Pith. sign in

REVIEW 5 major objections 4 minor 77 references

AnalogFed: Privacy-Preserving Discovery of Analog Circuits at Scale with Federated Generative AI

T0 review · 5 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read AnalogFed shows that chip designers can train a circuit-generating model across proprietary datasets, with dummy tokens and dynamic encryption blocking both membership inference and model inversion.

desk verdict The federated generative framework for analog circuits is real and useful, but the privacy claims are not: sub-0.5 AUC is an inverted signal, not indistinguishability. read the letter →

arxiv 2507.15104 v2 pith:Z257VYER submitted 2025-07-20 cs.LG cs.AI

Qiufeng Li , Shu Hong , Tian Lan , Weidong Cao This is my paper
classification cs.LGcs.AI
keywords analogcircuittopologydiscoveryfederatedlearninggenerativeAIforEDAmembershipinferenceattackmodelinversionhomomorphicencryptiondummytokenperturbationprivacy-preservinghardwaredesign
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

AnalogFed claims that generative-AI models for analog circuit design can be trained collaboratively across organizations that refuse to share their circuit libraries, without giving up either privacy or generation quality. The paper's core assertion is that two lightweight defenses suffice: dummy tokens spliced into training sequences block membership-inference attacks, and homomorphic encryption applied only to early, large gradients blocks model inversion. If true, this removes a key obstacle to large-scale electronic design automation, where proprietary and siloed datasets have limited generative models to small centralized corpora. The experiments show federated training with up to sixteen clients approaching centralized quality, while dummy-token defense drives membership-inference accuracy close to random guessing.

What carries the argument

Two mechanisms carry the argument. First, dummy-token input perturbation: every circuit is serialized as a sequence of device-pin tokens, and the framework randomly inserts small blocks of VDD/VSS dummy tokens after power nodes at a chosen ratio, then computes the autoregressive loss while masking the dummy positions, so the model never learns to predict them but its confidence on real member sequences is blurred. Second, Dynamic Homomorphic Encryption: because gradient magnitudes decay as training converges, only early-round gradients need additive encryption, and a convergence trigger disables encryption once five consecutive epochs show less than 20% loss reduction. Together these turn membership inference into a near coin flip and make server-side model inversion impractical at a fraction of the cost of full homomorphic encryption.

What would settle it

Take a trained AnalogFed with encryption disabled after the convergence trigger and run an existing model-inversion or gradient-matching attack on those late plaintext updates; if recognizable circuit topologies, such as a specific Op-Amp structure, are reconstructed, the claim that late gradients are safe is false.

Watch

Extended reading notes

Core claim

AnalogFed is presented as the first privacy-preserving federated framework for analog circuit topology discovery, built on a decoder-only transformer that generates circuits by predicting the next device pin in an Eulerian traversal of the circuit graph. Clients collaboratively pre-train via FedAvg while a server aggregates encrypted updates, then each client fine-tunes locally with PPO so that the manufacturing technology used for evaluation never leaves the client. Against a semi-honest server, Dynamic Homomorphic Encryption encrypts only the early large gradients and disables encryption once the loss reduction stays below 20% for five consecutive epochs, which in experiments occurs around round 600; this cuts communication cost by 5.1x and training time to 48.5 hours versus 184 hours for static full encryption. Against malicious clients running seven standard membership-inference attacks on the distributed model, injecting dummy VDD/VSS tokens at 6% density with block size 4, while masking those tokens out of the loss, drives AUC-ROC toward 0.5, meaning the attacker does no better than guessing, and the generated circuits remain close to centralized training in validity, novelty, and figure-of-merit.

Load-bearing premise

The load-bearing premise is that after training has mostly converged, the unencrypted late gradients no longer carry any usable information from which an attacker could reconstruct a proprietary circuit.

Editorial extensions

If this is right

  • More clients help: generation validity rises from 55.7% with 3 clients to 91.2% with 16 clients, approaching the 95.5% of centralized training with dummy tokens.
  • Unbalanced, domain-specialized data is not fatal: 12- and 16-client unbalanced splits match their balanced counterparts on validity and figure-of-merit.
  • Membership inference can be neutralized by a small input perturbation: all seven evaluated attacks drop to AUC-ROC near 0.5 at 6% dummy tokens with block size 4.
  • Encrypting only early gradients preserves defense: DHE matches static homomorphic encryption while cutting communication cost by 5.1x and training time by about 4x.
  • The same two-stage federated design is claimed to extend to other proprietary EDA datasets, such as digital RTL codebases and RF circuit designs.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An extension the paper does not pursue: dummy-token perturbation should transfer to any autoregressive model over graph-derived sequences, such as digital RTL code, netlists, or molecular graphs, as long as the injected tokens are semantically inert and excluded from the loss.
  • The DHE convergence trigger is a heuristic; a more defensible design would tie encryption on/off to a measured gradient-norm bound or to actual inversion-attack success on held-out late-round gradients.
  • The threat model assumes a semi-honest server that does not collude with a malicious client; a server that recruits one client's trained model as an oracle during the encrypted phase is outside the analysis and could bypass the membership-inference defense.
  • The paper does not run a model-inversion attack on the plaintext late-round gradients, so the strongest remaining test is exactly that audit before deployment.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 4 minor

Summary. AnalogFed proposes a federated learning framework for analog circuit topology generation built on the AnalogGenie backbone. The paper's central claims are that (i) federated collaboration across distributed proprietary datasets improves generation quality and scalability, (ii) dummy-token input perturbation defeats membership inference attacks without utility loss, and (iii) dynamic homomorphic encryption protects against model inversion while cutting communication cost. Experiments use the AnalogGenie dataset with 3 to 16 clients, varying dummy-token ratios and block sizes, seven MIA benchmarks, and a DHE implementation with encrypted early-round gradients. The paper reports improved generation metrics with more clients, low MIA AUC values under dummy-token perturbation, and a 5.1x communication-cost reduction relative to static HE.

