Pith. sign in

REVIEW 6 major objections 5 minor 29 references

PROTEAN: Federated Intrusion Detection in Non-IID Environments through Prototype-Based Knowledge Sharing

T0 review · 6 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read PROTEAN claims that sharing per-class prototypes alongside model updates lets federated intrusion-detection participants recognize rare and even never-seen attack types, reporting F1 gains of 23% on X-IIoTID and 5% on 5G-NIDD over the…

desk verdict PROTEAN is a sensible prototype-based FL extension with strong empirical gains on rare-class IDS, but a load-bearing formal gap—undefined global prototypes for absent classes—undermines the zero-shot claims until fixed. read the letter →

arxiv 2507.05524 v1 pith:SSRJPYTH submitted 2025-07-07 cs.CR

Sara Chennoufi , Yufei Han , Gregory Blanc , Emiliano De Cristofaro , Christophe Kiennert This is my paper
classification cs.CR
keywords federatedlearningintrusiondetectionprototypenon-IIDdataknowledgesharingzero-shotcyberattacksprivacy
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to fix a blind spot in federated intrusion detection: when attack types are spread unevenly across organizations, some participants never see certain attacks during training, so their models cannot recognize them in live traffic. PROTEAN, the proposed framework, has every participant share not only model updates but also one prototype vector per attack class, the mean embedding of that class's samples, and the central server aggregates these into global prototypes that are sent back to everyone. A two-fold alignment penalty in the local loss pulls local prototypes toward their global counterparts and local model parameters toward the global model, which the paper argues is what makes a global prototype usable as a classifier for a class a participant has never trained on. On IIoT and 5G datasets the framework reports 23% and 5% higher F1 than Cerberus, the prior state of the art, and detects classes that are entirely absent from a participant's local data with accuracy above 76% in the evaluated settings. The authors also argue the prototype channel is communication-cheap and that a reconstruction adversary learns at most class-level averages, not individual training samples.

What carries the argument

The carrying mechanism is the dual alignment objective of Equation (3). Each participant $i$ builds a local prototype for class $j$ as $C_{i,j} = \frac{1}{N_{i,j}} \sum_{x \in \text{class } j} \varphi(x)$, the average embedding of that class's samples; the server aggregates local prototypes into global prototypes $\bar{C}_j$ and redistributes them. The local loss then minimizes cross-entropy plus the prototype-alignment penalty $\lambda \sum_j \|C_{i,j} - \bar{C}_j\|^2$ and the parameter-alignment penalty $\frac{\mu}{2}\|\omega_i - \omega\|^2$. These two penalties jointly shrink the gap between the embedding spaces of different participants, and that shrinkage is what allows inference by nearest-prototype classification, assigning the label of the global prototype closest in L2 distance to a new instance's embedding. The appendix's convergence theorems bound the per-round descent of the objective under Lipschitz smoothness and continuity assumptions, and the complexity analysis shows prototype overhead is negligible because prototype dimension $d$ is much smaller than the number of model parameters $m$.

What would settle it

Compute, for each attack class on the two evaluation datasets, the average pairwise L2 distance among the local prototypes contributed by participants that actually hold that class, and correlate it with the zero-shot accuracy achieved on participants that lack the class: the paper's alignment mechanism predicts a strong negative correlation. If the correlation is absent or weak, or if zero-shot accuracy survives high prototype dispersion, the reported gains would need an explanation other than embedding-space alignment.

Watch

Extended reading notes

Core claim

The central claim is that the failure of vanilla federated prototype learning (FPL) under extreme data heterogeneity is caused by distribution drift between locally trained embedding spaces, which makes aggregated global prototypes diverge, and that this can be repaired by aligning models and prototypes at the same time. PROTEAN's local objective combines cross-entropy classification with an L2 prototype-alignment term that pulls each participant's local prototypes toward the global prototypes of the previous round, plus a proximal-term parameter alignment that pulls local model parameters toward the global model. With both alignment forces active, the averaged global prototype of an attack class becomes a valid nearest-prototype classifier even for a participant that has zero local samples of that class, enabling few-shot and zero-shot detection of rare attacks. The paper reports macro accuracy of about 93% on X-IIoTID where vanilla FPL lands near 57–64%, a 35% accuracy advantage over FPL in the most extreme heterogeneity setting, an average 33.24% accuracy gain over Cerberus on each participant's two rarest classes, and zero-shot accuracy between 76% and 100% for classes a participant never trained on, where a local-only model scores 0%.

