Pith. sign in

REVIEW 3 major objections 4 minor 63 references

Dropout-Robust Mechanisms for Differentially Private and Fully Decentralized Mean Estimation

T0 review · 3 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A fully decentralized gossip protocol matches central-differential-privacy accuracy for mean estimation without cryptography.

desk verdict A genuinely new decentralized-DP mechanism with a strong proof framework, but the headline central-DP accuracy claim rests on an unquantified rank condition on unseen messages. read the letter →

arxiv 2506.03746 v1 pith:U6CLYZMT submitted 2025-06-04 cs.CR cs.DCcs.LG

César Sabater , Sonia Ben Mokhtar , Jan Ramon This is my paper
classification cs.CRcs.DCcs.LG
keywords differentialprivacydecentralizedmeanestimationcorrelatednoisegossipaveragingdropoutresilienceincrementalinjectionsecureaggregationcomparison
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes IncA, a fully decentralized protocol for privately averaging $n$ parties' values, and claims it reaches the accuracy of centralized differential privacy without a trusted curator or cryptographic machinery. Each party splits its value, plus an independent Gaussian noise term, into $T+1$ incremental messages and mixes them by gossip, adding a fresh canceling noise term at every round and removing it later, so a dropout-free run cancels all correlated noise exactly and leaves only the small independent noise. Against an adversary who knows the entire interaction graph, sees a subset of messages, and corrupts some parties, the proof gives $(\varepsilon,\delta)$-DP with mean squared error $c^2/(n_H n \varepsilon^2)$, the same order as Secure Aggregation combined with local noise. When parties permanently drop out, the per-round noise does not fully cancel, but because values and noise are injected incrementally rather than at once, the leftover variance stays small and the experiments show errors well below earlier pairwise-canceling protocols.

What carries the argument

The load-bearing object is the Valid $(c,Z)$-Gaussian distribution named in Definition 3.4: each party $i$ writes its secret-plus-independent-noise $x_i+\eta^\star_i$ as a sum of $T+1$ terms $z_{i,0},\ldots,z_{i,T}$, with coefficient vector $c$, noise-shaping matrix $Z$, exact cancellation of the correlated noise over time, and invertibility conditions that stop the adversary from guessing individual noise terms. Algorithm 1 feeds these terms into a gossip averaging recursion $y_i^{(t)}=\sum_j W_{t;i,j} y_j^{(t-1)}+z_{i,t}$ with column-stochastic $W_t$, so in the final average only $\frac{1}{n}\sum_i \eta^\star_i$ remains. The privacy proof converts the adversary's observations into a linear system, and Lemma 4.4 shows that an unobserved message $y_i^{(t)}$ generates a nullspace vector $a^{(i,t)}$ whose coordinates are $(W_{t+1;i,i}-1)/w_i$ and $W_{t+1;j,i}/w_j$; the rank of the family $\{a^{(i,t)}\}$ then controls how small $\sigma_\star^2$ may be. The graph $G_H=(P_H,\bigcup_t E^H_t)$ of unseen honest exchange edges makes this rank condition checkable: strong connectivity suffices, while static interactions with two fully observed honest parties destroy it.

What would settle it

Run IncA on a static interaction graph where the adversary observes every message sent and received by two honest parties in every iteration: Theorem 4.9 predicts fewer than $n_H-1$ independent vectors, so the central-DP-level bound on $\sigma_\star^2$ should not be certified; if the protocol still achieved MSE $c^2/(n_H n \varepsilon^2)$ in that setting, the rank condition would be unnecessary. Alternatively, measure the fraction of random communication graphs for which $G_H$ is strongly connected under the paper's parameter choices, which the conclusion lists as unquantified future work.

Watch

Extended reading notes

Core claim

IncA's central claim is that privacy amplification comes from the messages the adversary does not see: each unobserved honest-party message contributes a direction $a^{(i,t)}$ in the nullspace of the adversary's linear system, and once these directions contain $n_H-1$ linearly independent vectors, the variance of the permanent noise $\eta^\star$ can be lowered to the central-DP level. The adversary's view is encoded as the linear system $\mathbf{B}(x_H+\eta^\star_H)+\mathbf{A}\eta_H = y_V$, and Theorem 4.5 shows that the rank condition yields $(\varepsilon,\delta)$-DP for $\sigma_\star^2 > c^2/(n_H \varepsilon^2)$, hence MSE $c^2/(n_H n \varepsilon^2)$. Theorem 4.8 makes the condition topological: strong connectivity of the graph $G_H$ of hidden exchanges between honest parties is sufficient. Theorem 4.9 gives the negative side: with static neighbor choices and the adversary observing all messages of two honest parties, the required rank is impossible. For dropouts, Theorems 4.6 and 4.7 bound the necessary growth of $\sigma_\star^2$, and the empirical study shows IncA's error stays far below GOPA and Cor-DP-DME up to 20% permanent dropouts.

