Pith. sign in

REVIEW 2 major objections 4 minor 37 references

Decentralized Optimization with Amplified Privacy via Efficient Communication

T0 review · 2 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read By keeping only the k largest coordinates of each update and waking each agent with probability p, decentralized optimization meets the same (ε,δ)-differential privacy guarantee with only a kp²/d fraction of the Gaussian noise —…

desk verdict The privacy amplification claim rests on misapplying subsampling amplification to a data-dependent Top-k sparsifier, so Theorem 1 is not established. read the letter →

arxiv 2506.07102 v1 pith:YP5VJIIM submitted 2025-06-08 eess.SY cs.SY

Wei Huo , Changxin Liu , Kemi Ding , Karl Henrik Johansson , Ling Shi This is my paper
classification eess.SYcs.SY MSC 68W1590C1568P27
keywords decentralizedoptimizationdifferentialprivacycommunicationefficiencysparsificationrandomactivationnon-convexamplificationmomentumSGD
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that communicating less makes decentralized optimization more private, not merely cheaper. It proposes DO-ADP, a decentralized momentum SGD algorithm in which each agent transmits only its $k$ largest-magnitude coordinates (Top-$k$ sparsification) and is randomly activated with probability $p$ each round, and it argues that both features reduce the sensitivity of the released gradient, so the Gaussian noise needed for a target $(\varepsilon,\delta)$-differential privacy guarantee drops by the factor $kp^2/d$. If the result is correct, privacy and communication efficiency are not competing costs in distributed learning but mutually reinforcing ones, and the noise saved can be spent on higher optimization accuracy. The paper backs the claim with a convergence analysis for non-convex objectives that bounds the average squared gradient norm, and with experiments on logistic regression and CNN training showing better accuracy at fixed privacy when communication is sparser.

What carries the argument

The argument is carried by the privacy-amplification factor $kp^2/d$, assembled from three standard DP building blocks: the Gaussian mechanism (Lemma 1) calibrated to a sensitivity reduced by sparsification from $2G$ to $\sqrt{4kG^2/d}$; the subsampling amplification lemma (Lemma 4) applied to random agent activation (probability $p$) and to drawing one of $q$ local samples; and the advanced composition rule (Lemma 5) over $T$ iterations, closed by the post-processing property (Lemma 6). The per-iteration privacy loss enters as $\varepsilon_t = 2\sqrt{2k\log(1.25/\delta_0)}\,G/(\sigma\sqrt d)$, and its squared value summed over the $T$ iterations is what the conditions on $\sigma$ and $T$ keep below $1$, yielding the $\sigma^2$ bound of Theorem 1. On the optimization side, the mechanism is a momentum-SGD update that communicates Top-$k$-sparsified differences $x_{i,t+1}-\hat x_{i,t}$ against a publicly maintained copy, with the consensus step size $\gamma = \rho p k/(d(16\rho+\rho^2+4\phi^2+2\rho\phi^2)-8\rho p k)$ tuned to the graph's spectral gap $\rho$ so that Lemma 3 keeps the consensus error bounded.

What would settle it

Take two neighboring datasets whose gradients differ in a single coordinate that Top-$k$ would transmit for one dataset and withhold for the other; an observer of the transmitted coordinate indices could then tell which dataset was used with probability close to 1, which is incompatible with the claimed $(\varepsilon,\delta)$-DP unless the index set itself is folded into the sensitivity calculation — so the guarantee can be checked by measuring how much the transmitted index set alone leaks about the data.

Watch

Extended reading notes

Core claim

The paper's central claim is a privacy-amplification rule for decentralized non-convex optimization. Theorem 1 states that DO-ADP is $(\varepsilon,\delta)$-differentially private whenever the Gaussian noise variance satisfies $\sigma^2 \geq 160kp^2T\log(1.25/\delta_0)G^2/(q^2d\varepsilon^2)$, with the factor $kp^2/d$ splitting into two effects: Top-$k$ sparsification lowers the $\ell_2$-sensitivity of each transmitted gradient message to $\sqrt{4kG^2/d}$, and random activation behaves as a subsampling step that amplifies the per-iteration privacy guarantee. Against the standard noise requirement $\Omega(T\log(1.25/\delta_0)G^2/(q^2\varepsilon^2))$ for non-sparsified, always-active protocols, the algorithm thus needs less noise for the same privacy level, and the freed noise can be reinvested in accuracy: Corollary 1 bounds the average squared gradient norm by the rate in (9). The paper further claims this is the first treatment of how efficient communication amplifies differential privacy in decentralized non-convex optimization, in contrast to earlier work that treats compression and perturbation as independent sources of error.

