Pith. sign in

REVIEW 5 major objections 5 minor 45 references

Private Aggregation for Byzantine-Resilient Heterogeneous Federated Learning

T0 review · 5 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A protocol that makes Byzantine-resilient federated learning information-theoretically private on heterogeneous data.

desk verdict First attempt to compose NNM with information-theoretic private aggregation, but the central theorem is unproven and the key PIR step is unspecified; treat as a promising design proposal rather than a proven scheme. read the letter →

arxiv 2506.09870 v1 pith:T7ZL2PZV submitted 2025-06-11 cs.LG cs.DCcs.ITmath.ITstat.ML

Maximilian Egger , Rawad Bitar This is my paper
classification cs.LGcs.DCcs.ITmath.ITstat.ML
keywords federatedlearningByzantineresilienceinformation-theoreticprivacynearestneighbormixingsecureaggregationprivateinformationretrievalzero-orderoptimizationdataheterogeneity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that the two main obstacles to private Byzantine-resilient federated learning—data heterogeneity and information-theoretic privacy—can be handled simultaneously. The authors propose a multi-stage protocol that composes nearest neighbor mixing (NNM) preprocessing with robust aggregation such as Krum or Multi-Krum, while hiding individual gradients and neighbor sets from both the federator and colluding clients. The payoff is a single scheme that achieves information-theoretic privacy, Byzantine resilience under data heterogeneity, and communication costs made practical by zero-order gradient estimation. If the construction holds, it would be the first end-to-end private and robust aggregation method that does not degrade on heterogeneous data.

What carries the argument

The central object is the NNM preprocessing step, which replaces each client's gradient by the sum of its $n-b$ nearest neighbors before a distance-based robust aggregation rule is applied. The protocol's machinery is a co-design of (i) information-theoretic verifiable secret sharing [29] to distribute gradients among clients, (ii) shared-randomness padded shares and Reed-Solomon decoding to let the federator compute pairwise distances without seeing gradients, (iii) a symmetric private information retrieval scheme adapted from coded PIR [41] to retrieve a nearest-neighbor sum without revealing the neighbor set, and (iv) re-encoding of the retrieved mixtures so that clients cannot infer other clients' neighbor sets. The whole pipeline turns NNM into an operation that can be evaluated on secret-shared data, which is what makes Krum and Multi-Krum privately usable under heterogeneity.

What would settle it

Instantiate the modified PIR for a small system, say $n=3$, $b=1$, $z=1$, and check whether the federator's queries let it distinguish between two different nearest-neighbor sets of size $2$; if any query transcript or the decoded sum reveals which clients were included beyond the sum itself, the claimed information-theoretic privacy fails. Conversely, a complete proof of the linear-combination PIR extension with collusion and Byzantine resistance would settle the claim.

Watch

Extended reading notes

Core claim

The paper's central claim is that the composition of NNM with any distance-based robust aggregation rule can be run inside a privacy-preserving protocol with information-theoretic guarantees. Concretely, Theorem 1 states that for $n > \max\{3b, 2(z+b)\}$ clients, with at most $b$ Byzantine and $z$ colluding clients, the protocol satisfies the privacy conditions of Definitions 3 and 4, is corruption-resilient against $b$ Byzantine clients, and achieves $(b, \frac{8b}{n-b}(\kappa+1))$-robustness whenever the underlying rule is $(b, \kappa)$-robust. The method works by verifiable secret sharing of gradients, private pairwise distance computation, a modified symmetric private information retrieval step that lets the federator recover sums of nearest-neighbor gradients without learning which clients were summed, re-encoding of mixtures, and a final robust aggregation on the shares. The authors report that on MNIST under several attacks and on SST-2 fine-tuning with RoBERTa-large, NNM improves accuracy over prior private schemes, and zero-order estimation slashes communication cost.

Load-bearing premise

The protocol assumes that the coded private-information-retrieval scheme cited as [41] can be extended to return linear combinations of files—specifically the sum of a client's nearest-neighbor gradients—while still resisting collusion, Byzantine behavior, and information-theoretic leakage, and the paper provides no proof for this extension.