Significance. If the privacy and utility claims held, AnalogFed would be a useful domain-specific contribution to privacy-preserving EDA: the dummy-token idea exploits circuit structure (VDD/VSS wires) in a way that is simple and mechanistically different from DP, and the DHE scheme addresses a real efficiency bottleneck. The paper also provides concrete quantitative comparisons, including communication cost and training time. However, the central privacy guarantee is not supported by the reported data: the MIA defense is justified by an AUC reading that appears miscalibrated, and the model-inversion defense is never directly evaluated. The scalability claim is also confounded by the experimental setup. These issues are load-bearing for the paper's headline assertions of 'strong privacy protection' and 'without degrading model utility.'

major comments (5)
  1. [Section IV-D, Table V] The conclusion that dummy tokens 'render various MIAs infeasible' and make members 'indistinguishable' from non-members is not supported by the reported AUC values. Table V reports AUCs systematically below 0.5 (e.g., Loss 6%+B4 = 0.443, Zlib 6%+B4 = 0.444). Under the paper's own definition, AUC = 0.5 is random guessing and 'the best defense'; values far below 0.5 do not mean indistinguishability but rather a reversed ordering of member and non-member scores. An attacker aware of the defense can invert the decision rule and obtain AUC ≈ 1 - 0.443 = 0.557, which is above chance. Thus Table V is evidence of an exploitable membership signal, not of defense success. Please report calibrated attacks or both directions of the score ordering, or use a metric such as attacker advantage that treats deviation from 0.5 in either direction as leakage.
  2. [Section III-C, DHE] The model-inversion defense is asserted but never tested. The paper assumes that after convergence (loss reduction below 20% for five consecutive epochs, around round 600), residual gradients are too small to be informative and can be transmitted in plaintext. No model-inversion attack is run on late-round gradients, and no theoretical argument is given for why gradient magnitude bounds reconstruction success. Since the abstract claims defense against model inversion attacks, and since the DHE evaluation in Section IV-C reports only loss and communication cost, the inversion-defense claim is currently unsupported. Please add inversion-attack experiments on early, middle, and late-round plaintext gradients, or explicitly weaken the security claim.
  3. [Section IV-A, Table III] The scalability conclusion is confounded by the data setup. The text states that 'in both scenarios, the data volume scales proportionally with the number of clients,' so the 16-client runs use considerably more total training data than the 3-client runs. The improved validity, FoM, and MMD in Table III may therefore be due to increased data volume rather than to the federated collaboration mechanism. To support the scalability claim, keep per-client data volume fixed while varying the number of clients, or otherwise disentangle the number of clients from total data size. The comparison to 'Centralized (no dummy tokens)' should also be matched in data volume and perturbation setting.
  4. [Section IV-B, Table III] The statement that dummy-token injection 'does not degrade model utility (compared to the centralized training without dummy tokens)' is contradicted by the numbers in Table III: centralized validity is 95.5% versus 91.2%/92.4% for 16 clients, FoM is 13744.7 versus 11211.3/11105.4, and MMD is 0.0406 versus 0.0547/0.0508. Unless the comparison is explicitly restricted to a matched setting, the utility-preservation claim needs a direct ablation: the same federated configuration with and without dummy tokens, at the same data volume. As written, the utility claim is unsupported.
  5. [Section IV-D, Table IV] The defense hyperparameters (6% dummy ratio, block size 4) are selected by minimizing MIA AUC in Table IV and then the same table and the derived configuration are used as evidence for the defense's effectiveness. No separate validation protocol is described. This creates a selection-bias risk: the reported AUCs may be optimistic relative to a configuration chosen on a held-out attack set. Please describe how the dummy ratio and block size were tuned and report defense performance on an independent evaluation set.
minor comments (4)
  1. [Section IV-A] The MIA evaluation reports AUC values without confidence intervals or repeated seeds; many differences between configurations are small (e.g., 0.486 vs 0.488 in Table V) and may be within noise. Please report standard errors or multiple runs.
  2. [References] Reference [47] duplicates reference [44], and reference [52] is truncated ('Min-k' with no title or venue). Please correct these bibliographic entries.
  3. [Section IV-C] The sentence 'further experiments show that DHE provides robust defense capabilities, comparable to FEDML-HE' is not substantiated by any attack experiment in the paper; only loss and communication cost are shown. If this is intended as a claim about privacy, it should be moved to a discussion or supported with attack results.
  4. [Section III-C] The encryption cutoff criterion ('loss reduction below 20% for five consecutive epochs') is introduced without justification or sensitivity analysis. Please state how this threshold was chosen and whether results are stable to it.

Circularity Check

1 steps flagged · score 6.0 of 10

The dummy-token MIA defense is partially circular: Table V tests 'member' inputs that are not members by construction, so the claimed indistinguishability is an artifact of the evaluation protocol.

