Pith. sign in

REVIEW 3 major objections 5 minor 53 references

Theoretically Unmasking Inference Attacks Against LDP-Protected Clients in Federated Vision Models

T0 review · 3 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Even when clients protect their data with local differential privacy, a dishonest federated-learning server can still run provably successful membership inference attacks in low polynomial time, with residual risk set by the privacy budget.

desk verdict FC bounds under LDP are solid and citable; the attention bound isn't certified for the paper's own vision experiments because the beta values used fail Theorem 3's separation condition. read the letter →

arxiv 2506.17292 v2 pith:IXH5TVEG submitted 2025-06-16 cs.CR cs.AI

Quan Nguyen , Minh N. Vu , Truc Nguyen , My T. Thai This is my paper
classification cs.CRcs.AI
keywords membershipinferenceattackfederatedlearninglocaldifferentialprivacyactiveadversaryfullyconnectedlayersself-attentionvisiontransformerprivacy-utilitytradeoff
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper aims to prove that local differential privacy (LDP) does not, by itself, protect federated-learning clients from a dishonest server that wants to know whether a specific sample sat in their training data. It analyzes two low-polynomial-time active attackers — one that plants two fully connected layers into the model, one that exploits self-attention — inside a formal security game where the server chooses the model and sees only gradients computed on LDP-protected data, and it proves lower bounds on their success. The bounds say the attacker's advantage stays close to perfect unless the privacy budget $\varepsilon$ is pushed small enough that the LDP noise becomes large, and the experiments show the noise that actually blunts the attacks also collapses model accuracy (over 20% accuracy lost on CIFAR10 before the fully connected attack falls below 80% success). If the proofs are right, the paper turns the intuition that 'LDP noise hides membership' into a quantified residual risk that depends on $\varepsilon$ and on how the mechanism spreads protected points around its output alphabet.

What carries the argument

The argument rides on two planted detectors inside a game that forces the client to compute gradients on protected data. The fully connected detector is a two-layer probe: the first layer computes $[M_\varepsilon(X)-T;\; T-M_\varepsilon(X)]$ and the second computes $z_0 = \max\{\Delta_X - \|M_\varepsilon(X)-T\|_{\ell^1}, 0\}$, so the gradient of the bias $b_2[1]$ is nonzero exactly when the protected sample lands inside the $\ell^1$-ball of radius $\Delta_X$ around the target; the alphabet's balls are disjoint, so a nonzero gradient means membership up to the noise probability $P_{M_\varepsilon}$. The attention detector uses the Hopfield interpretation of self-attention with exponentially small retrieval error: one head projects the target pattern $v$ out of the keys so that, when $v$ is present, that head's output collapses toward the protected patterns' mean while the unfiltered head does not, and the gap between the two heads surfaces as nonzero gradients on the output weight matrix. The proof then bounds the false-positive rate by the projection probability $P_{\mathrm{proj}}$ and the false-negative rate by the box probability $P_{\mathrm{box}}$, and Theorem 2 closes the picture by capping every adversary in this game at advantage $(e^\varepsilon-1)/(e^\varepsilon+1)$.

What would settle it

Measure, for a concrete mechanism such as BitRand or GRR applied to CIFAR10 embeddings, the empirical minimum pairwise separation $\Delta^\varepsilon$ of the protected patterns across privacy budgets and check whether $\Delta^\varepsilon \geq \Delta$ holds whenever condition (5) is satisfied; finding a budget where the minimum separation drops below the unperturbed value, or where the measured attention-attack advantage falls short of Eq. (6), would pinpoint the theorem's premise as the failing link.

Watch

Extended reading notes

Core claim

On its own terms, the paper's central discovery is that every $\varepsilon$-LDP mechanism leaves a provable hole for active membership inference in federated vision models. In the security game ExpAMI_LDP, where the adversarial server picks the model, crafts parameters from a target sample $T$, and receives gradients computed on the protected dataset $D' = M_\varepsilon(D)$, the fully connected adversary of Theorem 1 achieves advantage at least $1 - \frac{n+|\mathcal{X}|-1}{|\mathcal{X}|-1} P_{M_\varepsilon}$ in time $O(d_X^2)$: with threshold $\tau_D = \Delta_X$, the planted neuron fires exactly when the protected version of a sample lands inside the $\ell^1$-ball of radius $\Delta_X$ around $T$, and the disjointness of those balls makes a nonzero gradient a trustworthy signal that $T$ was present. Theorem 3 carries the same program to self-attention layers on $\Delta^\varepsilon$-separated protected patterns with time $O(d_X^3)$, giving the lower bound in Eq. (6) in terms of projection and box probabilities of the protected distribution; at small noise the bound is near one, and at large noise the box term $P^{\mathcal{D}_{M_\varepsilon}}_{\mathrm{box}}$ approaches one, which is exactly the regime where protected embeddings fuse near the center and the model stops telling classes apart. The experiments confirm the theory with near-100% attack success at moderate budgets ($\varepsilon \approx 6$ for the ResNet-based fully connected attack, $\varepsilon \geq 3$ for the ViT attention attack), and the noise needed to suppress the attacks degrades utility substantially.

