Pith. sign in

REVIEW 4 major objections 5 minor 66 references

DRAUN: An Algorithm-Agnostic Data Reconstruction Attack on Federated Unlearning Systems

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A malicious server can reconstruct the images a federated-learning client asks to erase, from the model update alone, without knowing the unlearning algorithm.

desk verdict A real first attack on federated unlearning with strong empirical results on coupled losses, but the algorithm-agnostic claim is under-tested and the formal support relies on an unproven convergence assumption. read the letter →

arxiv 2506.01777 v1 pith:FUBKA3UA submitted 2025-06-02 cs.LG

Hithem Lamri , Manaar Alam , Haiyan Jiang , Michail Maniatakos This is my paper
classification cs.LG
keywords federatedunlearningdatareconstructionattackgradientinversionprivacyleakageoptimization-basedhonest-but-curiousservermachine
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper sets out to show that the right to be forgotten in federated learning is, as currently implemented, invertible: a server that sees only the model update produced by a client's unlearning step can reconstruct the very images the client asked to erase. DRAUN does this without knowing which optimization-based unlearning algorithm the client used, by simulating two extreme forms of unlearning updates and matching the observed update. The paper also proves why previous reconstruction attacks, built for centralized unlearning, systematically miss when the unlearning loss depends on both forgotten and retained data. Across four datasets, four model architectures, and five unlearning methods, the reconstructions are claimed to be recognizable, so if the claim holds, unlearning as deployed today does not protect the data it is supposed to delete.

What carries the argument

The load-bearing object is the surrogate unlearning procedure $A_{\text{approx}}$, which replaces the unknown client algorithm with two candidate updates: one that ascends the gradient on the forget set ($\alpha=0$) and one that follows the gradient difference between retained and forgotten data ($\alpha=1$), each with a proximity term $\delta\|\theta_c-\theta_s\|_2$ to the global model. For both candidates the server simulates local update steps, computes dummy gradients $\tilde{\nabla}^{(0)}$ and $\tilde{\nabla}^{(1)}$, and optimizes dummy forget and retain inputs by minimizing the lower of the two cosine-similarity losses against the observed model delta, with total-variation smoothing. The theoretical engine is the local-minimizer argument: introducing the dummy retain input changes the objective so that the ground-truth pair is a stationary point, which is why the retain proxy is not an optional detail.

What would settle it

Run DRAUN against the same unlearning algorithm but with the client's true unlearning rate and regularization deliberately different from the server's fixed guesses (for example, $\eta_{\text{unl}}=0.01$ instead of $0.1$, and $\delta=1$ instead of $10$) on CIFAR-10, and measure reconstruction SSIM; if SSIM drops to near-random, the algorithm-agnostic claim fails.

Watch

Extended reading notes

Core claim

On its own terms, the paper's discovery is that the gradient of an optimization-based federated unlearning update is a recoverable fingerprint of the erased samples, even though the server never sees the client's loss, algorithm, or data. The theoretical result is that classical gradient inversion fails whenever the unlearning loss has the form $L(\theta,x_r,y_r)-L(\theta,x_u,y_u)$: at the true forget input $x_u$, the matching objective has nonzero gradient, so $x_u$ is not even a local minimum. DRAUN restores correctness by adding a dummy retain input $\tilde{x}_r$ to the surrogate, making the true pair $(x_u,x_r)$ a local minimizer of the similarity loss. Empirically, the paper reports strong reconstruction quality on the harder coupled-update algorithms, and shows that knowing the client's exact algorithm improves quality further.

Load-bearing premise

DRAUN's algorithm-agnostic claim rests on the server's guesses of the client's unlearning rate, number of local steps, and regularization strength being close to the client's actual values; every experiment fixes $\eta_{\text{unl}}=0.1$ and $\delta=10$, so if a real client deviates from those guesses, the surrogate update misrepresents the true update and the reconstruction justification collapses.

Editorial extensions

If this is right

  • An honest-but-curious server can silently recover data a client explicitly erased, so unlearning updates should be treated as sensitive as training gradients.
  • Optimization-based unlearning methods that couple the forget and retain sets leak most; methods whose update depends only on the forget set look less exposed.
  • Second-order, Newton-style unlearning updates are also recoverable, so choosing a fancier optimizer does not close the leak.
  • Privacy defenses that add noise or prune gradients reduce reconstruction quality only at a measurable cost to model utility.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper: the attack's dependence on matching the server's guessed $\eta_{\text{unl}}$ and $\delta$ suggests a cheap untested defense—clients randomizing their unlearning hyperparameters per request—could break the surrogate without harming model utility.
  • Beyond the paper: because the retain proxy is what makes the objective unbiased, unlearning methods that decouple the forget update from retained data may be inherently more resistant to this family of attacks.
  • Beyond the paper: DRAUN relies on knowing the labels and the size of the forget set; quantifying how reconstruction quality degrades when those are uncertain is a natural next experiment.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper introduces DRAUN, a gradient-inversion-based attack that aims to reconstruct data a client requests to unlearn in federated unlearning (FU) systems. The attack observes the model delta (θs − θc) after an optimization-based unlearning step, simulates the client's local update with two surrogate forms (gradient ascent on the unlearn set, and gradient difference between retain and unlearn sets), and optimizes dummy unlearn and retain inputs against the observed delta using a cosine-similarity loss with total variation regularization. The authors provide theoretical arguments for why classical gradient inversion attacks fail when the unlearning loss couples retain and unlearn data, and they report experiments across four datasets, four architectures, and five unlearning methods, including a comparison with the Hu et al. baseline and a defense analysis.

