Pith. sign in

REVIEW 59 references

FedGraM: Defending Against Untargeted Attacks in Federated Learning via Embedding Gram Matrix

T0 review · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A server that keeps one example per class can detect and drop malicious federated-learning clients by measuring how separated their learned embeddings are, via the norm of a Gram matrix.

arxiv 2505.14024 v1 pith:CKARV2I7 submitted 2025-05-20 cs.LG cs.AIcs.CRcs.DC

Di Wu , Qian Li , Heng Yang , Yong Han This is my paper
classification cs.LGcs.AIcs.CRcs.DC
keywords attacksdatafedgrammodelslocalmodeluntargeteddataset
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Federated learning lets many devices train one shared model while keeping their data local. A few malicious devices can try to break the shared model by sending damaged models to the server. FedGraM is a server-side filter. The server keeps a tiny dataset with one example per class. For each incoming model, it runs these examples through the model and reads the internal embeddings. It normalizes the embeddings, computes the Gram matrix, which contains the pairwise cosine similarities between classes, and takes the norm of that matrix as a quality score. A high score means the embeddings of different classes look similar to each other, so the model's representations separate classes poorly. FedGraM removes the models with the highest scores, then averages the rest to form the next global model.

The paper evaluates FedGraM on CIFAR-10, SVHN, and CIFAR-100, in both cross-device and cross-silo settings, under seven untargeted attacks, and against thirteen baseline defenses. In most tables FedGraM keeps accuracy close to the best result, and it often beats the baselines when data are heterogeneous. It is not always the winner; for example, with 15% malicious clients under the Fang attack on SVHN it trails Trimean. The authors also design an adaptive attack that makes malicious embeddings uniform and random, which evades the Gram-norm detector, but combining FedGraM with Trimean restores robustness.

The main weakness is that the link between the Gram norm and generalization is asserted from one illustrative experiment rather than derived or rigorously validated. No code, data, seeds, or error bars are provided, and the removal threshold of 30% is chosen after inspecting the norm distribution under one attack.

Extended reading notes

Core claim

The paper's load-bearing assertion is stated in Section 4.2: 'the norm of the Gram Matrix captures the inter-class separation ability of the representation layers, reflecting the generalization property of the model.' From this, FedGraM removes the local models with the largest norms because they are 'potential to be the malicious models,' and the paper claims this 'outperforms state-of-the-art defense methods' against untargeted attacks. If correct, a server with one labeled example per class can detect and drop poisoned local models before aggregation.

Load-bearing premise

The paper assumes the Euclidean norm of the normalized embedding Gram matrix is a monotone proxy for generalization, so malicious models have the largest norms among all uploaded models. This is stated in Section 4.2 (Eqs. 7 and 8), illustrated by one demo in Figure 1, and contradicted by the adaptive attack in Section 6, where malicious models trained to produce uniform embeddings have low norms and evade FedGraM detection. If this premise fails for any common attack family, FedGraM removes benign models instead of malicious ones, and the central claim collapses.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The central claim rests on an unproved statistical link between Gram-matrix norm and model generalization, an assumption about the behavior of malicious models under untargeted attacks, and an auxiliary-dataset assumption. The only explicit free parameter is the removal fraction C=30%, selected using the observed norm distribution under LIE attack. No new physical or mathematical entities are introduced.

free parameters (2)
  • C (fraction of models removed per round) = 30%
    Selected in Section 5.3 from the observed rank distribution of Gram norms under LIE attack on CIFAR-10 with beta=0.2; also tested at 20% and 40%, with 30% reported as the safest.
  • Auxiliary dataset construction = one random sample per class
    The default auxiliary dataset is randomly sampled from the union of client data and excluded from training; the paper varies class coverage in Section 5.3, treating the full-labels version as default.
assumptions (4)
  • domain assumption The Euclidean norm of the Gram matrix of normalized class embeddings is a monotone indicator of a model's inter-class separation and generalization.
    Introduced in Section 4.2 (Eqs. 7-8) as the foundation of the defense; no proof or quantitative validation beyond one demo figure.
  • domain assumption Malicious models under untargeted attacks have worse embedding separation than benign models and therefore rank among the highest Gram norms.
    Stated in Sections 4.2 and 5.3 (Figure 4); contradicted by the adaptive uniform-embedding attack in Section 6, which yields low norms.
  • domain assumption The server has a clean auxiliary dataset with at least one sample per class from the same distribution as the client data.
    Assumed in Section 4.3; without such data FedGraM cannot compute embeddings, and partial class coverage degrades MinSum defense (Figure 5).
  • ad hoc to paper Removing the top 30% of models by norm removes essentially all malicious models while keeping enough benign models for good accuracy.
    This is the C=30% choice in Section 5.3, supported by the observation that malicious norms rank below 30%; the value is data-dependent.

