Pith. sign in

REVIEW 1 major objections 1 minor 51 references

FedRE: Robust and Effective Federated Learning with Privacy Preference

T0 review · 1 major / 1 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A federated learning method claims to protect privacy-sensitive image regions with layer-wise noise, without losing model accuracy.

desk verdict Interesting layer-wise budget allocation idea, but the LDP proof doesn't hold and the aggregation weight contradicts the stated goal. read the letter →

arxiv 2505.04889 v1 pith:G5HARGIS submitted 2025-05-08 cs.LG cs.CR

Tianzhe Xiao , Yichen Li , Yu Zhou , Yining Qi , Yi Liu , Wei Wang , Haozhao Wang , Yi Wang
show 1 more author
Ruixuan Li
This is my paper · ORCID
classification cs.LGcs.CR
keywords FederatedLearningLocalDifferentialPrivacyPreferencePrivacy-SensitiveInformationLayer-wiseBudgetGradientInversionDefenseParameterAggregationTextTamperDetection
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that standard federated learning with local differential privacy wastes privacy budget on non-sensitive areas, which degrades the model. It introduces FedRE, which measures how strongly each network layer's gradients respond to the privacy-sensitive regions a client has marked, then distributes a fixed total privacy budget across layers so that sensitive layers receive more noise. A server-side aggregation mechanism weights client updates by their sensitivity scores on a public dataset, favoring less perturbed gradients. The claim is that this achieves strong protection of user-chosen regions and better global model accuracy than uniform LDP baselines under the same total privacy budget.

What carries the argument

The load-bearing objects are the PSI score and the derived layer-wise budget allocation. The PSI score $S_l$ is the average, over the annotated privacy-sensitive region, of the Frobenius-normalized Jacobian of the layer gradient with respect to the input; it measures how much each layer's gradient reveals about that region. The budget allocation sets $\epsilon_l$ in inverse proportion to $S_l$, so sensitive layers get smaller budgets and hence more noise. The Gaussian mechanism clips the layer gradient to norm $C_l$ and adds zero-mean noise with variance $C_l^2 \sigma_l^2$. The server-side PDA-PAM aggregation computes softmax weights from PSI scores of each client model on a public dataset and combines the updates. The paper's Corollary 1 asserts that composing these per-layer mechanisms yields $(\epsilon,\delta)$-LDP for the full gradient.

What would settle it

Check whether Algorithm 1 contains a per-sample clipping step: it clips the aggregated gradient, not each sample's gradient. Measure the L2 sensitivity of the released layer update by comparing the outputs for two adjacent datasets that differ in one sample; if the maximum difference exceeds $C_l$, the Gaussian noise calibrated with sensitivity $C_l$ cannot provide the claimed $(\epsilon_l,\delta_l)$-LDP for that layer. A concrete empirical test is a canary-insertion membership probe: add a unique sample to a client's batch and test whether the released gradient reveals its presence beyond the $e^\epsilon$ bound implied by the claimed budget.

Watch

Extended reading notes

Core claim

The paper's central claim is that privacy preference can be encoded as a per-layer sensitivity score, and that reallocating the privacy budget according to that score yields a strict $(\epsilon,\delta)$-LDP guarantee for the uploaded gradient while simultaneously improving defense against gradient inversion and preserving accuracy. The PSI score for a layer is defined as the average aligned Frobenius norm of the Jacobian of the layer gradient with respect to the input, computed over the client's annotated sensitive region. Layers with higher PSI scores receive smaller privacy budgets and therefore stronger Gaussian noise. The server then aggregates using softmax weights derived from PSI scores evaluated on a public dataset. Experiments on text tamper detection datasets T-SROIE and DocTamper report that FedRE outperforms LDP-Fed and BLUR+LUS on both utility and defense metrics.

Load-bearing premise

The privacy proof assumes that clipping the whole layer gradient bounds the sensitivity of the released output to any single sample, but the algorithm clips only after summing many samples, so the per-sample sensitivity can exceed the clipping bound and the stated guarantee does not follow.