Significance. If the central claim holds, the paper is a meaningful contribution: it identifies a privacy risk specific to federated unlearning, and the reported empirical gap on coupled methods (e.g., SSIM 0.6407 versus 0.0038 for ABL on CIFAR10) is striking. The experimental matrix is broad for a first study, and the comparison against an MLaaS-oriented baseline is a useful reference point. The main significance is conditional, however: the headline 'algorithm-agnostic without any knowledge of the client's unlearning algorithm' property is currently supported only by a single fixed configuration of server-chosen hyperparameters, and the formal correctness argument assumes the surrogate loss matches the client loss at the ground-truth inputs. If the required robustness experiments and a corrected theoretical statement are added, the paper would be a solid contribution to the privacy and federated unlearning literature.

major comments (4)
  1. [§2.1, §4.1, Algorithm 1 and 2] The central claim that DRAUN requires 'no knowledge of the client's unlearning algorithm' is not supported by the experimental design. Algorithm 1 takes E, m, ηunl, δ, β, yu, and yr as inputs, and Algorithm 2 approximates the client update with two surrogate forms using a single ηunl and δ; §4.1 fixes ηunl=0.1 and δ=10.0 and never varies these values against the client's true unlearning hyperparameters. Since Lsim is cosine similarity, a pure scale mismatch in ηunl is benign, but errors in δ, E, m, or the retain labels change the direction of the surrogate gradient and can make the surrogate misrepresent the observed θs−θc. The 'algorithm-agnostic' property therefore remains an unvalidated assumption; the authors should add a sensitivity study that sweeps each server-chosen hyperparameter against the client-side ground truth and report the resulting reconstruction quality.
  2. [Appendix C.4, Theorem 6] The formal correctness argument is partly circular. Theorem 6 verifies that (xu, xr) is a local minimizer of Lsim when the surrogate loss equals the client loss at that exact pair, and Appendix C.4's error bound relies on Assumption 11, which simply assumes the optimized dummy retain converges to the true retain with ε(T)=O(1/√T). In the actual Algorithm 1, xr is a random dummy and no mechanism or proof is given for its convergence to the true retain; the min(ℓ0,ℓ1) selection further means the optimization is not even running a fixed surrogate. The theory therefore does not establish correctness of the algorithm as executed; either a convergence argument under the actual objective should be supplied, or the theoretical claims should be weakened to a heuristic explanation.
  3. [Table 2, §4.2] All quantitative comparisons are reported as means over 10 selected images, with no standard deviations, no multiple seeds, and no sensitivity to which images are selected. For example, the CIFAR10/ABL row reports SSIM 0.6407 for DRAUN versus 0.0038 for Hu et al.; the gap is large, but without variance or per-image distributions the stability of the claim is unassessable, and the qualitative figures show only a single 'randomly selected' example. The authors should report mean±std over seeds and per-image results (e.g., box plots) for the main tables, and state the image selection procedure.
  4. [§3, Appendix C] The theoretical section contains internal inconsistencies and at least one invalid step. Theorem 1 cites Assumptions 5-7 before those assumptions are introduced, and Section 3 refers to 'Theorem 3' when only Theorems 1 and 2 have been stated. More substantively, the proof of Theorem 3 bounds the Taylor remainder by the inequality (µx/2)∥∆x∥² ≤ µx∥J(xu)∥F∥∆x∥ + 2µθ∥∇θLu∥2, which does not hold for small ∥∆x∥, and the subsequent 'projecting onto J(xu)⊤' step is not a derivation of the displayed lower bound. Since the qualitative claim that classical GIA fails on coupled unlearning losses is plausible and separately supported by experiments, these proofs should be corrected or replaced by a rigorous statement; as written they do not support the stated quantitative bounds.
minor comments (5)
  1. [Table 1, Algorithm 2] The surrogate in Algorithm 2 line 5 adds δ·∇θ∥θ−θs∥², whereas Table 1 lists the Halimi et al. update as θu ← θs + η∇L(xu,yu) + δ∥θs−θu∥; the mismatch between the table and the surrogate should be explained, especially because the regularization form affects the direction of the simulated update.
  2. [Figure 8] Figure 8's caption contains the word 'Placeholder', suggesting the ResNet18 experiment is incomplete; this must be fixed before the architecture-generality claim is made.
  3. [Algorithm 1, §2.3] The paper should state explicitly whether labels are optimized or fixed during reconstruction; Algorithm 1 inputs yu and yr and Algorithm 3 initializes only inputs, not labels, and if labels are fixed the sensitivity to incorrect label guesses should be discussed.
  4. [Appendix D.2] There is a typo ('In adition') and the assumption numbering is inconsistent across Section 3 (Assumptions 1-4) and Appendix C (Assumptions 5-14); these should be harmonized.
  5. [Reproducibility] The paper states that code will be open-sourced but provides no URL; for reproducibility, an anonymous repository link should be included.

Circularity Check

2 steps flagged · score 4.0 of 10

The empirical attack is independently grounded, but the formal correctness theorem is tautological and the algorithm-agnostic claim is only tested under fixed attacker-side hyperparameters.

  1. self definitional [Appendix C.3, Theorem 6 (and second-order analogue Theorem 7)]
    "Theorem 6 (First-Order DRAUN Correctness). Under Assumptions 5–7, let the client’s unlearning loss be: ∇θLu = ∇θL(θ, xr, yr) − ∇θL(θ, xu, yu), and the server’s surrogate loss be: ∇θ ˜Lu(˜xu, ˜xr) = ∇θL(θ, ˜xr, yr) − ∇θL(θ, ˜xu, yu). Then, the ground truth pair (˜xu, ˜xr) = (xu, xr) is a local minimizer of Lsim(˜xu, ˜xr)."

    The theorem's premise assumes the server's surrogate loss equals the client's unlearning loss and takes the dummy retain input to be the true retain input. Under those assumptions Lsim(xu, xr) = 0 by construction, so the conclusion that the ground truth is a local minimizer is a tautology; it does not show that DRAUN reaches that point from random initialization. Algorithm 2 does not optimize the exact continuous loss of the theorem; it runs two finite-step surrogates with server-chosen ηunl and δ, so the theorem does not even cover the attack it is used to justify. This is the only formal correctness argument for the first-order agnostic case.

  2. other [Section 2.1 Threat Model; Algorithm 1 input line; Section 4.1 Reconstruction Setup]
    "Importantly, the server does not know which unlearning algorithm each client employs. ... The other hyperparameters used in Algorithm 2 and Algorithm 3 are ηunl = 0.1, δ = 10.0, ∆ = 5.0, and σ = 1."

