Pith. sign in

REVIEW 4 major objections 4 minor 40 references

Detect \& Score: Privacy-Preserving Misbehaviour Detection and Contribution Evaluation in Federated Learning

T0 review · 4 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that a single multi-round scoring mechanism, MR-QI, built from QI's quality-inference rules and FedGT's overlapping group designs, detects malicious clients and ranks honest contributors in cross-silo federated learning…

desk verdict The paper's main contribution, MR-QI, is underspecified, which undermines the reproducibility of its headline results, but the experimental framework is sound and the underlying idea is worth pursuing. read the letter →

arxiv 2506.23583 v1 pith:ALAGIT3L submitted 2025-06-30 cs.CR cs.DCcs.LG

Marvin Xhemrishi , Alexandre Graell i Amat , Balázs Pejó This is my paper · ORCID
classification cs.CRcs.DCcs.LG
keywords federatedlearningsecureaggregationmisbehaviordetectioncontributionevaluationqualityinferencegrouptestingcross-silonon-IIDdata
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Federated learning with secure aggregation hides individual client updates, making it hard to tell whether a client is poisoning the model and how much each client contributes. This paper claims that one mechanism can do both jobs: it adapts QI's scoring rules, originally designed for randomly selected client groups across rounds, and re-runs them on FedGT's structured overlapping groups within the same round, in a multi-round variant called MR-QI. In experiments on CIFAR-10 and ISIC2019 with 15 clients and label-flipping attackers, MR-QI detects malicious clients at least as well as the best baseline and ranks client contributions better than leave-one-out scoring, with particular strength when client data is non-IID. If the claim holds, secure aggregation no longer forces a choice between privacy and the ability to police and reward participants.

What carries the argument

The load-bearing mechanism is the transfer of QI's three scoring rules—good, bad, and ugly—from the cross-device setting, where randomly selected client groups are compared across rounds, to the cross-silo setting, where FedGT's assignment matrix creates many overlapping groups of clients in the same round and the server compares every pair of those group aggregates. In QI's original logic, a group whose round produces a larger improvement than the previous round earns +1 and the previous round's group earns −1, while a round that fails to improve the model earns −1; these unit scores are accumulated over rounds. The paper's MR-QI performs both within-round comparisons among the $L$ groups defined by an assignment matrix and across-round comparisons with the groups of the previous and next rounds, giving $L(L-1)$ spatial comparisons instead of $2(T-1)$ temporal ones. It is this accumulation of simple comparison scores over structured groups that the paper claims carries enough signal for both detection and scoring, while the assignment matrix is chosen so that no individual client's model can be recovered from any linear combination of group aggregates within a round.

What would settle it

Fix a set of honest clients with known label-noise levels, run MR-QI under several randomly chosen assignment matrices with the same data, and check whether each client's relative ranking stays stable; if permuting only the grouping changes the ranking of honest clients, then the within-round spatial comparisons are measuring group composition rather than client quality.

Watch

Extended reading notes

Core claim

The paper's central claim is that misbehaviour detection and contribution evaluation are not separate tasks that need separate machinery under secure aggregation. By combining QI's quality-inference scoring with FedGT's error-correcting group designs, a server that only sees aggregated group model updates can both flag malicious clients and rank honest clients by data quality. The key new object is MR-QI, a multi-round scheme in which each client belongs to several overlapping groups defined by an assignment matrix, and the server compares group-aggregated models within the same round (spatial comparisons) and against adjacent rounds (temporal comparisons) using QI's good/bad/ugly rules. In the authors' experiments MR-QI outperforms single-round QI, multi-round FedGT, and the cosine-similarity baseline for detection on non-IID data, and outperforms leave-one-out for contribution scoring; the authors also find that FedGT's likelihood-ratio scores, while useful for detection, are poor at ranking contributions.

Load-bearing premise

The load-bearing assumption is that QI's good/bad/ugly scoring rules still estimate client data quality when the comparisons are changed from randomly selected client groups across different rounds to fixed structured overlapping groups compared within the same round, and the paper does not derive this transfer.

