that line 10 aggregates model parameters, which contradicts the content of line 10. This sequencing issue is load-bearing because the reported results depend on when \bar{X} is computed and how the global model is updated.
  2. [Section IV-D, Eqs. (10)-(12)] Equation (12) defines L_ASD as the squared ℓ2 distance between the local adversarial feature f_e_i(hat{x}_adv_i) and the entire set \bar{X}, but the surrounding text says that alignment is with the semantically matching class. If the loss is truly computed against the whole set, it is not a class-conditional distillation objective and could mix class information; if it is class-conditional, the equation must be written with \bar{X}_{y_i}. In addition, Eq. (10) is undefined when S_i,j = 0, which is common under a Dir(0.5) partition with 5 clients and 10 classes. The manuscript does not state how absent classes are handled in the client average or in the server-side average. These are not minor notation choices: they change the numerical values in Tables III-VII and affect the validity of the reported gains.
  3. [Section V-F, Fig. 9] The hyperparameter λ is selected per task by inspecting the test-accuracy and test-robustness curves in Fig. 9 and marking a red star. This is selection on the test set, so the reported clean and robust accuracies are optimistically biased relative to an honest model-selection protocol. The observation that the curves plateau after ρ=1.0 provides some reassurance, but it does not replace a validation-based or nested selection procedure. The paper should either report results for a fixed λ across tasks, use a validation split for choosing λ, or provide a sensitivity table showing that the qualitative conclusions are unchanged over a range of λ values.
  4. [Tables III-VIII and Figs. 5-8] All reported metrics are single runs, averaged over the last 5 iterations, with no standard deviations or multiple seeds and no multiple data partitions. In non-IID federated learning, variance across client partitions and random seeds is substantial. Several reported gains are small, for example +0.66% RA on CIFAR-10 in Table VIII, and may be within noise. The manuscript should report mean ± std over at least 3-5 seeds, or otherwise justify that the differences are statistically meaningful. Without this, the claim that FedBAT 'consistently outperforms' the baselines is not fully supported.
  5. [Section IV-D] The claim that global clean features are 'less biased' than local features is the foundation of the ASD regularizer, but it is supported only by citations to [21], [22], [37], [74] rather than by analysis or measurement in the proposed framework. The target \bar{X}_j is itself computed from the local models, so the regularizer is self-referential in the sense that the distillation target is derived from the same global model's own local features under non-IID participation. To make the argument load-bearing, the paper should provide a concrete justification, for example an empirical check that \bar{X}_j approximates the true global class mean as the number of clients grows, or a demonstration that the regularization does not degrade performance under extreme heterogeneity where the averaged target is skewed.
minor comments (6)
  1. [Section IV] The section heading 'Proposed FedBAFT Framework' uses 'FedBAFT', while the rest of the paper uses 'FedBAT'. The abbreviation should be made consistent.
  2. [Figure 2 caption] The caption refers to a coefficient α balancing the trade-off between L_adv_i and L_i, but Eq. (9) uses λ. The notation should be unified.
  3. [Section V-A] The subsection title 'Implementaion Details' contains a typo; it should be 'Implementation Details'.
  4. [Figure 9 caption] The caption says the selected parameter is 'highlighted with 8', which appears to be a rendering artifact; it should say 'highlighted with a red star'.
  5. [Section V-D] The text says the entire dataset is partitioned into 100 clients 'using the default Dirichlet parameter value'; to be self-contained, the numerical value 0.5 should be restated here rather than referring back to the setup section.
  6. [Section IV-E, Algorithm 1] The function signature at line 12 reads LocalUpdate(θ_t, \bar{X}), but the call at line 5 passes only θ_t. The algorithm should either pass \bar{X} to the clients or make clear that the feature exchange happens at a different point in the round.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: FedBAT's reported gains are empirical results against external benchmarks and independent baselines; the self-distillation target is a bootstrap by design, and the cited support for the 'less biased' premise is external, not self-derived.