Load-bearing premise

The privacy proof assumes that the Top-$k$ sparsifier acts like a random subsample of the data, even though Top-$k$ chooses which coordinates to send by looking at the gradient values themselves, so the released coordinate set is data-dependent and the amplification lemma for random subsampling does not automatically apply.

Editorial extensions

If this is right

  • The same $(\varepsilon,\delta)$-differential privacy guarantee can be met with Gaussian noise variance reduced by the factor $kp^2/d$: sending fewer coordinates (smaller $k$) and waking agents less often (smaller $p$) both relax the noise requirement, so communication savings buy privacy directly.
  • With the noise budget freed up, Corollary 1 bounds the average squared gradient norm by a first-order stationary-point rate with linear speed-up in the number of agents $n$; the noise level $\sigma$ enters both the dominant and higher-order terms while the sparsification ratio enters only the higher-order term, so the noise reduction outweighs the information loss from sparse communication.
  • The trade-off improves on all three axes at once — privacy, accuracy, and communication cost — as the experiments on logistic regression and CNN training show: at a fixed privacy budget $\varepsilon$, lower communication resource utilization gives lower suboptimality and higher test accuracy.
  • Because the amplification comes from the protocol itself rather than from extra noise, DO-ADP separates compression and perturbation so they compound instead of accumulating errors, and the guarantee holds without any central aggregator.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An extension the paper leaves implicit: replacing Top-$k$ with a data-independent sparsifier (Bernoulli or uniform random-$k$) would put the subsampling-amplification step on fully rigorous footing while preserving the same $kp^2/d$ noise reduction; the accuracy gap between the two variants, which the same experimental setup could measure, is the price of a provable rather than an assumed privacy
  • The same sensitivity-reduction logic suggests a general design rule: any communication rule that provably lowers the sensitivity of the released message — random activation, event-triggered transmission, or coordinate sampling chosen independently of the data — can be slotted into the DP analysis as a privacy amplifier, making communication efficiency a first-class privacy tool across decentralize
  • A sharper test of the mechanism than the paper's accuracy plots: hold the privacy budget and the noise fixed, vary only $k$ and $p$, and measure the empirical privacy loss (for example with a membership-inference attack on the transmitted coordinate set); if a sparser configuration leaks less at equal noise, the amplification mechanism is observable directly rather than only through the accuracy–p
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 4 minor

Summary. The paper proposes DO-ADP, a decentralized stochastic optimization algorithm that combines random agent activation, Gaussian noise injection, and Top-k sparsified communication. The main theoretical claim is Theorem 1: under Assumption 2 and a lower bound on the noise variance σ² ≥ 160 k p² T log(1.25/δ0) G²/(q² d ε²), Algorithm 1 satisfies (ε,δ)-DP, so sparsification and random activation reduce the noise required for privacy by a factor k p²/d. The paper also proves a non-asymptotic convergence bound for first-order stationary points and reports experiments on logistic regression and CNN training.

Significance. If the privacy theorem were valid, the result would be significant: it would quantify a privacy amplification effect from communication sparsification in decentralized non-convex optimization, improving on prior work that treats compression and privacy separately. The convergence analysis is detailed and the experiments are informative, and the random-activation component is a legitimate privacy amplification mechanism. However, the central privacy claim depends on treating Top-k sparsification as a data-independent subsampling operation, which it is not; the main theorem is therefore unsupported as written.