  1. self definitional [Section IV-D, Table V paragraph and Algorithm 1, lines 6-11]
    "We then evaluate robustness when member inputs also contain dummy tokens. Using models trained with 6% dummy tokens (block sizes 2 and 4), we test on inputs with varied dummy configurations. As shown in Table V, even small mismatches in percentage, block size, or position can lower AUC-ROC, making members indistinguishable from non-members. ... Overall, dummy token defense renders various MIAs infeasible."

    Algorithm 1 builds each client's training set by injecting dummy tokens at randomly selected positions with the training ratio (lines 8-9), and trains on that exact perturbed dataset. Table V then re-perturbs member circuits at different percentages, block sizes, or positions before querying. A member circuit with a mismatched dummy configuration was never in the training set, so its membership query is a non-member by construction. The low AUC (0.44-0.49) reflects the model's unfamiliarity with the mismatched input format, not the absence of a membership signal. Thus the conclusion that the dummy token defense renders MIAs infeasible reduces to the evaluation construction rather than to a measured privacy property.

full rationale

The federated framework and utility results are not definitionally circular: Table III compares against centralized AnalogGenie training, and the DHE encryption schedule is a heuristic, not derived from the outcome. The AnalogGenie backbone is a self-citation (W. Cao is a co-author), but it is an open-source model and dataset used as an external benchmark, so it is not load-bearing circularity. The partial circularity is confined to the MIA defense claim. The paper first selects the 6%-dummy/block-4 configuration from Table IV, and then supports the claim that the defense 'renders various MIAs infeasible' primarily with Table V. Because Table V deliberately mismatches the dummy configuration, the attacked 'member' sequences are not elements of the training set under Algorithm 1; their low AUC is forced by the input mismatch. Additionally, the paper's reading of AUC below 0.5 as 'indistinguishable' misinterprets sub-0.5 values as stronger defense rather than as an inverted membership signal; that is a correctness risk, not a circularity, and is not scored here. Overall, the central privacy claim is partially circular in its MIA evaluation, but the learning and utility contribution retains independent content.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The framework depends on two hand-tuned privacy hyperparameters (dummy ratio and block size) and a hand-set encryption cutoff, plus several domain assumptions about circuit semantics, attacker behavior, and gradient information content. No new physical entities are introduced.

free parameters (3)
  • Dummy token injection ratio (rho) = 6%
    Selected from a 1%-8% sweep in Section IV-D because it gave the best MIA-defense/utility trade-off; the headline defense strength is therefore fitted to the same evaluation table.
  • Dummy block size (B) = 4
    Chosen together with rho; Table IV shows block size 4 is close to best while larger blocks add little, so this hyperparameter is tuned on the reported MIA results.
  • DHE encryption cutoff (loss reduction <20% for 5 consecutive epochs) = 20% and 5 epochs (roughly round 600)
    Hand-set convergence criterion that decides when gradients are exposed in plaintext; no sensitivity analysis is given, and the security rests on this cutoff.
assumptions (5)
  • domain assumption AnalogGenie's Euler-tokenized circuit representation faithfully encodes analog topologies.
    The paper adopts AnalogGenie's representation and dataset as ground truth for validity and novelty evaluations; flaws in that representation would affect AnalogFed's generated circuits.
  • domain assumption A semi-honest server and a black-box malicious client capture the relevant adversaries.
    Stated in Section III-A; stronger adversaries, such as malicious servers that deviate from the protocol, are excluded, so privacy claims are scoped to this threat model.
  • ad hoc to paper Dummy VDD/VSS wires do not alter circuit functionality, so training on perturbed topologies still yields valid circuits.
    Used in Section III-D to justify why injecting dummy tokens is safe; the paper asserts functional neutrality but does not verify it with SPICE simulations on the generated circuits.
  • ad hoc to paper Gradient magnitude reflects information content, so late-round plaintext gradients leak no useful data.
    Core premise of DHE in Section III-C; it is an empirical regularity asserted from convergence behavior, but no model-inversion attack is run to confirm that late gradients are safe.
  • domain assumption Lower MIA AUC means stronger defense, and AUC below 0.5 is equivalent to random guessing.
    The paper treats any AUC near or below 0.5 as indistinguishability, but a below-0.5 AUC is an invertible signal; this assumption affects all defense claims in Tables IV and V.

how reviews work

0 comments
Cite this review

Pith. "Pith review of AnalogFed: Privacy-Preserving Discovery of Analog Circuits at Scale with Federated Generative AI." pith.science (2026). https://pith.science/paper/Z257VYER

@misc{pith2026250715104,
  author       = {Pith},
  title        = {Pith review of: AnalogFed: Privacy-Preserving Discovery of Analog Circuits at Scale with Federated Generative AI},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/Z257VYER}},
  note         = {Machine review of arXiv:2507.15104}
}
read the original abstract

Recent advances in generative AI (GenAI) have shown transformative potential for modern hardware design. However, existing GenAI-driven approaches fall short of enabling large-scale electronic design automation (EDA) due to the proprietary and siloed nature of hardware datasets, which cannot be centralized for model training. Achieving at-scale GenAI-driven EDA, therefore, requires a novel privacy-preserving framework that can leverage distributed data without compromising confidentiality. This work introduces AnalogFed, the first privacy-preserving framework for large-scale analog circuit topology discovery using federated learning (FedL) and GenAI. AnalogFed establishes the feasibility of collaborative analog topology design while addressing key security challenges: it mitigates membership inference attacks (MIAs) through a novel input perturbation strategy based on dummy token injection, and defends against model inversion attacks with customized, efficient homomorphic encryption. Extensive experiments demonstrate AnalogFed's effectiveness and efficiency, achieving strong privacy protection without degrading model utility. This framework lays the foundation for scalable, multi-party collaboration in next-generation hardware design automation with GenAI.