full rationale

The paper's central claim is an empirical one: combining the hybrid loss L_FHA (Eq. 9) with the self-adversarial distillation loss L_ASD (Eq. 12) improves clean and robust accuracy relative to federated adversarial baselines. This claim is tested on MNIST, Fashion-MNIST, SVHN, Office-Amazon, and CIFAR-10 against FedAvg, FedPGD, MixFAT, FedALP, FedAVmixup, FedTRADES, CalFAT, and DBFAT. No reported accuracy number is a fitted parameter renamed as a prediction; the ablation study in Table VIII isolates the contribution of each component. The distillation target X_bar (Eqs. 10-11) is indeed computed from the same global model's local clean features, but that is self-distillation by design, not a circular derivation: the paper does not derive the experimental gains from the unbiasedness premise, and the premise is supported by external citations [21], [22], [37], [74] rather than by the authors' own prior work. There are reproducibility concerns worth noting outside circularity: Algorithm 1 calls LocalUpdate(θ_t) at line 5 without passing X_bar while line 21 uses X_bar, and Eq. 12 aligns against the whole set X_bar rather than a class-conditional target despite the text saying alignment is with the semantically matching class. These are implementation ambiguities that could affect the reported numbers, but they are not circularity. Self-citations to the authors' earlier work ([14], [23], [58], [71], etc.) are used as related work and motivation, not as the sole justification for the central claim. No uniqueness theorem or ansatz is imported from the authors' prior work to force the method's form. Therefore the derivation chain is not circular.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The central claim relies on one tuned per-task hyperparameter and several domain assumptions about the benign nature of averaged features and augmentation invariance. No new physical or conceptual entities are introduced.

free parameters (2)
  • lambda (trade-off between clean and adversarial loss, Eq. 9) = MNIST: 10/11; Fashion-MNIST: 7/8; CIFAR-10: 7/8; SVHN: 5/6; Office-Amazon: 7/8 (derived from rho values in Figure 9)
    Selected per task from the accuracy-robustness curves in Figure 9, i.e., tuned on the test evaluation; this is a fitted hyperparameter, not derived from theory.
  • random augmentation set = random crop, flip, scale, rotation
    Chosen by hand with no ablation; affects the class-wise global features and the distillation target.
assumptions (4)
  • domain assumption Global augmented representations X_bar are less biased than local representations and are suitable pseudo-labels.
    Invoked in Section IV-D with citations [21], [22], [37], [74]; not proven in this paper.
  • domain assumption Random augmentation (crop, flip, scale, rotation) preserves semantic labels, and the invariance assumption holds for adversarial features.
    Used in Eq. (10) and Figure 4; no augmentation robustness analysis is provided.
  • domain assumption Averaging local feature vectors and transmitting them to the server does not leak meaningful private data.
    Claimed in Section IV-D as 'privacy-friendly' without formal privacy analysis.
  • standard math PGD attack generation (Eq. 5) and FedAvg aggregation are taken as standard and correct.
    Standard background tools used throughout the method; no new derivation is attempted.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Federated Hybrid Training and Self-Adversarial Distillation: Towards Robust Edge Networks." pith.science (2026). https://pith.science/paper/MA66IYR2

@misc{pith2026241219354,
  author       = {Pith},
  title        = {Pith review of: Federated Hybrid Training and Self-Adversarial Distillation: Towards Robust Edge Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MA66IYR2}},
  note         = {Machine review of arXiv:2412.19354}
}
read the original abstract

Federated learning (FL) is a distributed training technology that enhances data privacy in mobile edge networks by allowing data owners to collaborate without transmitting raw data to the edge server. However, data heterogeneity and adversarial attacks pose challenges to develop an unbiased and robust global model for edge deployment. To address this, we propose Federated hyBrid Adversarial training and self-adversarial disTillation (FedBAT), a new framework designed to improve both robustness and generalization of the global model. FedBAT seamlessly integrates hybrid adversarial training and self-adversarial distillation into the conventional FL framework from data augmentation and feature distillation perspectives. From a data augmentation perspective, we propose hybrid adversarial training to defend against adversarial attacks by balancing accuracy and robustness through a weighted combination of standard and adversarial training. From a feature distillation perspective, we introduce a novel augmentation-invariant adversarial distillation method that aligns local adversarial features of augmented images with their corresponding unbiased global clean features. This alignment can effectively mitigate bias from data heterogeneity while enhancing both the robustness and generalization of the global model. Extensive experimental results across multiple datasets demonstrate that FedBAT yields comparable or superior performance gains in improving robustness while maintaining accuracy compared to several baselines.

Figures

Figures reproduced from arXiv: 2412.19354 by the authors.