Load-bearing premise

The attention-attack theorem assumes the LDP noise leaves the protected patterns still $\Delta^\varepsilon$-separated and confined to a bounded noise norm $R_\varepsilon$, but the paper only argues the expected separation grows with noise, never proving the minimum separation $\Delta^\varepsilon \geq \Delta$ that condition (5) actually uses, and mechanisms with unbounded noise fall outside the bound entirely.

Editorial extensions

If this is right

  • For any LDP mechanism with output alphabet $\mathcal{X}$, the fully connected attack's success rate is at least $1 - \frac{n+|\mathcal{X}|-1}{2(|\mathcal{X}|-1)} P_{M_\varepsilon}$; for bit-flipping mechanisms with large bit-length $b$ the prefactor is nearly 1, so the residual success is essentially $1 - P_{M_\varepsilon}$.
  • Theorem 2 caps every adversary in the game at advantage $(e^\varepsilon-1)/(e^\varepsilon+1)$, so LDP still binds the damage — but at the budgets used in practice ($\varepsilon = 6$–$8$) the cap is already near certainty.
  • Empirically the attacks hit near 100% success at $\varepsilon \approx 6$ for the fully connected attack on ResNet embeddings and at $\varepsilon \geq 3$ for the attention attack on ViTs, and the noise needed to push the fully connected attack below 80% success costs at least 20% accuracy on CIFAR10.
  • For generalized random response the lower bound specializes to $(e^\varepsilon - n)/(e^\varepsilon + |\mathcal{X}| - 1)$, so the protection erodes as the number of clients $n$ grows and vanishes once $n$ reaches $e^\varepsilon$.
  • The box term in Eq. (6) predicts a cliff: at the noise level where protected embeddings start clustering near their mean, both the attack advantage and the model's utility drop together, so the privacy-utility tradeoff cannot be dodged by raising the embedding dimension.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A design criterion the paper leaves implicit: an LDP mechanism is harder to probe through the fully connected detector the larger its $P_{M_\varepsilon}$ is, so mechanisms that keep protected outputs tightly clumped near their originals are precisely the ones that preserve high attack success at a fixed budget.
  • The attention bound implies embedding geometry, not just $\varepsilon$, governs the residual risk — one-hot embeddings are the most vulnerable because patterns are mutually orthogonal and nothing sits near the center — so a testable prediction is that feature extractors producing well-spread, weakly aligned embeddings suffer higher attention-attack success at the same noise level.
  • The analysis covers a single round of gradient exchange; in multi-round federated training a server could average its probes across iterations, which should only sharpen the membership signal, an extension the paper does not analyze.
  • Because Theorem 3 needs a bounded noise norm $R_\varepsilon$, mechanisms with unbounded noise such as continuous Laplace outputs lie outside the attention bound, and whether the fully connected bounds survive for continuous alphabets is a question the paper leaves open.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper studies active membership inference (AMI) against federated vision models when client data are protected by local differential privacy (LDP). Building on the FC-based and attention-based attacks of Vu et al. (2024), the authors state a security game ExpAMI_LDP and prove: a lower bound for an FC adversary in terms of the probability P_{M_ε} that LDP noise moves a point out of its radius-Δ_X ball (Theorem 1); an information-theoretic upper bound (e^ε−1)/(e^ε+1) for any adversary (Theorem 2); a lower bound for an attention adversary on Δ^ε-separated LDP-protected data (Theorem 3, Eq. (6)); and a closed-form GRR specialization (Theorem 4). Experiments on CIFAR10, CIFAR100, and ImageNet with BitRand, GRR, RAPPOR, and dBitFlipPM report high attack success rates and show that the noise needed to reduce risk degrades utility. The paper's headline claim is that LDP does not eliminate privacy risk and that the residual risk is governed by the privacy budget ε.

Significance. If the central results hold, the paper makes a useful contribution: it moves AMI analysis from purely empirical demonstrations to provable lower bounds under LDP, and it provides an explicit GRR lower bound that is clean and checkable. The FC half of the paper is solid: Theorem 1's proof is elementary and correct, Theorem 2 is a standard LDP argument, and Theorem 4 gives a concrete closed form. The attention result is potentially interesting but currently not certified for the experiments in which it is claimed, because the hypothesis of Theorem 3, condition (5), is not verified for the ViT settings. The empirical study is broad (two vision datasets, four LDP mechanisms, NLP extension) and the privacy-utility tension is convincingly demonstrated. However, the paper does not ship machine-checked proofs or code, and the 'theoretical' curves in Figures 7 and 8 rely on empirically estimated P_{M_ε}; these caveats should be stated transparently.