how reviews work

0 comments
Cite this review

Pith. "Pith review of FedGraM: Defending Against Untargeted Attacks in Federated Learning via Embedding Gram Matrix." pith.science (2026). https://pith.science/paper/CKARV2I7

@misc{pith2026250514024,
  author       = {Pith},
  title        = {Pith review of: FedGraM: Defending Against Untargeted Attacks in Federated Learning via Embedding Gram Matrix},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/CKARV2I7}},
  note         = {Machine review of arXiv:2505.14024}
}
read the original abstract

Federated Learning (FL) enables geographically distributed clients to collaboratively train machine learning models by sharing only their local models, ensuring data privacy. However, FL is vulnerable to untargeted attacks that aim to degrade the global model's performance on the underlying data distribution. Existing defense mechanisms attempt to improve FL's resilience against such attacks, but their effectiveness is limited in practical FL environments due to data heterogeneity. On the contrary, we aim to detect and remove the attacks to mitigate their impact. Generalization contribution plays a crucial role in distinguishing untargeted attacks. Our observations indicate that, with limited data, the divergence between embeddings representing different classes provides a better measure of generalization than direct accuracy. In light of this, we propose a novel robust aggregation method, FedGraM, designed to defend against untargeted attacks in FL. The server maintains an auxiliary dataset containing one sample per class to support aggregation. This dataset is fed to the local models to extract embeddings. Then, the server calculates the norm of the Gram Matrix of the embeddings for each local model. The norm serves as an indicator of each model's inter-class separation capability in the embedding space. FedGraM identifies and removes potentially malicious models by filtering out those with the largest norms, then averages the remaining local models to form the global model. We conduct extensive experiments to evaluate the performance of FedGraM. Our empirical results show that with limited data samples used to construct the auxiliary dataset, FedGraM achieves exceptional performance, outperforming state-of-the-art defense methods.

Figures

Figures reproduced from arXiv: 2505.14024 by the authors.

Figure 1
Figure 1. The norm distribution and the accuracy distribution across clients at the beginning stage of [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. The overview of FedGraM. For each uploaded local model, the server feeds the auxiliary [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. The experiment results of the comparison between FedGraM and SOTA defenses. We draw [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: From lest to right, we show the experiment results of Gram matrix norm distribution, [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: The experiment results of the impact of the quality of the auxiliary dataset on the perfor [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: Experiment results of Fidelity of FedGraM. We show the accuracy curves of FedGraM and [PITH_FULL_IMAGE:figures/full_fig_p019_6.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

59 extracted references · 40 canonical work pages

  1. [1]

    Baffle: Backdoor detection via feedback-based federated learning

    Sebastien Andreina, Giorgia Azzurra Marson, Helen Möllering, and Ghassan Karame. Baffle: Backdoor detection via feedback-based federated learning. In 2021 IEEE 41st International Conference on Distributed Computing Systems (ICDCS), pages 852–863. IEEE, 2021

    work page 2021

  2. [2]

    How to backdoor federated learning

    Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. How to backdoor federated learning. CoRR, abs/1807.00459, 2018

    arXiv 2018

  3. [3]

    A little is enough: Circumventing defenses for distributed learning

    Gilad Baruch, Moran Baruch, and Yoav Goldberg. A little is enough: Circumventing defenses for distributed learning. Advances in Neural Information Processing Systems, 32, 2019

    work page 2019

  4. [4]

    Analyzing feder- ated learning through an adversarial lens

    Arjun Nitin Bhagoji, Supriyo Chakraborty, Prateek Mittal, and Seraphin Calo. Analyzing feder- ated learning through an adversarial lens. In International Conference on Machine Learning, pages 634–643. PMLR, 2019

    work page 2019

  5. [5]

    Machine learn- ing with adversaries: Byzantine tolerant gradient descent

    Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer. Machine learn- ing with adversaries: Byzantine tolerant gradient descent. Advances in neural information processing systems, 30, 2017

    work page 2017

  6. [6]

    Understanding distributed poisoning attack in federated learning

    Di Cao, Shan Chang, Zhijian Lin, Guohua Liu, and Donghong Sun. Understanding distributed poisoning attack in federated learning. In 2019 IEEE 25th international conference on parallel and distributed systems (ICPADS), pages 233–239. IEEE, 2019

    work page 2019

  7. [7]