Editorial extensions

If this is right

  • For any number of clients $n > \max\{3b, 2(z+b)\}$, the protocol satisfies the privacy guarantees of Definitions 3 and 4 and remains robust against $b$ Byzantine clients, so NNM-based heterogeneous federated learning can be run with information-theoretic privacy.
  • When built on a $(b, \kappa)$-robust distance-based aggregation rule such as Krum, the composition attains $(b, \frac{8b}{n-b}(\kappa+1))$-robustness, extending NNM's optimality guarantees to the private setting.
  • Per-user communication is $O(d n^2 + n^2)$ and federator communication is $O(d n^2 + n^3)$; coupling this with zero-order gradient estimation reduces the cost by large factors, pushing private aggregation toward practical LLM fine-tuning.
  • Numerical experiments show the protocol outperforms prior private Byzantine-resilient schemes (BREA, ByzSecAgg) on heterogeneous MNIST under ALIE, FOE, Sign Flipping, and Label Flipping attacks, and reaches state-of-the-art SST-2 accuracy under ALIE.
  • The privacy conditions can be relaxed from conditioning on the set of honest clients $C^*$ by adding one more private-sum-retrieval round, as the paper notes in Section IV, step 8.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the missing PIR-extension proof is supplied, the same co-design template—secret sharing, padded distance computation, and private sum retrieval—could be applied to other preprocessing steps that require the federator to learn only a selected sum, not the selection itself.
  • The zero-order results hint that the communication bottleneck of secure aggregation can be broken without hurting Byzantine robustness, but the privacy-utility trade-off of zero-order estimates under adaptive Byzantine attacks is not analyzed and is a natural next question.
  • The protocol relies on shared randomness between clients that is unknown to the federator; an interactive setup could remove this assumption, and the authors themselves flag this as out of scope.
  • The paper's allowance of distance leakage suggests a general principle: leaking low-sensitivity statistics such as pairwise distances may be the price for information-theoretic Byzantine resilience, and future work could characterize which statistics are safe to leak.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes a multi-stage protocol that combines information-theoretic verifiable secret sharing, secure pair-wise distance computation, and a tailored symmetric private information retrieval (PIR) step to make nearest neighbor mixing (NNM) compatible with private and Byzantine-resilient federated learning under data heterogeneity. The stated goal is to let the federator compute the NNM pre-processing followed by a distance-based robust aggregation rule (Krum or Multi-Krum) while guaranteeing information-theoretic privacy from colluding clients and from the federator, and Byzantine resilience for n > max{3b, 2(z+b)}. Theorem 1 claims privacy in the sense of Definitions 3 and 4, corruption resilience against b Byzantine clients, (b, 8b/(n-b)(kappa+1))-robustness when composed with a distance-based (b,kappa)-robust rule, and communication costs O(dn^2+n^2) per user and O(dn^2+n^3) for the federator. The numerical section evaluates NNM with Krum and Multi-Krum under several attacks on MNIST and in a RoBERTa-large fine-tuning task, with and without zero-order gradient estimation, and reports consistent accuracy improvements from NNM.

Significance. If the protocol can be completed as claimed, the paper would close a genuine gap: NNM is known to make robust aggregation near-optimal under heterogeneity, but prior private and Byzantine-resilient aggregation schemes could not incorporate it. The paper also contributes a useful comparison with BREA, ByzSecAgg, and ByITFL, and shows empirically that NNM improves robustness across multiple attacks. The zero-order estimation component is a sensible step toward reducing the communication overhead of private aggregation. However, the main theorem is currently unsupported because the proof is deferred, the key PIR extension is unspecified, and the experiments do not instantiate the private protocol. The contribution is therefore conditional on completing the missing construction and proofs.

