Pith. sign in

REVIEW 3 major objections 4 minor 97 references

Enhancing Privacy in Decentralized Min-Max Optimization: A Differentially Private Approach

T0 review · 3 major / 4 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that adding noise for differential privacy need not slow decentralized min-max optimization: DPMixSGD keeps the non-private algorithm's convergence rate and query complexity while achieving formal differential privacy.

desk verdict A real new algorithm combination, but the privacy theorem's SC-SC assumption contradicts the advertised nonconvex-strongly-concave setting, so the main claim is unproven as written. read the letter →

arxiv 2508.07505 v1 pith:LAEFJ2FE submitted 2025-08-10 cs.LG cs.CRcs.DC

Yueyang Quan , Chang Wang , Shengjie Zhai , Minghong Fang , Zhuqing Liu This is my paper
classification cs.LGcs.CRcs.DC MSC 90C47
keywords decentralizedmin-maxoptimizationdifferentialprivacySTORMvariancereductionnonconvex-strongly-concavegradienttrackingperturbationDLGattacksmulti-agentlearning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks whether differential privacy can be added to decentralized min-max optimization — the setting where many agents jointly solve $\min_x \max_y f(x,y)$ by exchanging gradient-like updates over a network — without degrading the speed of the underlying optimizer. Its answer is yes: DPMixSGD builds on the STORM-based DM-HSGD algorithm and injects calibrated Gaussian noise into each agent's local gradient before communication; the authors prove the average gradient-norm error stays at $O(\epsilon^2)$ once the privacy budget is set as in Theorem 2, and the non-private algorithm's first-order oracle complexity is unchanged. Why this matters: shared gradient updates over untrusted networks can leak training data, so a method that bounds both privacy loss and optimization error makes min-max workflows (adversarial training, AUC maximization, robust regression) viable in privacy-sensitive domains like healthcare and finance. The paper backs the theory with experiments showing AUROC on par with or better than non-private baselines and visibly degraded gradient-inversion reconstructions.

What carries the argument

Each agent adds Gaussian noise $n^{(i)}_{x,t}, n^{(i)}_{y,t}$ with variances $\sigma_x^2 I_{d_1}, \sigma_y^2 I_{d_2}$ to its STORM gradient estimators; averaged across agents this is $N_{x,t}\sim\mathcal{N}(0,\sigma_x^2 I_{d_1}/m)$, so the mean update $\bar{x}_{t+1}=\bar{x}_t-\eta_x(\bar{g}_t+N_{x,t})$ sees variance divided by $m$, adding only $O(\sigma_x^2 d_1+\sigma_y^2 d_2)$ to the error bound. This averaging keeps the perturbation from destabilizing the saddle-point dynamics. The STORM momentum recursion induces a Lipschitz constant $G\le L/\beta_x$ used by the privacy proof, and gradient tracking over the doubly stochastic mixing matrix $W$ (spectral gap $\lambda$) controls consensus er

What would settle it

Run DPMixSGD on a two-agent version of the paper's own robust-logistic-regression task, whose nonconvex regularizer $g(x)=\lambda_2\sum_i \alpha x_i^2/(1+\alpha x_i^2)$ violates Assumption 6; with $\theta,\gamma$ as in Theorem 2, repeat on adjacent datasets and estimate the total-variation distance between output distributions. Exceeding the claimed $(\theta,\gamma)$ bound falsifies the privacy guarantee in the advertised nonconvex-strongly-concave setting. A cheaper algebraic check: substitute Theorem 2's noise level into Theorem 1's additive term $\sigma_x^2 d_1+\sigma_y^2 d_2$ at the $T$ va

Watch

Extended reading notes

Core claim

The paper's central claim is that privacy noise can enter a fast decentralized min-max algorithm as a bounded additive perturbation. Theorem 1 states that, under Lipschitz smoothness, bounded variance, $\mu$-strong concavity in the dual variable, and a spectral gap on the mixing matrix, DPMixSGD's average squared gradient norm of $\Phi$ is $O(\epsilon^2)+O(m\epsilon^2)+O(\sigma_x^2 d_1+\sigma_y^2 d_2)$. Theorem 2 sets the noise variances so the algorithm is $(\theta,\gamma)$-differentially private; with $\theta=\Omega(L_g d^{1/2}\log^{1/2}(1/\gamma)/(m^{1/2}\epsilon^4))$ the noise term shrinks to $O(\epsilon^2)$. Conclusion: privacy noise does not change the DM-HSGD baseline's oracle complex

Load-bearing premise

The differential-privacy guarantee is proved only under Assumption 6, which requires the objective to be strongly convex in the minimization variable as well as strongly concave in the maximization variable, whereas the convergence analysis and the advertised setting assume nonconvexity in the minimization variable; the paper's own remark after Assumption 6 concedes the mismatch and defers a fix to a revised version.