    Fltrust: Byzantine-robust federated learning via trust bootstrapping

    Xiaoyu Cao, Minghong Fang, Jia Liu, and Neil Zhenqiang Gong. Fltrust: Byzantine-robust federated learning via trust bootstrapping. arXiv preprint arXiv:2012.13995, 2020

    arXiv 2012

  8. [9]

    Mpaf: Model poisoning attacks to federated learning based on fake clients

    Xiaoyu Cao and Neil Zhenqiang Gong. Mpaf: Model poisoning attacks to federated learning based on fake clients. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 3396–3404, 2022

    work page 2022

Show all 59 references
  1. [10]

    Towards multi-party targeted model poisoning attacks against federated learning systems

    Zheyi Chen, Pu Tian, Weixian Liao, and Wei Yu. Towards multi-party targeted model poisoning attacks against federated learning systems. High-Confidence Computing, 1(1):100002, 2021

    2021

  2. [11]

    Local model poisoning attacks to {Byzantine-Robust} federated learning

    Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Gong. Local model poisoning attacks to {Byzantine-Robust} federated learning. In 29th USENIX security symposium (USENIX Security 20), pages 1605–1622, 2020

    2020

  3. [12]

    Do we really need to design new byzantine-robust aggregation rules? arXiv preprint arXiv:2501.17381, 2025

    Minghong Fang, Seyedsina Nabavirazavi, Zhuqing Liu, Wei Sun, Sundararaja Sitharama Iyengar, and Haibo Yang. Do we really need to design new byzantine-robust aggregation rules? arXiv preprint arXiv:2501.17381, 2025

    2025 arXiv

  4. [13]

    Badnets: Evaluating backdooring attacks on deep neural networks

    Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access, 7:47230–47244, 2019. 10

    2019

  5. [14]

    The hidden vulnerability of distributed learning in byzantium

    Rachid Guerraoui, Sébastien Rouault, et al. The hidden vulnerability of distributed learning in byzantium. In International conference on machine learning, pages 3521–3530. PMLR, 2018

    2018

  6. [15]

    Flmjr: Improving robustness of federated learning via model stability

    Qi Guo, Di Wu, Yong Qi, Saiyu Qi, and Qian Li. Flmjr: Improving robustness of federated learning via model stability. In European Symposium on Research in Computer Security, pages 405–424. Springer, 2022

    2022

  7. [16]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016

    2016

  8. [17]

    Byzantine-robust learning on heteroge- neous datasets via bucketing

    Sai Praneeth Karimireddy, Lie He, and Martin Jaggi. Byzantine-robust learning on heteroge- neous datasets via bucketing. arXiv preprint arXiv:2006.09365, 2020

    2006 arXiv

  9. [18]

    Scaffold: Stochastic controlled averaging for federated learning

    Sai Praneeth Karimireddy, Satyen Kale, Mehryar Mohri, Sashank Reddi, Sebastian Stich, and Ananda Theertha Suresh. Scaffold: Stochastic controlled averaging for federated learning. In International conference on machine learning, pages 5132–5143. PMLR, 2020

    2020

  10. [19]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009

    2009

  11. [20]

    A review of applications in federated learning

    Li Li, Yuxi Fan, Mike Tse, and Kuo-Yi Lin. A review of applications in federated learning. Computers & Industrial Engineering, 149:106854, 2020

    2020

  12. [21]

    Federated optimization in heterogeneous networks

    Tian Li, Anit Kumar Sahu, Manzil Zaheer, Maziar Sanjabi, Ameet Talwalkar, and Virginia Smith. Federated optimization in heterogeneous networks. Proceedings of Machine learning and systems, 2:429–450, 2020

    2020

  13. [22]

    On the convergence of fedavg on non-iid data, 2020

    Xiang Li, Kaixuan Huang, Wenhao Yang, Shusen Wang, and Zhihua Zhang. On the convergence of fedavg on non-iid data, 2020

    2020

  14. [23]

    Communication-efficient learning of deep networks from decentralized data

    Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication-efficient learning of deep networks from decentralized data. In Artificial intelligence and statistics, pages 1273–1282. PMLR, 2017

    2017

  15. [24]

    Local and central differential privacy for robustness and privacy in federated learning

    Mohammad Naseri, Jamie Hayes, and Emiliano De Cristofaro. Local and central differential privacy for robustness and privacy in federated learning. arXiv preprint arXiv:2009.03561, 2020

    2009 arXiv

  16. [25]

    Reading digits in natural images with unsupervised feature learning

    Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Baolin Wu, Andrew Y Ng, et al. Reading digits in natural images with unsupervised feature learning. In NIPS workshop on deep learning and unsupervised feature learning, volume 2011, page 7. Granada, Spain, 2011

    2011

  17. [26]

    {FLAME}: Taming backdoors in federated learning

    Thien Duc Nguyen, Phillip Rieger, Roberta De Viti, Huili Chen, Björn B Brandenburg, Hossein Yalame, Helen Möllering, Hossein Fereidooni, Samuel Marchal, Markus Miettinen, et al. {FLAME}: Taming backdoors in federated learning. In 31st USENIX Security Symposium (USENIX Security...