Load-bearing premise

The load-bearing premise is that, after federated training with the dual alignment penalties, the embedding spaces of the different participants are aligned well enough that a global prototype, an average of local prototypes, is a valid classifier for an attack class a participant has never trained on; if participant embedding spaces stay misaligned, the shared prototype carries the same noisy signal the paper uses to explain why vanilla FPL fails.

Editorial extensions

If this is right

  • A participant with no local samples of an attack class can still detect it: after PROTEAN training, zero-shot accuracy for absent classes reaches 76–100%, where a local-only model scores 0%.
  • The benefit grows as heterogeneity worsens: PROTEAN's macro-accuracy margin over vanilla FPL widens as the Dirichlet parameter $\alpha$ decreases, meaning the alignment mechanism matters most exactly where class absence is most frequent.
  • Rare-class detection is the main beneficiary: averaged across participants, accuracy on each participant's two rarest attack classes is 33.24% higher than with Cerberus, and the gap is statistically significant (p less than 2e-4 on X-IIoTID).
  • The extra communication cost is small: per-round cost rises from $2Mm$ to $2M(m + dK)$ with $dK \ll m$, and PROTEAN converges in round 2 versus rounds 4–5 for FedProx and Cerberus, saving communication rounds.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • My inference: the dual-alignment recipe is not specific to intrusion detection; any federated task with client-skewed classes, such as fraud detection or medical diagnosis, could plausibly apply the same pattern of sharing per-class prototypes under a parameter-alignment penalty, and the paper's convergence argument is stated in general optimization terms.
  • My inference: the zero-shot results suggest that prototype quality in a shared embedding space, rather than local classifier capacity, is the binding constraint in non-IID federated learning; a direct test would be to correlate the dispersion among local prototypes of a class with that class's zero-shot accuracy, which should be strongly negative if this reading is right.
  • My inference: the privacy audit measures reconstruction of class-average profiles, so it leaves open whether an adversary with membership-inference or attribute-inference goals could extract more from the prototype channel than MSE and PSNR reveal.
  • My inference: the paper evaluates one averaged global prototype per class, yet notes that a single attack type has multiple local prototypes reflecting distinct data modes; extending PROTEAN to share several prototypes per class could sharpen rare-attack detection and is a natural, testable variant.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

6 major / 5 minor

Summary. The paper introduces PROTEAN, a federated intrusion detection framework that combines standard model parameter aggregation with the exchange of class-specific prototypes. The training objective (Eq. 3) includes cross-entropy classification loss, a prototype alignment loss, and a proximal term. Experiments on X-IIoTID and 5G-NIDD report macro-accuracy improvements over Cerberus, MOON, FedProx-IDS, and FPL-IDS under Dirichlet-based non-IID splits, and the authors claim F1 improvements over Cerberus in the abstract. A zero-shot evaluation in Section 4.3 reports high detection accuracy for attack classes absent from a participant's local training data. A reconstruction attack is used to argue that sharing prototypes does not leak sensitive feature values, and the appendix states convergence theorems for the method.

Significance. If the claims are correct, PROTEAN would be a practically useful contribution to federated intrusion detection, particularly for rare and unseen attack classes, which are known pain points in cross-silo IDS deployments. The paper compares against several relevant baselines on two realistic datasets, includes statistical significance testing for the rare-attack results, and the idea of combining prototype alignment with full-parameter aggregation is plausible. However, the central zero-shot claim rests on an unspecified convention for prototypes of classes absent at a client, the abstract's F1 claim is not backed by any table, and the privacy evaluation contains an internal contradiction. The paper is potentially significant, but several load-bearing details need to be clarified or corrected.