major comments (3)
  1. [§4.2, Theorem 3, Eq. (5)] The applicability condition for the attention lower bound is not discharged for the paper's main vision experiments. The manuscript defends Δ^ε ≥ Δ only through an expectation calculation in Appx. D.3: E[x_i^{ε⊤}x_i^{ε} − x_i^{ε⊤}x_j^{ε}] = E[x_i^{⊤}x_i − x_i^{⊤}x_j] + Var(r_i). This concerns the average separation, whereas condition (5) uses the minimum separation Δ^ε. In the ViT experiments NX = 49 (Table 2) and β = 0.01 is reported as a good default (Appx. G.3, Fig. 10). For these values the right-hand side of (5) is at least 2/(0.01·49) = 4.08 plus 100·log(2·48·49·0.01·(M^ε)^2); even for a modest M^ε ≈ 5 this exceeds 700, while inner-product separations of patch embeddings are typically O(1)–O(10). Therefore Eq. (6) is not certified for Figures 9–10. The attention-based privacy risk in the vision setting rests on the empirical curves, not on Theorem 3. The theorem may be correct under its own hypotheses, but the paper must either verify the minimum-separation condition for the deployed β and data, or explicitly restrict the theoretical claim to settings where (5) is known to hold.
  2. [§4.2, bounded-noise assumption before Theorem 3] Theorem 3 assumes that LDP noise is bounded by a norm budget R_ε, so that M^ε = sqrt(M^2 + R_ε^2) exists. This excludes common LDP mechanisms with unbounded support, such as continuous Laplace noise. The abstract and introduction state that privacy risks persist 'even when data are protected by LDP' and refer to 'any ideal LDP mechanism'; the theorem as stated does not support that unrestricted reading. Please add an explicit bounded-support hypothesis to Theorem 3 and adjust the scope claims accordingly, or restrict the statement to the finite-alphabet mechanisms used in the experiments (GRR, RAPPOR, dBitFlipPM, BitRand).
  3. [§4.1, Remark 1; Figures 7–8] The theoretical lower-bound curves in Figures 7 and 8 are plotted using an estimate of P_{M_ε} obtained from the same data on which the empirical attack success rates are measured. Theorem 1 is a valid bound for any fixed M_ε, but substituting an empirical P̂_{M_ε} makes the 'theoretical' curve a data-dependent plug-in rather than a parameter-free prediction. This weakens the claimed corroboration in Section 5 ('The theoretical lower bound... corroborates the empirical success rate'). The paper should either derive P_{M_ε} analytically for each mechanism (as is done for GRR in Theorem 4) or explicitly label these curves as simulations/empirical plug-in estimates.
minor comments (5)
  1. [Theorem 1 statement] The bound is written as 1 − n+|X |−1 / |X |−1 P_{M_ε}, which is ambiguous; the proof uses (n+|X|−1)/(|X|−1). Please add parentheses in the theorem statement.
  2. [Theorem 2 statement] The theorem says 'for all AMI adversary A' but then writes AdvAMI_LDP(AD^FC); the advantage should be for A, not for the specific FC adversary, or the quantifier should be rephrased.
  3. [§4.2, paragraph before Theorem 3] The sentence 'we can generally expect Δ^ε ≥ Δ' is presented as an intuition; since condition (5) uses the minimum separation, this expectation should be labeled as a heuristic rather than a proved statement.
  4. [Appx. G.3, Table 3] There is a typo in the table note ('β is is set'), and the columns Min β/Max β are not explained; please clarify how these values were selected and whether they were tuned on held-out data.
  5. [Figure 10] The caption does not state which dataset, LDP mechanism, and ε values are used; please specify these in the caption or in the text referencing the figure.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the theoretical bounds are conditional reductions with external support; the main weakness is an undischarged separation condition, not a circular step.

full rationale

The derivation chain is self-contained rather than circular. Theorem 1 (Appendix D.1) reduces the FC adversary's advantage to the mechanism's escape probability P_Mε through a union bound (Eqs. 11-20); the adversary is fully specified (Algorithms 1-2), and for GRR the bound is made explicit in Theorem 4, so the result is not a fitted quantity renamed as a prediction. Theorem 3 (Appendix D.4) is a genuine lower bound: Eq. (6) is derived from Lemma 1 (an exponentially small retrieval error bound), Lemma 2 (Jacobian bound), and triangle-inequality/mean-value arguments; P_proj and P_box are distributional statistics of the protected data, not the empirical attack success, so plotting Monte-Carlo evaluations of Eq. (6) in Figs. 5-6 is legitimate. The same-author citation to Vu et al. (2024) for Lemma 1 is not load-bearing because the paper states Lemma 1 as a specific case of the external Ramsauer et al. (2021) Theorem 5 and reproduces the attack algorithms. The genuine weakness is non-circular: Theorem 3's hypothesis (5) is not discharged for the vision experiments. Appendix D.3 only computes an expectation E[x_i^εᵀ x_i^ε − x_i^εᵀ x_j^ε] = E[x_iᵀ x_i − x_iᵀ x_j] + Var(r_i), which does not imply the minimum separation Δ^ε ≥ Δ required by condition (5), and the experimental β = 0.01 (Appendix G.3) is unlikely to satisfy (5) for ViT patch counts; this is a scope/verification gap, not a reduction of the conclusion to its inputs. Accordingly, the paper's central claims do not reduce to their inputs by construction.