Editorial extensions

If this is right

  • A server that only ever sees group-aggregated models can flag malicious clients and rank contributors without seeing any individual update.
  • In non-IID cross-silo settings, a contribution-scoring mechanism can serve as the attack detector, beating the cosine-similarity baseline that is not private in its standard form.
  • Extending group-based testing across rounds with prefixed assignment matrices improves detection over one-shot testing.
  • Soft-decoding likelihood ratios from group testing do not transfer to contribution evaluation, so detection and scoring need different score semantics even when computed from the same group aggregates.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper does not explore applying the same spatial group-comparison idea outside federated learning; it could carry over to any setting that exposes only aggregate group statistics, such as secure multi-party computation with group sums.
  • The paper flags inter-round privacy as open; in practice a deployment would need re-randomised assignment matrices or added noise, and MR-QI's measured edge over baselines could shrink once that protection is added.
  • Because QI's 'ugly' rule only fires when a round fails to improve the model, a targeted backdoor that preserves global accuracy might evade MR-QI; testing that attack type would delimit the method's range.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper targets the cross-silo federated learning setting with secure aggregation, where the server cannot inspect individual client updates. It combines two existing schemes: QI, a contribution-evaluation (CE) method based on comparing randomly selected client groups across rounds, and FedGT, a misbehavior-detection (MD) method based on group testing with overlapping groups. The authors adapt QI to the cross-silo setting by replacing cross-round random group comparisons with same-round comparisons among structured groups (MR-QI), extend FedGT to multiple rounds with a prefixed assignment-matrix strategy (MR-FedGT), and evaluate both MD and CE on CIFAR-10 and ISIC2019 with label-flipping attacks and label-noise-based ground truth. The central claim, stated in the abstract and Section 4.1, is that the combination achieves robust MD and accurate CE and outperforms either method independently, especially in the non-IID cross-silo setting.

Significance. If the reported results are reproducible, the paper makes a useful step: it shows that a privacy-preserving group-comparison mechanism can serve both MD and CE without per-client update access. The experimental protocol is a strength: each training process is repeated ten times, standard deviations are reported, and the comparisons to COS and LOO are controlled in the sense that the same aggregation and scoring pipeline is applied. The paper also honestly states several limitations (Section 5) and an open privacy problem (Section 3.1). However, the main contribution, MR-QI, is not specified precisely enough for the central empirical claim to be independently checked, and the privacy claim is narrower than the title and abstract suggest.

major comments (4)
  1. [Section 3.1, 'Adopting QI for Cross-Silo FL'] The scoring rule for MR-QI is not specified. The text states that 'comparisons are now made between carefully designed groups within the same round' and that QI uses 'within-round comparison' and 'across-round comparison', but it never defines how group comparisons are converted into per-client scores. In the original QI (Section 2.2), the +1/-1 rules are given explicitly; for MR-QI no analogous equation, pseudocode, or textual rule appears. This is load-bearing because the headline results in Table 2 (e.g., MR-QI F1 0.84 vs MR-FedGT 0.50 for 5 attackers on non-IID CIFAR-10) cannot be reproduced or even simulated from the manuscript as written, and because the semantics of QI's good/bad/ugly rules may not survive the shift from temporal random-group comparisons to spatial structured-group comparisons without additional justification.
  2. [Section 4, 'Setup' and Section 4.1, 'Multi-round MD'] The MD evaluation depends on an unspecified clustering step: the paper says suspected attackers and benign clients are separated using 'agglomerative Clustering technique', but it does not give the linkage criterion, distance metric, number of clusters, or threshold. Since F1 scores in Table 2 are computed from this clustering output, the reported MD performance is not reproducible from the text, and it is unclear whether the comparison with COS is sensitive to this choice.
  3. [Section 4, 'Setup' and Table 3] The ground-truth contribution scores used to evaluate CE are defined by an ad-hoc rule: 'for client n each label is changed with probability n/(N+1)'. The paper does not argue that this quantity is a valid measure of contribution quality for the learning task, nor does it compare against a more principled ground truth such as Shapley values on a small subset. Since Table 3 reports L2 and Spearman correlations against this ground truth, the CE claim is only as strong as this unvalidated label.
  4. [Section 3.1, 'Multi-Round' and Section 5, 'Limitation & Future Work'] The privacy guarantee is stated too broadly. The abstract and title present the scheme as 'privacy-preserving', but Section 3.1 explicitly acknowledges that when models from consecutive rounds are correlated, considering A_tau_i and A_tau_{i+1} simultaneously 'may deteriorate' the privacy guarantees, and Section 5 states that inter-round privacy protection 'was not the scope of this paper'. Since MR-QI and MR-FedGT rely on across-round information, the paper should either state a precise threat model that limits privacy to within-round secure aggregation, or provide a formal analysis of what the multi-round scheme leaks.
minor comments (4)
  1. [Throughout] The dataset name is typeset inconsistently as 'CIF AR-10' and 'CIFAR-10'; this should be unified.
  2. [Section 3.1, 'Multi-Round'] The 'Same' strategy is listed as one of three multi-round strategies but is dismissed with one sentence ('Experimental results showed that the Same strategy provided no improvement'). Since this is a claimed empirical finding, it should either be shown or removed.
  3. [Section 4.1, 'Adopting QI for Cross Silo'] The statement 'the comparison regarding the IID setting is inconclusive' is vague; the reader does not know whether this refers to statistical significance, variance, or ordering across attacker counts.
  4. [Section 3.3, 'Comprehensive Solution'] The sentence 'our empirical findings revealed that latter is superior for both tasks' appears without a table or figure reference; a pointer to the relevant experiment would help.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation found: the reported gains are empirical and benchmarked against external baselines; underspecification of MR-QI and post-hoc strategy choice are reproducibility/selection concerns, not circularity.