Figure 1
Figure 1. Illustration of the vanilla robust FL framework [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Illustration of the proposed FL-based hybrid-AT strat [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Illustration of the proposed self-adversarial distillation strategy designed to address the non-IID challenge. For an [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (8 more)
Figure 4
Figure 4. Figure 4: Illustration of the key idea behind the proposed self [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Comparison of the average clean accuracy (CA) on [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 6
Figure 6. Figure 6: Comparison of the average robust accuracy (RA) on [PITH_FULL_IMAGE:figures/full_fig_p011_6.png]
Figure 7
Figure 7. Figure 7: Comparison of the average clean accuracy (CA) on [PITH_FULL_IMAGE:figures/full_fig_p012_7.png]
Figure 8
Figure 8. Figure 8: Comparison of the average robust accuracy (RA) on [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]
Figure 10
Figure 10. Figure 10: The first row shows both clean and adversarial [PITH_FULL_IMAGE:figures/full_fig_p012_10.png]
Figure 9
Figure 9. Figure 9: Tradeoff between accuracy and robustness across various tasks under different values of [PITH_FULL_IMAGE:figures/full_fig_p013_9.png]
Figure 10
Figure 10. Figure 10: Feature visualization extracted from the same client [PITH_FULL_IMAGE:figures/full_fig_p013_10.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Towards Communication-Efficient Adversarial Federated Learning for Robust Edge Intelligence

    cs.CV 2025-01 conditional novelty 6.0 of 10

    A pre-trained teacher-guided distillation framework, PM-AFL++, improves clean and adversarial accuracy of federated models while reducing communication rounds and parameters.

Reference graph

Works this paper leans on

79 extracted references · 71 canonical work pages · cited by 1 Pith paper

  1. [21]

    Model-contrastive federated learning,

    Q. Li, B. He, and D. Song, “Model-contrastive federated learning,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, (TN, USA), pp. 10713–10722, Jun. 2021

    work page 2021

  2. [22]

    Federated class-incremental learning with dynamic feature extractor fusion,

    Y . Lu, L. Yang, H.-R. Chen, J. Cao, W. Lin, and S. Long, “Federated class-incremental learning with dynamic feature extractor fusion,” IEEE Transactions on Mobile Computing , Jun. 2024

    work page 2024

  3. [37]

    Fedproto: Federated prototype learning across heterogeneous clients,

    Y . Tan, G. Long, L. Liu, T. Zhou, Q. Lu, J. Jiang, and C. Zhang, “Fedproto: Federated prototype learning across heterogeneous clients,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 36, pp. 8432–8440, Jun. 2022

    work page 2022

  4. [74]

    Fedproc: Prototypical contrastive federated learning on non-iid data,

    X. Mu, Y . Shen, K. Cheng, X. Geng, J. Fu, T. Zhang, and Z. Zhang, “Fedproc: Prototypical contrastive federated learning on non-iid data,” Future Generation Computer Systems , vol. 143, pp. 93–104, Jun. 2023

    work page 2023

  5. [1]

    Edge intelligence: The confluence of edge computing and artificial intelligence,

    S. Deng, H. Zhao, W. Fang, J. Yin, S. Dustdar, and A. Y . Zomaya, “Edge intelligence: The confluence of edge computing and artificial intelligence,” IEEE Internet of Things Journal , vol. 7, pp. 7457–7469, Apr. 2020

    work page 2020

  6. [2]

    Edge comput- ing with artificial intelligence: A machine learning perspective,

    H. Hua, Y . Li, T. Wang, N. Dong, W. Li, and J. Cao, “Edge comput- ing with artificial intelligence: A machine learning perspective,” ACM Computing Surveys, vol. 55, pp. 1–35, Jan. 2023

    work page 2023

  7. [3]

    Node selection toward faster convergence for federated learning on non-iid data,

    H. Wu and P. Wang, “Node selection toward faster convergence for federated learning on non-iid data,” IEEE Transactions on Network Science and Engineering , vol. 9, pp. 3099–3111, Feb. 2022

    work page 2022

  8. [4]

    Nvm-enhanced machine learning inference in 6g edge computing,

    X. Shang, Y . Huang, Z. Liu, and Y . Yang, “Nvm-enhanced machine learning inference in 6g edge computing,” IEEE Transactions on Net- work Science and Engineering , Sep. 2021

    work page 2021

Show all 79 references
  1. [5]