Figures

Figures reproduced from arXiv: 2507.15104 by the authors.

Figure 1
Figure 1. Comparison between (a) current centralized training, where [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Overview of the AnalogFed framework. (a) Federated pre-training for privacy-preserving collaborative learning. (b) Client-side fine-tuning via RLHF (PPO) for design optimization. Threat models: Data reconstruction (model inversion) from shared gradients (c) and MIA targeting training data (d). (e) Circuit generation using a decoder-only Transformer with Euler-tokenized topologies and dummy token injection. Framework… view at source ↗
Figure 3
Figure 3. (a) Change in gradients distribution, (b) Communication cost (ours [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

77 extracted references · 46 canonical work pages

  1. [1]

    The times sues openai and microsoft over a.i. use of copyrighted work,

    M. M. Grynbaum and R. Mac, “The times sues openai and microsoft over a.i. use of copyrighted work,” https://www.nytimes.com/2023/12/27/business/media/ new-york-times-open-ai-microsoft-lawsuit.html, 2023

    work page 2023

  2. [2]

    The battle over books3 could change ai forever,

    K. Knibbs, “The battle over books3 could change ai forever,” https://www.wired.com/story/battle-over-books3/, 2023

    work page 2023

  3. [3]

    Proving test set contamination in black box lan- guage models,

    Y . Oren, N. Meister, N. Chatterji, F. Ladhak, and T. B. Hashimoto, “Proving test set contamination in black box lan- guage models,”arXiv preprint arXiv:2310.17623, 2023

    arXiv 2023

  4. [4]

    Verilogcoder: Autonomous verilog coding agents with graph-based planning and abstract syntax tree (ast)-based waveform tracing tool,

    C.-T. Ho, H. Ren, and B. Khailany, “Verilogcoder: Autonomous verilog coding agents with graph-based planning and abstract syntax tree (ast)-based waveform tracing tool,” inProceedings of the AAAI Conference on Artificial Intelligence, vol. 39, no. 1, 2025, pp. 300–307

    work page 2025

  5. [5]

    Chip-chat: Chal- lenges and opportunities in conversational hardware design,

    J. Blocklove, S. Garg, R. Karri, and H. Pearce, “Chip-chat: Chal- lenges and opportunities in conversational hardware design,” in 2023 ACM/IEEE 5th Workshop on Machine Learning for CAD (MLCAD). IEEE, 2023, pp. 1–6

    work page 2023

  6. [6]

    Autockt: Deep reinforcement learning of analog circuit designs,

    K. Settaluri, A. Haj-Ali, Q. Huang, K. Hakhamaneshi, and B. Nikolic, “Autockt: Deep reinforcement learning of analog circuit designs,” in2020 Design, Automation & Test in Europe Conference & Exhibition (DATE). IEEE, 2020, pp. 490–495

    work page 2020

  7. [7]

    Edalearn: A comprehensive rtl-to-signoff eda benchmark for democratized and reproducible ml for eda research,

    J. Pan, C.-C. Chang, Z. Xie, Y . Chen, and H. H. Li, “Edalearn: A comprehensive rtl-to-signoff eda benchmark for democratized and reproducible ml for eda research,” inProceedings of the 43rd IEEE/ACM International Conference on Computer-Aided Design, 2024, pp. 1–8

    work page 2024

  8. [8]

    Chipnemo: Domain-adapted llms for chip design,

    M. Liu, T.-D. Ene, R. Kirby, C. Cheng, N. Pinckney, R. Liang, J. Alben, H. Anand, S. Banerjee, I. Bayraktaroglu, B. Bhaskaran, B. Catanzaro, A. Chaudhuri, S. Clay, B. Dally, L. Dang, P. Deshpande, S. Dhodhi, S. Halepete, E. Hill, J. Hu, S. Jain, A. Jindal, B. Khailany, G. Kokai, K. Kunal, X. Li, C. Lind, H. Liu, S. Oberman, S. Omar, G. Pasandi, S. Pratty,...

    arXiv 2024

Show all 77 references
  1. [9]

    In- sight: Universal neural simulator for analog circuits harnessing autoregressive transformers,

    S. Poddar, Y . Oh, Y . Lai, H. Zhu, B. Hwang, and D. Z. Pan, “In- sight: Universal neural simulator for analog circuits harnessing autoregressive transformers,”arXiv preprint arXiv:2407.07346, 2024

    2024 arXiv

  2. [10]

    The end of moore’s law: A new beginning for information technology,

    T. N. Theis and H.-S. P. Wong, “The end of moore’s law: A new beginning for information technology,”Computing in science & engineering, vol. 19, no. 2, pp. 41–50, 2017

    2017

  3. [11]