    2022

  18. [27]

    Defending against backdoors in federated learning with robust learning rate

    Mustafa Safa Ozdayi, Murat Kantarcioglu, and Yulia R Gel. Defending against backdoors in federated learning with robust learning rate. In Proceedings of the AAAI conference on artificial intelligence, volume 35, pages 9268–9276, 2021

    2021

  19. [28]

    Robust aggregation for federated learning

    Krishna Pillutla, Sham M Kakade, and Zaid Harchaoui. Robust aggregation for federated learning. IEEE Transactions on Signal Processing, 70:1142–1154, 2022

    2022

  20. [29]

    Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning

    Virat Shejwalkar and Amir Houmansadr. Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning. In NDSS, 2021

    2021

  21. [30]

    Back to the drawing board: A critical evaluation of poisoning attacks on production federated learning

    Virat Shejwalkar, Amir Houmansadr, Peter Kairouz, and Daniel Ramage. Back to the drawing board: A critical evaluation of poisoning attacks on production federated learning. In 2022 IEEE Symposium on Security and Privacy (SP), pages 1354–1371. IEEE, 2022

    2022

  22. [31]

    Can you really backdoor federated learning? arXiv preprint arXiv:1911.07963, 2019

    Ziteng Sun, Peter Kairouz, Ananda Theertha Suresh, and H Brendan McMahan. Can you really backdoor federated learning? arXiv preprint arXiv:1911.07963, 2019. 11

    1911 arXiv

  23. [32]

    Understanding contrastive representation learning through alignment and uniformity on the hypersphere

    Tongzhou Wang and Phillip Isola. Understanding contrastive representation learning through alignment and uniformity on the hypersphere. arXiv preprint arXiv:2005.10242, 2020

    2005 arXiv

  24. [33]

    Crfl: Certifiably robust federated learning against backdoor attacks

    Chulin Xie, Minghao Chen, Pin-Yu Chen, and Bo Li. Crfl: Certifiably robust federated learning against backdoor attacks. In International Conference on Machine Learning, pages 11372–11382. PMLR, 2021

    2021

  25. [34]

    Dba: Distributed backdoor attacks against federated learning

    Chulin Xie, Keli Huang, Pin-Yu Chen, and Bo Li. Dba: Distributed backdoor attacks against federated learning. In International conference on learning representations, 2019

    2019

  26. [35]

    Model poisoning attacks to federated learning via multi-round consistency

    Yueqi Xie, Minghong Fang, and Neil Zhenqiang Gong. Model poisoning attacks to federated learning via multi-round consistency. arXiv preprint arXiv:2404.15611, 2024

    2024 arXiv

  27. [36]

    Fedrola: Robust federated learning against model poisoning via layer-based aggregation

    Gang Yan, Hao Wang, Xu Yuan, and Jian Li. Fedrola: Robust federated learning against model poisoning via layer-based aggregation. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 3667–3678, 2024

    2024

  28. [37]

    Byzantine-robust distributed learning: Towards optimal statistical rates

    Dong Yin, Yudong Chen, Ramchandran Kannan, and Peter Bartlett. Byzantine-robust distributed learning: Towards optimal statistical rates. In International Conference on Machine Learning, pages 5650–5659. PMLR, 2018

    2018

  29. [38]

    Fedredefense: Defending against model poisoning attacks for federated learning using model update reconstruction error

    XIE Yueqi, Minghong Fang, and Neil Zhenqiang Gong. Fedredefense: Defending against model poisoning attacks for federated learning using model update reconstruction error. In Forty-first International Conference on Machine Learning

  30. [39]

    Fldetector: Defending federated learning against model poisoning attacks via detecting malicious clients

    Zaixi Zhang, Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. Fldetector: Defending federated learning against model poisoning attacks via detecting malicious clients. In Proceed- ings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 2545–2555, 2022

    2022

  31. [40]

    baseline model

    Haomin Zhuang, Mingxian Yu, Hao Wang, Yang Hua, Jian Li, and Xu Yuan. Backdoor federated learning by poisoning backdoor-critical layers. arXiv preprint arXiv:2308.04466, 2023. 12 A Additional Experiment Setting A.1 Evaluated Attacks A.1.1 LIE LIE[3] is a common untargeted atta...