    Wireless powered mobile edge computing networks: A survey,

    X. Wang, J. Li, Z. Ning, Q. Song, L. Guo, S. Guo, and M. S. Obaidat, “Wireless powered mobile edge computing networks: A survey,” ACM Computing Surveys, Jul. 2023

    2023

  2. [6]

    Mp-fedcl: Multiprototype federated contrastive learning for edge intelligence,

    Y . Qiao, M. S. Munir, A. Adhikary, H. Q. Le, A. D. Raha, C. Zhang, and C. S. Hong, “Mp-fedcl: Multiprototype federated contrastive learning for edge intelligence,” IEEE Internet of Things Journal , Sep. 2023

    2023

  3. [7]

    Convergence of edge computing and deep learning: A comprehensive survey,

    X. Wang, Y . Han, V . C. Leung, D. Niyato, X. Yan, and X. Chen, “Convergence of edge computing and deep learning: A comprehensive survey,” IEEE Communications Surveys & Tutorials , vol. 22, pp. 869– 904, Jan. 2020

    2020

  4. [8]

    Model aggregation techniques in federated learning: A comprehensive survey,

    P. Qi, D. Chiaro, A. Guzzo, M. Ianni, G. Fortino, and F. Piccialli, “Model aggregation techniques in federated learning: A comprehensive survey,” Future Generation Computer Systems , Jan. 2023

    2023

  5. [9]

    Communication-efficient learning of deep networks from decentralized data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Artificial Intelligence and Statistics , pp. 1273–1282, PMLR, Apr. 2017. 14

    2017

  6. [10]

    Fedbn: Federated learning on non-iid features via local batch normalization,

    X. Li, M. Jiang, X. Zhang, M. Kamp, and Q. Dou, “Fedbn: Federated learning on non-iid features via local batch normalization,” in Interna- tional Conference on Learning Representations , May 2021

    2021

  7. [11]

    Fat: Federated adversarial training,

    G. Zizzo, A. Rawat, M. Sinn, and B. Buesser, “Fat: Federated adversarial training,” in Annual Conference on Neural Information Processing Systems, Dec. 2020

    2020

  8. [12]

    Federated robustness propaga- tion: sharing adversarial robustness in heterogeneous federated learning,

    J. Hong, H. Wang, Z. Wang, and J. Zhou, “Federated robustness propaga- tion: sharing adversarial robustness in heterogeneous federated learning,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 37, (W A., USA), pp. 7893–7901, Feb. 2023

    2023

  9. [13]

    Privacy and robustness in federated learning: Attacks and defenses,

    L. Lyu, H. Yu, X. Ma, C. Chen, L. Sun, J. Zhao, Q. Yang, and S. Y . Philip, “Privacy and robustness in federated learning: Attacks and defenses,” IEEE Transactions on Neural Networks and Learning Systems, Nov. 2022

    2022

  10. [14]

    Logit calibration and feature contrast for robust federated learning on non-iid data,

    Y . Qiao, C. Zhang, A. Adhikary, and C. S. Hong, “Logit calibration and feature contrast for robust federated learning on non-iid data,” arXiv preprint arXiv:2404.06776, 2024

    2024 arXiv

  11. [15]

    A survey on security and privacy issues in modern healthcare systems: Attacks and defenses,

    A. I. Newaz, A. K. Sikder, M. A. Rahman, and A. S. Uluagac, “A survey on security and privacy issues in modern healthcare systems: Attacks and defenses,” ACM Transactions on Computing for Healthcare , vol. 2, pp. 1–44, Jul 2021

    2021

  12. [16]

    Ef- fective adversarial examples identification of credit card transactions,

    M.-Y . Tsai, H.-H. Cho, C.-M. Yu, Y .-C. Chang, and H.-C. Chao, “Ef- fective adversarial examples identification of credit card transactions,” IEEE Intelligent Systems , Mar. 2024

    2024

  13. [17]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” in International Conference on Learning Repre- sentations, (CA, USA), May 2015

    2015

  14. [18]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” in International Conference on Learning Representations , (BC, Canada), Apr. 2018

    2018

  15. [19]

    Federated adversarial learning: A framework with convergence analysis,

    X. Li, Z. Song, and J. Yang, “Federated adversarial learning: A framework with convergence analysis,” in International Conference on Machine Learning, pp. 19932–19959, PMLR, Jul. 2023

    2023

  16. [20]

    Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks,

    F. Croce and M. Hein, “Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks,” in International conference on machine learning , pp. 2206–2216, PMLR, Nov. 2020

    2020

  17. [23]

    Knowledge distillation assisted robust federated learning: Towards edge intelli- gence,

    Y . Qiao, A. Adhikary, K. T. Kim, C. Zhang, and C. S. Hong, “Knowledge distillation assisted robust federated learning: Towards edge intelli- gence,” in ICC 2024-IEEE International Conference on Communica- tions, (CO, USA), pp. 843–848, IEEE, Jun. 2024

    2024

  18. [24]

    Gradient-based learning applied to document recognition,

    Y . LeCun, L. Bottou, Y . Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,” Proceedings of the IEEE , vol. 86, pp. 2278–2324, Nov. 1998

    1998

  19. [25]

    Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,

    H. Xiao, K. Rasul, and R. V ollgraf, “Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,” arXiv preprint arXiv:1708.07747, 2017

    2017 arXiv

  20. [26]

    Reading digits in natural images with unsupervised feature learning,

    Y . Netzer, T. Wang, A. Coates, A. Bissacco, B. Wu, A. Y . Ng, et al. , “Reading digits in natural images with unsupervised feature learning,” in NIPS workshop on deep learning and unsupervised feature learning , vol. 2011, p. 4, Granada, Dec. 2011

    2011

  21. [27]

    Geodesic flow kernel for unsupervised domain adaptation,

    B. Gong, Y . Shi, F. Sha, and K. Grauman, “Geodesic flow kernel for unsupervised domain adaptation,” in 2012 IEEE conference on computer vision and pattern recognition , (Providence, RI), pp. 2066–2073, IEEE, Jun. 2012

    2012

  22. [28]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky, G. Hinton, et al., “Learning multiple layers of features from tiny images,” 2009

    2009

  23. [29]

    Handling both stragglers and adversaries for robust federated learning,

    J. Park, D.-J. Han, M. Choi, and J. Moon, “Handling both stragglers and adversaries for robust federated learning,” in ICML 2021 Workshop on Federated Learning for User Privacy and Data Confidentiality , ICML Board, Jul. 2021

    2021

  24. [30]

    Fe- dat: a high-performance and communication-efficient federated learning system with asynchronous tiers,

    Z. Chai, Y . Chen, A. Anwar, L. Zhao, Y . Cheng, and H. Rangwala, “Fe- dat: a high-performance and communication-efficient federated learning system with asynchronous tiers,” in Proceedings of the International Conference for High Performance Computing, Networking, Storage and...

    2021

  25. [31]

    Cdfed: Contribution-based dynamic federated learning for managing system and statistical heterogeneity,

    Y . Qiao, M. S. Munir, A. Adhikary, A. D. Raha, and C. S. Hong, “Cdfed: Contribution-based dynamic federated learning for managing system and statistical heterogeneity,” in NOMS 2023-2023 IEEE/IFIP Network Operations and Management Symposium , (FL, USA), IEEE, May 2023

    2023

  26. [32]

    Federated learning with sparsified model perturbation: Improving accuracy under client-level differential privacy,

    R. Hu, Y . Guo, and Y . Gong, “Federated learning with sparsified model perturbation: Improving accuracy under client-level differential privacy,” IEEE Transactions on Mobile Computing , Dec. 2023

    2023

  27. [33]

    Representative kernels-based cnn for faster transmission in federated learning,

    W. Li, Z. Shen, X. Liu, M. Wang, C. Ma, C. Ding, and J. Cao, “Representative kernels-based cnn for faster transmission in federated learning,” IEEE Transactions on Mobile Computing , Jul. 2024

    2024

  28. [34]

    The analysis and optimization of volatile clients in over-the-air federated learning,

    F. Shi, W. Lin, X. Wang, K. Li, and A. Y . Zomaya, “The analysis and optimization of volatile clients in over-the-air federated learning,” IEEE Transactions on Mobile Computing , Jul. 2024

    2024

  29. [35]

    Scaffold: Stochastic controlled averaging for federated learn- ing,

    S. P. Karimireddy, S. Kale, M. Mohri, S. Reddi, S. Stich, and A. T. Suresh, “Scaffold: Stochastic controlled averaging for federated learn- ing,” in International Conference on Machine Learning, pp. 5132–5143, PMLR, Jul. 2020

    2020

  30. [36]