    Analogcoder: Analog circuit design via training-free code generation,

    Y . Lai, S. Lee, G. Chen, S. Poddar, M. Hu, D. Z. Pan, and P. Luo, “Analogcoder: Analog circuit design via training-free code generation,” inProceedings of the AAAI Conference on Artificial Intelligence, vol. 39, no. 1, 2025, pp. 379–387

    2025

  4. [12]

    Artisan: Automated operational amplifier design via domain-specific large language model,

    Z. Chen, J. Huang, Y . Liu, F. Yang, L. Shang, D. Zhou, and X. Zeng, “Artisan: Automated operational amplifier design via domain-specific large language model,” inProceedings of the 61st ACM/IEEE Design Automation Conference, 2024, pp. 1–6

    2024

  5. [13]

    Cktgnn: Circuit graph neural network for electronic design automation,

    Z. Dong, W. Cao, M. Zhang, D. Tao, Y . Chen, and X. Zhang, “Cktgnn: Circuit graph neural network for electronic design automation,”arXiv preprint arXiv:2308.16406, 2023

    2023 arXiv

  6. [14]

    Lamagic: Language-model-based topology generation for analog integrated circuits,

    C.-C. Chang, Y . Shen, S. Fan, J. Li, S. Zhang, N. Cao, Y . Chen, and X. Zhang, “Lamagic: Language-model-based topology generation for analog integrated circuits,”arXiv preprint arXiv:2407.18269, 2024

    2024 arXiv

  7. [15]

    Analoggenie: A generative engine for automatic discovery of analog circuit topologies,

    J. Gao, W. Cao, J. Yang, and X. Zhang, “Analoggenie: A generative engine for automatic discovery of analog circuit topologies,”arXiv preprint arXiv:2503.00205, 2025

    2025 arXiv

  8. [16]

    Matching, euler tours and the chinese postman,

    J. Edmonds and E. L. Johnson, “Matching, euler tours and the chinese postman,”Mathematical programming, vol. 5, pp. 88– 124, 1973

    1973

  9. [17]

    gspan: Graph-based substructure pattern mining,

    X. Yan and J. Han, “gspan: Graph-based substructure pattern mining,” in2002 IEEE International Conference on Data Min- ing, 2002. Proceedings.IEEE, 2002, pp. 721–724

    2002

  10. [18]

    Biggs, E

    N. Biggs, E. K. Lloyd, and R. J. Wilson,Graph Theory, 1736-

  11. [19]

    F. S. Roberts and B. Tesman,Applied combinatorics. CRC Press, 2024

    2024

  12. [20]

    Pricing: Privacy-preserving circuit data sharing framework for lithographic hotspot detection,

    C.-C. Chang, W.-H. Lin, J. Pan, G. Zhou, Z. Xie, J. Hu, and Y . Chen, “Pricing: Privacy-preserving circuit data sharing framework for lithographic hotspot detection,” inProceedings of the 30th Asia and South Pacific Design Automation Conference, 2025, pp. 1308–1313

    2025

  13. [21]

    Feder- ated learning for microwave filter behavior prediction,

    S. Luo, J. Ma, C. Zhang, S. Dang, and R. Shubair, “Feder- ated learning for microwave filter behavior prediction,”IEEE Microwave and Wireless Technology Letters, vol. 34, no. 3, pp. 255–258, 2024

    2024

  14. [22]

    Fedbn: Federated learning on non-iid features via local batch normal- ization,

    X. Li, M. Jiang, X. Zhang, M. Kamp, and Q. Dou, “Fedbn: Federated learning on non-iid features via local batch normal- ization,”arXiv preprint arXiv:2102.07623, 2021

    2021 arXiv

  15. [23]

    Communication-efficient learning of deep networks from decentralized data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” inArtificial intelligence and statistics. PMLR, 2017, pp. 1273–1282

    2017

  16. [24]

    Federated optimization in heterogeneous networks,

    T. Li, A. K. Sahu, M. Zaheer, M. Sanjabi, A. Talwalkar, and V . Smith, “Federated optimization in heterogeneous networks,” Proceedings of Machine learning and systems, vol. 2, pp. 429– 450, 2020

    2020

  17. [25]

    Scaffold: Stochastic controlled averaging for federated learning,

    S. P. Karimireddy, S. Kale, M. Mohri, S. Reddi, S. Stich, and A. T. Suresh, “Scaffold: Stochastic controlled averaging for federated learning,” inInternational conference on machine learning. PMLR, 2020, pp. 5132–5143

    2020

  18. [26]

    Federated learn- ing for smart healthcare: A survey,

    D. C. Nguyen, Q.-V . Pham, P. N. Pathirana, M. Ding, A. Senevi- ratne, Z. Lin, O. Dobre, and W.-J. Hwang, “Federated learn- ing for smart healthcare: A survey,”ACM Computing Surveys (Csur), vol. 55, no. 3, pp. 1–37, 2022

    2022

  19. [27]

    Decepticons: Corrupted transformers breach privacy in federated learning for language models,

    L. Fowl, J. Geiping, S. Reich, Y . Wen, W. Czaja, M. Gold- blum, and T. Goldstein, “Decepticons: Corrupted transformers breach privacy in federated learning for language models,”arXiv preprint arXiv:2201.12675, 2022

    2022 arXiv

  20. [28]