    Algorithm 1 takes E, m, ηunl, δ, β, yu, yr as inputs, and Algorithm 2's two surrogate updates are evaluated at the attacker-fixed ηunl = 0.1 and δ = 10.0. The threat model defines the attack as operating without knowledge of the client's unlearning algorithm or hyperparameters. The experiments never vary these attacker guesses against the client-side true values, so the central 'algorithm-agnostic' claim is supported only in the configuration where the server's chosen surrogates are assumed to describe the client. The claimed generality reduces to an unvalidated assumption about unobservable client choices rather than being demonstrated.

full rationale

The empirical evaluation is self-contained: DRAUN is compared against Hu et al. on four datasets, four architectures, and five unlearning methods, and those reconstructions are independent evidence that the attack works in the tested fixed configuration. There is no load-bearing self-citation chain; reference [1] is used only as an evaluated unlearning method. However, the formal analysis contains a genuinely circular step: Theorem 6 (and Theorem 7) proves only that if the surrogate loss is exactly the client's loss and the dummy retain equals the true retain, the ground truth has zero similarity loss, which is true by construction and says nothing about convergence from random dummies. In addition, the paper's headline claim of algorithm-agnostic operation is not tested under mismatch of E, m, ηunl, δ, or retain labels, even though the threat model says these are unknown; this is an assumption-to-conclusion gap in the paper's own derivation chain, though it is not a fit-to-prediction circularity. Correctness risks such as Assumption 11 (assuming the dummy retain converges to true retain at O(1/√T)) and the unjustified inequality in Theorem 1 are noted separately and are not counted as circularity. Overall, the central empirical claim retains independent content, so the score is moderate.

Assumptions & free parameters 8 free parameters · 6 assumptions · 0 invented entities

The central attack rests on server-side knowledge of labels and client update structure. The formal analysis introduces smoothness and full-rank assumptions, plus an assumption that dummy retain images already approach ground truth. The free parameters are hand-set hyperparameters with no sensitivity analysis.

free parameters (8)
  • ηunl (surrogate unlearning rate) = 0.1
    The server must guess the client's unlearning step size; Algorithm 2 uses it to simulate the local update, and no mismatch sensitivity analysis is reported.
  • δ (surrogate divergence regularizer) = 10.0
    Controls model drift in Equations 2 and 3 and in Algorithm 2; chosen without evidence that it matches any client's regularization.
  • β (TV mixing weight) = 0.9
    Balances total variation between dummy unlearn and dummy retain images in Algorithm 1.
  • λTV or λreg (total variation regularizer) = 10^-6
    Smoothness prior for image reconstruction; chosen by hand.
  • ηrec (reconstruction Adam learning rate) = 0.1
    Optimization step for dummy inputs in Algorithm 1.
  • Δ (dummy separation threshold) = 5.0
    Controls initial distance between dummy unlearn and retain inputs in Algorithm 3.
  • σ (Gaussian noise standard deviation in initialization) = 1.0
    Perturbation used in Algorithm 3 to separate dummy inputs.
  • T (reconstruction iterations) = 6000 to 24000
    Stopping budget that varies with experiment; affects quality but is not a physical constant.
assumptions (6)
  • domain assumption The server knows the labels yu of unlearned data and yr of retained data, plus |Du| and |Dr|.
    Algorithm 1 takes yu and yr as inputs; the threat model justifies labels via prior gradient inversion results, but retain labels are not available in standard setups.
  • ad hoc to paper The client's unlearning update can be represented by one of two surrogate forms: pure gradient ascent on Du or gradient difference between Dr and Du.
    Algorithm 2 only simulates α=0 and α=1; algorithms with different regularization or coefficients, such as Alam et al. with α, β, γ, are not exactly represented.
  • domain assumption The observed model delta (θs−θc)/Uc equals the averaged client gradient.
    Algorithm 1 line 3 treats model difference divided by step count as an averaged gradient; for multi-step local updates with batch shuffling, this is only an approximation.
  • standard math The surrogate loss is twice differentiable, smooth in x and θ, and its Jacobian J has full column rank with dθ≥dx.
    Assumptions 5 through 8 in Section 3; needed for the Fermat and Taylor arguments and not verified for ReLU networks.
  • ad hoc to paper The dummy retain inputs converge to the true retain inputs with error ε(T)=O(1/√T).
    Assumption 11 in Appendix C.4; this is close to the conclusion the paper needs to prove, not a demonstrated property.
  • standard math The similarity loss Lsim is smooth and the reconstruction step satisfies ηrec≤1/(2μx).
    Assumption 12 in Appendix C.5, used in the proximity argument; the smoothness constants are not estimated.

how reviews work

0 comments
Cite this review

Pith. "Pith review of DRAUN: An Algorithm-Agnostic Data Reconstruction Attack on Federated Unlearning Systems." pith.science (2026). https://pith.science/paper/FUBKA3UA

@misc{pith2026250601777,
  author       = {Pith},
  title        = {Pith review of: DRAUN: An Algorithm-Agnostic Data Reconstruction Attack on Federated Unlearning Systems},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FUBKA3UA}},
  note         = {Machine review of arXiv:2506.01777}
}
read the original abstract

Federated Unlearning (FU) enables clients to remove the influence of specific data from a collaboratively trained shared global model, addressing regulatory requirements such as GDPR and CCPA. However, this unlearning process introduces a new privacy risk: A malicious server may exploit unlearning updates to reconstruct the data requested for removal, a form of Data Reconstruction Attack (DRA). While DRAs for machine unlearning have been studied extensively in centralized Machine Learning-as-a-Service (MLaaS) settings, their applicability to FU remains unclear due to the decentralized, client-driven nature of FU. This work presents DRAUN, the first attack framework to reconstruct unlearned data in FU systems. DRAUN targets optimization-based unlearning methods, which are widely adopted for their efficiency. We theoretically demonstrate why existing DRAs targeting machine unlearning in MLaaS fail in FU and show how DRAUN overcomes these limitations. We validate our approach through extensive experiments on four datasets and four model architectures, evaluating its performance against five popular unlearning methods, effectively demonstrating that state-of-the-art FU methods remain vulnerable to DRAs.

Figures

Figures reproduced from arXiv: 2506.01777 by the authors.