Load-bearing premise

The load-bearing premise is that the adversary has not seen enough honest-party messages: the hidden messages must provide $n_H-1$ linearly independent directions $a^{(i,t)}$, which the paper equates to strong connectivity of the hidden honest graph $G_H$ and does not prove holds with any stated probability.

Editorial extensions

If this is right

  • With no permanent dropouts, IncA's estimate has mean squared error $c^2/(n_H n \varepsilon^2)$, matching centralized DP and Secure Aggregation with local noise in order, without using cryptographic primitives.
  • The protocol satisfies classical $(\varepsilon,\delta)$-DP, not a relaxed variant such as Network DP or Pairwise Network DP, against an adversary that knows the full interaction graph, sees a subset of messages, and corrupts a proportion of parties.
  • Permanent dropouts no longer trigger a noise catastrophe: because values and canceling noise are spread over $T$ rounds, a party leaving early loses only a fraction of its value and leaves a bounded amount of uncancelled noise.
  • Strong connectivity of the hidden honest graph $G_H$ is sufficient for the central-DP-level bound, and static interaction where the adversary sees all messages of two honest parties makes that bound unattainable.
  • In the empirical evaluation, at 5-20% permanent dropout rates IncA's MSE stays far below GOPA and Cor-DP-DME under the same communication budget, even when GOPA's rollback round loses almost no parties.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the recursion is linear, the same incremental-injection mechanism should transfer to other aggregate statistics such as inner products, empirical cumulative distribution functions, and decentralized gradient descent; the only ingredients needed are the column-stochastic gossip step and the Valid $(c,Z)$-Gaussian property.
  • The paper leaves the probability that $G_H$ is strongly connected under random communication graphs unquantified; the empirical success rates suggest a sharp threshold near $T\approx 15$-$20$ messages per party even for $n=5000$, so a high-probability version of Theorem 4.5 may be within reach of standard gossip concentration arguments.
  • A practical instantiation could compute the rank of $\{a^{(i,t)}\}$ before fixing $\sigma_\star^2$, and fall back to a larger independent-noise variance on executions where the condition fails, turning an existential guarantee into an adaptive one.
  • The semi-honest adversary model excludes deliberately misreporting parties; combining IncA with robust or verifiable aggregation would be the next step toward Byzantine resilience.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes IncA, a fully decentralized protocol for differentially private mean estimation. The protocol injects each party's private value incrementally over T mixing iterations together with correlated Gaussian noise, so that the correlated noise cancels exactly in the final average when no party drops out. A final independent Gaussian noise term of variance sigma_star^2 provides the central-DP noise. The main theoretical results are: (i) Theorem 4.1, a per-execution (epsilon,delta)-DP condition expressed through a linear system of the adversary's observations; (ii) Theorem 4.5, which states that, under a rank condition on the set of unseen-message vectors a^(i,t), the required sigma_star^2 is of order c^2/(n_H epsilon^2), matching centralized DP up to constants; (iii) Theorems 4.6 and 4.7, dropout-adapted variance bounds; (iv) Theorem 4.8, a sufficient topological condition (strong connectivity of the hidden graph G_H) for the rank condition; and (v) Theorem 4.9, a negative result for static topologies with two fully observed honest parties. The empirical section measures the success rate of the rank condition as a function of T and degree k, and compares the MSE of IncA with GOPA, Cor-DP-DME, Muffliato, central DP, and local DP under various dropout rates.