    Fedmekt: Distillation-based embedding knowledge transfer for multimodal federated learning,

    H. Q. Le, M. N. Nguyen, C. M. Thwal, Y . Qiao, C. Zhang, and C. S. Hong, “Fedmekt: Distillation-based embedding knowledge transfer for multimodal federated learning,” arXiv preprint arXiv:2307.13214, 2023

    2023 arXiv

  31. [38]

    Personalized federated learning with moreau envelopes,

    C. T Dinh, N. Tran, and J. Nguyen, “Personalized federated learning with moreau envelopes,” Advances in Neural Information Processing Systems, vol. 33, pp. 21394–21405, Dec. 2020

    2020

  32. [39]

    Multi-level personalized feder- ated learning on heterogeneous and long-tailed data,

    R. Zhang, Y . Chen, C. Wu, and F. Wang, “Multi-level personalized feder- ated learning on heterogeneous and long-tailed data,” IEEE Transactions on Mobile Computing , Jun. 2024

    2024

  33. [40]

    Federated optimization in heterogeneous networks,

    T. Li, A. K. Sahu, M. Zaheer, M. Sanjabi, A. Talwalkar, and V . Smith, “Federated optimization in heterogeneous networks,” Proceedings of Machine learning and systems , vol. 2, pp. 429–450, Mar. 2020

    2020

  34. [41]

    Fedfed: Feature distillation against data heterogeneity in federated learning,

    Z. Yang, Y . Zhang, Y . Zheng, X. Tian, H. Peng, T. Liu, and B. Han, “Fedfed: Feature distillation against data heterogeneity in federated learning,” Advances in Neural Information Processing Systems , vol. 36, Feb. 2024

    2024

  35. [42]

    An aggregation-free federated learning for tackling data heterogeneity,

    Y . Wang, H. Fu, R. Kanagavelu, Q. Wei, Y . Liu, and R. S. M. Goh, “An aggregation-free federated learning for tackling data heterogeneity,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, (W A, USA), pp. 26233–26242, Jun. 2024

    2024

  36. [43]

    Dfrd: Data-free robustness distillation for heterogeneous federated learning,

    S. Wang, Y . Fu, X. Li, Y . Lan, M. Gao,et al., “Dfrd: Data-free robustness distillation for heterogeneous federated learning,” Advances in Neural Information Processing Systems , vol. 36, Dec. 2024

    2024

  37. [44]

    Distilling the knowledge in a neural network,

    G. Hinton, O. Vinyals, and J. Dean, “Distilling the knowledge in a neural network,” arXiv preprint arXiv:1503.02531 , 2015

    2015 arXiv

  38. [45]

    Logit standardization in knowledge distillation,

    S. Sun, W. Ren, J. Li, R. Wang, and X. Cao, “Logit standardization in knowledge distillation,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , (W A, USA), pp. 15731– 15740, Jun. 2024

    2024

  39. [46]

    Differentiable feature aggregation search for knowledge distillation,

    Y . Guan, P. Zhao, B. Wang, Y . Zhang, C. Yao, K. Bian, and J. Tang, “Differentiable feature aggregation search for knowledge distillation,” in Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XVII 16 , (Glasgow, UK), pp. ...

    2020

  40. [47]

    Data-free knowledge distillation via feature exchange and activation region constraint,

    S. Yu, J. Chen, H. Han, and S. Jiang, “Data-free knowledge distillation via feature exchange and activation region constraint,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, (Vancouver, Canada), pp. 24266–24275, Dec. 2023

    2023

  41. [48]

    Probabilistic knowledge transfer for lightweight deep representation learning,

    N. Passalis, M. Tzelepi, and A. Tefas, “Probabilistic knowledge transfer for lightweight deep representation learning,” IEEE Transactions on Neural Networks and Learning Systems , vol. 32, pp. 2030–2039, Jun. 2020

    2020

  42. [49]

    Pairwise difference relational distillation for object re-identification,

    Y . Xie, H. Wu, Y . Lin, J. Zhu, and H. Zeng, “Pairwise difference relational distillation for object re-identification,” Pattern Recognition, vol. 152, p. 110455, Aug. 2024

    2024

  43. [50]

    Knowledge distillation and student-teacher learning for visual intelligence: A review and new outlooks,