major comments (6)
  1. [Section 3.2, Eq. (1)-(2)] The local prototype C_{i,j} is defined by Eq. (1) as an average over N_{i,j} samples of class j on participant i, which is undefined when N_{i,j}=0. Section 4.3 explicitly evaluates zero-shot detection for classes with no local training samples (e.g., participant 5 on X-IIoTID with zero RDOS/Reconnaissance/Tampering/Weaponization samples). The global aggregation in Eq. (2) must therefore assign some value to C_{i,j} for clients with zero samples of class j, but the manuscript never states this convention. Please specify what value is used (e.g., zero vector, exclusion of such clients from the average, or some other placeholder) and justify that the choice does not artificially inflate the zero-shot results.
  2. [Abstract and Section 1] The abstract and introduction claim F1 improvements over Cerberus of 23% on X-IIoTID and 5% on 5G-NIDD, but Table 1 reports macro accuracy only, and no other table or figure in the manuscript presents F1 values that support these specific percentages. Please provide the F1 results (e.g., a table analogous to Table 1) or amend the claims to match the reported metrics.
  3. [Section 4.1, Eq. (3)] The prototype alignment weight lambda in Eq. (3) is never reported. The text states mu = 0.1 for the proximal term, but lambda, which controls the strength of the central prototype alignment mechanism, is omitted. The paper should state the value used in the experiments and ideally include a sensitivity analysis, since the reported utility gains depend on this hyperparameter.
  4. [Appendix A] The paper says the convergence proof is provided in Appendix A, but the appendix contains only Assumptions 1-3 and two theorem statements; no proof is given. Furthermore, the terms in Eq. (9) are ambiguous (L_2 appears both as a Lipschitz constant and as a multiplier in the final term), and Eq. (10) defines tau with a term that grows with T, so the claimed condition on eta is not shown to hold or to imply descent. Please provide a complete, unambiguous proof and a precise convergence statement.
  5. [Section 5, Figure 5] The privacy evaluation is internally inconsistent. The text states that a smaller L2 distance indicates a more successful reconstruction, but then says 'A larger gap between them indicates a more successful data reconstruction attack.' In Figure 5, Reconstructed MSE values (e.g., 324.9) are much larger than Random MSE values (e.g., 1.17), which by the first definition would indicate that the attack is much worse than random, not more successful. The metric interpretation and the privacy conclusion must be reconciled with the data shown.
  6. [Section 3.4] The claim that 'PROTEAN can reach 35% higher classification accuracy than the SOTA FPL algorithm' is not directly supported by Table 1, which shows larger relative improvements at alpha=0.25 (e.g., 93.43% vs 57.32% on X-IIoTID). Please state the exact experimental condition that produces the 35% figure, or remove the claim.
minor comments (5)
  1. [Section 4.2] The sentence reporting '63.92% vs. 93.64%' for alpha=0.25 on X-IIoTID does not match Table 1, which reports 57.32% for FPL-IDS and 93.43% for PROTEAN; please reconcile the numbers.
  2. [Appendix A, Eq. (9)] The symbol L_2 is used for both the Lipschitz constant and in the product L_2 T; please use distinct notation to avoid confusion.
  3. [Full text, Tables 4 and 5] Tables 4 and 5 appear as placeholders with incomplete or missing values and should be either completed or removed.
  4. [Full text, Figures] Some figure captions are duplicated (e.g., Figure 8 appears twice with different content); please check and fix the figure numbering and captions.
  5. [References] The reference list contains several entries in the text that seem to be numbered inconsistently (e.g., the citations for MOON and FedProx in Section 2); please verify all in-text citations against the bibliography.

Circularity Check

0 steps flagged · score 2.0 of 10

No circular derivation: zero-shot detection is an empirical claim about embedding alignment, and the only self-citation (the Cerberus baseline) is not load-bearing.

full rationale

PROTEAN's derivation chain is self-contained. Local prototypes (Eq. 1) are class-mean embeddings of local data; global prototypes (Eq. 2) are averages of local prototypes; inference assigns the nearest global prototype. The zero-shot accuracy reported in Section 4.3 is therefore a genuine empirical outcome: it could be low if cross-client embedding spaces were misaligned, and the paper's Section 3.4 argument is that model-parameter aggregation plus prototype alignment makes alignment good enough. Nothing in Equations 1 through 3 makes the reported accuracies true by construction. The comparison to Cerberus involves prior work by two co-authors (Han and De Cristofaro), but Cerberus is used only as a baseline algorithm re-run in this paper's experiments, not as an authority for PROTEAN's design; the evaluation also includes external baselines (MOON, FedProx, FedProto) and external datasets (X-IIoTID, 5G-NIDD). Issues that do exist - Eq. 1 is undefined for zero local samples in the zero-shot regime, the hyperparameter lambda is not reported, and the convergence proof in Appendix A and the values in Tables 4-5 are incomplete - are correctness and completeness gaps, not reductions of a prediction to its inputs, so they do not raise the circularity score.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The central claim relies on two tunable scalars (lambda, mu) and on the assumption that averaged embeddings form a transferable representation space across participants with disjoint label distributions. No new physical entity is introduced; prototypes are standard in prototype learning.