Significance. If the claimed guarantees hold as stated, IncA is a meaningful advance: it achieves centralized-DP-level utility in a fully decentralized setting without cryptography, under an adversary that knows the interaction graph, observes a subset of messages, and corrupts some parties. The paper's main strengths are: the Gaussian-mechanism-based proofs of Theorems 4.1 and 4.7 are coherent and standard; the utility derivation in Equation (5) is correct under column stochasticity; the linear-algebra formulation of the adversary's knowledge is transparent; and the experiments are structured to test the actual conditions used by the theorems, rather than only reporting MSE numbers. The paper also clearly acknowledges a major limitation in its conclusion: the probability that the rank condition holds under random communication graphs is not quantified theoretically. This limitation is load-bearing, because the central accuracy claim is conditional on that rank condition, and the current wording of the abstract overstates what is proven.

major comments (3)
  1. [Abstract, Section 4.3, Theorem 4.5, Section 5.1, Section 7] The central accuracy claim, stated in the abstract as reaching 'accuracy comparable to that of a centralized setting' when no parties permanently disconnect, is conditional on a rank condition that is never shown to hold with high probability. Theorem 4.5 requires the set {a^(i,t)} for unseen honest-party messages to contain at least n_H-1 linearly independent vectors; Theorem 4.8 shows this is equivalent to strong connectivity of the hidden graph G_H, which depends on both the random communication pattern and the adversary's observation set V_val. Section 5.1 measures the success rate of this condition empirically for selected parameters, and Section 7 lists 'theoretical quantification of the probability that our conditions hold under random communication graphs' as future work. Moreover, Theorem 4.9 shows a concrete scenario (static exchanges, two fully observed honest parties) where the rank condition fails and the central-DP bound does not follow. The unconditional phrasing of the abstract and of contribution (2) should therefore be qualified, or the paper should provide a probability bound over the random communication graph under which the central-DP accuracy guarantee holds.
  2. [Section 4.4, Eq. (15) and Theorem 4.8] There is an off-by-one indexing error between the statement of Theorem 4.8 and its proof. In Eq. (15), the edge set E_H^t is defined for t in [1,T] as {(i,j) in P_H x P_H : W^O_{t;j,i} > 0 and (i,t) not in V_val}, which associates an unobserved message y_i^(t) with the weight matrix W^O_t. However, Lemma 4.4 states that for an unobserved message y_i^(t) with t in [0,T-1], the vector a^(i,t) is defined through W^O_{t+1;:,i}. The proof of Theorem 4.8 in Appendix A.8 indeed uses W^O_{t+1} and the index set P_H x [0,T-1] \ V_val. As written, the theorem's stated graph condition is not the same as the condition used in the proof, and a reader following Eq. (15) may verify a different graph than the one that the proof requires. This needs to be corrected in the formulation of G_H and E_H^t.
  3. [Algorithm 2, line 13] The self-weight update in Algorithm 2 appears to be incorrect as printed. Line 11 sets W^O_{t;i,i} to W_{t;i,i} for all j in O(t), and then line 13 sets W^O_{t;i,i} to the sum over j in P\O(t) of W_{t;j,i}. If read literally, in the no-dropout case O(t)=P the sum is empty and W^O_{t;i,i} becomes 0, destroying column stochasticity of W^O_t and invalidating the utility derivation in Eq. (5). The text preceding the algorithm states that the self-weight is 'increased with the weights of value that i could not send due to dropout,' so the intended update is an addition, e.g., W^O_{t;i,i} <- W_{t;i,i} + sum_{j in P\O(t)} W_{t;j,i}. The pseudocode should be corrected to avoid this ambiguity.
minor comments (4)
  1. [Theorem 4.6 statement] In the statement of Theorem 4.6, the condition 'at least |n_H| - 1 independent vectors' uses absolute value bars around n_H; this should be n_H - 1.
  2. [Section 4.3, end of first paragraph after Theorem 4.5] The sentence 'In the remaining of Section 5.2 we show a bound on sigma_star^2 in the presence of dropouts' appears to refer to the theoretical results of Section 4.3 rather than the experimental Section 5.2; the cross-reference should be corrected.
  3. [Introduction, Section 1] There are several spelling errors: 'reluctent' should be 'reluctant', 'juridic' should be 'juridical' or 'legal', and 'Collussion' is used in several places where 'Collusion' is intended.
  4. [Figure 2 caption] The caption says 'Figure 2a' twice; the second reference should likely be 'Figure 2b'.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the central DP-utility claim is a conditional theorem proved from rank conditions on unseen messages, and the one self-cited lemma is re-proven in the appendix.