major comments (2)
  1. [§IV, proof of Theorem 1, Eqs. (6)-(7)] The proof applies Lemma 4 to 'the subsampling (including random activation and sparsification)'. Lemma 4 is a standard amplification result for data-independent subsampling operations: PoisSample_p drops agents independently of the data, and DataSample_{q,1} selects a data sample uniformly. The Top-k sparsifier S(·) is not such an operation. The coordinate set c_t^i is selected from x_i,t+1 - x_hat_i,t, which depends on the private gradient g_i,t and on previous private states, and the indices in c_t^i are part of the released message s_i,t. The released object is the pair (c_t^i, [g_i,t + θ_i,t]_{c_t^i}), whereas Eq. (6) computes the sensitivity only for the restricted value vector, treating c_t^i as fixed. The privacy loss from revealing which coordinates have the largest magnitude is not accounted for. Consequently, the k/d reduction in the variance bound (7) and the amplification claim in Remark 1 are not established by the proof. A valid analysis would need to treat the support as part of the query output, which would remove the claimed improvement, or would need to replace Top-k with a data-independent sparsifier.
  2. [§IV, final paragraph of Theorem 1 proof] The post-processing argument at the end of the proof is not sufficient to repair the gap. Post-processing preserves DP only if the mechanism feeding the post-processing step is itself DP on the full vector from which the messages are computed. Here the Top-k operation is applied inside the alleged private mechanism before the message is released, so the post-processing step merely transfers the (unproven) privacy of the sparse output to the transmitted message; it does not restore the missing accounting for the data-dependent support.
minor comments (4)
  1. [§IV, Eq. (8)] The constant C in the expression for ε_t^2 is undefined; it should be G from Assumption 2.
  2. [Algorithm 1, line 1] The loop variable is written as k, which collides with the sparsification parameter k used throughout the paper; the loop should use t for consistency with the update equations.
  3. [Definition 2] The definition says the entries of x are reordered before defining e, but then writes S(x)=x⊙e without clarifying whether the mask is data-dependent or how the reordering interacts with the coordinate-set notation c_t^i used later.
  4. [Theorem 1 statement] The theorem states that Algorithm 1 is (ε,δ)-DP 'for some constant δ∈(0,1]', but the proof defines δ via the composition argument; the explicit expression for δ in terms of δ0, p, q, and T should be stated.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity; the central privacy and convergence bounds are derived from external standard results and stated assumptions, though the Top-k subsampling step is a correctness gap rather than a circular reduction.

full rationale

I walked the derivation chain and found no step in which a claimed prediction or first-principles result is equivalent to its inputs by construction. Theorem 1's privacy bound is derived from Assumption 2 via the sensitivity bound (6), the Gaussian mechanism (Lemma 1), subsampling amplification (Lemma 4), composition (Lemma 5), and post-processing (Lemma 6), which are cited standard external results (Steinke; Kairouz et al.; Dwork et al.) and are not the authors' own fitted or defined quantities. No parameter is fitted to a subset of data and then renamed as a prediction: the noise variance (7) is a closed-form expression in k, p, T, q, d, G, epsilon, delta_0, and the convergence bounds in Corollary 1 follow from Assumptions 1–3 by standard momentum/SGD arguments. The authors do cite their own prior work ([8], [15]–[17]), but those citations are contextual (event-triggered communication, compression-based privacy baselines, and a survey) and are not load-bearing for the claimed kp^2/d noise reduction. The most serious concern is a correctness gap, not circularity: the proof invokes Lemma 4 for 'subsampling (including random activation and sparsification)' even though Top-k sparsification selects coordinates based on the data-dependent vector being released, so the support c_t^i itself leaks information. That is an invalid or at least unsupported application of a standard lemma, but it is not a circular reduction of the theorem to its own input. The central derivation is self-contained against external, independently established results, so the circularity score is low.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The central result introduces no new physical or mathematical entities and fits no constants to data. The load-bearing assumptions are the standard smoothness, bounded-gradient, and network conditions plus one inadmissible assumption that the subsampling amplification lemma applies to the data-dependent Top-k sparsifier.

assumptions (4)
  • domain assumption Each loss function is L-smooth and stochastic gradients have bounded variance (Assumption 1).
    Standard in non-convex optimization; used throughout the convergence proofs (Section II-A).
  • domain assumption Per-coordinate gradient bound |[∇l_i]j| ≤ G/√d (Assumption 2).
    Needed for the sensitivity bound in (6); can be enforced by gradient clipping.
  • domain assumption The weight matrix W is symmetric, doubly stochastic, and has a positive spectral gap (Assumption 3).
    Standard in decentralized optimization; used in Lemma 3 and Theorem 2.
  • ad hoc to paper The subsampling amplification lemma (Lemma 4) applies to Top-k sparsification.
    The proof of Theorem 1 uses this lemma for 'the subsampling including random activation and sparsification', but the lemma requires data-independent subsampling and Top-k is data-dependent, so the assumption is inadmissible as stated.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Decentralized Optimization with Amplified Privacy via Efficient Communication." pith.science (2026). https://pith.science/paper/YP5VJIIM