    Fedcv: a federated learning framework for di- verse computer vision tasks,

    C. He, A. D. Shah, Z. Tang, D. F. N. Sivashunmugam, K. Bhog- araju, M. Shimpi, L. Shen, X. Chu, M. Soltanolkotabi, and S. Avestimehr, “Fedcv: a federated learning framework for di- verse computer vision tasks,”arXiv preprint arXiv:2111.11066, 2021

    2021 arXiv

  21. [29]

    A joint learning and communications framework for federated learning over wireless networks,

    M. Chen, Z. Yang, W. Saad, C. Yin, H. V . Poor, and S. Cui, “A joint learning and communications framework for federated learning over wireless networks,”IEEE transactions on wireless communications, vol. 20, no. 1, pp. 269–283, 2020

    2020

  22. [30]

    A comprehensive empirical study of heterogeneity in federated learning,

    A. M. Abdelmoniem, C.-Y . Ho, P. Papageorgiou, and M. Canini, “A comprehensive empirical study of heterogeneity in federated learning,”IEEE Internet of Things Journal, vol. 10, no. 16, pp. 14 071–14 083, 2023

    2023

  23. [31]

    Differential privacy,

    C. Dwork, “Differential privacy,” inAutomata, Languages and Programming, M. Bugliesi, B. Preneel, V . Sassone, and I. We- gener, Eds. Berlin, Heidelberg: Springer Berlin Heidelberg, 2006, pp. 1–12

    2006

  24. [32]

    Analyzing and defending against membership inference attacks in natural language processing classification,

    Y . Wang, N. Xu, S. Huang, K. Mahmood, D. Guo, C. Ding, W. Wen, and S. Rajasekaran, “Analyzing and defending against membership inference attacks in natural language processing classification,” in2022 IEEE International Conference on Big Data (Big Data), 2022, pp. 5823–5832

    2022

  25. [33]

    Deep learning with differential privacy,

    M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” inProceedings of the ACM SIGSAC conference on computer and communications security, 2016, pp. 308–318

    2016

  26. [34]

    Lightweight federated learning with differential privacy and straggler resilience,

    S. Hong, X. Lin, and L. Duan, “Lightweight federated learning with differential privacy and straggler resilience,” inProceed- ings of the IEEE Conference on Computer Communications, 2025, pp. 1–10

    2025

  27. [35]

    Deep learning with gaussian differential privacy,

    Z. Bu, J. Dong, Q. Long, and W. J. Su, “Deep learning with gaussian differential privacy,”Harvard data science review, vol. 2020, no. 23, pp. 10–1162, 2020

    2020

  28. [36]

    Mia-tuner: Adapting large language models as pre-training text detector,

    W. Fu, H. Wang, C. Gao, G. Liu, Y . Li, and T. Jiang, “Mia-tuner: Adapting large language models as pre-training text detector,”

  29. [37]

    Dictpfl: Efficient and private federated learning on encrypted gradients,

    J. Xue, M. Kumar, Y . Shang, S. Gao, R. Ning, M. Zheng, X. Jiang, and Q. Lou, “Dictpfl: Efficient and private federated learning on encrypted gradients,” 2025. [Online]. Available: https://arxiv.org/abs/2510.21086

    2025

  30. [38]

    Fedml-he: An efficient homomorphic- encryption-based privacy-preserving federated learning system,

    W. Jin, Y . Yao, S. Han, J. Gu, C. Joe-Wong, S. Ravi, S. Aves- timehr, and C. He, “Fedml-he: An efficient homomorphic- encryption-based privacy-preserving federated learning system,”

  31. [39]

    Openfhe: Open-source fully homomorphic encryption library,

    A. Al Badawi, J. Bates, F. Bergamaschi, D. B. Cousins, S. Er- abelli, N. Genise, S. Halevi, H. Hunt, A. Kim, Y . Leeet al., “Openfhe: Open-source fully homomorphic encryption library,” inproceedings of the 10th workshop on encrypted computing & applied homomorphic cryptography...

    2022

  32. [40]

    Homomorphic encryption for arithmetic of approximate numbers,

    J. H. Cheon, A. Kim, M. Kim, and Y . Song, “Homomorphic encryption for arithmetic of approximate numbers,” inInterna- tional conference on the theory and application of cryptology and information security. Springer, 2017, pp. 409–437

    2017

  33. [41]

    Available: https://arxiv.org/abs/2303.10837

    [Online]. Available: https://arxiv.org/abs/2303.10837

    arXiv

  34. [42]

    Eva: An efficient and versatile generative engine for targeted discovery of novel analog circuits,

    J. Gao, W. Fu, X. Guo, W. Cao, and X. Zhang, “Eva: An efficient and versatile generative engine for targeted discovery of novel analog circuits,” in2025 62nd ACM/IEEE Design Automation Conference (DAC), 2025, pp. 1–7

    2025

  35. [43]

    Threats to federated learning: A survey,

    L. Lyu, H. Yu, and Q. Yang, “Threats to federated learning: A survey,”arXiv preprint arXiv:2003.02133, 2020

    2003 arXiv

  36. [44]

    Training language models to follow instructions with human feedback,

    L. Ouyang, J. Wu, X. Jiang, D. Almeida, C. Wainwright, P. Mishkin, C. Zhang, S. Agarwal, K. Slama, A. Rayet al., “Training language models to follow instructions with human feedback,”Advances in neural information processing systems, vol. 35, pp. 27 730–27 744, 2022

    2022

  37. [45]

    Data poi- soning attacks against federated learning systems,

    V . Tolpegin, S. Truex, M. E. Gursoy, and L. Liu, “Data poi- soning attacks against federated learning systems,” inComputer security–ESORICs 2020: 25th European symposium on research in computer security, ESORICs 2020, guildford, UK, September 14–18, 2020, proceedings, part i ...