full rationale

The paper's central claim is a conditional theorem, not a definitional or fitted result. Theorem 4.5 establishes an (epsilon,delta)-DP guarantee only when the set {a^(i,t)} of nullspace vectors from unseen honest-party messages contains at least n_H-1 linearly independent vectors; this is a mathematical precondition stated explicitly in the theorem, not an input that is renamed as a prediction. The associated MSE c^2/(n_H n epsilon^2) follows algebraically from the theorem's bound on sigma_star^2 and Equation (5), which is an exact calculation from column stochasticity and the noise-cancellation property of D. The derived utility is therefore not fitted to data and does not reduce by construction to an assumption that already contains the conclusion. The only self-citation that touches a proof is the acknowledgment that the main technique of Lemma 4.3 was studied in the authors' earlier GOPA paper [52]; however, the paper includes a full self-contained proof of Lemma 4.3 in Appendix A.5, resting on the standard Gaussian tail bound and Lemma A.1, so it does not load the argument onto an unverified self-citation. Other self-citations ([4], [48], [49], [56]) appear in related-work, motivational, or comparative remarks and are not load-bearing. The unquantified probability that the rank condition holds under random communication graphs, which the paper itself lists as future work, is a completeness or overclaim gap in the abstract's unconditional wording, but it is not circularity: the derivation of the stated conditional guarantee is independent of any fitted value and is not equivalent to its own inputs.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The main contribution rests on standard DP and linear algebra machinery, plus the threat model and the hidden-graph connectivity condition. T, k, and alpha are user-chosen or hand-chosen protocol parameters; no constant is fitted to data to obtain the reported accuracy.

free parameters (3)
  • T (number of mixing iterations)
    Protocol hyperparameter chosen by the user; more iterations increase communication and the chance of satisfying the rank condition, while reducing the per-iteration injection fraction 1/(T+1) and hence the required correlated noise variance sigma_Delta^2.
  • k (outgoing neighbors per iteration)
    Protocol hyperparameter; higher k increases mixing speed but also increases the number of messages the adversary can observe, affecting the rank condition and sigma_Delta^2. In experiments k is varied over 1, 3, 5.
  • alpha = 1.3
    Hand-chosen degradation factor in Section 5.2 that multiplies the theoretical lower bound of sigma_*^2 to balance independent and correlated noise variances in experiments.
assumptions (5)
  • standard math Gaussian mechanism tail bound with c^2 > 2 ln(1.25/delta)
    Used in Lemma A.1 and Theorem 4.1 to convert the quadratic form condition into (epsilon,delta)-DP.
  • standard math Perron-Frobenius theorem for non-negative irreducible matrices
    Used in Theorem 4.8 to show that a strongly connected column-stochastic graph yields n_H-1 independent nullspace vectors.
  • domain assumption Semi-honest parties, synchronous rounds, secure pair channels, adversary knows the interaction graph W but only observes subset V_val of message contents.
    Defined in Sections 2.3 and 2.5; the entire E-DP and C-DP analysis is relative to this threat model.
  • domain assumption The set of unseen honest messages yields n_H-1 linearly independent vectors a^(i,t), or equivalently the hidden honest graph G_H is strongly connected.
    This is the precondition of Theorems 4.5 to 4.8; the paper only proves it under strong connectivity and empirically estimates its frequency, and lists its probability bound as future work.
  • domain assumption The noise distribution D is a Valid (c,Z)-Gaussian, i.e., terms sum to the private value, (c,Z) is invertible, and Z_{-T,:} is invertible.
    Definition 3.4; the privacy proofs rely on the full-row-rank property of the noise matrix Z to construct nullspace vectors in Lemma 4.4.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Dropout-Robust Mechanisms for Differentially Private and Fully Decentralized Mean Estimation." pith.science (2026). https://pith.science/paper/U6CLYZMT

@misc{pith2026250603746,
  author       = {Pith},
  title        = {Pith review of: Dropout-Robust Mechanisms for Differentially Private and Fully Decentralized Mean Estimation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/U6CLYZMT}},
  note         = {Machine review of arXiv:2506.03746}
}
read the original abstract

Achieving differentially private computations in decentralized settings poses significant challenges, particularly regarding accuracy, communication cost, and robustness against information leakage. While cryptographic solutions offer promise, they often suffer from high communication overhead or require centralization in the presence of network failures. Conversely, existing fully decentralized approaches typically rely on relaxed adversarial models or pairwise noise cancellation, the latter suffering from substantial accuracy degradation if parties unexpectedly disconnect. In this work, we propose IncA, a new protocol for fully decentralized mean estimation, a widely used primitive in data-intensive processing. Our protocol, which enforces differential privacy, requires no central orchestration and employs low-variance correlated noise, achieved by incrementally injecting sensitive information into the computation. First, we theoretically demonstrate that, when no parties permanently disconnect, our protocol achieves accuracy comparable to that of a centralized setting-already an improvement over most existing decentralized differentially private techniques. Second, we empirically show that our use of low-variance correlated noise significantly mitigates the accuracy loss experienced by existing techniques in the presence of dropouts.