major comments (5)
  1. [Section III, Theorem 1] Theorem 1 is the central claim of the paper, yet the manuscript states 'The proofs will be provided in an extended version.' No proof is given for the privacy guarantees, the Byzantine resilience, the (b, 8b/(n-b)(kappa+1))-robustness bound, or the communication costs. A journal submission must provide these proofs in the manuscript itself; deferring the proof of the main theorem to an extended version is not acceptable.
  2. [Section IV, Step 5] The entire privacy mechanism for the nearest-neighbor sets N_j relies on an unspecified extension of the coded PIR scheme of Tajeddine et al. [41]. The text says 'we omit the details of the PIR scheme' and refers to 'carefully modifying' the scheme to return linear combinations of files. There is no theorem or lemma establishing that the modified scheme keeps the query distribution independent of the requested linear combination under any coalition of at most z clients, nor that Reed-Solomon decoding still tolerates b Byzantine servers when the desired object is a sum of files rather than a single file. If this extension does not exist or leaks the coefficient vector, the mutual-information equalities in Theorem 1(1) collapse and the reconstructed mixtures in Steps 7 and 8 are not trustworthy. The authors need to provide the construction or a rigorous reduction to [41].
  3. [Section III, Theorem 1(3) vs. Section IV, Step 5] The communication bound in Theorem 1 appears inconsistent with the protocol description. Step 5 states that the per-client communication for one private sum retrieval is O(dn+n^2), and the protocol text says the retrieval steps 'should be repeated for each j in [n].' Repeating n times would give O(dn^2+n^3) per user, not the O(dn^2+n^2) claimed in Theorem 1(3). If the costs are amortized across all retrievals, or if the PIR queries for different j can be batched, the text should say so explicitly and the theorem statement should match the protocol.
  4. [Section IV, Steps 5 and 8; Section V] The numerical evaluation does not implement the private protocol. It runs NNM followed by Krum or Multi-Krum on plaintext gradients (with SGD or zero-order estimates) and compares these with BREA and ByzSecAgg represented by SGD-MKR. No secret sharing, no PIR, no federator-side distance reconstruction, and no Byzantine share aggregation is simulated. Consequently, the experiments provide evidence only for the non-private NNM component and the zero-order estimation method; they do not validate the privacy or Byzantine-resilience claims of Theorem 1. The claims should be scoped accordingly.
  5. [Section II, Definitions 1 and 2; Section III, Theorem 1(2)] The robustness claim in Theorem 1(2) assumes that the (b,kappa)-robustness guarantee of the underlying distance-based rule transfers to the quantized finite-field setting and to the NNM definition that uses sums instead of averages. The paper cites [33] but gives no argument that stochastic quantization with mu levels and field size q preserves the distance ordering or the robustness constants, nor that the unnormalized NNM of Definition 2 satisfies the same robustness properties as the normalized version. This transfer is load-bearing for Theorem 1(2) and needs a proof or a precise reference with a stated adaptation.
minor comments (5)
  1. [Section III, Theorem 1(1) vs. Definition 3] The privacy guarantee in Theorem 1 is conditioned additionally on the set C* of clients declared honest, which is weaker than Definition 3. The text notes this and says the full guarantee can be restored, but the required modification is not described. Please clarify this gap explicitly in the theorem statement.
  2. [Section V, Figure 1] The main text says 'We provide in Fig. 1 the accuracy for SF over time,' but the Figure 1 caption refers to a 'label flipping attack.' Please align the caption and the text.
  3. [Section IV, Step 6] The re-encoding step writes g_j(x) with coefficients s_{i,t} indexed by i, but it is not immediately clear whether a separate polynomial is generated for each receiver i and each target j. Please rewrite the notation so that the dependence on both i and j is unambiguous.
  4. [Section II and throughout] The notation g_i is redefined to mean the quantized gradient after the paragraph on stochastic quantization, which can confuse readers comparing the original gradients with the quantized ones. Please use a distinct symbol such as q_i or tilde g_i for the quantized values.
  5. [Section IV, Step 1] The scheme relies on shared randomness among clients that is unknown to the federator and is said to be instantiated by a one-time use of a trusted random number generator. This is a system assumption that should be listed among the model assumptions in Section II, since it effectively introduces a trusted setup.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the paper's central claims rest on external results and omitted proofs, not on self-referential inputs.