Figure 1
Figure 1. Reconstruction of deleted samples after unlearning using ABL [ [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. DRAUN reconstructions from local updates of four unlearning methods on CIFAR10. Higher SSIM and PSNR, and lower LPIPS scores indicate strong similarity to the original images, revealing residual information in the updates. Federated Unlearning Setup: We simulate an FL environment with 100 clients. In each communi￾cation round, 10 clients are selected uniformly at random to participate. Each selected client trains a … view at source ↗
Figure 3
Figure 3. Reconstruction loss over reconstruc￾tion steps for DRAUN and Hu et al. [24] across four unlearning algorithms on CIFAR10. Ground Truth Reconstructed (a) (a) (b) (b) batch = 2 batch = 4 [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (26 more)
Figure 5
Figure 5. Figure 5: (a) Examples of CIFAR10 images reconstructed by DRAUN from second-order unlearning updates [29]. (b) Effects of two defense strategies: Gaussian noise addition (top row) and gradient pruning (bottom row) at varying noise levels and pruning thresholds σ. (c) Comparison …
Figure 6
Figure 6. Figure 6: Single-image reconstructions on FEMNIST using LeNet. We compare DRAUN reconstruc [PITH_FULL_IMAGE:figures/full_fig_p025_6.png]
Figure 7
Figure 7. Figure 7: Single-image reconstructions on MNIST using MLP. We compare DRAUN reconstructions [PITH_FULL_IMAGE:figures/full_fig_p025_7.png]
Figure 9
Figure 9. Figure 9: Reconstruction results from local updates with [PITH_FULL_IMAGE:figures/full_fig_p025_9.png]
Figure 8
Figure 8. Figure 8: Single-image reconstructions on CIFAR100 using ResNet18. We compare DRAUN [PITH_FULL_IMAGE:figures/full_fig_p026_8.png]
Figure 10
Figure 10. Figure 10: Reconstruction results from local updates with [PITH_FULL_IMAGE:figures/full_fig_p026_10.png]
Figure 11
Figure 11. Figure 11: DRAUN reconstructions from local updates of four unlearning methods on CIFAR100. 26 [PITH_FULL_IMAGE:figures/full_fig_p026_11.png]
Figure 12
Figure 12. Figure 12: DRAUN reconstructions from local updates of four unlearning methods on FEMNIST. MNIST Ground Truth Wu et al. [52] ↑SSIM: 0.98 ↑PSNR: 38.7 ↓LPIPS: 0.00 ABL [33] ↑SSIM: 0.88 ↑PSNR: 30.02 ↓LPIPS: 0.02 Alam et al. [1] ↑SSIM: 0.96 ↑PSNR: 39.6 ↓LPIPS: 0.00 Halimi et al. [20…
Figure 13
Figure 13. Figure 13: DRAUN reconstructions from local updates of four unlearning methods on MNIST. E.4 Batch Reconstructions for Datasets and Batch Sizes We evaluate DRAUN by reconstructing images from local model updates produced by two unlearning methods—ABL [33] and Halimi et al. [20]—…
Figure 14
Figure 14. Figure 14: Multi image reconstruction from Halimi et al. [20] on CIFAR10. [PITH_FULL_IMAGE:figures/full_fig_p027_14.png]
Figure 15
Figure 15. Figure 15: Multi image reconstruction from ABL [33] on CIFAR10. [PITH_FULL_IMAGE:figures/full_fig_p028_15.png]
Figure 16
Figure 16. Figure 16: Effect of batch size scaling on reconstruction quality for the CIFAR10 dataset on four [PITH_FULL_IMAGE:figures/full_fig_p028_16.png]
Figure 17
Figure 17. Figure 17: Multi image reconstruction from Halimi et al. [20] on CIFAR100. [PITH_FULL_IMAGE:figures/full_fig_p028_17.png]
Figure 18
Figure 18. Figure 18: Multi image reconstruction from ABL [33] on CIFAR100. [PITH_FULL_IMAGE:figures/full_fig_p028_18.png]
Figure 19
Figure 19. Figure 19: Effect of batch size scaling on reconstruction quality for the CIFAR100 dataset on four [PITH_FULL_IMAGE:figures/full_fig_p029_19.png]
Figure 20
Figure 20. Figure 20: Multi image reconstruction from Halimi et al. [20] on FEMNIST. [PITH_FULL_IMAGE:figures/full_fig_p029_20.png]
Figure 21
Figure 21. Figure 21: Multi image reconstruction from ABL [33] on FEMNIST. [PITH_FULL_IMAGE:figures/full_fig_p029_21.png]
Figure 22
Figure 22. Figure 22: Effect of batch size scaling on reconstruction quality for the FEMNIST dataset on four [PITH_FULL_IMAGE:figures/full_fig_p029_22.png]
Figure 23
Figure 23. Figure 23: Multi image reconstruction from Halimi et al. [20] on MNIST. [PITH_FULL_IMAGE:figures/full_fig_p030_23.png]
Figure 24
Figure 24. Figure 24: Multi image reconstruction from ABL [33] on MNIST. [PITH_FULL_IMAGE:figures/full_fig_p030_24.png]
Figure 25
Figure 25. Figure 25: Effect of batch size scaling on reconstruction quality for the MNIST dataset on four [PITH_FULL_IMAGE:figures/full_fig_p030_25.png]
Figure 26
Figure 26. Figure 26: DRAUN: Agnostic vs Specific reconstruction on CIFAR-10 using Alam [1] unlearning. CIFAR-100 Ground Truth Agnostic SSIM: 0.56, PSNR: 14.8, LPIPS: 0.44 Specific SSIM: 0.71, PSNR: 21.4, LPIPS: 0.29 [PITH_FULL_IMAGE:figures/full_fig_p031_26.png]
Figure 27
Figure 27. Figure 27: DRAUN: Agnostic vs Specific reconstruction on CIFAR-100 using Alam [1] unlearning. FEMNIST Ground Truth Agnostic SSIM: 0.99, PSNR: 41.0, LPIPS: 0.00 Specific SSIM: 1.00, PSNR: 49.1, LPIPS: 0.00 [PITH_FULL_IMAGE:figures/full_fig_p031_27.png]
Figure 28
Figure 28. Figure 28: DRAUN: Agnostic vs Specific reconstruction on FEMNIST using Alam [1] unlearning. 31 [PITH_FULL_IMAGE:figures/full_fig_p031_28.png]
Figure 29
Figure 29. Figure 29: DRAUN: Agnostic vs Specific reconstruction on MNIST using Alam [1] unlearning. F DRAUN for Second-Order Unlearning Algorithms We extend DRAUN to the setting where the client employs second-order unlearning algorithms. While uncommon in federated learning due to their …
Figure 30
Figure 30. Figure 30: DRAUN reconstruction-accuracy trade-off under pruning and Gaussian noise defenses. H Broader Impacts Recent works [24, 4] have shown that unlearning algorithms are vulnerable to data reconstruction attacks in Machine Learning as a Service (MLaaS) settings. However, th…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