Figures

Figures reproduced from arXiv: 2506.03746 by the authors.

Figure 1
Figure 1. MSE of Local DP, Central DP, IncA and Muffliato using a Hypercube graph for 𝑛 = 2 10 , 𝜀 = 0.1 and 𝛿 = 10−5 . The MSE of IncA is in function of 𝑛𝐻 in the 𝑥-axis. adversary by reporting the mean privacy loss under Pairwise Net￾work DP (PNDP). We show the error of IncA under E-DP, where there are no corrupted parties and C-DP, where the proportion of corrupted parties varies in the 𝑥-axis from 0 to 0.7 (the error unde… view at source ↗
Figure 2
Figure 2. Percentage of success in function of the number of iterations (figures 2a and 2c) and the number of messages (Figure [PITH_FULL_IMAGE:figures/full_fig_p011_2.png] view at source ↗
Figure 3
Figure 3. Minimum number of iterations (and messages since [PITH_FULL_IMAGE:figures/full_fig_p011_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Mean Squared Error (MSE) in function of the propor [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

63 extracted references · 50 canonical work pages

  1. [1]

    Naman Agarwal, Peter Kairouz, and Ziyu Liu. 2021. The skellam mechanism for differentially private federated learning. Advances in Neural Information Processing Systems 34 (2021), 5052–5064

    work page 2021

  2. [2]

    Youssef Allouah, Anastasia Koloskova, Aymane El Firdoussi, Martin Jaggi, and Rachid Guerraoui. 2024. The Privacy Power of Correlated Noise in Decentralized Learning. arXiv preprint arXiv:2405.01031 (2024)

    work page Pith review arXiv 2024

  3. [3]

    Borja Balle, James Bell, Adria Gascón, and Kobbi Nissim. 2020. Private summation in the multi-message shuffle model. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security . 657–676

    work page 2020

  4. [4]

    Antoine Barczewski, Amal Mawass, and Jan Ramon. 2025. Differentially Private Empirical Cumulative Distribution Functions. arXiv preprint arXiv:2502.06651 (2025)

    work page Pith review arXiv 2025

  5. [5]

    2023.{ACORN}: input validation for secure aggrega- tion

    James Bell, Adrià Gascón, Tancrède Lepoint, Baiyu Li, Sarah Meiklejohn, Mariana Raykova, and Cathie Yun. 2023.{ACORN}: input validation for secure aggrega- tion. In 32nd USENIX Security Symposium (USENIX Security 23) . 4805–4822

    work page 2023

  6. [6]

    James Henry Bell, Kallista A Bonawitz, Adrià Gascón, Tancrède Lepoint, and Mariana Raykova. 2020. Secure single-server aggregation with (poly) logarithmic overhead. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security. 1253–1269

    work page 2020

  7. [7]

    Enrique Tomás Martínez Beltrán, Mario Quiles Pérez, Pedro Miguel Sánchez Sánchez, Sergio López Bernal, Gérôme Bovet, Manuel Gil Pérez, Grego- rio Martínez Pérez, and Alberto Huertas Celdrán. 2023. Decentralized federated learning: Fundamentals, state of the art, frameworks, trends, and challenges.IEEE Communications Surveys & Tutorials 25, 4 (2023), 2983–3013

    work page 2023

  8. [8]

    Raphaël Berthier, Francis Bach, and Pierre Gaillard. 2020. Accelerated gossip in networks of given dimension using jacobi polynomial iterations. SIAM Journal on Mathematics of Data Science 2, 1 (2020), 24–47

    work page 2020

Show all 63 references
  1. [9]

    Akash Bharadwaj and Graham Cormode. 2024. Federated computation: a survey of concepts and challenges. Distributed and Parallel Databases 42, 3 (2024), 299– 335

    2024

  2. [10]

    Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth. 2017. Prac- tical secure aggregation for privacy-preserving machine learning. In proceedings of the 2017 ACM SIGSAC Conference on Comput...