free parameters (2)
  • Prototype alignment weight lambda = Not reported
    Equation 3 combines cross-entropy, prototype alignment, and proximal terms; lambda balances these, but the experimental setup never states its value or tuning procedure.
  • Proximal term weight mu = 0.1
    Stated in Section 4.1 for the proximal term; no sensitivity analysis or grid search is reported.
assumptions (4)
  • domain assumption The learning objective and embedding function are Lipschitz smooth/continuous (Assumptions 1-3, Appendix A).
    Invoked to bound the per-round objective descent (Equation 9); the paper asserts these hold for most deep networks but does not verify them for the specific CNN or prove the bound in detail.
  • domain assumption Dirichlet partitions with alpha in {0.75, 0.5, 0.25} represent realistic non-IID attack distributions.
    The evaluation depends on this simulation model to conclude PROTEAN works under heterogeneity; no real distributed deployment is tested.
  • domain assumption A global prototype formed by averaging local prototypes is a meaningful class representative for zero-shot detection.
    Section 3.3 and the zero-shot experiments assume embeddings from different participants align sufficiently after training; this is the core mechanism being tested, not independently established.
  • domain assumption Ten participants and ten federated rounds suffice for convergence of all methods compared.
    PROTEAN targets cross-silo FL with a limited number of participants, but the same setting is imposed on baselines; a 20-participant check is mentioned only for PROTEAN.

how reviews work

0 comments
Cite this review

Pith. "Pith review of PROTEAN: Federated Intrusion Detection in Non-IID Environments through Prototype-Based Knowledge Sharing." pith.science (2026). https://pith.science/paper/SSRJPYTH

@misc{pith2026250705524,
  author       = {Pith},
  title        = {Pith review of: PROTEAN: Federated Intrusion Detection in Non-IID Environments through Prototype-Based Knowledge Sharing},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SSRJPYTH}},
  note         = {Machine review of arXiv:2507.05524}
}
read the original abstract

In distributed networks, participants often face diverse and fast-evolving cyberattacks. This makes techniques based on Federated Learning (FL) a promising mitigation strategy. By only exchanging model updates, FL participants can collaboratively build detection models without revealing sensitive information, e.g., network structures or security postures. However, the effectiveness of FL solutions is often hindered by significant data heterogeneity, as attack patterns often differ drastically across organizations due to varying security policies. To address these challenges, we introduce PROTEAN, a Prototype Learning-based framework geared to facilitate collaborative and privacy-preserving intrusion detection. PROTEAN enables accurate detection in environments with highly non-IID attack distributions and promotes direct knowledge sharing by exchanging class prototypes of different attack types among participants. This allows organizations to better understand attack techniques not present in their data collections. We instantiate PROTEAN on two cyber intrusion datasets collected from IIoT and 5G-connected participants and evaluate its performance in terms of utility and privacy, demonstrating its effectiveness in addressing data heterogeneity while improving cyber attack understanding in federated intrusion detection systems (IDSs).

Figures

Figures reproduced from arXiv: 2507.05524 by the authors.