Editorial extensions

If this is right

  • At the stated parameter settings, DPMixSGD is $(\theta,\gamma)$-differentially private with optimization error $O(\epsilon^2)$, so the privacy noise does not change the asymptotic accuracy of the non-private optimizer.
  • For networks of up to $O(\epsilon^{-1})$ agents the stochastic first-order oracle complexity remains $O(\kappa^3\epsilon^{-3})$, identical to DM-HSGD, so the worst-case gradient-query cost does not rise when privacy is enforced.
  • Privacy is enforced locally, each agent perturbing its own gradient before communication, so no trusted central aggregator is needed, unlike centralized differentially private min-max methods such as DP-SGDA.
  • In the reported experiments the method matches or surpasses the AUROC of SGDA, DM-HSGD, and DP-SGDA on robust logistic regression over a8a, a9a, and CIFAR-10 and on Fashion-MNIST classification, and its noise visibly degrades DLG gradient-inversion reconstructions at noise level $\sigma=1$.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the noise-averaging mechanism is right, privacy against gradient-inference attacks should strengthen as the network grows, because the averaged perturbation seen by the mean update has variance $\sigma^2/m$; the reported $m=5$ to $m=20$ grids show only a weak trend, so a dedicated scaling study would test this directly.
  • The privacy accounting composes per-round Rényi divergences using the worst-case Lipschitz bound $G\le L/\beta_x$; a moment accountant that exploits the geometric decay $(1-\beta_x)^{t-k}$ in the STORM recursion could reduce the required $\sigma$ for the same $(\theta,\gamma)$, a tightening available within the paper's own proof structure.
  • The additive-noise argument is architectural: any decentralized variance-reduced method whose mean estimator is an average of local estimators (SARAH/SPIDER-style gradient tracking) should inherit an $O(\sigma^2 d)$ noise term, so the no-complexity-cost conclusion plausibly transfers beyond STORM.
  • Because the privacy theorem assumes strong convexity in both variables while the experiments use a nonconvex regularizer, the nonconvex results are best read as stress tests of the algorithm rather than as evidence for the $(\theta,\gamma)$ bound itself; the paper's own remark after Assumption 6 flags exactly this gap as the direction to close.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes DPMixSGD, a differentially private variant of the decentralized min-max algorithm DM-HSGD. The algorithm adds Gaussian noise to each agent's STORM-type gradient estimators before network mixing, and the authors claim two main theoretical results: (i) a convergence guarantee for nonconvex-strongly-concave decentralized min-max problems in which the privacy noise appears only as an additive O(σ_x^2 d_1 + σ_y^2 d_2) term, and (ii) an (θ,γ)-differential privacy guarantee for the same algorithm. The paper further claims that, with a suitable choice of privacy budget, the noise does not change the SFO complexity of the non-private DM-HSGD algorithm. Experiments on robust logistic regression and on AUROC/DLG-attack benchmarks are used to support the claims.

Significance. If the theoretical claims were correct, this would be a useful contribution: decentralized differentially private min-max optimization with variance reduction and a convergence rate matching the non-private baseline is an interesting and timely problem. The paper does contain a substantial amount of technical machinery: a noise-aware re-derivation of the DM-HSGD convergence bounds, a moments-accountant/Rényi-divergence privacy analysis, and empirical comparisons including a DLG-attack evaluation. These are useful building blocks. However, the central advertised result — differentially private nonconvex-strongly-concave decentralized min-max with essentially no extra cost — is not established by the theorems as stated. The two most important problems are a formal mismatch between the convergence setting and the privacy-assumption setting, and an internal inconsistency between the privacy noise scale stated in Theorem 2 and the convergence analysis in Theorem 1.