full rationale

I found no step in which a claimed result reduces by the paper's own equations or by self-citation to its own inputs. Theorem 1's privacy guarantees are mutual-information statements (Definitions 3 and 4) whose proofs are deferred ('The proofs will be provided in an extended version'), but an omitted proof is a completeness gap, not a circular dependency. The robustness claim (b, 8b/(n-b)(kappa+1)) is a composition result for NNM with a distance-based (b,kappa)-robust aggregation rule and is explicitly attributed to the independent prior work [33] by Allouah et al.; the paper credits that result rather than deriving its conclusion from its own assumptions. The 'extended symmetric PIR scheme' in Step 5 is described as a careful modification of the external scheme [41] with the details omitted; this is an unsupported extension of independent work, not an ansatz smuggled in by self-citation, and it does not make the claimed privacy guarantee true by construction. The self-citations [35] and [36] are used only in the numerical evaluation and zero-order optimization discussion, not as load-bearing support for the core privacy, Byzantine-resilience, or communication-cost claims of Theorem 1. No fitted parameter is renamed as a prediction, no uniqueness theorem is imported from the authors' prior work, and no known empirical result is repackaged as a new organizational contribution without attribution. Thus, notwithstanding the serious missing proofs and unspecified PIR details, the paper does not exhibit circular reasoning.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The protocol rests on standard secret-sharing math, on prior verification and PIR results, and on two unproven transfers: the linear-combination PIR extension and the quantization-aware version of NNM robustness. The experimental hyperparameters are design choices, not fitted constants for the theorem.

free parameters (3)
  • Quantization levels mu = 1024
    Chosen by hand for experiments; sets field size q >= 2d(n-b)^2 mu^2 and controls gradient fidelity, but the theorem does not specify a required value.
  • ZO perturbation count R = 64 (MNIST), 5 (RoBERTa)
    Experimental hyperparameter controlling compression ratio d/R and estimator variance; not used in the privacy theorem.
  • ZO smoothing parameter mu_ZO = 0.001
    Smoothing step for zero-order gradient estimates; chosen experimentally.
assumptions (5)
  • standard math Shamir secret sharing and Reed-Solomon error correction over F_q reconstruct secrets and correct up to b corrupt shares.
    Used in steps 1, 2, 7, and 8; standard properties of polynomial secret sharing.
  • domain assumption The information-theoretic verifiable secret sharing scheme of Ben-Or et al. [29] is correct and private when n > 3b.
    Invoked in step 1 to detect malicious secret sharing; cited from prior literature, not proven here.
  • ad hoc to paper The PIR scheme of Tajeddine et al. [41] can be extended to return linear combinations of files while preserving privacy and Byzantine resilience.
    Step 5 asserts this modification but omits the construction and proof; it is load-bearing for hiding the neighbor set.
  • domain assumption Clients share one-time random padding and PIR queries unknown to the federator.
    Stated in Section III; if the shared randomness leaks, the padding and PIR privacy break.
  • ad hoc to paper The robustness guarantees of NNM and distance-based robust aggregation from Allouah et al. [33] transfer to quantized, finite-field representations of gradients.
    Theorem 1's robustness claim borrows from [33] but the protocol computes distances on stochastic quantized values in F_q; no analysis of this transfer is given.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Private Aggregation for Byzantine-Resilient Heterogeneous Federated Learning." pith.science (2026). https://pith.science/paper/T7ZL2PZV

@misc{pith2026250609870,
  author       = {Pith},
  title        = {Pith review of: Private Aggregation for Byzantine-Resilient Heterogeneous Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/T7ZL2PZV}},
  note         = {Machine review of arXiv:2506.09870}
}
read the original abstract