full rationale

The paper does not derive any predicted quantity from a fitted constant or from an equation that is equivalent to its own input by construction. MR-QI and MR-FedGT are empirical modifications of the authors' own prior methods, QI and FedGT; citing those works is normal, and those methods are externally published and experimentally falsifiable rather than being invoked as unique theorems. The evaluation is benchmarked against non-private external baselines (COS for misbehavior detection, LOO for contribution evaluation), and the synthetic ground-truth noise ratios are generated independently of the method under test. The experimental claims are therefore not logically forced. The most serious weaknesses are that Section 3.1 never specifies the actual MR-QI scoring rule (it only says comparisons are 'made between carefully designed groups within the same round' without defining how group aggregates are converted into per-client scores), and that the Prefixed multi-round strategy was selected after observing that the Same strategy gave no improvement. These are reproducibility and selection-bias concerns that reduce the evidentiary weight of the tables, but they do not make the central claim circular in the sense of Eq. X = Eq. Y by construction or a fitted parameter renamed as a prediction. Accordingly, no specific circular step can be exhibited from the text, and the honest finding is no significant circularity.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The central claim rests on the validity of transferring QI's scoring rules from random temporal groups to structured spatial groups, on the synthetic label-noise ground truth for contribution evaluation, and on the assumption that plaintext simulations faithfully represent secure aggregation. None of these is derived in the paper; the first two are adopted without justification, and the third is stated but not validated by implementation.

free parameters (3)
  • Group testing matrix size (L, k) = not reported
    The number of test groups L and group size k define the assignment matrix A used in all MR-QI and MR-FedGT runs; the paper says these follow FedGT [11] but does not state their values, so the reported F1 and L2 scores cannot be reproduced or checked for sensitivity.
  • Agglomerative clustering configuration for MD = not reported
    In Section 4, detection scores are converted to benign/malicious labels by 'a clustering approach... based on agglomerative Clustering technique.' The distance threshold or number of clusters is not given, and this step directly determines the F1-scores.
  • MR-QI within/across-round score combination weights = not specified
    The paper never defines how within-round and across-round comparison scores are aggregated for MR-QI. If equal weights are assumed, that is a hand-set parameter; if weights were tuned, the tuning is undisclosed, and it could inflate the reported gains.
assumptions (5)
  • ad hoc to paper QI scoring semantics survive replacement of temporal random-group comparisons by spatial structured-group comparisons.
    Introduced in Section 3.1 without derivation; the entire MR-QI method and its reported gains depend on this transfer.
  • ad hoc to paper Per-client label-flip probability n/(N+1) is a valid ground-truth measure of contribution quality.
    Section 4 defines ground truth this way, following [12], and all CE metrics (L2, phi) in Table 3 measure distance to this synthetic ordering.
  • domain assumption Plaintext aggregation in the experiments faithfully represents what secure aggregation or homomorphic encryption would compute.
    Section 4 states 'we do not employ cryptographic techniques in our implementation'; the privacy-preserving claims assume these computations are feasible and numerically equivalent under SA/HE.
  • domain assumption The assignment matrix A from FedGT ensures intra-round privacy of individual models.
    Section 3.1 relies on FedGT's group structure to keep raw client models hidden; this property is inherited from [11] and not re-verified.
  • ad hoc to paper Inter-round privacy loss is acceptable because the scheme only claims in-round privacy.
    Section 3.1 acknowledges that across-round comparisons can leak information as models converge, but the paper still presents the scheme as privacy-preserving in the title and abstract, limiting the guarantee to in-round privacy.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Detect \& Score: Privacy-Preserving Misbehaviour Detection and Contribution Evaluation in Federated Learning." pith.science (2026). https://pith.science/paper/ALAGIT3L