66 extracted references · 38 canonical work pages

  1. [1]

    Get rid of your trail: Remotely erasing backdoors in federated learning

    Manaar Alam, Hithem Lamri, and Michail Maniatakos. Get rid of your trail: Remotely erasing backdoors in federated learning. IEEE Trans. Artif. Intell. , 5(12):6683–6698, 2024. doi: 10.1109/TAI.2024.3465441. URL https://doi.org/10.1109/TAI.2024.3465441

    arXiv 2024

  2. [2]

    Reconstructing training data with informed adversaries

    Borja Balle, Giovanni Cherubin, and Jamie Hayes. Reconstructing training data with informed adversaries. In 43rd IEEE Symposium on Security and Privacy, SP 2022, San Francisco, CA, USA, May 22-26, 2022, pages 1138–1156. IEEE, 2022. doi: 10.1109/SP46214.2022.9833677. URL https://doi.org/10.1109/SP46214.2022.9833677

    arXiv 2022

  3. [3]

    Mislav Balunovic, Dimitar Iliev Dimitrov, Robin Staab, and Martin T. Vechev. Bayesian framework for gradient leakage. In The Tenth International Conference on Learning Rep- resentations, ICLR 2022, Virtual Event, April 25-29, 2022 . OpenReview.net, 2022. URL https://openreview.net/forum?id=f2lrIbGx3x7

    work page 2022

  4. [4]

    Morgenstern, Aaron Roth, and Steven Z

    Martín Bertran, Shuai Tang, Michael Kearns, Jamie H. Morgenstern, Aaron Roth, and Steven Z. Wu. Reconstruction attacks on machine unlearning: Simple models are vulnerable. In Advances in Neural Information Processing Systems 38: Annual Conference on Neural Information Processing Systems 2024, NeurIPS 2024, Vancouver, BC, Canada, December 10 - 15, 2024 , 2...

    work page 2024

  5. [5]

    When the curious abandon honesty: Federated learning is not private

    Franziska Boenisch, Adam Dziedzic, Roei Schuster, Ali Shahin Shamsabadi, Ilia Shumailov, and Nicolas Papernot. When the curious abandon honesty: Federated learning is not private. In 8th IEEE European Symposium on Security and Privacy, EuroS&P 2023, Delft, Netherlands, July 3-7, 2023, pages 175–199. IEEE, 2023. doi: 10.1109/EUROSP57164.2023.00020. URL htt...

    arXiv 2023

  6. [6]

    Leaf: A benchmark for federated settings

    Sebastian Caldas, Peter Wu, Tian Li, Jakub Konecny, H Brendan McMahan, Virginia Smith, and Ameet Talwalkar. Leaf: A benchmark for federated settings. In Workshop on Federated Learning for Data Privacy and Confidentiality, NeurIPS, 2018. URL https://arxiv.org/ abs/1812.01097

    arXiv 2018

  7. [7]

    Towards Making Systems Forget with Machine Unlearning

    Yinzhi Cao and Junfeng Yang. Towards Making Systems Forget with Machine Unlearning. In 2015 IEEE Symposium on Security and Privacy, SP 2015, San Jose, CA, USA, May 17- 21, 2015, pages 463–480. IEEE Computer Society, 2015. doi: 10.1109/SP.2015.35. URL https://doi.org/10.1109/SP.2015.35

    doi:10.1109/sp.2015.35 2015

  8. [8]

    SPEAR:Exact Gradient Inversion of Batches in Federated Learning

    Dimitar I. Dimitrov, Maximilian Baader, Mark Niklas Müller, and Martin T. Vechev. SPEAR: exact gradient inversion of batches in federated learning. CoRR, abs/2403.03945, 2024. doi: 10.48550/ARXIV .2403.03945. URLhttps://doi.org/10.48550/arXiv.2403.03945

    work page Pith review arXiv doi:10.48550/arxiv.2403.03945 2024

Show all 66 references
  1. [9]

    Dimitar Iliev Dimitrov, Mislav Balunovic, Nikola Konstantinov, and Martin T. Vechev. Data leakage in federated averaging. Trans. Mach. Learn. Res. , 2022, 2022. URL https:// openreview.net/forum?id=e7A0B99zJf

    2022

  2. [10]

    Data protection in the EU, 2024

    European Commission. Data protection in the EU, 2024. https://commission.europa.eu/ law/law-topic/data-protection/data-protection-eu_en

    2024

  3. [11]

    Fowl, Jonas Geiping, Wojciech Czaja, Micah Goldblum, and Tom Goldstein

    Liam H. Fowl, Jonas Geiping, Wojciech Czaja, Micah Goldblum, and Tom Goldstein. Robbing the fed: Directly obtaining private data in federated learning with modified models. InThe Tenth International Conference on Learning Representations, ICLR 2022, Virtual Event, April 25-29,

    2022

  4. [13]

    Kostadin Garov, Dimitar Iliev Dimitrov, Nikola Jovanovic, and Martin T. Vechev. Hiding in plain sight: Disguising data stealing attacks in federated learning. In The Twelfth Interna- tional Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024. Ope...

    2024

  5. [14]

    Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller. Inverting gradients - how easy is it to break privacy in federated learning? In Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurIP...

    2020

  6. [15]

    Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller. Inverting gradients - how easy is it to break privacy in federated learning? In Hugo Larochelle, Marc’Aurelio Ranzato, Raia Hadsell, Maria-Florina Balcan, and Hsuan-Tien Lin, editors, Advances in Neural In...