Editorial extensions

If this is right

  • If FedRE's claim holds, a fixed total privacy budget can be reallocated across layers to give stronger protection to user-specified sensitive regions at no extra utility cost.
  • The layer-wise PSI score provides a gradient-level map of where private information resides, which could guide defenses beyond LDP, such as gradient compression or selective dropout.
  • The server-side aggregation implies that a public dataset can down-weight noisy updates, so the method's tolerance to LDP noise may improve as the number of clients grows.
  • The same sensitivity-based budget allocation could be applied to other architectures by computing Jacobians per layer, making the method architecture-agnostic rather than specific to text tamper detection.
  • The paper reports the largest accuracy gains under tight privacy budgets, suggesting the benefit grows with the noise level.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • One unstated risk is that the server's PSI-score weighting on a public dataset could leak information about where a client's sensitive regions lie; an adversary with access to the aggregation weights might infer the location of the PSI regions.
  • The sensitivity computation adds $O(F D)$ time and $O(D N)$ space per sample; the paper's suggestion to sample ten same-format images may be insufficient under high data heterogeneity, which is testable.
  • A natural extension would be to combine FedRE with per-sample clipping (as in DP-SGD) to actually certify the LDP guarantee; this would likely change the reported utility because per-sample clipping is more aggressive.
  • The PSI concept could transfer to non-image domains where 'regions' become tokens or features, but the Jacobian alignment step would need a new definition and validation.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

1 major / 1 minor

Summary. The paper proposes FedRE, a federated learning method that allocates layer-wise local differential privacy budgets according to a per-client privacy-sensitive information (PSI) score, and a server-side parameter aggregation mechanism (PDA-PAM) intended to favor less perturbed gradients. The method is evaluated on text tamper detection with the T-SROIE and DocTamper datasets, reporting competitive utility and improved defense against gradient inversion relative to LDP-Fed and BLUR+LUS. The central advertised contribution is that FedRE provides a provable (epsilon,delta)-LDP guarantee while achieving better or comparable model accuracy.

Significance. If the formal privacy claim were valid, the idea of allocating privacy budgets layer-wise according to client-defined sensitive regions would be useful and timely: it addresses a real limitation of uniform LDP mechanisms in federated learning and introduces a plausible way to match privacy protection to user preferences. The empirical study is also nontrivial: the authors annotate PSI regions on two real-world document datasets and compare against two LDP baselines, and the defense-evaluation protocol (recovered-image similarity in the PSI regions) is appropriate for the stated threat. However, the main theoretical result is not established as written, and the aggregation mechanism contains an internal inconsistency, so the paper's load-bearing claims do not currently hold.

major comments (1)
  1. [§3.3, Tables 1-2 and Fig. 5] The empirical evaluation does not isolate the contribution of the PSI-based budget allocation. There is no ablation that compares FedRE with a uniform layer-wise Gaussian mechanism using the same total privacy budget and the same clipping and aggregation scheme; without such a comparison, the reported gains in utility or defense could come from the clipping operation, the particular aggregation rule, or the noise scale, rather than from the PSI-aware allocation. In addition, the defense metrics (MSE, SSIM, PSNR, LPIPS) are evaluated on the PSI regions, which are exactly the regions where FedRE injects more noise; this makes the defense comparison favorable by construction. A matched-noise or matched-budget ablation, and ideally an evaluation on both PSI and non-PSI regions, is needed to support the claim that FedRE provides better protection at equal utility cost.
minor comments (1)
  1. [Fig. 6] The text says "IoU values surpass those of centralized training without applying differential privacy" when the privacy budget is large and there is a single client, but this is an unusual and potentially important observation; it should be explained more carefully, particularly whether the clipping regularizes the update or whether the comparison is confounded by the number of clients.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: FedRE's layer-wise budget allocation and aggregation are not fitted to the reported metrics, and no load-bearing step reduces to its own inputs.

full rationale

Walked the derivation chain. The PSI score S_l (Eq. 5) is computed from Jacobian sensitivities of the annotated privacy-sensitive region; the per-layer budget epsilon_l (Eq. 6) is an inverse-PSI reweighting of the client's total budget; the clipping and Gaussian noise steps (Eqs. 7-9) use the standard Gaussian mechanism; and the aggregation weight (Eq. 10) is a softmax over public-dataset PSI scores. None of these quantities is fitted to the reported IoU/F-score values in Table 1 or to the defense similarities in Table 2, so there is no fitted-input-called-prediction pattern. Corollary 1 invokes an external composition theorem [13], and the layer-wise LDP claim is asserted rather than proved; even if the sensitivity analysis is missing, that is a correctness or soundness defect, not a circular reduction. The citations to the authors' own prior work ([17], [31]) appear only in the related-work enumeration and are not load-bearing. The only conceivable 'by construction' element is that the defense evaluation measures distortion in the PSI regions that FedRE is explicitly designed to protect more strongly; that is metric alignment with the stated objective, not a derivation that turns a fitted parameter into a predicted result, and it does not meet the standard required by the circularity rubric. Therefore no circular step is identified.