@misc{pith2026250623583,
  author       = {Pith},
  title        = {Pith review of: Detect \& Score: Privacy-Preserving Misbehaviour Detection and Contribution Evaluation in Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ALAGIT3L}},
  note         = {Machine review of arXiv:2506.23583}
}
read the original abstract

Federated learning with secure aggregation enables private and collaborative learning from decentralised data without leaking sensitive client information. However, secure aggregation also complicates the detection of malicious client behaviour and the evaluation of individual client contributions to the learning. To address these challenges, QI (Pejo et al.) and FedGT (Xhemrishi et al.) were proposed for contribution evaluation (CE) and misbehaviour detection (MD), respectively. QI, however, lacks adequate MD accuracy due to its reliance on the random selection of clients in each training round, while FedGT lacks the CE ability. In this work, we combine the strengths of QI and FedGT to achieve both robust MD and accurate CE. Our experiments demonstrate superior performance compared to using either method independently.

Figures

Figures reproduced from arXiv: 2506.23583 by the authors.

Figure 1
Figure 1. Illustration of the envisioned settings where the shapes represent clients [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Detection performance (F1-score) of QI, FedGT and COS where 5 clients [PITH_FULL_IMAGE:figures/full_fig_p011_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

40 extracted references · 37 canonical work pages

  1. [1]

    Sok: Differential privacies,

    D. Desfontaines and B. Pej´ o, “Sok: Differential privacies,”Proc. on Privacy Enhancing Technologies, 2020

    work page 2020

  2. [2]

    Communication-efficient learning of deep networks from decentralized data,

    H. B. McMahan, E. Moore, D. Ramage, S. Hampson, et al. , “Communication-efficient learning of deep networks from decentralized data,” arXiv preprint arXiv:1602.05629 , 2016

    arXiv 2016

  3. [3]

    Data poisoning attacks against federated learning systems,

    V. Tolpegin, S. Truex, M. E. Gursoy, and L. Liu, “Data poisoning attacks against federated learning systems,” in 25th European Symposium on Re- search in Computer Security, ESORICS 2020 , Springer, 2020

    work page 2020

  4. [4]

    How to backdoor federated learning,

    E. Bagdasaryan, A. Veit, Y. Hua, D. Estrin, and V. Shmatikov, “How to backdoor federated learning,” in International Conference on Artificial In- telligence and Statistics , PMLR, 2020

    work page 2020

  5. [5]

    An exploratory analysis on users’ contributions in federated learning,

    J. Huang, R. Talbi, Z. Zhao, S. Boucchenak, L. Y. Chen, and S. Roos, “An exploratory analysis on users’ contributions in federated learning,” in 2020 IEEE Int. Conf. Trust, Priv. and Sec. in Intel. Syst. and applications , 2020

    work page 2020

  6. [6]

    Machine learning with adversaries: Byzantine tolerant gradient descent,

    P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: Byzantine tolerant gradient descent,” Advances in neural information processing systems , 2017

    work page 2017

  7. [7]

    A principled approach to data valuation for federated learning,

    T. Wang, J. Rausch, C. Zhang, R. Jia, and D. Song, “A principled approach to data valuation for federated learning,” Federated Learning: Privacy and Incentive, 2020

    work page 2020

  8. [8]

    Fedsv: Byzantine-robust feder- ated learning via shapley value,

    K. Otmani, R. El-Azouzi, and V. Labatut, “Fedsv: Byzantine-robust feder- ated learning via shapley value,” in ICC 2024-IEEE International Confer- ence on Communications , IEEE, 2024

    work page 2024

Show all 40 references
  1. [9]

    Zeno: Distributed stochastic gradient descent with suspicion-based fault-tolerance,