Assumptions & free parameters 3 free parameters · 6 assumptions · 0 invented entities

The central claim rests on standard DP background, on the attack constructions of Vu et al. (2024, self-cited), and on several data-dependent quantities (P_{M_ε}, P_proj, P_box) that are not computed in closed form for most LDP mechanisms. The attacks themselves introduce no new physical entities; they only configure existing layers. The free parameters are the adversary's thresholds, which in the experiments are fitted to the data distribution, creating a gap between the theoretical adversaries and the implemented ones.

free parameters (3)
  • τ_D (FC attack threshold) = Δ_X in theory; fitted via linear regression in experiments
    In Theorem 1, τ_D = Δ_X, the minimum separation of the alphabet. In Appx G.3, the implemented adversary fits τ_D from simulated pre-activation outputs, so the attack tested is not exactly the one analyzed.
  • β (attention inverse temperature) = 0.01 to 0.07 in experiments
    The theory requires β satisfying condition (5), which for normalized embeddings is often not met by β = 0.01; the implementation uses a look-up table per privacy budget (Appx G.3), so the empirical β is a fitted value.
  • γ (attention detection threshold) = 2Δ̄^ε in theory; regression-fitted in experiments
    The theorem sets γ = 2Δ̄^ε; Appx G.3 fits γ by linear regression on the data distribution, so the experimental decision rule is calibrated to the data rather than set by the theorem.
assumptions (6)
  • domain assumption The data alphabet X is discrete with a well-defined L1 metric and minimum separation Δ_X (for Theorem 1).
    Used to define disjoint balls B1(X, Δ_X); the alphabet is the output set of the LDP mechanism, which is finite for GRR, RAPPOR, and bit-flipping mechanisms but not for continuous noises.
  • domain assumption The LDP-protected dataset D^{M_ε} is Δ^ε-separated with i.i.d. patterns (for Theorem 3).
    Condition (5) requires a positive min-separation; the paper only gives a heuristic expectation argument (Appx D.3) that noise increases separation.
  • domain assumption LDP noise is bounded by a norm budget R_ε and pattern norms are bounded by M.
    Theorem 3 uses R_ε to define M^ε and to bound the Jacobian term; this excludes common unbounded mechanisms (e.g., continuous Laplace).
  • domain assumption The adversarial server knows the client data distribution D.
    Stated in Sec 3.1; it justifies tuning the adversary and interpreting P_proj and P_box as probabilities over D^{M_ε}.
  • standard math Lemma 1 and Lemma 2 from Ramsauer et al. (2021) hold.
    Lemma 1 is the exponentially small retrieval error theorem; Lemma 2 bounds the Jacobian of the attention fixed point iteration. Both are taken unchanged from the Hopfield networks literature.
  • ad hoc to paper The random matrix W in Algorithm 3 has full rank and all W^h_Q, W^h_K have rank d_X - 1.
    Appx D.4 states this 'for simplicity of analysis' and says the adversary can re-run if it fails; it is a probabilistic convenience rather than a guaranteed property.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Theoretically Unmasking Inference Attacks Against LDP-Protected Clients in Federated Vision Models." pith.science (2026). https://pith.science/paper/IXH5TVEG

@misc{pith2026250617292,
  author       = {Pith},
  title        = {Pith review of: Theoretically Unmasking Inference Attacks Against LDP-Protected Clients in Federated Vision Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/IXH5TVEG}},
  note         = {Machine review of arXiv:2506.17292}
}
read the original abstract

Federated Learning enables collaborative learning among clients via a coordinating server while avoiding direct data sharing, offering a perceived solution to preserve privacy. However, recent studies on Membership Inference Attacks (MIAs) have challenged this notion, showing high success rates against unprotected training data. While local differential privacy (LDP) is widely regarded as a gold standard for privacy protection in data analysis, most studies on MIAs either neglect LDP or fail to provide theoretical guarantees for attack success rates against LDP-protected data. To address this gap, we derive theoretical lower bounds for the success rates of low-polynomial time MIAs that exploit vulnerabilities in fully connected or self-attention layers. We establish that even when data are protected by LDP, privacy risks persist, depending on the privacy budget. Practical evaluations on federated vision models confirm considerable privacy risks, revealing that the noise required to mitigate these attacks significantly degrades models' utility.

Figures

Figures reproduced from arXiv: 2506.17292 by the authors.