Ensuring resilience to Byzantine clients while maintaining the privacy of the clients' data is a fundamental challenge in federated learning (FL). When the clients' data is homogeneous, suitable countermeasures were studied from an information-theoretic perspective utilizing secure aggregation techniques while ensuring robust aggregation of the clients' gradients. However, the countermeasures used fail when the clients' data is heterogeneous. Suitable pre-processing techniques, such as nearest neighbor mixing, were recently shown to enhance the performance of those countermeasures in the heterogeneous setting. Nevertheless, those pre-processing techniques cannot be applied with the introduced privacy-preserving mechanisms. We propose a multi-stage method encompassing a careful co-design of verifiable secret sharing, secure aggregation, and a tailored symmetric private information retrieval scheme to achieve information-theoretic privacy guarantees and Byzantine resilience under data heterogeneity. We evaluate the effectiveness of our scheme on a variety of attacks and show how it outperforms the previously known techniques. Since the communication overhead of secure aggregation is non-negligible, we investigate the interplay with zero-order estimation methods that reduce the communication cost in state-of-the-art FL tasks and thereby make private aggregation scalable.

Figures

Figures reproduced from arXiv: 2506.09870 by the authors.

Figure 2
Figure 2. Averaged test accuracies over 3 runs with different seeds for fine￾tuning SST-2 with RoBERTa-large. The Byzantine clients conduct ALIE. ZO￾TM-NNM is the straightforward extension of [35] to NNM without privacy. Both Krum and Multi-Krum can achieve state-of-the-art accuracies in this setting. See Section V for details. presentation, we omit the details of the PIR scheme. On a high level, the clients here can be seen … view at source ↗
Figure 1
Figure 1. However, the communication cost compared to SGD is [PITH_FULL_IMAGE:figures/full_fig_p006_1.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

45 extracted references · 34 canonical work pages

  1. [41]

    Private information retrieval from coded storage systems with colluding, byzantine, and unresponsive servers,

    R. Tajeddine, O. W. Gnilke, D. Karpuk, R. Freij-Hollanti, and C. Hol- lanti, “Private information retrieval from coded storage systems with colluding, byzantine, and unresponsive servers,”IEEE Transactions on information theory, vol. 65, no. 6, pp. 3898–3906, 2019

    work page 2019

  2. [33]

    Fixing by mixing: A recipe for optimal byzantine ml under heterogeneity,

    Y . Allouah, S. Farhadkhani, R. Guerraoui, N. Gupta, R. Pinot, and J. Stephan, “Fixing by mixing: A recipe for optimal byzantine ml under heterogeneity,” inInternational Conference on Artificial Intelligence and Statistics, 2023, pp. 1232–1300

    work page 2023

  3. [1]

    Communication-efficient learning of deep networks from decentralized data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” inArtificial intelligence and statistics, 2017, pp. 1273–1282

    2017

  4. [2]

    A comprehensive survey of privacy- preserving federated learning: A taxonomy, review, and future direc- tions,

    X. Yin, Y . Zhu, and J. Hu, “A comprehensive survey of privacy- preserving federated learning: A taxonomy, review, and future direc- tions,”ACM Computing Surveys (CSUR), vol. 54, no. 6, pp. 1–36, 2021

    2021

  5. [3]

    Survey on federated learning threats: Concepts, taxonomy on attacks and defences, experimental study and challenges,

    N. Rodríguez-Barroso, D. Jiménez-López, M. V . Luzón, F. Herrera, and E. Martínez-Cámara, “Survey on federated learning threats: Concepts, taxonomy on attacks and defences, experimental study and challenges,” Information Fusion, vol. 90, pp. 148–173, 2023

    work page 2023

  6. [4]

    Practical secure ag- gregation for privacy-preserving machine learning,

    K. Bonawitz, V . Ivanov, B. Kreuter, A. Marcedone, H. B. McMahan, S. Patel, D. Ramage, A. Segal, and K. Seth, “Practical secure ag- gregation for privacy-preserving machine learning,” inACM SIGSAC Conference on Computer and Communications Security, 2017, pp. 1175–1191

    work page 2017

  7. [5]

    Secure single-server aggregation with (poly)logarithmic overhead,

    J. H. Bell, K. A. Bonawitz, A. Gascón, T. Lepoint, and M. Raykova, “Secure single-server aggregation with (poly)logarithmic overhead,” in ACM SIGSAC Conference on Computer and Communications Security, 2020, p. 1253–1269

    work page 2020

  8. [6]

    Turbo-aggregate: Breaking the quadratic aggregation barrier in secure federated learning,