Figure 1
Figure 1. PROTEAN training process. Each participant trains a local model and extracts prototypes that summarize observed attacks. These prototypes and models are sent to the server, which aggregates them and sends the aggregated results to the participants to refine their knowledge using both local and global insights. The global class prototypes and model parameters are computed on the central server as: ω t = 1 M X M i=1 ω… view at source ↗
Figure 2
Figure 2. Per-round accuracy, F1 score, macro accuracy, and precision of PROTEAN, FedProx-IDS, Cerberus, and MOON￾IDS with α = 0.75, 0.5, and 0.25 on the X-IIoTID dataset. On each data set, we average the accuracy score of the 2 rare attack classes for each local participant with PROTEAN and Cerberus, noted as APROTEAN and ACerberus. We then compare the averaged accuracy scores of PROTEAN and Cerberus in Figures 3 and 8. In t… view at source ↗
Figure 3
Figure 3. Comparison of the averaged accuracy on two rare classes of each participant on the X-IIoTID dataset with different α values. Blue and orange bars represent Cerberus and PROTEAN, respectively. the average of APROTEAN and ACerberus scores derived on all the participants, which gives 91.32% and 58.08% respec￾tively. We observe that globally, PROTEAN can reach 33.24% higher detection accuracy than Cerberus on the rarely… view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4 [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]
Figure 5
Figure 5. Figure 5: Comparison between Random and Reconstructed MSEs per client (with α=0.75). Larger/smaller gap between the two MSE values indicates more/less accurate data reconstruction. 10 1 10 2 10 3 10 4 Variance (log scale) 125 150 175 200 225 MSE MSE 10 1 10 2 10 3 10 4 Variance …
Figure 6
Figure 6. Figure 6: Reconstructed MSE, PSNR and Utility for α = 0.75, 0.5 and 0.25 on the X-IIoTID dataset. values indicate better reconstruction. Results are shown in Figures 6 and 10 for X-IIoTID and 5G-NIDD datasets, re￾spectively. Higher noise variance improves privacy (higher MSE). W…
Figure 7
Figure 7. Figure 7: Per-round accuracy, F1 score, macro accuracy, and precision of PROTEAN, FedProx-IDS, Cerberus, and MOON￾IDS with α = 0.75, 0.5, and 0.25 on the 5G-NIDD dataset. 0 1 2 3 4 5 6 7 8 9 User 0.00 0.25 0.50 0.75 1.00 Avg Accuracy (a) α=0.75 0 1 2 3 4 5 6 7 8 9 User 0.00 0.25…
Figure 8
Figure 8. Figure 8: Comparison of the averaged accuracy on two rare classes of each participant on the on 5G-NIDD dataset with different α values. Blue and orange bars represent Cerberus and PROTEAN, respectively. 14 [PITH_FULL_IMAGE:figures/full_fig_p014_8.png]
Figure 9
Figure 9. Figure 9: Per-class accuracy for all users using PROTEAN on the 5G-NIDD dataset with different α values. Blue and orange bars represent the accuracy without FL and with PROTEAN, respectively. 15 [PITH_FULL_IMAGE:figures/full_fig_p015_9.png]
Figure 10
Figure 10. Figure 10: Reconstructed MSE, PSNR and Utility for α = 0.75, 0.5 and 0.25 on the 5G-NIDD dataset. 16 [PITH_FULL_IMAGE:figures/full_fig_p016_10.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

29 extracted references · 25 canonical work pages

  1. [1]

    Abosata, S

    N. Abosata, S. Al-Rubaye, and G. Inalhan. Customised Intru- sion Detection for an Industrial IoT Heterogeneous Network Based on Machine Learning Algorithms Called FTL-CID.Sen- sors, 23(1), 2023

    work page 2023

  2. [2]

    Al-Hawawreh, E

    M. Al-Hawawreh, E. Sitnikova, and N. Aboutorab. X-IIoTID: A Connectivity- and Device-agnostic Intrusion Dataset for Industrial Internet of Things. https://dx.doi.org/10. 21227/mpb6-py55, 2021

    work page 2021

  3. [3]

    M. Asad, A. Moustafa, and T . Ito. Fedopt: Towards com- munication efficiency and privacy preservation in federated learning.Applied Sciences, 10(8), 2020

    work page 2020

  4. [4]

    Briggs, Z

    C. Briggs, Z. Fan, and P . Andras. Federated learning with hierarchical clustering of local updates to improve training on non-IID data. InIJCNN, 2020

    work page 2020

  5. [5]

    Fallah, A

    A. Fallah, A. Mokhtari, and A. Ozdaglar. Personalized feder- ated learning: A meta-learning approach.arXiv:2002.07948, 2020

    arXiv 2002

  6. [6]

    Y. Fan, Y. Li, M. Zhan, H. Cui, and Y. Zhang. IoTDefender: A federated transfer learning intrusion detection framework for 5G IoT. InIEEE BigDataSE, 2020

    work page 2020

  7. [7]

    Geiping, H

    J. Geiping, H. Bauermeister, H. Dröge, and M. Moeller. In- verting gradients-how easy is it to break privacy in federated learning? InNeurIPS, volume 33, 2020

    work page 2020

  8. [8]

    S. P . Karimireddy, S. Kale, M. Mohri, S. Reddi, S. Stich, and A. T . Suresh. Scaffold: Stochastic controlled averaging for federated learning. InICML, 2020

    work page 2020

Show all 29 references
  1. [9]

    Lavaur, M.-O

    L. Lavaur, M.-O. Pahl, Y. Busnel, and F . Autrel. The evolution of federated learning-based intrusion detection and mitiga- tion: a survey.IEEE Transactions on Network and Service Management, 19(3), 2022

    2022

  2. [10]

    Q. Li, Y. Diao, Q. Chen, and B. He. Federated learning on non-iid data silos: An experimental study. InICDE, 2022

    2022

  3. [11]