    2020

  38. [46]

    Poisoning attacks in federated learning: A survey,

    G. Xia, J. Chen, C. Yu, and J. Ma, “Poisoning attacks in federated learning: A survey,”Ieee Access, vol. 11, pp. 10 708– 10 722, 2023

    2023

  39. [48]

    Language models are unsupervised multitask learners,

    A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, I. Sutskever et al., “Language models are unsupervised multitask learners,” OpenAI blog, vol. 1, no. 8, p. 9, 2019

    2019

  40. [49]

    The butterfly effect of altering prompts: How small changes and jailbreaks affect large lan- guage model performance,

    A. Salinas and F. Morstatter, “The butterfly effect of altering prompts: How small changes and jailbreaks affect large lan- guage model performance,” 2024. [Online]. Available: https: //arxiv.org/abs/2401.03729

    2024 arXiv

  41. [50]

    Fldetector: Defending federated learning against model poisoning attacks via detecting malicious clients,

    Z. Zhang, X. Cao, J. Jia, and N. Z. Gong, “Fldetector: Defending federated learning against model poisoning attacks via detecting malicious clients,” inProceedings of the 28th ACM SIGKDD conference on knowledge discovery and data mining, 2022, pp. 2545–2555

    2022

  42. [51]

    Detecting pretraining data from large language models,

    W. Shi, A. Ajith, M. Xia, Y . Huang, D. Liu, T. Blevins, D. Chen, and L. Zettlemoyer, “Detecting pretraining data from large language models,” 2024. [Online]. Available: https://arxiv.org/ abs/2310.16789

    2024 arXiv

  43. [52]

    Zhang, J

    J. Zhang, J. Sun, E. Yeats, Y . Ouyang, M. Kuo, J. Zhang, H. F. Yang, and H. Li, “Min-k

  44. [53]

    Extracting training data from large language models,

    N. Carlini, F. Tramer, E. Wallace, M. Jagielski, A. Herbert- V oss, K. Lee, A. Roberts, T. Brown, D. Song, U. Erlingsson, A. Oprea, and C. Raffel, “Extracting training data from large language models,” 2021. [Online]. Available: https://arxiv.org/ abs/2012.07805

    2021 arXiv

  45. [54]

    Recall: Membership inference via relative conditional log-likelihoods,

    R. Xie, J. Wang, R. Huang, M. Zhang, R. Ge, J. Pei, N. Z. Gong, and B. Dhingra, “Recall: Membership inference via relative conditional log-likelihoods,” 2025. [Online]. Available: https://arxiv.org/abs/2406.15968

    2025 arXiv

  46. [55]

    Con-recall: Detecting pre-training data in llms via contrastive decoding,

    C. Wang, Y . Wang, B. Hooi, Y . Cai, N. Peng, and K.-W. Chang, “Con-recall: Detecting pre-training data in llms via contrastive decoding,” 2025. [Online]. Available: https://arxiv.org/abs/2409. 03363

    2025

  47. [56]

    Privacy risk in machine learning: Analyzing the connection to overfitting,

    S. Yeom, I. Giacomelli, M. Fredrikson, and S. Jha, “Privacy risk in machine learning: Analyzing the connection to overfitting,”

  48. [57]

    Analogxpert: Automating analog topology synthesis by incorporating circuit design expertise into large language models,

    H. Zhang, S. Sun, Y . Lin, R. Wang, and J. Bian, “Analogxpert: Automating analog topology synthesis by incorporating circuit design expertise into large language models,” 2025. [Online]. Available: https://arxiv.org/abs/2412.19824

    2025 arXiv

  49. [58]

    The pile: An 800gb dataset of diverse text for language modeling,

    L. Gao, S. Biderman, S. Black, L. Golding, T. Hoppe, C. Foster, J. Phang, H. He, A. Thite, N. Nabeshima, S. Presser, and C. Leahy, “The pile: An 800gb dataset of diverse text for language modeling,” 2020. [Online]. Available: https://arxiv.org/ abs/2101.00027

    2020 arXiv

  50. [59]

    GPT-Neo: Large Scale Autoregressive Language Modeling with Mesh-Tensorflow,

    S. Black, G. Leo, P. Wang, C. Leahy, and S. Biderman, “GPT-Neo: Large Scale Autoregressive Language Modeling with Mesh-Tensorflow,” Mar. 2021, If you use this software, please cite it using these metadata. [Online]. Available: https: //doi.org/10.5281/zenodo.5297715

    2021 doi

  51. [60]

    Analoggenie-lite: Enhancing scalability and precision in circuit topology discovery through lightweight graph modeling,

    J. Gao, W. Cao, and X. Zhang, “Analoggenie-lite: Enhancing scalability and precision in circuit topology discovery through lightweight graph modeling,” inForty-second International Conference on Machine Learning, 2025. [Online]. Available: https://openreview.net/forum?id=KRk0WTII0I

    2025

  52. [61]