Assumptions & free parameters 1 free parameters · 5 assumptions · 0 invented entities

The core derivation rests on a misapplied DP sensitivity bound, plus several unvalidated domain assumptions about the Jacobian score, public dataset representativeness, and manual PSI annotations. One free hyperparameter (C_l) is tuned per dataset. No new physical entities are introduced.

free parameters (1)
  • Clipping threshold C_l = 0.20 for T-SROIE, 0.15 for DocTamper (from Tables 3-4)
    Chosen per dataset from threshold sweeps; central to noise scale in Eq (8)-(9) and can be tuned to improve IoU.
assumptions (5)
  • domain assumption Gaussian mechanism with L2 sensitivity C_l provides (epsilon_l, delta_l)-LDP after clipping the full layer gradient (Eq 7-9).
    This is the load-bearing privacy premise; it is not satisfied by whole-gradient clipping, so the proof of Corollary 1 is invalid.
  • standard math Simple composition of per-layer mechanisms sums epsilon and delta (Corollary 1).
    Standard composition theorem from [13]; correct in itself but applied to mechanisms whose per-layer privacy is not established.
  • domain assumption The Jacobian of the gradient with respect to input, averaged over the PSI region (Eq 3-5), quantifies the risk of gradient inversion leakage.
    No theoretical or empirical justification is given for why this second-derivative score tracks attack success; it is a heuristic.
  • domain assumption The server's public dataset is representative of the clients' local data distribution.
    PSI scores used in aggregation (Eq 10) are computed on the public dataset; no argument is given for transferability to client data.
  • domain assumption Clients' manual PSI annotations correctly capture their privacy preferences.
    T-SROIE and DocTamper PSI regions were manually annotated; annotation protocol and inter-annotator reliability are not reported.

how reviews work

0 comments
Cite this review

Pith. "Pith review of FedRE: Robust and Effective Federated Learning with Privacy Preference." pith.science (2026). https://pith.science/paper/G5HARGIS

@misc{pith2026250504889,
  author       = {Pith},
  title        = {Pith review of: FedRE: Robust and Effective Federated Learning with Privacy Preference},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/G5HARGIS}},
  note         = {Machine review of arXiv:2505.04889}
}
read the original abstract

Despite Federated Learning (FL) employing gradient aggregation at the server for distributed training to prevent the privacy leakage of raw data, private information can still be divulged through the analysis of uploaded gradients from clients. Substantial efforts have been made to integrate local differential privacy (LDP) into the system to achieve a strict privacy guarantee. However, existing methods fail to take practical issues into account by merely perturbing each sample with the same mechanism while each client may have their own privacy preferences on privacy-sensitive information (PSI), which is not uniformly distributed across the raw data. In such a case, excessive privacy protection from private-insensitive information can additionally introduce unnecessary noise, which may degrade the model performance. In this work, we study the PSI within data and develop FedRE, that can simultaneously achieve robustness and effectiveness benefits with LDP protection. More specifically, we first define PSI with regard to the privacy preferences of each client. Then, we optimize the LDP by allocating less privacy budget to gradients with higher PSI in a layer-wise manner, thus providing a stricter privacy guarantee for PSI. Furthermore, to mitigate the performance degradation caused by LDP, we design a parameter aggregation mechanism based on the distribution of the perturbed information. We conducted experiments with text tamper detection on T-SROIE and DocTamper datasets, and FedRE achieves competitive performance compared to state-of-the-art methods.

Figures

Figures reproduced from arXiv: 2505.04889 by the authors.