Figure 1
Figure 1. Active inference security game under LDP: a random bit b determines the state of the data D (i), the server A D specifies Φ (ii) and θ (iii), gradients on LDP-protected data D ′ are sent back (iv), and A D guesses b (v). where Ij ∈ R √H L × √W L ×C represents the j-th patch of the im￾age I and pj is the corresponding positional encoding. The resulting set of embeddings {xj} L j=1 is then passed through the Vision Tr… view at source ↗
Figure 2
Figure 2. Scenarios when A D FC fail. 4. Privacy Leakage Analysis This section presents our theoretical analysis for assessing the risk of leaking membership information of users’ local training data in FL under LDP. Given the security game ExpAMI LDP defined in Section 3.1, we generalize the lower bound and upper bound for the advantage of the adversar￾ial server AD FC in Theorem 1 and Theorem 2, respectively. Finally, we pr… view at source ↗
Figure 3
Figure 3. The adversarial server exploits self-attention mechanism to conduct inference attack of victim’s protected local training data D ′ in FL: If xi in the data equals to the target pattern v, the input to the filtered attention heads is the pertubed version x ε i and the output z 1 i of the filtered head is close to the protected pattern’s average X¯ ε instead of x ε i . This creates non-zero gradients on weights comput… view at source ↗
Figures from the paper (11 more)
Figure 5
Figure 5. Figure 5: AdvAMI LDP(A D Attn) on one-hot data using Monte-Carlo simulation 0.0 0.001 0.002 0.003 0.004 0.005 L1 noise R 0.0 0.2 0.4 0.6 0.8 1.0 Advantage Input dim 10000 15000 20000 25000 30000 35000 [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 7
Figure 7. Figure 7: Theoretical upper/lower bound and empirical results on the attack success rates of FC-based AMI adversaries against CIFAR10 dataset protected by BitRand (a), GRR (b), RAPPOR (c) and dBitFlipPM (d). (a) (b) (c) (d) [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]
Figure 8
Figure 8. Figure 8: Theoretical upper/lower bound and empirical results on the attack success rates of FC-based AMI adversaries against CIFAR100 dataset protected by BitRand (a), GRR (b), RAPPOR (c) and dBitFlipPM (d). line), the model has to suffer at least 20% accuracy loss. The theoret…
Figure 9
Figure 9. Figure 9: Comparison of success rates of Attention-based AMI adversaries against CIFAR10 protected by BitRand, GRR, RAPPOR, and dBitFlipPM (a) as well as the privacy-utility trade-off and the impact of batch size on attack success on BitRand-protected data (b,c). Here, Attn-10 m…
Figure 10
Figure 10. Figure 10: Impact of β on AdvAMI LDP(A D Attn) 2018), DistilBERT (Sanh et al., 2019)), and 3 LDP algo￾rithms (GRR, RAPPOR, dBitFlipPM). The results given in Appx. H.2 indicate that privacy risks persist even for LLMs, depending on the privacy budget. To explore more in depth the…
Figure 11
Figure 11. Figure 11: The AMI Threat Model as a Security Game. ExpAMI LDP(AD, ε): # Simulating the dataset D of the client As in the AMI threat model in [PITH_FULL_IMAGE:figures/full_fig_p014_11.png]
Figure 12
Figure 12. Figure 12: The AMI threat model under LDP mechanism as a security game. AMI on LDP-protected data ExpAMI LDP(AD): This security game describes the AMI threat model when the data is protected by LDP mechanisms. The work (Nguyen et al., 2023) extends ExpAMI NONE(AD) to obtain the …
Figure 13
Figure 13. Figure 13: Visualization of the theoretical upperbound (Theorem. 2) and lower bound of AdvAMI GRR-LDP(A D FC). (Theorem. 4) Generalized Randomized Response (GRR). Given an user with a value v ∈ X . A random variable, denoted by Xˆ, represents the response of the user on a value …
Figure 14
Figure 14. Figure 14: Architecture of Vision Transformer model. Image adapted from (Dosovitskiy et al., 2021). Recall we represent the victim’s dataset as D = {Xi} n i=1, where Xi ∈ X , and X ⊆ R dX×NX . For any 2-dimensional array 26 [PITH_FULL_IMAGE:figures/full_fig_p026_14.png]
Figure 15
Figure 15. Figure 15: Success rates of AMI adversaries against datasets protected by OME [PITH_FULL_IMAGE:figures/full_fig_p029_15.png]
Figure 16
Figure 16. Figure 16: ROC analysis of Attention-based AMI on LDP-protected IMDB dataset. offer strong privacy guarantees by ensuring no party learns individual updates via secure aggregation protocols (Ma et al., 2023; Bonawitz et al., 2017), but they incur high communication overhead, esp…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

53 extracted references · 36 canonical work pages

  1. [1]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...