    2017

  3. [11]

    Stephen Boyd, Arpita Ghosh, Balaji Prabhakar, and Devavrat Shah. 2006. Ran- domized gossip algorithms. IEEE transactions on information theory 52, 6 (2006), 2508–2530

    2006

  4. [12]

    Wei-Ning Chen, Peter Kairouz, and Ayfer Ozgur. 2020. Breaking the communication-privacy-accuracy trilemma. Advances in Neural Information Processing Systems 33 (2020), 3312–3324

    2020

  5. [13]

    Wei-Ning Chen, Ayfer Ozgur, and Peter Kairouz. 2022. The poisson binomial mechanism for unbiased federated learning with secure aggregation. In Interna- tional Conference on Machine Learning . PMLR, 3490–3506

    2022

  6. [14]

    Albert Cheu, Adam Smith, Jonathan Ullman, David Zeber, and Maxim Zhilyaev

  7. [15]

    Edwige Cyffers and Aurélien Bellet. 2022. Privacy amplification by decentral- ization. In International Conference on Artificial Intelligence and Statistics . PMLR, 5334–5353

    2022

  8. [16]

    Edwige Cyffers, Aurélien Bellet, and Jalaj Upadhyay. 2024. Differentially private decentralized learning with random walks.arXiv preprint arXiv:2402.07471 (2024)

    2024 arXiv

  9. [17]

    Edwige Cyffers, Mathieu Even, Aurélien Bellet, and Laurent Massoulié. 2022. Muffliato: Peer-to-peer privacy amplification for decentralized optimization and averaging. Advances in Neural Information Processing Systems 35 (2022), 15889– 15902

    2022

  10. [18]

    Ivan Damgård, Marcel Keller, Enrique Larraia, Valerio Pastro, Peter Scholl, and Nigel P Smart. 2013. Practical covertly secure MPC for dishonest majority–or: breaking the SPDZ limits. In Computer Security–ESORICS 2013: 18th European Symposium on Research in Computer Security, ...

    2013

  11. [19]

    Alan Demers, Dan Greene, Carl Hauser, Wes Irish, John Larson, Scott Shenker, Howard Sturgis, Dan Swinehart, and Doug Terry. 1987. Epidemic algorithms for replicated database maintenance. In Proceedings of the sixth annual ACM Symposium on Principles of distributed computing . 1–12

    1987

  12. [20]

    Bolin Ding, Janardhan Kulkarni, and Sergey Yekhanin. 2017. Collecting telemetry data privately. Advances in Neural Information Processing Systems 30 (2017)

    2017

  13. [21]

    John C Duchi, Michael I Jordan, and Martin J Wainwright. 2013. Local privacy and statistical minimax rates. In FOCS

    2013

  14. [22]

    John C Duchi, Michael I Jordan, and Martin J Wainwright. 2013. Local pri- vacy, data processing inequalities, and statistical minimax rates. arXiv preprint arXiv:1302.3203 (2013)

    2013 arXiv

  15. [23]

    Sanghamitra Dutta, Gauri Joshi, Soumyadip Ghosh, Parijat Dube, and Priya Nagpurkar. 2018. Slow and stale gradients can win the race: Error-runtime trade- offs in distributed SGD. In International conference on artificial intelligence and statistics. PMLR, 803–812

    2018

  16. [24]

    Cynthia Dwork, Krishnaram Kenthapadi, Frank McSherry, Ilya Mironov, and Moni Naor. 2006. Our data, ourselves: Privacy via distributed noise generation. In Advances in cryptology-EUROCRYPT 2006: 24th annual international conference on the theory and applications of cryptographi...

    2006

  17. [25]

    Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. 2006. Cali- brating noise to sensitivity in private data analysis. In Theory of Cryptography: Third Theory of Cryptography Conference, TCC 2006, New York, NY, USA, March 4-7, 2006. Proceedings 3 . Springer, 265–284

    2006

  18. [26]

    Cynthia Dwork and Aaron Roth. 2014. The Algorithmic Foundations of Differen- tial Privacy. Foundations and Trends in Theoretical Computer Science 9, 3–4 (2014), 1–277

    2014

  19. [27]

    Cynthia Dwork, Aaron Roth, et al. 2014. The algorithmic foundations of differ- ential privacy. Foundations and Trends® in Theoretical Computer Science 9, 3–4 (2014), 211–407