    J. So, B. Güler, and A. S. Avestimehr, “Turbo-aggregate: Breaking the quadratic aggregation barrier in secure federated learning,”IEEE Journal on Selected Areas in Information Theory, vol. 2, no. 1, pp. 479–489, 2021

    work page 2021

Show all 45 references
  1. [7]

    Fast- SecAgg: Scalable secure aggregation for privacy-preserving federated learning,

    S. Kadhe, N. Rajaraman, O. O. Koyluoglu, and K. Ramchandran, “Fast- SecAgg: Scalable secure aggregation for privacy-preserving federated learning,”arXiv preprint arXiv:2009.11248, 2020

    2009 arXiv

  2. [8]

    LightSecAgg: a lightweight and versatile design for secure aggregation in federated learning,

    J. So, C. J. Nolet, C.-S. Yang, S. Li, Q. Yu, R. E. Ali, B. Guler, and S. Avestimehr, “LightSecAgg: a lightweight and versatile design for secure aggregation in federated learning,” inMachine Learning and Systems, vol. 4, 2022, pp. 694–720

    2022

  3. [9]

    Swiftagg+: Achieving asymptotically optimal communication loads in secure ag- gregation for federated learning,

    T. Jahani-Nezhad, M. A. Maddah-Ali, S. Li, and G. Caire, “Swiftagg+: Achieving asymptotically optimal communication loads in secure ag- gregation for federated learning,”IEEE Journal on Selected Areas in Communications, vol. 41, no. 4, pp. 977–989, 2023

    2023

  4. [10]

    Codedpaddedfl and codedsecagg: Straggler mitigation and secure aggregation in feder- ated learning,

    R. Schlegel, S. Kumar, E. Rosnes, and A. G. i. Amat, “Codedpaddedfl and codedsecagg: Straggler mitigation and secure aggregation in feder- ated learning,”IEEE Transactions on Communications, vol. 71, no. 4, pp. 2013–2027, 2023

    2013

  5. [11]

    Secure aggregation for clustered federated learning,

    H. U. Sami and B. Güler, “Secure aggregation for clustered federated learning,” inIEEE International Symposium on Information Theory (ISIT), 2023, pp. 186–191

    2023

  6. [12]

    Private aggregation in hierarchical wireless federated learning with partial and full collusion,

    M. Egger, C. Hofmeister, A. Wachter-Zeh, and R. Bitar, “Private aggregation in hierarchical wireless federated learning with partial and full collusion,”arXiv preprint arXiv:2306.14088, 2024

    2024 arXiv

  7. [13]

    Ma- chine learning with adversaries: Byzantine tolerant gradient descent,

    P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Ma- chine learning with adversaries: Byzantine tolerant gradient descent,” Advances in neural information processing systems, vol. 30, 2017

    2017

  8. [14]

    Byzantine- resilient non-convex stochastic gradient descent,

    Z. Allen-Zhu, F. Ebrahimianghazani, J. Li, and D. Alistarh, “Byzantine- resilient non-convex stochastic gradient descent,” inInternational Con- ference on Learning Representations, 2021

    2021

  9. [15]

    Distributed statistical machine learning in adversarial settings: Byzantine gradient descent,

    Y . Chen, L. Su, and J. Xu, “Distributed statistical machine learning in adversarial settings: Byzantine gradient descent,”ACM on Measurement and Analysis of Computing Systems, vol. 1, no. 2, pp. 1–25, 2017

    2017

  10. [16]

    Collaborative learning in the jungle (decentral- ized, byzantine, heterogeneous, asynchronous and nonconvex learning),

    E. M. El-Mhamdi, S. Farhadkhani, R. Guerraoui, A. Guirguis, L.-N. Hoang, and S. Rouault, “Collaborative learning in the jungle (decentral- ized, byzantine, heterogeneous, asynchronous and nonconvex learning),” Advances in neural information processing systems, vol. 34, pp. 25 ...