@misc{pith2026250607102,
  author       = {Pith},
  title        = {Pith review of: Decentralized Optimization with Amplified Privacy via Efficient Communication},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YP5VJIIM}},
  note         = {Machine review of arXiv:2506.07102}
}
read the original abstract

Decentralized optimization is crucial for multi-agent systems, with significant concerns about communication efficiency and privacy. This paper explores the role of efficient communication in decentralized stochastic gradient descent algorithms for enhancing privacy preservation. We develop a novel algorithm that incorporates two key features: random agent activation and sparsified communication. Utilizing differential privacy, we demonstrate that these features reduce noise without sacrificing privacy, thereby amplifying the privacy guarantee and improving accuracy. Additionally, we analyze the convergence and the privacy-accuracy-communication trade-off of the proposed algorithm. Finally, we present experimental results to illustrate the effectiveness of our algorithm.

Figures

Figures reproduced from arXiv: 2506.07102 by the authors.

Figure 1
Figure 1. DP amplified by random activation and sparsification. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Performance of DO-ADP. During each iteration, the [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 4
Figure 4. Decentralized CNN training under DO-ADP with [PITH_FULL_IMAGE:figures/full_fig_p008_4.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

37 extracted references · 27 canonical work pages

  1. [1]

    Can decentralized algorithms outperform centralized algorithms? A case study for decentralized parallel stochastic gradient descent,

    X. Lian, C. Zhang, H. Zhang, C.-J. Hsieh, W. Zhang, and J. Liu, “Can decentralized algorithms outperform centralized algorithms? A case study for decentralized parallel stochastic gradient descent,”Advances in Neural Information Processing Systems, vol. 30, 2017

    2017

  2. [2]

    Distributed compressive spectrum sensing in cooperative multihop cognitive networks,

    F. Zeng, C. Li, and Z. Tian, “Distributed compressive spectrum sensing in cooperative multihop cognitive networks,”IEEE Journal of Selected Topics in Signal Processing, vol. 5, no. 1, pp. 37–48, 2010

    work page 2010

  3. [3]

    Distributed stochastic gradient tracking methods,

    S. Pu and A. Nedi ´c, “Distributed stochastic gradient tracking methods,” Mathematical Programming, vol. 187, no. 1, pp. 409–457, 2021

    2021

  4. [4]

    On the linear convergence of the ADMM in decentralized consensus optimization,

    W. Shi, Q. Ling, K. Yuan, G. Wu, and W. Yin, “On the linear convergence of the ADMM in decentralized consensus optimization,” IEEE Transactions on Signal Processing, vol. 62, no. 7, pp. 1750–1761, 2014

    2014

  5. [5]

    Language models are unsupervised multitask learners,

    A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, I. Sutskeveret al., “Language models are unsupervised multitask learners,”OpenAI Blog, vol. 1, no. 8, p. 9, 2019

    work page 2019

  6. [6]

    Deep leakage from gradients,

    L. Zhu, Z. Liu, and S. Han, “Deep leakage from gradients,”Advances in Neural Information Processing Systems, vol. 32, 2019

    work page 2019

  7. [7]

    Membership inference attacks against machine learning models via prediction sensitivity,

    L. Liu, Y . Wang, G. Liu, K. Peng, and C. Wang, “Membership inference attacks against machine learning models via prediction sensitivity,”IEEE Transactions on Dependable and Secure Computing, vol. 20, no. 3, pp. 2341–2347, 2023

    work page 2023

  8. [8]

    Distributed Nash equilibrium seeking with stochastic event-triggered mechanism,

    W. Huo, K. F. E. Tsang, Y . Yan, K. H. Johansson, and L. Shi, “Distributed Nash equilibrium seeking with stochastic event-triggered mechanism,”Automatica, vol. 162, p. 111486, 2024

    work page 2024

Show all 37 references
  1. [9]

    An exact quantized decentralized gradient descent algorithm,

    A. Reisizadeh, A. Mokhtari, H. Hassani, and R. Pedarsani, “An exact quantized decentralized gradient descent algorithm,”IEEE Transactions on Signal Processing, vol. 67, no. 19, pp. 4934–4947, 2019

    2019

  2. [10]

    Error-compensated sparsification for communication-efficient decentralized training in edge environment,

    H. Wang, S. Guo, Z. Qu, R. Li, and Z. Liu, “Error-compensated sparsification for communication-efficient decentralized training in edge environment,”IEEE Transactions on Parallel and Distributed Systems, vol. 33, no. 1, pp. 14–25, 2021