    2020

  7. [16]

    Towards general deep leakage in federated learning

    Jiahui Geng, Yongli Mou, Feifei Li, Qing Li, Oya Beyan, Stefan Decker, and Chunming Rong. Towards general deep leakage in federated learning. CoRR, abs/2110.09074, 2021. URL https://arxiv.org/abs/2110.09074

    2021 arXiv

  8. [17]

    Deep Learning

    Ian Goodfellow, Yoshua Bengio, and Aaron Courville. Deep Learning. MIT Press, 2016. http://www.deeplearningbook.org

    2016

  9. [18]

    Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron C

    Ian J. Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron C. Courville, and Yoshua Bengio. Generative adversarial networks. CoRR, abs/1406.2661, 2014. URL http://arxiv.org/abs/1406.2661

    2014 arXiv

  10. [19]

    Reconstruct- ing training data from trained neural networks

    Niv Haim, Gal Vardi, Gilad Yehudai, Ohad Shamir, and Michal Irani. Reconstruct- ing training data from trained neural networks. In Sanmi Koyejo, S. Mohamed, A. Agarwal, Danielle Belgrave, K. Cho, and A. Oh, editors, Advances in Neural In- formation Processing Systems 35: Annua...

    2022

  11. [20]

    Federated unlearning: How to efficiently erase a client in fl? In Updatable Machine Learning (part of ICML 2022), UpML 2022, Baltimore, USA, July 23, 2022, 2022

    Anisa Halimi, Swanand Kadhe, Ambrish Rawat, and Nathalie Baracaldo. Federated unlearning: How to efficiently erase a client in fl? In Updatable Machine Learning (part of ICML 2022), UpML 2022, Baltimore, USA, July 23, 2022, 2022. doi: 10.48550/ARXIV .2207.05521. URL https://do...

    2022 doi arXiv

  12. [21]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In 2016 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2016, Las Vegas, NV , USA, June 27-30, 2016, pages 770–778. IEEE Computer Society, 2016. doi: 10.1109/C...

    2016 doi

  13. [22]

    Zecheng He, Tianwei Zhang, and Ruby B. Lee. Model inversion attacks against collaborative inference. In David M. Balenson, editor, Proceedings of the 35th Annual Computer Security Applications Conference, ACSAC 2019, San Juan, PR, USA, December 09-13, 2019 , pages 148–162. ACM...

    2019

  14. [23]

    Deep models under the GAN: information leakage from collaborative deep learning

    Briland Hitaj, Giuseppe Ateniese, and Fernando Pérez-Cruz. Deep models under the GAN: information leakage from collaborative deep learning. In Bhavani Thuraisingham, David Evans, Tal Malkin, and Dongyan Xu, editors, Proceedings of the 2017 ACM SIGSAC Conference on Computer and...

    2017

  15. [24]

    Learn what you want to unlearn: Unlearning inversion attacks against machine unlearning

    Hongsheng Hu, Shuo Wang, Tian Dong, and Minhui Xue. Learn what you want to unlearn: Unlearning inversion attacks against machine unlearning. In IEEE Symposium on Security and Privacy, SP 2024, San Francisco, CA, USA, May 19-23, 2024, pages 3257–3275. IEEE,

    2024

  16. [25]

    Evaluating gradient inversion attacks and defenses in federated learning

    Yangsibo Huang, Samyak Gupta, Zhao Song, Kai Li, and Sanjeev Arora. Evaluating gradient inversion attacks and defenses in federated learning. In Marc’Aurelio Ranzato, Alina Beygelzimer, Yann N. Dauphin, Percy Liang, and Jennifer Wortman Vaughan, edi- tors, Advances in Neural I...

    2021

  17. [26]

    Neural tangent kernel: Conver- gence and generalization in neural networks

    Arthur Jacot, Clément Hongler, and Franck Gabriel. Neural tangent kernel: Conver- gence and generalization in neural networks. In Samy Bengio, Hanna M. Wallach, Hugo Larochelle, Kristen Grauman, Nicolò Cesa-Bianchi, and Roman Garnett, editors, Advances in Neural Information Pr...

    2018

  18. [27]

    Gradi- ent inversion with generative image prior

    Jinwoo Jeon, Jaechang Kim, Kangwook Lee, Sewoong Oh, and Jungseul Ok. Gradi- ent inversion with generative image prior. In Marc’Aurelio Ranzato, Alina Beygelz- imer, Yann N. Dauphin, Percy Liang, and Jennifer Wortman Vaughan, editors, Ad- vances in Neural Information Processin...

    2021

  19. [28]

    Directional convergence and alignment in deep learning

    Ziwei Ji and Matus Telgarsky. Directional convergence and alignment in deep learning. In H. Larochelle, M. Ranzato, R. Hadsell, M.F. Balcan, and H. Lin, editors, Advances in Neural Information Processing Systems, volume 33, pages 17176–17186. Curran Associates, Inc., 2020. URL...

    2020

  20. [29]

    Forgettable federated linear learning with certified data unlearning, 2024

    Ruinan Jin, Minghui Chen, Qiong Zhang, and Xiaoxiao Li. Forgettable federated linear learning with certified data unlearning, 2024. URL https://arxiv.org/abs/2306.02216

    2024 arXiv

  21. [30]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky. Learning multiple layers of features from tiny images. Techni- cal report, University of Toronto, 2009. URL https://www.cs.toronto.edu/~kriz/ learning-features-2009-TR.pdf

    2009

  22. [31]

    H. W. Kuhn and A. W. Tucker. Nonlinear programming. In Proceedings of the Second Berkeley Symposium on Mathematical Statistics and Probability, 1950, pages 481–492, Berkeley and Los Angeles, 1951. University of California Press

    1950

  23. [32]

    Gradient-based learning applied to document recognition

    Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proc. IEEE, 86(11):2278–2324, 1998. doi: 10.1109/5.726791. URL https://doi.org/10.1109/5.726791

    1998 doi

  24. [33]

    Anti-backdoor learning: Training clean models on poisoned data

    Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Anti-backdoor learning: Training clean models on poisoned data. In Advances in Neural Information Processing Systems 34: Annual Conference on Neural Informa- tion Processing Systems 2021, NeurIPS 2021, De...