    2014

  20. [28]

    Úlfar Erlingsson, Vasyl Pihur, and Aleksandra Korolova. 2014. Rappor: Random- ized aggregatable privacy-preserving ordinal response. In Proceedings of the 2014 ACM SIGSAC conference on computer and communications security . 1054–1067

    2014

  21. [29]

    Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller

  22. [30]

    Badih Ghazi, Ravi Kumar, Pasin Manurangsi, and Rasmus Pagh. 2020. Private counting from anonymous messages: Near-optimal accuracy with vanishing communication overhead. InInternational Conference on Machine Learning. PMLR, 3505–3514

    2020

  23. [31]

    Rachid Guerraoui and Luis Rodrigues. 2006. Introduction to reliable distributed programming. Springer Science & Business Media

    2006

  24. [32]

    Suyog Gupta, Wei Zhang, and Fei Wang. 2016. Model accuracy and runtime tradeoff in distributed deep learning: A systematic study. In 2016 IEEE 16th International Conference on Data Mining (ICDM) . IEEE, 171–180

    2016

  25. [33]

    István Hegedűs, Gábor Danner, and Márk Jelasity. 2021. Decentralized learning works: An empirical comparison of gossip learning and federated learning. J. Parallel and Distrib. Comput. 148 (2021), 109–124

    2021

  26. [34]

    Mikko A Heikkilä. 2025. On Using Secure Aggregation in Differentially Private Federated Learning with Multiple Local Steps. Transactions on Machine Learning Research (2025)

    2025

  27. [35]

    Hafiz Imtiaz, Jafar Mohammadi, and Anand D Sarwate. 2019. Distributed differ- entially private computation of functions with correlated noise. arXiv preprint arXiv:1904.10059 (2019)

    2019 arXiv

  28. [36]

    Yuval Ishai, Eyal Kushilevitz, Rafail Ostrovsky, and Amit Sahai. 2006. Cryptog- raphy from anonymity. In 2006 47th Annual IEEE Symposium on Foundations of Computer Science (FOCS’06). IEEE, 239–248

    2006

  29. [37]

    Bargav Jayaraman, Lingxiao Wang, David Evans, and Quanquan Gu. 2018. Dis- tributed learning without distress: Privacy-preserving empirical risk minimiza- tion. Advances in neural information processing systems 31 (2018)

    2018

  30. [38]

    Peter Kairouz, Keith Bonawitz, and Daniel Ramage. 2016. Discrete distribution estimation under local privacy. In International Conference on Machine Learning . PMLR, 2436–2444

    2016

  31. [39]

    Peter Kairouz, Ziyu Liu, and Thomas Steinke. 2021. The distributed discrete gauss- ian mechanism for federated learning with secure aggregation. In International Conference on Machine Learning . PMLR, 5201–5212

    2021

  32. [40]

    Peter Kairouz, H Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Ben- nis, Arjun Nitin Bhagoji, Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, et al. 2021. Advances and open problems in federated learning. Foundations and trends® in machine learnin...

    2021

  33. [41]

    Peter Kairouz, Sewoong Oh, and Pramod Viswanath. 2014. Extremal mechanisms for local differential privacy. Advances in neural information processing systems 27 (2014)

    2014

  34. [42]

    Sanjay Kariyappa, Chuan Guo, Kiwan Maeng, Wenjie Xiong, G Edward Suh, Moinuddin K Qureshi, and Hsien-Hsin S Lee. 2023. Cocktail party attack: Breaking aggregation-based privacy in federated learning using independent component analysis. In International Conference on Machine L...

    2023

  35. [43]

    Shiva Prasad Kasiviswanathan, Homin K Lee, Kobbi Nissim, Sofya Raskhodnikova, and Adam Smith. 2011. What can we learn privately? SIAM J. Comput. 40, 3 (2011), 793–826

    2011

  36. [44]

    Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. 2017. Communication-efficient learning of deep net- works from decentralized data. In Artificial intelligence and statistics . PMLR, 1273–1282

    2017

  37. [45]

    Luca Melis, Congzheng Song, Emiliano De Cristofaro, and Vitaly Shmatikov

  38. [46]

    Ilya Mironov. 2017. Rényi differential privacy. In2017 IEEE 30th computer security foundations symposium (CSF). IEEE, 263–275

    2017

  39. [47]