  2. [2]

    Arachchige, P. C. M., Bertok, P., Khalil, I., Liu, D., Camtepe, S., and Atiquzzaman, M. Local differential privacy for deep learning. IEEE Internet of Things Journal, 7 0 (7): 0 5827--5842, 2019

    work page 2019

  3. [3]

    Exploring homomorphic encryption and differential privacy techniques towards secure federated learning paradigm

    Aziz, R., Banerjee, S., Bouzefrane, S., and Le Vinh, T. Exploring homomorphic encryption and differential privacy techniques towards secure federated learning paradigm. Future internet, 15 0 (9): 0 310, 2023

    work page 2023

  4. [4]

    Foundations of data science

    Blum, A., Hopcroft, J., and Kannan, R. Foundations of data science. Cambridge University Press, 2020

    work page 2020

  5. [5]

    B., Patel, S., Ramage, D., Segal, A., and Seth, K

    Bonawitz, K., Ivanov, V., Kreuter, B., Marcedone, A., McMahan, H. B., Patel, S., Ramage, D., Segal, A., and Seth, K. Practical secure aggregation for privacy-preserving machine learning. In proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pp.\ 1175--1191, 2017

    work page 2017

  6. [6]

    Efficient intent detection with dual sentence encoders

    Casanueva, I., Tem c inas, T., Gerz, D., Henderson, M., and Vuli \'c , I. Efficient intent detection with dual sentence encoders. In Wen, T.-H., Celikyilmaz, A., Yu, Z., Papangelis, A., Eric, M., Kumar, A., Casanueva, I., and Shah, R. (eds.), Proceedings of the 2nd Workshop on Natural Language Processing for Conversational AI, pp.\ 38--45, Online, July 20...

    doi:10.18653/v1/2020.nlp4convai-1.5 2020

  7. [7]

    H., and Shi, X

    Chen, J., Wang, W. H., and Shi, X. Differential privacy protection against membership inference attack on machine learning for genomic data. Pacific Symposium on Biocomputing, 26: 0 26--37, 2021. doi:10.1142/9789811232701_0003. URL https://pubmed.ncbi.nlm.nih.gov/33691001/

    work page arXiv 2021

  8. [8]

    Imagenet: A large-scale hierarchical image database

    Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., and Fei-Fei, L. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pp.\ 248--255. Ieee, 2009

    2009

Show all 53 references
  1. [9]

    Bert: Pre-training of deep bidirectional transformers for language understanding

    Devlin, J., Chang, M.-W., Lee, K., and Toutanova, K. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of the 2019 conference of the North American chapter of the association for computational linguistics: human language technolog...

    2019

  2. [10]

    Collecting telemetry data privately

    Ding, B., Kulkarni, J., and Yekhanin, S. Collecting telemetry data privately. Advances in Neural Information Processing Systems, 30, 2017

    2017

  3. [11]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., Gelly, S., Uszkoreit, J., and Houlsby, N. An image is worth 16x16 words: Transformers for image recognition at scale. In International Conference on...

    2021

  4. [12]

    Differential privacy

    Dwork, C. Differential privacy. In International colloquium on automata, languages, and programming, pp.\ 1--12. Springer, 2006

    2006

  5. [13]

    The algorithmic foundations of differential privacy

    Dwork, C., Roth, A., et al. The algorithmic foundations of differential privacy. Foundations and Trends in Theoretical Computer Science , 9 0 (3--4): 0 211--407, 2014

    2014

  6. [14]

    Rappor: Randomized aggregatable privacy-preserving ordinal response

    Erlingsson, \'U ., Pihur, V., and Korolova, A. Rappor: Randomized aggregatable privacy-preserving ordinal response. In Proceedings of the 2014 ACM SIGSAC conference on computer and communications security, pp.\ 1054--1067, 2014

    2014

  7. [15]

    Privacy leakage on dnns: A survey of model inversion attacks and defenses

    Fang, H., Qiu, Y., Yu, H., Yu, W., Kong, J., Chong, B., Chen, B., Wang, X., Xia, S.-T., and Xu, K. Privacy leakage on dnns: A survey of model inversion attacks and defenses. arXiv preprint arXiv:2402.04013, 2024

    2024 arXiv

  8. [16]

    Secure aggregation is insecure: Category inference attack on federated learning

    Gao, J., Hou, B., Guo, X., Liu, Z., Zhang, Y., Chen, K., and Li, J. Secure aggregation is insecure: Category inference attack on federated learning. IEEE Transactions on Dependable and Secure Computing, 20 0 (1): 0 147--160, 2021

    2021

  9. [17]

    Deep residual learning for image recognition

    He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp.\ 770--778, 2016

    2016

  10. [18]

    J., yelong shen, Wallis, P., Allen-Zhu, Z., Li, Y., Wang, S., Wang, L., and Chen, W

    Hu, E. J., yelong shen, Wallis, P., Allen-Zhu, Z., Li, Y., Wang, S., Wang, L., and Chen, W. Lo RA : Low-rank adaptation of large language models. In International Conference on Learning Representations, 2022 a . URL https://openreview.net/forum?id=nZeVKeeFYf9

    2022

  11. [19]

    S., and Zhang, X

    Hu, H., Salcic, Z., Sun, L., Dobbie, G., Yu, P. S., and Zhang, X. Membership inference attacks on machine learning: A survey. ACM Computing Surveys (CSUR), 54 0 (11s): 0 1--37, 2022 b

    2022

  12. [20]

    D., Chen, A., Shila, D

    Jiang, X., Hu, H., On, T., Lai, P., Mayyuri, V. D., Chen, A., Shila, D. M., Larmuseau, A., Jin, R., Borcea, C., et al. Flsys: Toward an open ecosystem for federated learning mobile apps. IEEE Transactions on Mobile Computing, 23 0 (1): 0 501--519, 2022

    2022

  13. [21]

    E., Qureshi, M

    Kariyappa, S., Guo, C., Maeng, K., Xiong, W., Suh, G. E., Qureshi, M. K., and Lee, H.-H. S. Cocktail party attack: Breaking aggregation-based privacy in federated learning using independent component analysis. In Krause, A., Brunskill, E., Cho, K., Engelhardt, B., Sabato, S., ...