Figure 1
Figure 1. This illustration depicts the varied privacy prefer [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Different derivatives of different layer networks [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. The overall architecture of FedRE. When clients want to train a model cooperatively, each of them first trains locally on [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Images recovered from gradient after gradient leak [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Comparison of the effects of no noise, adding noise [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: Iou gain of aggregation using PDA-PAM under the [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

51 extracted references · 40 canonical work pages

  1. [1]

    Rodolfo Stoffel Antunes, Cristiano André da Costa, Arne Küderle, Imrana Abdul- lahi Yari, and Björn Eskofier. 2022. Federated learning for healthcare: Systematic review and architecture proposal. ACM Transactions on Intelligent Systems and Technology (TIST) 13, 4 (2022), 1–23

    work page 2022

  2. [2]

    Pathum Chamikara Mahawaga Arachchige, Peter Bertok, Ibrahim Khalil, Dongxi Liu, Seyit Camtepe, and Mohammed Atiquzzaman. 2019. Local differential privacy for deep learning. IEEE Internet of Things Journal 7, 7 (2019), 5827–5842

    work page 2019

  3. [3]

    Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth. 2017. Prac- tical secure aggregation for privacy-preserving machine learning. In proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security . 1175–1191

    2017

  4. [4]

    David Byrd and Antigoni Polychroniadou. 2020. Differentially private secure multi-party computation for federated learning in financial applications. In Pro- ceedings of the First ACM International Conference on AI in Finance . 1–9

    work page 2020

  5. [5]

    Anda Cheng, Peisong Wang, Xi Sheryl Zhang, and Jian Cheng. 2022. Differentially private federated learning with local regularization and sparsification. In Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 10122–10131

    work page 2022

  6. [6]

    Graham Cormode, Somesh Jha, Tejas Kulkarni, Ninghui Li, Divesh Srivastava, and Tianhao Wang. 2018. Privacy at scale: Local differential privacy in practice. In Proceedings of the 2018 International Conference on Management of Data . 1655– 1658

    work page 2018

  7. [7]

    Tianchi Deng, Yingguang Li, Xu Liu, and Lihui Wang. 2023. Federated learning- based collaborative manufacturing for complex parts. Journal of Intelligent Manufacturing 34, 7 (2023), 3025–3038

    work page 2023

  8. [8]

    Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller

Show all 51 references
  1. [9]

    Zishan Gu, Ke Zhang, Guangji Bai, Liang Chen, Liang Zhao, and Carl Yang. 2023. Dynamic activation of clients and parameters for federated learning over hetero- geneous graphs. In 2023 IEEE 39th International Conference on Data Engineering (ICDE). IEEE, 1597–1610

    2023

  2. [10]

    Yangsibo Huang, Samyak Gupta, Zhao Song, Kai Li, and Sanjeev Arora. 2021. Eval- uating gradient inversion attacks and defenses in federated learning. Advances in Neural Information Processing Systems 34 (2021), 7232–7241

    2021

  3. [11]

    Jinwoo Jeon, Kangwook Lee, Sewoong Oh, Jungseul Ok, et al . 2021. Gradient inversion with generative image prior. Advances in neural information processing systems 34 (2021), 29898–29908

    2021

  4. [12]

    Peter Kairouz, H Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Ben- nis, Arjun Nitin Bhagoji, Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, et al. 2021. Advances and open problems in federated learning. Foundations and Trends® in Machine Learnin...

    2021

  5. [13]

    Peter Kairouz, Sewoong Oh, and Pramod Viswanath. 2015. The composition theorem for differential privacy. In International conference on machine learning . PMLR, 1376–1385

    2015

  6. [14]

    Latif U Khan, Madyan Alsenwi, Ibrar Yaqoob, Muhammad Imran, Zhu Han, and Choong Seon Hong. 2020. Resource optimized federated learning-enabled cognitive internet of things for smart industries. IEEE Access 8 (2020), 168854– 168864

    2020

  7. [15]

    Jingtao Li, Adnan Siraj Rakin, Xing Chen, Zhezhi He, Deliang Fan, and Chaitali Chakrabarti. 2022. Ressfl: A resistance transfer framework for defending model inversion attack in split federated learning. In Proceedings of the IEEE/CVF Con- ference on Computer Vision and Patter...