    2021

  11. [17]

    Learning from history for byzantine robust optimization,

    S. P. Karimireddy, L. He, and M. Jaggi, “Learning from history for byzantine robust optimization,” inInternational Conference on Machine Learning, 2021, pp. 5311–5319

    2021

  12. [18]

    Byzantine-robust learning on heterogeneous datasets via buck- eting,

    ——, “Byzantine-robust learning on heterogeneous datasets via buck- eting,” inInternational Conference on Learning Representations, 2022

    2022

  13. [19]

    Byzantines can also learn from history: Fall of centered clipping in federated learning,

    K. Özfatura, E. Özfatura, A. Küpçü, and D. Gunduz, “Byzantines can also learn from history: Fall of centered clipping in federated learning,” IEEE Transactions on Information Forensics and Security, vol. 19, pp. 2010–2022, 2023

    2010

  14. [20]

    Byzantine-resilient secure fed- erated learning,

    J. So, B. Güler, and A. S. Avestimehr, “Byzantine-resilient secure fed- erated learning,”IEEE Journal on Selected Areas in Communications, vol. 39, no. 7, pp. 2168–2181, 2020

    2020

  15. [21]

    How to share a secret,

    A. Shamir, “How to share a secret,”Communications of the ACM, vol. 22, no. 11, pp. 612–613, 1979

    1979

  16. [22]

    On sharing secrets and reed-solomon codes,

    R. J. McEliece and D. V . Sarwate, “On sharing secrets and reed-solomon codes,”Communications of the ACM, vol. 24, no. 9, pp. 583–584, 1981

    1981

  17. [23]

    Byzsecagg: A byzantine-resistant secure aggregation scheme for federated learning based on coded computing and vector commitment,

    T. Jahani-Nezhad, M. A. Maddah-Ali, and G. Caire, “Byzsecagg: A byzantine-resistant secure aggregation scheme for federated learning based on coded computing and vector commitment,”arXiv preprint arXiv:2302.09913, 2023

    2023 arXiv

  18. [24]

    Priroagg: Achieving robust model aggregation with minimum privacy leakage for federated learning,

    S. Hou, S. Li, T. Jahani-Nezhad, and G. Caire, “Priroagg: Achieving robust model aggregation with minimum privacy leakage for federated learning,”arXiv preprint arXiv:2407.08954, 2024

    2024 arXiv

  19. [25]

    Robust aggregation for federated learning,

    K. Pillutla, S. M. Kakade, and Z. Harchaoui, “Robust aggregation for federated learning,”IEEE Transactions on Signal Processing, vol. 70, pp. 1142–1154, 2022

    2022

  20. [26]

    Defending against backdoors in federated learning with robust learning rate,

    M. S. Ozdayi, M. Kantarcioglu, and Y . R. Gel, “Defending against backdoors in federated learning with robust learning rate,” inAAAI Conference on Artificial Intelligence, vol. 35, no. 10, 2021, pp. 9268– 9276

    2021

  21. [27]

    Byzantine-resilient secure aggregation for federated learning without privacy compromises,

    Y . Xia, C. Hofmeister, M. Egger, and R. Bitar, “Byzantine-resilient secure aggregation for federated learning without privacy compromises,” inIEEE Information Theory Workshop (ITW), 2024, pp. 223–228

    2024

  22. [28]

    Fltrust: Byzantine- robust federated learning via trust bootstrapping,

    X. Cao, M. Fang, J. Liu, and N. Z. Gong, “Fltrust: Byzantine- robust federated learning via trust bootstrapping,”arXiv preprint arXiv:2012.13995, 2020

    2012 arXiv

  23. [29]

    Completeness theorems for non-cryptographic fault-tolerant distributed computation,

    M. Ben-Or, S. Goldwasser, and A. Wigderson, “Completeness theorems for non-cryptographic fault-tolerant distributed computation,” inACM Symposium on Theory of Computing, 1988, p. 1–10

    1988

  24. [30]

    Lobyitfl: Low communication secure and private federated learning,

    Y . Xia, C. Hofmeister, M. Egger, and R. Bitar, “Lobyitfl: Low communication secure and private federated learning,”arXiv preprint arXiv:2405.19217, 2024