    2021

  25. [34]

    Deep gradient compression: Reducing the communication bandwidth for distributed training

    Yujun Lin, Song Han, Huizi Mao, Yu Wang, and Bill Dally. Deep gradient compression: Reducing the communication bandwidth for distributed training. In6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference T...

    2018

  26. [35]

    Federaser: Enabling efficient client-level data removal from federated learning models

    Gaoyang Liu, Xiaoqiang Ma, Yang Yang, Chen Wang, and Jiangchuan Liu. Federaser: Enabling efficient client-level data removal from federated learning models. In 2021 IEEE/ACM 29th International Symposium on Quality of Service (IWQOS) , pages 1–10, 2021. doi: 10.1109/ IWQOS52092...

    2021

  27. [36]

    A survey on federated unlearning: Challenges, methods, and future directions

    Ziyao Liu, Yu Jiang, Jiyuan Shen, Minyi Peng, Kwok-Yan Lam, Xingliang Yuan, and Xiaoning Liu. A survey on federated unlearning: Challenges, methods, and future directions. ACM Comput. Surv., 57(1):2:1–2:38, 2025. doi: 10.1145/3679014. URL https://doi.org/10. 1145/3679014

    2025 doi

  28. [37]

    Gradient descent maximizes the margin of homogeneous neural networks

    Kaifeng Lyu and Jian Li. Gradient descent maximizes the margin of homogeneous neural networks. In International Conference on Learning Representations , 2020. URL https: //openreview.net/forum?id=SJeLIgBKPS

    2020

  29. [38]

    Communication-efficient learning of deep networks from decentralized data

    Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Agüera y Arcas. Communication-efficient learning of deep networks from decentralized data. In Proceedings of the 20th International Conference on Artificial Intelligence and Statistics, AISTATS 2017, 20-22 A...

    2017

  30. [39]

    Inf2guard: An information-theoretic framework for learning privacy-preserving representations against inference attacks

    Sayedeh Leila Noorbakhsh, Binghui Zhang, Yuan Hong, and Binghui Wang. Inf2guard: An information-theoretic framework for learning privacy-preserving representations against inference attacks. In Davide Balzarotti and Wenyuan Xu, editors, 33rd USENIX Security Symposium, USENIX S...

    2024

  31. [40]

    California Consumer Privacy Act (CCPA),

    Office of the Attorney General, State of California. California Consumer Privacy Act (CCPA),

  32. [41]

    Rudin, Stanley Osher, and Emad Fatemi

    Leonid I. Rudin, Stanley Osher, and Emad Fatemi. Nonlinear total variation based noise removal algorithms. Physica D: Nonlinear Phenomena, 60(1):259–268, 1992. ISSN 0167-2789. doi: https://doi.org/10.1016/0167-2789(92)90242-F. URL https://www.sciencedirect.com/ science/article...

    1992

  33. [42]

    Updates- leak: Data set inference and reconstruction attacks in online learning

    Ahmed Salem, Apratim Bhattacharya, Michael Backes, Mario Fritz, and Yang Zhang. Updates- leak: Data set inference and reconstruction attacks in online learning. In Srdjan Capkun and Franziska Roesner, editors, 29th USENIX Security Symposium, USENIX Security 2020, August 12-14,...

    2020

  34. [43]

    https://oag.ca.gov/privacy/ccpa

  35. [44]

    FRAMU: attention-based machine unlearning using federated reinforcement learning

    Thanveer Shaik, Xiaohui Tao, Lin Li, Haoran Xie, Taotao Cai, Xiaofeng Zhu, and Qing Li. FRAMU: attention-based machine unlearning using federated reinforcement learning. IEEE Trans. Knowl. Data Eng., 36(10):5153–5167, 2024. doi: 10.1109/TKDE.2024.3382726. URL https://doi.org/1...

    2024

  36. [46]

    PRECODE - A generic model extension to prevent deep gradient leakage

    Daniel Scheliga, Patrick Mäder, and Marco Seeland. PRECODE - A generic model extension to prevent deep gradient leakage. In IEEE/CVF Winter Conference on Applications of Computer Vision, WACV 2022, Waikoloa, HI, USA, January 3-8, 2022, pages 3605–3614. IEEE, 2022. doi: 10.1109...

    2022

  37. [47]

    Beyond inferring class representatives: User-level privacy leakage from federated learning

    Zhibo Wang, Mengkai Song, Zhifei Zhang, Yang Song, Qian Wang, and Hairong Qi. Beyond inferring class representatives: User-level privacy leakage from federated learning. In 2019 IEEE Conference on Computer Communications, INFOCOM 2019, Paris, France, April 29 - May 2, 2019, pa...

    2019

  38. [48]

    Bovik, Hamid R

    Zhou Wang, Alan C. Bovik, Hamid R. Sheikh, and Eero P. Simoncelli. Image quality assessment: from error visibility to structural similarity. IEEE Trans. Image Process., 13(4):600–612, 2004. doi: 10.1109/TIP.2003.819861. URL https://doi.org/10.1109/TIP.2003.819861

    2004

  39. [49]

    BFU: bayesian federated unlearning with parameter self-sharing

    Weiqi Wang, Zhiyi Tian, Chenhan Zhang, An Liu, and Shui Yu. BFU: bayesian federated unlearning with parameter self-sharing. In Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security, ASIA CCS 2023, Melbourne, VIC, Australia, July 10-14, 2023, pages...

    2023

  40. [50]

    Fishing for user data in large-batch federated learning via gradient magnification

    Yuxin Wen, Jonas Geiping, Liam Fowl, Micah Goldblum, and Tom Goldstein. Fishing for user data in large-batch federated learning via gradient magnification. In International Conference on Machine Learning, ICML 2022, 17-23 July 2022, Baltimore, Maryland, USA, volume 162 of Proc...

    2022

  41. [51]

    Geiping, Liam Fowl, Micah Goldblum, and Tom Goldstein

    Yuxin Wen, Jonas A. Geiping, Liam Fowl, Micah Goldblum, and Tom Goldstein. Fishing for user data in large-batch federated learning via gradient magnification. In Kamalika Chaudhuri, Stefanie Jegelka, Le Song, Csaba Szepesvari, Gang Niu, and Sivan Sabato, editors, Proceedings o...