    2023

  14. [22]

    Learning multiple layers of features from tiny images

    Krizhevsky, A., Hinton, G., et al. Learning multiple layers of features from tiny images. 2009

    2009

  15. [23]

    Krizhevsky, A., Sutskever, I., and Hinton, G. E. Imagenet classification with deep convolutional neural networks. Advances in neural information processing systems, 25, 2012

    2012

  16. [24]

    The power of scale for parameter-efficient prompt tuning

    Lester, B., Al-Rfou, R., and Constant, N. The power of scale for parameter-efficient prompt tuning. In Moens, M.-F., Huang, X., Specia, L., and Yih, S. W.-t. (eds.), Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pp.\ 3045--3059, Online...

    2021 doi

  17. [25]

    Tear: Exploring temporal evolution of adversarial robustness for membership inference attacks against federated learning

    Liu, G., Tian, Z., Chen, J., Wang, C., and Liu, J. Tear: Exploring temporal evolution of adversarial robustness for membership inference attacks against federated learning. IEEE Transactions on Information Forensics and Security, 18: 0 4996--5010, 2023

    2023

  18. [26]

    Roberta: A robustly optimized bert pretraining approach

    Liu, Y., Ott, M., Goyal, N., Du, J., Joshi, M., Chen, D., Levy, O., Lewis, M., Zettlemoyer, L., and Stoyanov, V. Roberta: A robustly optimized bert pretraining approach. arXiv preprint arXiv:1907.11692, 2019

    1907 arXiv

  19. [27]

    Towards differentially private text representations

    Lyu, L., Li, Y., He, X., and Xiao, T. Towards differentially private text representations. In Proceedings of the 43rd International ACM SIGIR Conference on Research and Development in Information Retrieval, pp.\ 1813--1816, 2020

    2020

  20. [28]

    Flamingo: Multi-round single-server secure aggregation with applications to private federated learning

    Ma, Y., Woods, J., Angel, S., Polychroniadou, A., and Rabin, T. Flamingo: Multi-round single-server secure aggregation with applications to private federated learning. In 2023 IEEE Symposium on Security and Privacy (SP), pp.\ 477--496. IEEE, 2023

    2023

  21. [29]

    E., Pham, P

    Maas, A., Daly, R. E., Pham, P. T., Huang, D., Ng, A. Y., and Potts, C. Learning word vectors for sentiment analysis. In Proceedings of the 49th annual meeting of the association for computational linguistics: Human language technologies, pp.\ 142--150, 2011

    2011

  22. [30]

    McMahan, B., Moore, E., Ramage, D., Hampson, S., and y Arcas, B. A. Communication-efficient learning of deep networks from decentralized data. In Artificial intelligence and statistics, pp.\ 1273--1282. PMLR, 2017

    2017

  23. [31]

    Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning

    Nasr, M., Shokri, R., and Houmansadr, A. Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In 2019 IEEE symposium on security and privacy (SP), pp.\ 739--753. IEEE, 2019

    2019

  24. [32]

    Secure aggregation is not private against membership inference attacks

    Ngo, K.-H., \"O stman, J., Durisi, G., and Graell i Amat, A. Secure aggregation is not private against membership inference attacks. In Joint European Conference on Machine Learning and Knowledge Discovery in Databases, pp.\ 180--198. Springer, 2024

    2024

  25. [33]

    and Thai, M

    Nguyen, T. and Thai, M. T. Preserving privacy and security in federated learning. IEEE/ACM Transactions on Networking, 2023

    2023

  26. [34]

    N., and Thai, M

    Nguyen, T., Thai, P., Tre’R, J., Dinh, T. N., and Thai, M. T. Blockchain-based secure client selection in federated learning. In 2022 IEEE International Conference on Blockchain and Cryptocurrency (ICBC), pp.\ 1--9. IEEE, 2022

    2022

  27. [35]

    Nguyen, T., Lai, P., Tran, K., Phan, N., and Thai, M. T. Active membership inference attack under local differential privacy in federated learning. In International Conference on Artificial Intelligence and Statistics, pp.\ 5714--5730. PMLR, 2023

    2023

  28. [36]

    Fedshe: privacy preserving and efficient federated learning with adaptive segmented ckks homomorphic encryption