    2022

  8. [16]

    Tian Li, Anit Kumar Sahu, Ameet Talwalkar, and Virginia Smith. 2020. Federated learning: Challenges, methods, and future directions. IEEE signal processing magazine 37, 3 (2020), 50–60

    2020

  9. [17]

    Yichen Li, Qunwei Li, Haozhao Wang, Ruixuan Li, Wenliang Zhong, and Guannan Zhang. 2024. Towards Efficient Replay in Federated Incremental Learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 12820–12829

    2024

  10. [18]

    Zhaohua Li, Le Wang, Guangyao Chen, Muhammad Shafq, et al. 2023. A survey of image gradient inversion against federated learning.Authorea Preprints (2023)

    2023

  11. [19]

    Ji Liu, Jizhou Huang, Yang Zhou, Xuhong Li, Shilei Ji, Haoyi Xiong, and Dejing Dou. 2022. From distributed machine learning to federated learning: A survey. Knowledge and Information Systems 64, 4 (2022), 885–917

    2022

  12. [20]

    Ruixuan Liu, Yang Cao, Yanlin Wang, Lingjuan Lyu, Yun Chen, and Hong Chen

  13. [21]

    Guodong Long, Yue Tan, Jing Jiang, and Chengqi Zhang. 2020. Federated learning for open banking. In Federated Learning: Privacy and Incentive. Springer, 240–254

    2020

  14. [22]

    Yaxin Luopan, Rui Han, Qinglong Zhang, Chi Harold Liu, Guoren Wang, and Lydia Y Chen. 2023. Fedknow: Federated continual learning with signature task knowledge integration at edge. In2023 IEEE 39th International Conference on Data Engineering (ICDE). IEEE, 341–354

    2023

  15. [23]

    Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. 2017. Communication-efficient learning of deep net- works from decentralized data. In Artificial intelligence and statistics . PMLR, 1273–1282

    2017

  16. [24]

    Qiying Pan, Yifei Zhu, and Lingyang Chu. 2023. Lumos: Heterogeneity-aware fed- erated graph learning over decentralized devices. In 2023 IEEE 39th International Conference on Data Engineering (ICDE) . IEEE, 1914–1926

    2023

  17. [25]

    Zhen Qin, Shuiguang Deng, Mingyu Zhao, and Xueqiang Yan. 2023. FedAPEN: Personalized Cross-silo Federated Learning with Adaptability to Statistical Het- erogeneity. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining . 1954–1964

    2023

  18. [26]

    Zeyu Qin, Liuyi Yao, Daoyuan Chen, Yaliang Li, Bolin Ding, and Minhao Cheng

  19. [27]

    Md Mahmudur Rahman and Sanjay Purushotham. 2023. FedPseudo: Privacy- Preserving Pseudo Value-Based Deep Learning Models for Federated Survival Analysis. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining . 1999–2009

    2023

  20. [28]

    Nicola Rieke, Jonny Hancox, Wenqi Li, Fausto Milletari, Holger R Roth, Shadi Albarqouni, Spyridon Bakas, Mathieu N Galtier, Bennett A Landman, Klaus Maier- Hein, et al. 2020. The future of digital health with federated learning. NPJ digital medicine 3, 1 (2020), 119

    2020

  21. [29]

    arXiv preprint arXiv:2302.01677 (2023)

    Revisiting Personalized Federated Learning: Robustness Against Backdoor Attacks. arXiv preprint arXiv:2302.01677 (2023)

    2023 arXiv

  22. [30]

    Stacey Truex, Ling Liu, Ka-Ho Chow, Mehmet Emre Gursoy, and Wenqi Wei. 2020. LDP-Fed: Federated learning with local differential privacy. In Proceedings of the Third ACM International Workshop on Edge Systems, Analytics and Networking . 61–66

    2020

  23. [31]

    Haozhao Wang, Yichen Li, Wenchao Xu, Ruixuan Li, Yufeng Zhan, and Zhigang Zeng. 2023. DaFKD: Domain-aware Federated Knowledge Distillation. In Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 20412–20421

    2023

  24. [32]

    Qiheng Sun, Xiang Li, Jiayao Zhang, Li Xiong, Weiran Liu, Jinfei Liu, Zhan Qin, and Kui Ren. 2023. Shapleyfl: Robust federated learning based on shapley value. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. 2096–2108

    2023

  25. [33]

    Kang Wei, Jun Li, Ming Ding, Chuan Ma, Hang Su, Bo Zhang, and H Vincent Poor

  26. [34]

    Kang Wei, Jun Li, Ming Ding, Chuan Ma, Howard H Yang, Farhad Farokhi, Shi Jin, Tony QS Quek, and H Vincent Poor. 2020. Federated learning with differential privacy: Algorithms and performance analysis. IEEE Transactions on Information Forensics and Security 15 (2020), 3454–3469

    2020

  27. [35]