    2022

  42. [52]

    Reconstructing training data from model gradient, provably

    Zihan Wang, Jason Lee, and Qi Lei. Reconstructing training data from model gradient, provably. In Francisco J. R. Ruiz, Jennifer G. Dy, and Jan-Willem van de Meent, editors,International Conference on Artificial Intelligence and Statistics, 25-27 April 2023, Palau de Congresso...

    2023

  43. [54]

    Álvarez, Jan Kautz, and Pavlo Molchanov

    Hongxu Yin, Arun Mallya, Arash Vahdat, José M. Álvarez, Jan Kautz, and Pavlo Molchanov. See through gradients: Image batch recovery via gradinversion. In IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2021, virtual, June 19-25, 2021, pages 16337– 16346. Compu...

    2021

  44. [55]

    Federated unlearning: Guarantee the right of clients to forget

    Leijie Wu, Song Guo, Junxiao Wang, Zicong Hong, Jie Zhang, and Yaohong Ding. Federated unlearning: Guarantee the right of clients to forget. IEEE Netw., 36(5):129–135, 2022. doi: 10.1109/MNET.001.2200198. URL https://doi.org/10.1109/MNET.001.2200198

    2022 doi

  45. [56]

    Compromise privacy in large-batch federated learning via malicious model parameters

    Shuaishuai Zhang, Jie Huang, Zeping Zhang, and Chunyang Qi. Compromise privacy in large-batch federated learning via malicious model parameters. In Weizhi Meng, Rongxing Lu, Geyong Min, and Jaideep Vaidya, editors, Algorithms and Architectures for Parallel Processing - 22nd In...

    2022 doi

  46. [57]

    idlg: Improved deep leakage from gradients

    Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. idlg: Improved deep leakage from gradients. CoRR, abs/2001.02610, 2020. URL http://arxiv.org/abs/2001.02610

    2001 arXiv

  47. [58]

    Efros, Eli Shechtman, and Oliver Wang

    Richard Zhang, Phillip Isola, Alexei A. Efros, Eli Shechtman, and Oliver Wang. The un- reasonable effectiveness of deep features as a perceptual metric. In 2018 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2018, Salt Lake City, UT, USA, June 18-22, 2018, pa...

    2018

  48. [59]

    Zhao, Atul Sharma, Ahmed Roushdy Elkordy, Yahya H

    Joshua C. Zhao, Atul Sharma, Ahmed Roushdy Elkordy, Yahya H. Ezzeldin, Salman Avestimehr, and Saurabh Bagchi. Loki: Large-scale data reconstruction attack against federated learning through model manipulation. In IEEE Symposium on Security and Privacy, SP 2024, San Francisco, ...

    2024

  49. [60]

    HyperINF: Unleashing the hyperpower of the schulz’s method for data influence estimation, 2025

    Xinyu Zhou, Simin Fan, and Martin Jaggi. HyperINF: Unleashing the hyperpower of the schulz’s method for data influence estimation, 2025. URL https://openreview.net/forum?id= OLtD2vDF5X

    2025

  50. [61]

    Zhao, Atul Sharma, Ahmed Roushdy Elkordy, Yahya H

    Joshua C. Zhao, Atul Sharma, Ahmed Roushdy Elkordy, Yahya H. Ezzeldin, Salman Avestimehr, and Saurabh Bagchi. Secure aggregation in federated learning is not private: Leaking user data at large scale through model modification. CoRR, abs/2303.12233, 2023. doi: 10.48550/ ARXIV ...

    2023 doi arXiv

  51. [62]

    Blaschko

    Junyi Zhu and Matthew B. Blaschko. R-GAP: recursive gradient attack on privacy. In 9th Inter- national Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7,

    2021

  52. [63]

    Deep leakage from gradients

    Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. In Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019, NeurIPS 2019, December 8-14, 2019, Vancouver, BC, Canada , pages 14747–14756, 2019. URL...

    2019

  53. [67]

    URL https://openreview.net/forum?id=RSU17UoKfJF

    OpenReview.net, 2021. URL https://openreview.net/forum?id=RSU17UoKfJF

    2021

  54. [69]

    Deep leakage from gradients

    Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. In Hanna M. Wallach, Hugo Larochelle, Alina Beygelzimer, Florence d’Alché-Buc, Emily B. Fox, and Roman Garnett, editors, Advances in Neural Information Processing Systems 32: Annual Conference on Neural Inform...

    2019

  55. [70]

    Simplify using ∇θLu = H −1 r ∇θL(θ, xu, yu): Lsim = H −1 r − I ∇θL(θ, xu, yu) − J(xu)∆x − R 2 2

    Substituting into Lsim: Lsim = H −1 r ∇θL(θ, xu, yu) − (∇θL(θ, xu, yu) + J(xu)∆x + R) 2 2 . Simplify using ∇θLu = H −1 r ∇θL(θ, xu, yu): Lsim = H −1 r − I ∇θL(θ, xu, yu) − J(xu)∆x − R 2 2 . Using ∥H −1 r ∥ ≤κ (Assumption 10) and the Hessian Lipschitz property (Assumption 9): ∥...

  56. [71]

    Apply triangle inequality and use σmin(Ju)-lower bound (Assumption 7): L1/2 sim (T ) ≥ σmin(Ju)∥˜x(T ) u − xu∥2 − µxϵ(T )

    From the similarity objective: Lsim(T ) = ∥(∇θL(θ, xr, yr) − ∇θL(θ, ˜x(T ) r , yr)) − (Ju(˜x(T ) u − xu) + R)∥2 2. Apply triangle inequality and use σmin(Ju)-lower bound (Assumption 7): L1/2 sim (T ) ≥ σmin(Ju)∥˜x(T ) u − xu∥2 − µxϵ(T ). Rearranging gives the bound. Theorem 9 ...

  57. [2022]

    URL https://openreview.net/forum?id=fwzUgo0FM9v

    OpenReview.net, 2022. URL https://openreview.net/forum?id=fwzUgo0FM9v. 10

    2022

  58. [2024]

    URL https://doi.org/10.1109/SP54263

    doi: 10.1109/SP54263.2024.00248. URL https://doi.org/10.1109/SP54263. 2024.00248

    2024

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.