    Pan, Y., Chao, Z., He, W., Jing, Y., Hongjia, L., and Liming, W. Fedshe: privacy preserving and efficient federated learning with adaptive segmented ckks homomorphic encryption. Cybersecurity, 7 0 (1): 0 40, 2024

    2024

  29. [37]

    Eluding secure aggregation in federated learning via model inconsistency

    Pasquini, D., Francati, D., and Ateniese, G. Eluding secure aggregation in federated learning via model inconsistency. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pp.\ 2429--2443, 2022

    2022

  30. [38]

    Natural language understanding with privacy-preserving bert

    Qu, C., Kong, W., Yang, L., Zhang, M., Bendersky, M., and Najork, M. Natural language understanding with privacy-preserving bert. In Proceedings of the 30th ACM International Conference on Information & Knowledge Management, pp.\ 1488--1497, 2021

    2021

  31. [39]

    Improving language understanding by generative pre-training

    Radford, A., Narasimhan, K., Salimans, T., Sutskever, I., et al. Improving language understanding by generative pre-training. 2018

    2018

  32. [40]

    K., Klambauer, G., Brandstetter, J., and Hochreiter, S

    Ramsauer, H., Sch \"a fl, B., Lehner, J., Seidl, P., Widrich, M., Gruber, L., Holzleitner, M., Adler, T., Kreil, D., Kopp, M. K., Klambauer, G., Brandstetter, J., and Hochreiter, S. Hopfield networks is all you need. In International Conference on Learning Representations, 202...

    2021

  33. [41]

    img2vec, 2021

    Safka, C. img2vec, 2021. URL https://github.com/christiansafka/img2vec. Accessed: 2025-01-31

    2021

  34. [42]

    Distilbert, a distilled version of bert: smaller, faster, cheaper and lighter

    Sanh, V., Debut, L., Chaumond, J., and Wolf, T. Distilbert, a distilled version of bert: smaller, faster, cheaper and lighter. arXiv preprint arXiv:1910.01108, 2019

    1910 arXiv

  35. [43]

    T., Huang, Y.-H., Wu, J., and Chen, Y.-S

    Saravia, E., Liu, H.-C. T., Huang, Y.-H., Wu, J., and Chen, Y.-S. Carer: Contextualized affect representations for emotion recognition. In Proceedings of the 2018 conference on empirical methods in natural language processing, pp.\ 3687--3697, 2018

    2018

  36. [44]

    Membership inference attacks against machine learning models

    Shokri, R., Stronati, M., Song, C., and Shmatikov, V. Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pp.\ 3--18. IEEE, 2017

    2017

  37. [45]

    T., et al

    Vu, M., Nguyen, T., Thai, M. T., et al. Analysis of privacy leakage in federated large language models. In International Conference on Artificial Intelligence and Statistics, pp.\ 1423--1431. PMLR, 2024

    2024

  38. [46]

    A comprehensive survey on local differential privacy toward data statistics and analysis

    Wang, T., Zhang, X., Feng, J., and Yang, X. A comprehensive survey on local differential privacy toward data statistics and analysis. Sensors, 20 0 (24): 0 7030, 2020

    2020

  39. [47]

    Warner, S. L. Randomized response: A survey technique for eliminating evasive answer bias. Journal of the American statistical association, 60 0 (309): 0 63--69, 1965

    1965

  40. [48]

    Gradient leakage attacks in federated learning: Research frontiers, taxonomy and future directions

    Yang, H., Ge, M., Xue, D., Xiang, K., Li, H., and Lu, R. Gradient leakage attacks in federated learning: Research frontiers, taxonomy and future directions. IEEE Network, 2023

    2023

  41. [49]

    Adapter is all you need for tuning visual tasks

    Yin, D., Hu, L., Li, B., and Zhang, Y. Adapter is all you need for tuning visual tasks. arXiv preprint arXiv:2311.15010, 2023

    2023 arXiv

  42. [50]

    Yue, X., Du, M., Wang, T., Li, Y., Sun, H., and Chow, S. S. Differential privacy for text analytics via natural text sanitization. In Findings of the Association for Computational Linguistics: ACL-IJCNLP 2021, pp.\ 3853--3866. Association for Computational Linguistics (ACL), 2021

    2021

  43. [51]

    B., Goldberg, Y., and Ravfogel, S

    Zaken, E. B., Goldberg, Y., and Ravfogel, S. Bitfit: Simple parameter-efficient fine-tuning for transformer-based masked language-models. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers), pp.\ 1--9, 2022

    2022

  44. [52]

    Gan enhanced membership inference: A passive local attack in federated learning

    Zhang, J., Zhang, J., Chen, J., and Yu, S. Gan enhanced membership inference: A passive local attack in federated learning. In ICC 2020-2020 IEEE International Conference on Communications (ICC), pp.\ 1--6. IEEE, 2020

    2020

  45. [53]

    Character-level convolutional networks for text classification

    Zhang, X., Zhao, J., and LeCun, Y. Character-level convolutional networks for text classification. Advances in neural information processing systems, 28, 2015

    2015

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.