    C. Xie, O. Koyejo, and I. Gupta, “Zeno: Distributed stochastic gradient descent with suspicion-based fault-tolerance,” 2019

    2019

  2. [10]

    The shapley value in machine learning,

    B. Rozemberczki, L. Watson, P. Bayer, H.-T. Yang, O. Kiss, S. Nilsson, and R. Sarkar, “The shapley value in machine learning,” arXiv preprint arXiv:2202.05594, 2022

    2022 arXiv

  3. [11]

    FedGT: Identification of malicious clients in federated learning with secure aggrega- tion,

    M. Xhemrishi, J. ¨Ostman, A. Wachter-Zeh, and A. Graell i Amat, “FedGT: Identification of malicious clients in federated learning with secure aggrega- tion,” IEEE Trans. on Inf. Forensics and Sec. , 2025

    2025

  4. [12]

    Quality inference in federated learning with secure aggregation,

    B. Pej´ o and G. Bicz´ ok, “Quality inference in federated learning with secure aggregation,” IEEE Transactions on Big Data , 2023

    2023

  5. [13]

    A survey on data poisoning attacks and defenses,

    J. Fan, Q. Yan, M. Li, G. Qu, and Y. Xiao, “A survey on data poisoning attacks and defenses,” in 2022 7th IEEE International Conference on Data Science in Cyberspace (DSC) , IEEE, 2022

    2022

  6. [14]

    Label poisoning is all you need,

    R. Jha, J. Hayase, and S. Oh, “Label poisoning is all you need,” Advances in Neural Information Processing Systems , 2023

    2023

  7. [15]

    Autoregressive perturbations for data poisoning,

    P. Sandoval-Segura, V. Singla, J. Geiping, M. Goldblum, T. Goldstein, and D. Jacobs, “Autoregressive perturbations for data poisoning,” Advances in Neural Information Processing Systems , 2022. Detect & Score: Privacy-Preserving MD and CE in FL 15

    2022

  8. [16]

    Backdoor learning: A survey,

    Y. Li, Y. Jiang, Z. Li, and S.-T. Xia, “Backdoor learning: A survey,” IEEE Transactions on Neural Networks and Learning Systems , 2022

    2022

  9. [17]

    Defense strategies toward model poisoning attacks in federated learning: A survey,

    Z. Wang, Q. Kang, X. Zhang, and Q. Hu, “Defense strategies toward model poisoning attacks in federated learning: A survey,” in 2022 IEEE Wireless Communications and Networking Conference (WCNC) , IEEE, 2022

    2022

  10. [18]

    Learning to invert: Simple adaptive attacks for gradient inversion in federated learning,

    R. Wu, X. Chen, C. Guo, and K. Q. Weinberger, “Learning to invert: Simple adaptive attacks for gradient inversion in federated learning,” inUncertainty in Artificial Intelligence , PMLR, 2023

    2023

  11. [19]

    Mitigating sybils in federated learning poisoning,

    C. Fung, C. J. Yoon, and I. Beschastnikh, “Mitigating sybils in federated learning poisoning,” arXiv preprint arXiv:1808.04866 , 2018

    2018 arXiv

  12. [20]

    Robust aggregation for fed- erated learning,

    K. Pillutla, S. M. Kakade, and Z. Harchaoui, “Robust aggregation for fed- erated learning,” IEEE Trans. on Signal Processing , 2022

    2022

  13. [21]

    Byzantine-resilient secure federated learning,

    J. So, B. Guler, and A. S. Avestimehr, “Byzantine-resilient secure federated learning,” IEEE Journal on Selected Areas in Communications , 2020

    2020

  14. [22]

    Advances and open problems in federated learning,

    P. Kairouz and et al, “Advances and open problems in federated learning,” 2021

    2021

  15. [23]

    Fast-convergent federated learning with adaptive weighting,

    H. Wu and P. Wang, “Fast-convergent federated learning with adaptive weighting,” IEEE Trans. on Cognitive Commun. and Networking , 2021

    2021

  16. [24]

    Byzantine- robust federated learning via cosine similarity aggregation,

    T. Zhu, Z. Guo, C. Yao, J. Tan, S. Dou, W. Wang, and Z. Han, “Byzantine- robust federated learning via cosine similarity aggregation,” Computer Net- works, 2024

    2024

  17. [25]