    L. Wang and K.-J. Yoon, “Knowledge distillation and student-teacher learning for visual intelligence: A review and new outlooks,” IEEE Transactions on Pattern Analysis and Machine Intelligence , vol. 44, pp. 3048–3068, Jan. 2021

    2021

  44. [51]

    Federated distillation: A survey,

    L. Li, J. Gou, B. Yu, L. Du, and Z. Y . D. Tao, “Federated distillation: A survey,” arXiv preprint arXiv:2404.08564 , 2024

    2024 arXiv

  45. [52]

    Federated learning with label-masking distillation,

    J. Lu, S. Li, K. Bao, P. Wang, Z. Qian, and S. Ge, “Federated learning with label-masking distillation,” inProceedings of the 31st ACM International Conference on Multimedia , pp. 222–232, 2023

    2023

  46. [53]

    Data-free adversarial distillation,

    G. Fang, J. Song, C. Shen, X. Wang, D. Chen, and M. Song, “Data-free adversarial distillation,” arXiv preprint arXiv:1912.11006 , 2019

    1912 arXiv

  47. [54]

    Adversarially robust distillation,

    M. Goldblum, L. Fowl, S. Feizi, and T. Goldstein, “Adversarially robust distillation,” in Proceedings of the AAAI conference on artificial intelligence, vol. 34, (NY , USA), pp. 3996–4003, Apr. 2020. 15

    2020

  48. [55]

    Delving into the adversarial robustness of federated learning,

    J. Zhang, B. Li, C. Chen, L. Lyu, S. Wu, S. Ding, and C. Wu, “Delving into the adversarial robustness of federated learning,” in Proceedings of the AAAI Conference on Artificial Intelligence , vol. 37, (DC, USA), pp. 11245–11253, Feb. 2023

    2023

  49. [56]

    Continuous multivariate distributions,

    N. Balakrishnan, “Continuous multivariate distributions,” Wiley StatsRef: Statistics Reference Online , Aug. 2014

    2014

  50. [57]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” arXiv preprint arXiv:1312.6199, 2013

    2013 arXiv

  51. [58]

    Towards robust federated learning via logits calibration on non-iid data,

    Y . Qiao, A. Adhikary, C. Zhang, and C. S. Hong, “Towards robust federated learning via logits calibration on non-iid data,” in NOMS 2024- 2024 IEEE/IFIP Network Operations and Management Symposium , (Seoul, Korea), IEEE, May 2024

    2024

  52. [59]

    Adversarial examples in the physical world,

    A. Kurakin, I. J. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” in Artificial Intelligence Safety and Security, pp. 99– 112, Chapman and Hall/CRC, Jul. 2018

    2018

  53. [60]

    Square attack: a query-efficient black-box adversarial attack via random search,

    M. Andriushchenko, F. Croce, N. Flammarion, and M. Hein, “Square attack: a query-efficient black-box adversarial attack via random search,” in European Conference on Computer Vision , (Glasgow, UK), pp. 484– 501, Springer, Aug. 2020

    2020

  54. [61]

    Towards evaluating the robustness of neural networks,

    N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in 2017 IEEE Symposium on Security and Privacy (SP) , pp. 39–57, IEEE, May 2017

    2017

  55. [62]

    Data augmentation can improve robustness,

    S.-A. Rebuffi, S. Gowal, D. A. Calian, F. Stimberg, O. Wiles, and T. A. Mann, “Data augmentation can improve robustness,”Advances in Neural Information Processing Systems , vol. 34, pp. 29935–29948, Dec. 2021

    2021

  56. [63]

    Maximum-entropy adver- sarial data augmentation for improved generalization and robustness,

    L. Zhao, T. Liu, X. Peng, and D. Metaxas, “Maximum-entropy adver- sarial data augmentation for improved generalization and robustness,” Advances in Neural Information Processing Systems, vol. 33, pp. 14435– 14447, Dec. 2020

    2020

  57. [64]

    Towards robustness of deep neural networks via regularization,

    Y . Li, M. R. Min, T. Lee, W. Yu, E. Kruus, W. Wang, and C.-J. Hsieh, “Towards robustness of deep neural networks via regularization,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 7496–7505, Oct. 2021

    2021

  58. [65]

    Improving dnn robustness to adversarial attacks using jacobian regularization,

    D. Jakubovitz and R. Giryes, “Improving dnn robustness to adversarial attacks using jacobian regularization,” in Proceedings of the European conference on computer vision (ECCV) , (Munich, Germany), pp. 514– 529, Sep. 2018