    2023 arXiv

  32. [41]

    FedGraM has shown similar performances with C = 20% and C = 30%

    Accordingly, while C = 40%, an excessive number of local models were removed which led to performance degradation in all datasets. FedGraM has shown similar performances with C = 20% and C = 30%. However, under certain situations, C = 20% is insufficient to defend against atta...

  33. [42]

    Under all kinds of untargeted attacks, it can successfully defend the attacks and maintain the test accuracy of the global model at a high level

    FedGraM has a good performance in the comparison. Under all kinds of untargeted attacks, it can successfully defend the attacks and maintain the test accuracy of the global model at a high level. 19 Table 3: The entire experiment results of the impact of C. Dataset CIFAR10 SVH...

  34. [43]

    SVHN is an easier classification task compared with CIFAR10 which further facilitate the robustness of FedGraM

    Accordingly, FedGraM’s performance in SVHN is better than its performance in CIFAR10 as it achieve the best accuracy in more situations. SVHN is an easier classification task compared with CIFAR10 which further facilitate the robustness of FedGraM. B.3.3 Cross-device CIFAR100 ...

  35. [44]

    [Yes] " is generally preferable to

    CIFAR100 classification is the most difficult task among all the evaluated three tasks. As shown in our results, many defense methods fall short in defending in CIFAR100. However, our method FedGraM is still effectiveness. Only few methods can be effective as FedGraM in defend...

  36. [45]

    Guidelines: • The answer NA means that the abstract and introduction do not include the claims made in the paper

    Claims Question: Do the main claims made in the abstract and introduction accurately reflect the paper’s contributions and scope? Answer: [Yes] Justification: We have reflected the main claims in our methodology and empirical evalua- tions. Guidelines: • The answer NA means th...

  37. [46]

    Limitations

    Limitations Question: Does the paper discuss the limitations of the work performed by the authors? Answer: [Yes] 27 Justification: We have discussed the limitation of the paper in Section 6. Guidelines: • The answer NA means that the paper has no limitation while the answer No...

  38. [47]

    Guidelines: • The answer NA means that the paper does not include theoretical results

    Theory assumptions and proofs Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof? Answer: [NA] Justification: The paper does not include theoretical results. Guidelines: • The answer NA means that the pa...

  39. [48]

    Guidelines: • The answer NA means that the paper does not include experiments

    Experimental result reproducibility Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and da...

  40. [49]

    Guidelines: • The answer NA means that paper does not include experiments requiring code

    Open access to data and code Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material? Answer: [No] Justification: The paper does not provide d...

  41. [50]

    Guidelines: • The answer NA means that the paper does not include experiments

    Experimental setting/details Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results? Answer: [Yes] Justification: The paper has provided the de...

  42. [51]

    Guidelines: • The answer NA means that the paper does not include experiments

    Experiment statistical significance Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments? Answer: [No] Justification: The paper does not provide error bars. Guidelines: ...

  43. [52]

    Guidelines: • The answer NA means that the paper does not include experiments

    Experiments compute resources Question: For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments? Answer: [Yes] Justification: The paper has provided ...

  44. [53]

    Guidelines: • The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics

    Code of ethics Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines? Answer: [Yes] Justification: The research conducted in the paper conforms with the NeurIPS Code of Ethics. G...

  45. [54]

    Guidelines: • The answer NA means that there is no societal impact of the work performed

    Broader impacts Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed? Answer: [Yes] Justification: paper discuss potential positive societal impacts of the work performed. Guidelines: • The answer NA mean...

  46. [55]

    Safeguards Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)? Answer: [NA] Justification: The paper poses...

  47. [56]

    Guidelines: • The answer NA means that the paper does not use existing assets

    Licenses for existing assets Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected? Answer: [Yes] Justification: Assets are the l...

  48. [57]

    Guidelines: • The answer NA means that the paper does not release new assets

    New assets Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets? Answer: [NA] Justification: The paper does not release new assets. Guidelines: • The answer NA means that the paper does not release new assets. ...

  49. [58]

    Guidelines: • The answer NA means that the paper does not involve crowdsourcing nor research with human subjects

    Crowdsourcing and research with human subjects Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)? A...

  50. [59]

    Guidelines: • The answer NA means that the paper does not involve crowdsourcing nor research with human subjects

    Institutional review board (IRB) approvals or equivalent for research with human subjects Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals...

  51. [60]

    Answer: [NA] Justification: The core method development in this research does not involve LLMs as any important, original, or non-standard components

    Declaration of LLM usage Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the ...

    2025

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.