    Abdellah El Mrini, Edwige Cyffers, and Aurélien Bellet. 2024. Privacy Attacks in Decentralized Learning. arXiv preprint arXiv:2402.10001 (2024)

    2024 arXiv

  40. [48]

    In 2019 IEEE symposium on security and privacy (SP)

    Exploiting unintended feature leakage in collaborative learning. In 2019 IEEE symposium on security and privacy (SP) . IEEE, 691–706. , , Sabater et al

    2019

  41. [49]

    Julien Nicolas, César Sabater, Mohamed Maouche, Sonia Ben Mokhtar, and Mark Coates. 2025. Secure Federated Graph-Filtering for Recommender Systems. arXiv preprint arXiv:2501.16888 (2025)

    2025 arXiv

  42. [50]

    Dario Pasquini, Mathilde Raynal, and Carmela Troncoso. 2023. On the (in) security of peer-to-peer decentralized machine learning. In 2023 IEEE Symposium on Security and Privacy (SP) . IEEE, 418–436

    2023

  43. [51]

    Julien Nicolas, César Sabater, Mohamed Maouche, Sonia Ben Mokhtar, and Mark Coates. 2024. Differentially private and decentralized randomized power method. arXiv preprint arXiv:2411.01931 (2024)

    2024 arXiv

  44. [52]

    César Sabater, Aurélien Bellet, and Jan Ramon. 2022. An accurate, scalable and verifiable protocol for federated differentially private averaging. Machine Learning 111, 11 (2022), 4249–4293

    2022

  45. [53]

    César Sabater, Florian Hahn, Andreas Peter, and Jan Ramon. 2023. Private sam- pling with identifiable cheaters. Proceedings on Privacy Enhancing Technologies 2023, 2 (2023)

    2023

  46. [54]

    Boris Pittel. 1987. On spreading a rumor. SIAM J. Appl. Math. 47, 1 (1987), 213–223

    1987

  47. [55]

    Riccardo Taiello, Melek Önen, Clémentine Gritti, and Marco Lorenzi. 2024. Let Them Drop: Scalable and Efficient Federated Learning Solutions Agnostic to Stragglers. In Proceedings of the 19th International Conference on A vailability, Reliability and Security. 1–12

    2024

  48. [56]

    Ousmane Touat, Jezekael Brunon, Yacine Belal, Julien Nicolas, Mohamed Maouche, César Sabater, and Sonia Ben Mokhtar. 2024. Scrutinizing the Vulnera- bility of Decentralized Learning to Membership Inference Attacks. arXiv preprint arXiv:2412.12837 (2024)

    2024

  49. [57]

    Jinhyun So, Başak Güler, and A Salman Avestimehr. 2021. Turbo-aggregate: Breaking the quadratic aggregation barrier in secure federated learning. IEEE Journal on Selected Areas in Information Theory 2, 1 (2021), 479–489

    2021

  50. [58]

    Jianyu Wang, Anit Kumar Sahu, Zhouyi Yang, Gauri Joshi, and Soummya Kar

  51. [59]

    Andrew C Yao. 1982. Protocols for secure computations. In 23rd annual sympo- sium on foundations of computer science (sfcs 1982) . IEEE, 160–164. A Missing Theoretical Material A.1 Proof of Lemma 3.5 Lemma 3.5. DEI andDInc are Valid Gaussians. Proof.DEI is a(𝑐,𝑍)-Gaussian wher...

    1982

  52. [60]

    Sajani Vithana, Viveck R Cadambe, Flavio P Calmon, and Haewon Jeong. 2025. Correlated privacy mechanisms for differentially private distributed mean es- timation. In 2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML). IEEE, 590–614

    2025

  53. [62]

    In 2019 Sixth Indian Control Conference (ICC)

    MATCHA: Speeding up decentralized SGD via matching decomposition sampling. In 2019 Sixth Indian Control Conference (ICC) . IEEE, 299–300

    2019

  54. [2019]

    Distributed differential privacy via shuffling. In Advances in Cryptology– EUROCRYPT 2019: 38th Annual International Conference on the Theory and Ap- plications of Cryptographic Techniques, Darmstadt, Germany, May 19–23, 2019, Proceedings, Part I 38 . Springer, 375–403

    2019

  55. [2020]

    Inverting gradients-how easy is it to break privacy in federated learning? Advances in neural information processing systems 33 (2020), 16937–16947

    2020

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.