    Q. Li, B. He, and D. Song. Model-contrastive federated learn- ing. InIEEE CVPR, 2021

    2021

  4. [12]

    T . Li, S. Hu, A. Beirami, and V . Smith. Ditto: Fair and robust federated learning through personalization. InICML, volume

  5. [13]

    T . Li, A. K. Sahu, M. Zaheer, M. Sanjabi, A. Talwalkar, and V . Smith. Federated optimization in heterogeneous networks. InMLSys, 2020

    2020

  6. [14]

    K. Liu, S. Hu, S. Z. Wu, and V . Smith. On privacy and person- alization in cross-silo federated learning.Advances in neural information processing systems, 35, 2022

    2022

  7. [15]

    G. Long, J. Ma, J. Jiang, L. Liu, T . Zhou, and Y. Tan. FedPCL: Learning to Blend Representations for Federated Prototype Learning. InAAAI, 2022

    2022

  8. [16]

    H. B. Mann and D. R. Whitney. On a Test of Whether one of Two Random Variables is Stochastically Larger than the Other. The Annals of Mathematical Statistics, 18(1):50 – 60, 1947

    1947

  9. [17]

    Marfoq, G

    O. Marfoq, G. Neglia, A. Bellet, L. Kameni, and R. Vidal. Fed- erated multi-task learning under a mixture of distributions. InNeurIPS, 2021

    2021

  10. [18]

    Naseri, Y

    M. Naseri, Y. Han, E. Mariconti, Y. Shen, G. Stringhini, and E. De Cristofaro. Cerberus: Exploring Federated Prediction of Security Events. InACM CCS, CCS ’22, 2022

    2022

  11. [19]

    X. Pei, X. Deng, S. Tian, L. Zhang, and K. Xue. A knowledge transfer-based semi-supervised federated learning for IoT malware detection.IEEE Transactions on Dependable and Secure Computing, 20(3), 2022

    2022

  12. [20]

    Pillutla, K

    K. Pillutla, K. Malik, A.-R. Mohamed, M. Rabbat, M. Sanjabi, and L. Xiao. Federated learning with partial model personal- ization. InICML, 2022

    2022

  13. [21]

    Samarakoon, Y

    S. Samarakoon, Y. Siriwardhana, P . Porambage, M. Liyanage, S.-Y. Chang, J. Kim, J. Kim, and M. Ylianttila. 5G-NIDD: A Comprehensive Network Intrusion Detection Dataset Gener- ated over 5G Wireless Network.arXiv:2212.01298, 2022

    2022 arXiv

  14. [22]

    Snell, K

    J. Snell, K. Swersky, and R. Zemel. Prototypical networks for few-shot learning. InNeurIPS, 2017

    2017

  15. [23]

    Q. Tan, Q. Li, Y. Zhao, Z. Liu, X. Guo, and K. Xu. Defending against data reconstruction attacks in federated learning: An information theory approach. InUSENIX Security, 2024

    2024

  16. [24]

    Y. Tan, G. Long, L. Liu, T . Zhou, Q. Lu, J. Jiang, and C. Zhang. Fedproto: Federated prototype learning across heteroge- neous clients. InAAAI, 2022

    2022

  17. [25]

    H. Wang, M. Yurochkin, Y. Sun, D. Papailiopoulos, and Y. Khazaeni. Federated learning with matched averaging. arXiv:2002.06440, 2020

    2002 arXiv

  18. [26]

    J. Wang, Q. Liu, H. Liang, G. Joshi, and H. V . Poor. A novel framework for the analysis and design of heterogeneous fed- erated learning.IEEE Transactions on Signal Processing, 69, 2021

    2021

  19. [27]

    Y. Xian, C. H. Lampert, B. Schiele, and Z. Akata. Zero-Shot Learning—A Comprehensive Evaluation of the Good, the Bad and the Ugly .IEEE Transactions on Pattern Analysis & Ma- chine Intelligence, 41(09):2251–2265, 2019

    2019

  20. [28]

    D. Xiao, J. Li, and M. Li. Privacy-preserving federated com- pressed learning against data reconstruction attacks based on secure data. InICONIP, 2023. 12

    2023

  21. [29]

    L. Zhu, Z. Liu, and S. Han. Deep leakage from gradients. In NeurIPS, 2019. A Convergence Analysis of PROTEAN We first provide the Lipschitz continuity and smoothness assumptions posed to the model trained in PROTEAN. Note that Lipschitz continuity and smoothness hold for most ...

    2019

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.