    2021

  3. [11]

    Differential privacy,

    C. Dwork, “Differential privacy,” inInternational Colloquium on Au- tomata, Languages, and Programming. Springer, 2006, pp. 1–12

    2006

  4. [12]

    Differentially private distributed optimization,

    Z. Huang, S. Mitra, and N. Vaidya, “Differentially private distributed optimization,” inProceedings of the 16th International Conference on Distributed Computing and Networking, 2015, pp. 1–10

    2015

  5. [13]

    Differentially private distributed optimization via state and direction perturbation in multiagent systems,

    T. Ding, S. Zhu, J. He, C. Chen, and X. Guan, “Differentially private distributed optimization via state and direction perturbation in multiagent systems,”IEEE Transactions on Automatic Control, vol. 67, no. 2, pp. 722–737, 2021

    2021

  6. [14]

    Quantization enabled privacy protection in decentralized stochastic optimization,

    Y . Wang and T. Bas ¸ar, “Quantization enabled privacy protection in decentralized stochastic optimization,”IEEE Transactions on Automatic Control, vol. 68, no. 7, pp. 4038–4052, 2023

    2023

  7. [15]

    Compression- based privacy preservation for distributed Nash equilibrium seeking in aggregative games,

    W. Huo, X. Chen, K. Ding, S. Dey, and L. Shi, “Compression- based privacy preservation for distributed Nash equilibrium seeking in aggregative games,”IEEE Control Systems Letters, vol. 8, pp. 886–891, 2024

    2024

  8. [16]

    Distributed empirical risk minimization with differential privacy,

    C. Liu, K. H. Johansson, and Y . Shi, “Distributed empirical risk minimization with differential privacy,”Automatica, vol. 162, p. 111514, 2024

    2024

  9. [17]

    A survey on secure decentralized optimization and learning,

    C. Liu, N. Bastianello, W. Huo, Y . Shi, and K. H. Johansson, “A survey on secure decentralized optimization and learning,”arXiv preprint arXiv:2408.08628, 2024

    2024 arXiv

  10. [18]

    Dynamic event-triggered and self-triggered control for multi-agent systems,

    X. Yi, K. Liu, D. V . Dimarogonas, and K. H. Johansson, “Dynamic event-triggered and self-triggered control for multi-agent systems,”IEEE Transactions on Automatic Control, vol. 64, no. 8, pp. 3300–3307, 2018

    2018

  11. [19]

    Compressed differen- tially private distributed optimization with linear convergence,

    A. Xie, X. Yi, X. Wang, M. Cao, and X. Ren, “Compressed differen- tially private distributed optimization with linear convergence,”IFAC- PapersOnLine, vol. 56, no. 2, pp. 8369–8374, 2023

    2023

  12. [20]

    Differentially private and communication-efficient distributed nonconvex optimization algorithms,

    ——, “Differentially private and communication-efficient distributed nonconvex optimization algorithms,”arXiv preprint arXiv:2307.16656, 2023

    2023 arXiv

  13. [21]

    Gradient sparsification can improve performance of differentially-private convex machine learning,

    F. Farokhi, “Gradient sparsification can improve performance of differentially-private convex machine learning,” in60th IEEE Confer- ence on Decision and Control, 2021, pp. 1695–1700

    2021

  14. [22]

    Federated learning with sparsified model perturbation: Improving accuracy under client-level differential privacy,

    R. Hu, Y . Guo, and Y . Gong, “Federated learning with sparsified model perturbation: Improving accuracy under client-level differential privacy,” IEEE Transactions on Mobile Computing, vol. 23, no. 8, pp. 8242–8255, 2024

    2024

  15. [23]

    Privacy am- plification via compression: Achieving the optimal privacy-accuracy- communication trade-off in distributed mean estimation,

    W.-N. Chen, D. Song, A. Ozgur, and P. Kairouz, “Privacy am- plification via compression: Achieving the optimal privacy-accuracy- communication trade-off in distributed mean estimation,”Advances in Neural Information Processing Systems, vol. 36, 2024

    2024

  16. [24]

    Adaptive federated optimization,

    S. Reddi, Z. Charles, M. Zaheer, Z. Garrett, K. Rush, J. Kone ˇcn`y, S. Kumar, and H. B. McMahan, “Adaptive federated optimization,”arXiv preprint arXiv:2003.00295, 2020