    2018

  59. [66]

    Advances in adversarial attacks and defenses in computer vision: A survey,

    N. Akhtar, A. Mian, N. Kardan, and M. Shah, “Advances in adversarial attacks and defenses in computer vision: A survey,” IEEE Access, vol. 9, pp. 155161–155196, Nov. 2021

    2021

  60. [67]

    On adversarial robustness: A neural architecture search perspective,

    C. Devaguptapu, D. Agarwal, G. Mittal, P. Gopalani, and V . N. Bala- subramanian, “On adversarial robustness: A neural architecture search perspective,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , pp. 152–161, Oct. 2021

    2021

  61. [68]

    The limitations of adversarial training and the blind-spot attack,

    H. Zhang, H. Chen, Z. Song, D. Boning, I. Dhillon, and C. J. Hsieh, “The limitations of adversarial training and the blind-spot attack,” in 7th International Conference on Learning Representations, ICLR 2019 , (LA, USA), May 2019

    2019

  62. [69]

    Calfat: Calibrated federated ad- versarial training with label skewness,

    C. Chen, Y . Liu, X. Ma, and L. Lyu, “Calfat: Calibrated federated ad- versarial training with label skewness,” Advances in Neural Information Processing Systems, vol. 35, pp. 3569–3581, Nov. 2022

    2022

  63. [70]

    On the robustness of the cvpr 2018 white- box adversarial example defenses,

    A. Athalye and N. Carlini, “On the robustness of the cvpr 2018 white- box adversarial example defenses,” arXiv preprint arXiv:1804.03286 , 2018

    2018 arXiv

  64. [71]

    Fedccl: Federated dual-clustered feature contrast under domain heterogeneity,

    Y . Qiao, H. Q. Le, M. Zhang, A. Adhikary, C. Zhang, and C. S. Hong, “Fedccl: Federated dual-clustered feature contrast under domain heterogeneity,” Information Fusion, vol. 113, p. 102645, Jan. 2025

    2025

  65. [72]

    Ensemble federated learning with non-iid data in wireless networks,

    Z. Zhao, J. Wang, W. Hong, T. Q. Quek, Z. Ding, and M. Peng, “Ensemble federated learning with non-iid data in wireless networks,” IEEE Transactions on Wireless Communications , Sep. 2023

    2023

  66. [73]

    Fraug: Tackling federated learning with non-iid features via representation augmenta- tion,

    H. Chen, A. Frikha, D. Krompass, J. Gu, and V . Tresp, “Fraug: Tackling federated learning with non-iid features via representation augmenta- tion,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, (Paris, France), pp. 4849–4859, Oct. 2023

    2023

  67. [75]

    Adversarial logit pairing,

    H. Kannan, A. Kurakin, and I. Goodfellow, “Adversarial logit pairing,” arXiv preprint arXiv:1803.06373 , 2018

    2018 arXiv

  68. [76]

    Adversarial vertex mixup: Toward better adversarially robust generalization,

    S. Lee, H. Lee, and S. Yoon, “Adversarial vertex mixup: Toward better adversarially robust generalization,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , (Washington, USA), pp. 272–281, Jun. 2020

    2020

  69. [77]

    Theoretically principled trade-off between robustness and accuracy,

    H. Zhang, Y . Yu, J. Jiao, E. Xing, L. El Ghaoui, and M. Jordan, “Theoretically principled trade-off between robustness and accuracy,” in International Conference on Machine Learning , (CA, USA), pp. 7472– 7482, PMLR, Jun. 2019

    2019

  70. [78]

    Bayesian nonparametric federated learning of neural networks,

    M. Yurochkin, M. Agarwal, S. Ghosh, K. Greenewald, N. Hoang, and Y . Khazaeni, “Bayesian nonparametric federated learning of neural networks,” in International Conference on Machine Learning , (CA, USA), pp. 7252–7261, PMLR, Jun. 2019

    2019

  71. [79]

    V-measure: A conditional entropy- based external cluster evaluation measure,

    A. Rosenberg and J. Hirschberg, “V-measure: A conditional entropy- based external cluster evaluation measure,” in Proceedings of the 2007 joint conference on empirical methods in natural language process- ing and computational natural language learning (EMNLP-CoNLL) , pp. 410–...

    2007

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.