    Pseudo-private data guided model inversion attacks,

    X. Peng, B. Han, F. Liu, T. Liu, and M. Zhou, “Pseudo-private data guided model inversion attacks,”Advances in Neural Infor- mation Processing Systems, vol. 37, pp. 33 338–33 375, 2024

    2024

  53. [62]

    Membership inference attacks and defenses in federated learning: A survey,

    L. Bai, H. Hu, Q. Ye, H. Li, L. Wang, and J. Xu, “Membership inference attacks and defenses in federated learning: A survey,” ACM Computing Surveys, vol. 57, no. 4, pp. 1–35, 2024

    2024

  54. [63]

    Deep generative modelling: A comparative review of vaes, gans, normalizing flows, energy-based and autoregressive models,

    S. Bond-Taylor, A. Leach, Y . Long, and C. G. Willcocks, “Deep generative modelling: A comparative review of vaes, gans, normalizing flows, energy-based and autoregressive models,” IEEE transactions on pattern analysis and machine intelligence, vol. 44, no. 11, pp. 7327–7347, 2021

    2021

  55. [64]

    A survey on federated learning,

    C. Zhang, Y . Xie, H. Bai, B. Yu, W. Li, and Y . Gao, “A survey on federated learning,”Knowledge-Based Systems, vol. 216, p. 106775, 2021

    2021

  56. [65]

    A systematic survey on deep generative models for graph generation,

    X. Guo and L. Zhao, “A systematic survey on deep generative models for graph generation,” 2022. [Online]. Available: https: //arxiv.org/abs/2007.06686

    2022 arXiv

  57. [66]

    Soft: Selective data obfuscation for protecting llm fine-tuning against membership inference attacks,

    Z. Kaiyuan Zhang and N. Li, “Soft: Selective data obfuscation for protecting llm fine-tuning against membership inference attacks,” 2025. [Online]. Available: https://arxiv.org/abs/2506. 10424

    2025

  58. [67]

    The promise and peril of generative ai,

    A. Jo, “The promise and peril of generative ai,”Nature, vol. 614, no. 1, pp. 214–216, 2023

    2023

  59. [68]

    Think before you speak: Training language models with pause tokens,

    S. Goyal, Z. Ji, A. S. Rawat, A. K. Menon, S. Kumar, and V . Nagarajan, “Think before you speak: Training language models with pause tokens,” 2024. [Online]. Available: https: //arxiv.org/abs/2310.02226

    2024 arXiv

  60. [69]

    Gpt-4o system card,

    OpenAI, “Gpt-4o system card,” 2024. [Online]. Available: https: //arxiv.org/abs/2410.21276

    2024 arXiv

  61. [70]

    Qwen2.5 technical report,

    Qwen, :, A. Yang, B. Yang, B. Zhang, B. Hui, B. Zheng, B. Yu, C. Li, D. Liu, F. Huang, H. Wei, H. Lin, J. Yang, J. Tu, J. Zhang, J. Yang, J. Yang, J. Zhou, J. Lin, K. Dang, K. Lu, K. Bao, K. Yang, L. Yu, M. Li, M. Xue, P. Zhang, Q. Zhu, R. Men, R. Lin, T. Li, T. Tang, T. Xia, ...

    2025 arXiv

  62. [71]

    A comprehensive review of generative ai in healthcare,

    Y . Shokrollahi, S. Yarmohammadtoosky, M. M. Nikahd, P. Dong, X. Li, and L. Gu, “A comprehensive review of generative ai in healthcare,”arXiv preprint arXiv:2310.00795, 2023

    2023 arXiv

  63. [72]

    A survey of reinforcement learning for large reasoning models,

    K. Zhang, Y . Zuo, B. He, Y . Sun, R. Liu, C. Jiang, Y . Fan, K. Tian, G. Jia, P. Liet al., “A survey of reinforcement learning for large reasoning models,”arXiv preprint arXiv:2509.08827, 2025

    2025 arXiv

  64. [73]

    Cir- cuitnet: An open-source dataset for machine learning in vlsi cad applications with improved domain-specific evaluation metric and learning strategies,

    Z. Chai, Y . Zhao, W. Liu, Y . Lin, R. Wang, and R. Huang, “Cir- cuitnet: An open-source dataset for machine learning in vlsi cad applications with improved domain-specific evaluation metric and learning strategies,”IEEE Transactions on Computer-Aided Design of Integrated Circ...

    2023

  65. [74]

    Federatedscope-llm: A comprehen- sive package for fine-tuning large language models in federated learning,

    W. Kuang, B. Qian, Z. Li, D. Chen, D. Gao, X. Pan, Y . Xie, Y . Li, B. Ding, and J. Zhou, “Federatedscope-llm: A comprehen- sive package for fine-tuning large language models in federated learning,” inProceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Dat...

    2024

  66. [76]

    Szeliski,Computer vision: algorithms and applications

    R. Szeliski,Computer vision: algorithms and applications. Springer Nature, 2022

    2022

  67. [1936]

    Oxford University Press, 1986

    1986

  68. [2018]

    Available: https://arxiv.org/abs/1709.01604

    [Online]. Available: https://arxiv.org/abs/1709.01604

    arXiv

  69. [2024]

    Available: https://arxiv.org/abs/2408.08661

    [Online]. Available: https://arxiv.org/abs/2408.08661

    arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.