    2003 arXiv

  17. [25]

    Distributed nonconvex optimization with event-triggered communication,

    L. Xu, X. Yi, Y . Shi, K. H. Johansson, T. Chai, and T. Yang, “Distributed nonconvex optimization with event-triggered communication,”IEEE Transactions on Automatic Control, vol. 69, no. 4, pp. 2745–2752, 2024

    2024

  18. [26]

    Understanding gradient clipping in private SGD: A geometric perspective,

    X. Chen, S. Z. Wu, and M. Hong, “Understanding gradient clipping in private SGD: A geometric perspective,”Advances in Neural Information Processing Systems, vol. 33, pp. 13 773–13 782, 2020

    2020

  19. [27]

    On the linear speedup analysis of communi- cation efficient momentum sgd for distributed non-convex optimization,

    H. Yu, R. Jin, and S. Yang, “On the linear speedup analysis of communi- cation efficient momentum sgd for distributed non-convex optimization,” inInternational Conference on Machine Learning. PMLR, 2019, pp. 7184–7193

    2019

  20. [28]

    Improving the gaussian mechanism for differential privacy: Analytical calibration and optimal denoising,

    B. Balle and Y .-X. Wang, “Improving the gaussian mechanism for differential privacy: Analytical calibration and optimal denoising,” in International Conference on Machine Learning. PMLR, 2018, pp. 394–403

    2018

  21. [29]

    Communication compression for distributed nonconvex optimization,

    X. Yi, S. Zhang, T. Yang, T. Chai, and K. H. Johansson, “Communication compression for distributed nonconvex optimization,”IEEE Transactions on Automatic Control, vol. 68, no. 9, pp. 5477–5492, 2023

    2023

  22. [30]

    DP-ADMM: ADMM-based distributed learning with differential privacy,

    Z. Huang, R. Hu, Y . Guo, E. Chan-Tin, and Y . Gong, “DP-ADMM: ADMM-based distributed learning with differential privacy,”IEEE Transactions on Information Forensics and Security, vol. 15, pp. 1002– 1012, 2019

    2019

  23. [31]

    Large scale multiple kernel learning,

    S. Sonnenburg, G. R ¨atsch, C. Sch ¨afer, and B. Sch ¨olkopf, “Large scale multiple kernel learning,”The Journal of Machine Learning Research, vol. 7, pp. 1531–1565, 2006

    2006

  24. [32]

    The MNIST database of handwritten digit images for machine learning research [best of the web],

    L. Deng, “The MNIST database of handwritten digit images for machine learning research [best of the web],”IEEE Signal Processing Magazine, vol. 29, no. 6, pp. 141–142, 2012

    2012

  25. [33]

    Scikit-learn: Machine learning in python,

    F. Pedregosa, G. Varoquaux, A. Gramfort, V . Michel, B. Thirion, O. Grisel, M. Blondel, P. Prettenhofer, R. Weiss, V . Dubourget al., “Scikit-learn: Machine learning in python,”The Journal of Machine Learning Research, vol. 12, pp. 2825–2830, 2011

    2011

  26. [34]

    Composition of differential privacy & privacy amplification by subsampling,

    T. Steinke, “Composition of differential privacy & privacy amplification by subsampling,”arXiv preprint arXiv:2210.00597, 2022

    2022 arXiv

  27. [35]

    The composition theorem for differential privacy,

    P. Kairouz, S. Oh, and P. Viswanath, “The composition theorem for differential privacy,” inInternational Conference on Machine Learning. PMLR, 2015, pp. 1376–1385

    2015

  28. [36]

    The algorithmic foundations of differential privacy,

    C. Dwork, A. Rothet al., “The algorithmic foundations of differential privacy,”Foundations and Trends® in Theoretical Computer Science, vol. 9, no. 3–4, pp. 211–407, 2014. 9

    2014

  29. [37]

    Decentralized deep learning with arbitrary communication compression,

    A. Koloskova, T. Lin, S. U. Stich, and M. Jaggi, “Decentralized deep learning with arbitrary communication compression,”arXiv preprint arXiv:1907.09356, 2019. APPENDIXA SOMEUSEFULLEMMAS Lemma 4.(Privacy for Subsampling [34]) SupposeMis an(ε, δ)-DP mechanism. LetPoisSample p :U...

    1907 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.