    A survey on homomor- phic encryption schemes: Theory and implementation,

    A. Acar, H. Aksu, A. S. Uluagac, and M. Conti, “A survey on homomor- phic encryption schemes: Theory and implementation,” ACM Computing Surveys (Csur) , 2018

    2018

  18. [26]

    Xai—explainable ai,

    D. Gunning, M. Stefik, J. Choi, T. Miller, S. Stumpf, and G.-Z. Yang, “Xai—explainable ai,” Science robotics, 2019

    2019

  19. [27]

    Beyond accuracy: What data quality means to data consumers,

    R. Y. Wang and D. M. Strong, “Beyond accuracy: What data quality means to data consumers,” Journal of management information systems , 1996

    1996

  20. [28]

    Measure contribution of participants in federated learning,

    G. Wang, C. X. Dang, and Z. Zhou, “Measure contribution of participants in federated learning,” in 2019 IEEE Int. Conf. on Big Data , IEEE, 2019

    2019

  21. [29]

    Gradient driven rewards to guarantee fairness in collaborative machine learning,

    X. Xu, L. Lyu, X. Ma, C. Miao, C. S. Foo, and B. K. H. Low, “Gradient driven rewards to guarantee fairness in collaborative machine learning,” Adv. in Neural Inf. Processing Syst. , 2021

    2021

  22. [30]

    The shapley value,

    E. Winter, “The shapley value,” Handbook of game theory with economic applications, 2002

    2002

  23. [31]

    Secure shapley value for cross-silo federated learning (technical report),

    S. Zheng, Y. Cao, and M. Yoshikawa, “Secure shapley value for cross-silo federated learning (technical report),” arXiv preprint arXiv:2209.04856 , 2022

    2022 arXiv

  24. [32]

    Differentially private shapley values for data evaluation,

    L. Watson, R. Andreeva, H.-T. Yang, and R. Sarkar, “Differentially private shapley values for data evaluation,” arXiv:2206.00511, 2022

    2022 arXiv

  25. [33]

    Transparent contribution evaluation for secure federated learning on blockchain,

    S. Ma, Y. Cao, and L. Xiong, “Transparent contribution evaluation for secure federated learning on blockchain,” in 2021 IEEE 37th international conference on data engineering workshops (ICDEW) , IEEE, 2021

    2021

  26. [34]

    Measuring contributions in privacy- preserving federated learning,

    B. Pej´ o, G. Bicz´ ok, and G. ´Acs, “Measuring contributions in privacy- preserving federated learning,” ERCIM NEWS. 16 M. Xhemrishi, A. Graell i Amat, and B. Pej´ o

  27. [35]

    Inferring contributions in privacy-preserving fed- erated learning,

    B. Pej´ o and D. J. Velez, “Inferring contributions in privacy-preserving fed- erated learning,” ERCIM NEWS, 2025

    2025

  28. [36]

    Leave one out error, stability, and generalization of voting combinations of classifiers,

    T. Evgeniou, M. Pontil, and A. Elisseeff, “Leave one out error, stability, and generalization of voting combinations of classifiers,” Machine learning, 2004

    2004

  29. [37]

    Leave-one-out unfairness,

    E. Black and M. Fredrikson, “Leave-one-out unfairness,” inProc. of the 2021 ACM Conference on Fairness, Accountability, and Transparency, 2021

    2021

  30. [38]

    Flamby: datasets and benchmarks for cross-silo federated learning in realistic healthcare settings,

    J. O. du Terrail, S.-S. Ayed, E. Cyffers, and et al, “Flamby: datasets and benchmarks for cross-silo federated learning in realistic healthcare settings,” in Proc. 36th Int. Conf. on Neural Infor. Process. Syst. , 2022

    2022

  31. [39]

    Shapleyfl: Robust federated learning based on shapley value,

    Q. Sun, X. Li, J. Zhang, L. Xiong, W. Liu, J. Liu, Z. Qin, and K. Ren, “Shapleyfl: Robust federated learning based on shapley value,” in Proc. of the 29th ACM SIGKDD Conf. on Knowledge Discovery and Data Mining , 2023

    2023

  32. [40]

    Opendataval: a unified benchmark for data valuation,

    K. Jiang, W. Liang, J. Y. Zou, and Y. Kwon, “Opendataval: a unified benchmark for data valuation,” Adv. in Neural Inf. Processing Syst. , 2023

    2023

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.