    2024 arXiv

  25. [31]

    Learning from untrusted data,

    M. Charikar, J. Steinhardt, and G. Valiant, “Learning from untrusted data,” inAnnual ACM SIGACT Symposium on Theory of Computing, 2017, pp. 47–60

    2017

  26. [32]

    Approximate byzantine fault- tolerance in distributed optimization,

    S. Liu, N. Gupta, and N. H. Vaidya, “Approximate byzantine fault- tolerance in distributed optimization,” inACM Symposium on Principles of Distributed Computing, 2021, pp. 379–389

    2021

  27. [34]

    Fine-tuning language models with just forward passes,

    S. Malladi, T. Gao, E. Nichani, A. Damian, J. D. Lee, D. Chen, and S. Arora, “Fine-tuning language models with just forward passes,”Ad- vances in Neural Information Processing Systems, vol. 36, pp. 53 038– 53 075, 2023

    2023

  28. [35]

    Communication- efficient byzantine-resilient federated zero-order optimization,

    A. d. S. D. Neto, M. Egger, M. Bakshi, and R. Bitar, “Communication- efficient byzantine-resilient federated zero-order optimization,”arXiv preprint arXiv:2406.14362, 2024

    2024 arXiv

  29. [36]

    Byzantine-resilient zero-order opti- mization for communication-efficient heterogeneous federated learning,

    M. Egger, M. Bakshi, and R. Bitar, “Byzantine-resilient zero-order opti- mization for communication-efficient heterogeneous federated learning,” arXiv preprint arXiv:2502.00193, 2025

    2025 arXiv

  30. [37]

    Deep learning with limited numerical precision,

    S. Gupta, A. Agrawal, K. Gopalakrishnan, and P. Narayanan, “Deep learning with limited numerical precision,” inInternational conference on machine learning, 2015, pp. 1737–1746

    2015

  31. [38]

    Stochas- tic rounding: implementation, error analysis and applications,

    M. Croci, M. Fasi, N. J. Higham, T. Mary, and M. Mikaitis, “Stochas- tic rounding: implementation, error analysis and applications,”Royal Society Open Science, vol. 9, no. 3, p. 211631, 2022

    2022

  32. [39]

    Byzantine-robust dis- tributed learning: Towards optimal statistical rates,

    D. Yin, Y . Chen, R. Kannan, and P. Bartlett, “Byzantine-robust dis- tributed learning: Towards optimal statistical rates,” inInternational conference on machine learning, 2018, pp. 5650–5659

    2018

  33. [40]

    Secure ag- gregation is not private against membership inference attacks,

    K.-H. Ngo, J. Östman, G. Durisi, and A. Graell i Amat, “Secure ag- gregation is not private against membership inference attacks,” inJoint European Conference on Machine Learning and Knowledge Discovery in Databases, 2024, pp. 180–198

    2024

  34. [42]

    A little is enough: Circumvent- ing defenses for distributed learning,

    G. Baruch, M. Baruch, and Y . Goldberg, “A little is enough: Circumvent- ing defenses for distributed learning,”Advances in Neural Information Processing Systems, vol. 32, 2019

    2019

  35. [43]

    Fall of empires: Breaking byzantine- tolerant sgd by inner product manipulation,

    C. Xie, O. Koyejo, and I. Gupta, “Fall of empires: Breaking byzantine- tolerant sgd by inner product manipulation,” inUncertainty in Artificial Intelligence, 2020, pp. 261–270

    2020

  36. [44]

    Roberta: A robustly optimized bert pretraining approach,

    Y . Liu, “Roberta: A robustly optimized bert pretraining approach,”arXiv preprint arXiv:1907.11692, vol. 364, 2019

    1907 arXiv

  37. [45]

    Recursive deep models for semantic compositionality over a sentiment treebank,

    R. Socher, A. Perelygin, J. Wu, J. Chuang, C. D. Manning, A. Y . Ng, and C. Potts, “Recursive deep models for semantic compositionality over a sentiment treebank,” inConference on empirical methods in natural language processing, 2013, pp. 1631–1642

    2013

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.