    Junxiao Wang, Song Guo, Xin Xie, and Heng Qi. 2022. Protect privacy from gradi- ent leakage attack in federated learning. In IEEE INFOCOM 2022-IEEE Conference on Computer Communications. IEEE, 580–589

    2022

  28. [36]

    Xidong Wu, Zhengmian Hu, Jian Pei, and Heng Huang. 2023. Serverless federated auprc optimization for multi-party collaborative imbalanced data mining. In Proceedings of the 29th ACM SIGKDD conference on knowledge discovery and data mining. 2648–2659

    2023

  29. [37]

    Gang Yan, Hao Wang, Xu Yuan, and Jian Li. 2023. CriticalFL: A Critical Learning Periods Augmented Client Selection Framework for Efficient Federated Learning. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. 2898–2907

    2023

  30. [39]

    Wenqi Wei, Ling Liu, Margaret Loper, Ka-Ho Chow, Mehmet Emre Gursoy, Stacey Truex, and Yanzhao Wu. 2020. A framework for evaluating gradient leakage attacks in federated learning. arXiv preprint arXiv:2004.10397 (2020)

    2020 arXiv

  31. [40]

    Xiyuan Yang, Wenke Huang, and Mang Ye. 2023. Dynamic Personalized Federated Learning with Adaptive Differential Privacy. In Thirty-seventh Conference on Neural Information Processing Systems

    2023

  32. [41]

    Jingwei Yi, Fangzhao Wu, Bin Zhu, Jing Yao, Zhulin Tao, Guangzhong Sun, and Xing Xie. 2023. UA-FedRec: untargeted attack on federated news recommendation. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. 5428–5438

    2023

  33. [42]

    Hongxu Yin, Arun Mallya, Arash Vahdat, Jose M Alvarez, Jan Kautz, and Pavlo Molchanov. 2021. See through gradients: Image batch recovery via gradinver- sion. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 16337–16346

    2021

  34. [43]

    Wensi Yang, Yuhang Zhang, Kejiang Ye, Li Li, and Cheng-Zhong Xu. 2019. Ffd: A federated learning based method for credit card fraud detection. In Big Data– BigData 2019: 8th International Congress, Held as Part of the Services Conference Federation, SCF 2019, San Diego, CA, US...

    2019

  35. [44]

    Jingwen Zhang, Jiale Zhang, Junjun Chen, and Shui Yu. 2020. Gan enhanced membership inference: A passive local attack in federated learning. In ICC 2020- 2020 IEEE International Conference on Communications (ICC) . IEEE, 1–6

    2020

  36. [45]

    Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. 2020. idlg: Improved deep leakage from gradients. arXiv preprint arXiv:2001.02610 (2020)

    2020 arXiv

  37. [46]

    Jingwen Zhao, Yunfang Chen, and Wei Zhang. 2019. Differential privacy preser- vation in deep learning: Challenges, opportunities and solutions. IEEE Access 7 (2019), 48901–48911

    2019

  38. [47]

    Chengliang Zhang, Suyi Li, Junzhe Xia, Wei Wang, Feng Yan, and Yang Liu. 2020. BatchCrypt: Efficient homomorphic encryption for Cross-Silo federated learning. ICMR ’25, June 30-July 3, 2025, Chicago, IL, USA Tianzhe Xiao et al. In 2020 USENIX annual technical conference (USENI...

    2020

  39. [48]

    Ligeng Zhu, Zhijian Liu, and Song Han. 2019. Deep leakage from gradients. Advances in neural information processing systems 32 (2019)

    2019

  40. [51]

    Wenbo Zheng, Lan Yan, Chao Gou, and Fei-Yue Wang. 2021. Federated meta- learning for fraudulent credit card detection. In Proceedings of the Twenty-Ninth International Conference on International Joint Conferences on Artificial Intelligence. 4654–4660

    2021

  41. [2020]

    Inverting gradients-how easy is it to break privacy in federated learning? Advances in Neural Information Processing Systems 33 (2020), 16937–16947

    2020

  42. [2021]

    IEEE Transactions on Mobile Computing 21, 9 (2021), 3388–3401

    User-level privacy-preserving federated learning: Analysis and performance optimization. IEEE Transactions on Mobile Computing 21, 9 (2021), 3388–3401

    2021

  43. [2023]

    In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining

    PrivateRec: Differentially Private Model Training and Online Serving for Federated News Recommendation. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining . 4539–4548

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.