major comments (3)
  1. [Section 5.2, Theorem 2 and Assumption 6] Theorem 2 is stated under Assumption 6, which requires the objective to be ρ-strongly-convex-strongly-concave (ρ-SC-SC) in both x and y. This contradicts the setting of Theorem 1 and of the paper's stated contributions, where f is nonconvex in x and μ-strongly concave in y (Assumption 5). The authors themselves write, immediately after Assumption 6, 'In this paper, we focus on the ρ−SC−SC problem', and defer clarification to a revised version. Thus the (θ,γ)-DP guarantee is not proven for the nonconvex-strongly-concave setting advertised in the abstract and introduction. Moreover, the robust logistic regression objective in Section 6.1 contains a nonconvex regularizer g(x)=λ_2 Σ α x_i^2/(1+α x_i^2), so the experiments do not instantiate Assumption 6 either. This is a load-bearing gap, not a cosmetic one.
  2. [Section 5.2, Theorem 2 and Remark (Eqs. (18)-(20))] The privacy noise scale in Theorem 2 is σ_x,σ_y = O( L_g sqrt(8T(T+1)(2T+1)/3 + 4T) log(1/γ)/(2 θ sqrt(m)) ), which is of order O(L_g T^{3/2} log(1/γ)/(θ sqrt(m))). The Remark claims that by choosing θ = Ω(L_g d^{1/2} log(1/γ)^{1/2}/(m^{1/2} ε^4)), the noise-induced error is O(ε^2), citing Eq. (20). But Eq. (20), L_g^2 d log(1/γ)/(θ^2 m ε^6)=O(ε^2), does not involve T at all. Substituting the Theorem 2 value of σ into the convergence bound of Theorem 1 gives a noise term of order T^3 ε^8/m (up to constants and log factors). With the T chosen in Theorem 1, T = 1500κ^3/((1-λ)^2 ε β_x), which for m ≤ 1/ε is O(κ^3/(m ε^3)), this noise term diverges as ε→0 rather than converging as O(ε^2). Therefore the main claim that the DP noise does not change the SFO complexity is not supported by the stated theorems.
  3. [Appendix B, Eqs. (121)-(124)] The privacy proof compares the distributions P and Q for adjacent datasets using the same state vectors x^(m)_k, y^(m)_k in both worlds. These state vectors are data-dependent outputs of previous iterations; under adjacent datasets they are not equal, and no coupling or trajectory-stability argument is provided. In addition, the derivation treats the differing sample as being used at every iteration (z^(m)_k vs z'^(m)_k for all k), whereas Algorithm 1 samples a fresh z_t at each step. The paper does not analyze subsampling/sampling amplification or the probability that the changed sample actually appears in the minibatch. Consequently the Rényi-divergence bound in Eq. (124) is not established for the actual stochastic mechanism of Algorithm 1. Since this is the technical heart of the DP guarantee, the privacy claim remains unproven as written.
minor comments (4)
  1. [Section 5.2, Lemma 1] Lemma 1 is introduced as the basis for Theorem 2, but Appendix B's proof does not actually use Lemma 1; it uses a moments-accountant/Rényi-divergence argument with a different noise schedule. The relationship between the two should be clarified, and the notation for σ_x^2 vs σ_x should be made consistent.
  2. [Section 6.2] The DLG-attack experiment fixes σ=1 but does not report the corresponding (θ,γ) privacy budget, so it does not validate the DP guarantee of Theorem 2 or allow a quantitative comparison with the theoretical analysis.
  3. [Appendix C.1] The gradient-clipping experiment clips the 'top 20% of gradients' but does not define the clipping operation, threshold, or its effect on the sensitivity bounds used in the privacy proof. This makes the empirical claim of DP harder to interpret.
  4. [Theorem 1, first display] The bound is written as O(ε^2)+O(mε^2)+O(σ_x^2 d_1+σ_y^2 d_2). Since m≥1, the first two terms are simply O(mε^2). The subsequent SFO-complexity claim depends delicately on whether m≤O(ε^{-1}) or not; this should be stated explicitly rather than leaving the reader to infer it from the remark.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: convergence re-derives DM-HSGD bounds with added noise terms, and the DP proof relies on external moments-accountant/Rényi-divergence results; the Assumption 5/6 mismatch is a correctness gap, not a circular step.

full rationale

I walked the derivation chain and found no step where a claimed prediction reduces by construction to its own inputs. Theorem 1 is proved from Assumptions 1–5 by re-deriving the STORM variance-reduction lemmas from Xian et al. [74] while carrying the extra Gaussian noise terms; the bounds in Lemmas 9, 13, and Eqs. (97)–(105) explicitly separate the noise variance, and the parameter choices (β_x=ε min{1,mε}/20, η_x, η_y, b_0) are standard target-accuracy tunings verified by the inequalities (90)–(91), not fitted quantities renamed as predictions. The DP proof (Theorem 2, Appendix B) uses the external moments accountant of Abadi et al. [1] and Rényi-divergence bounds, and Lemma 1 is taken from Wang et al. [71]; these are independent support, not self-citations. The noise variance is chosen as a function of the privacy budget θ and T, and the Remark after Theorem 2 then states the algebraic condition θ=Ω(L_g d^{1/2} log(1/γ)^{1/2}/(m^{1/2} ε^4)) needed to make the noise term O(ε^2); this is a stated privacy–utility tradeoff (θ grows as ε shrinks), not a circular equation in which the conclusion defines the input. The only load-bearing concern is a correctness gap, not circularity: Theorem 2 and Assumption 6 assume ρ-SC-SC, while the paper’s advertised setting and Theorem 1 use nonconvex-strongly-concave (Assumption 5); the authors’ own Remark after Assumption 6 concedes this by saying “In this paper, we focus on the ρ−SC−SC problem” and “We will clarify this in the revised version,” deferring a fix. That mismatch undermines the formal DP guarantee as stated, but it is not a self-reference or fitted-input reduction, so it does not raise the circularity score. Self-citations (e.g., [23], [82]) appear only in background motivation and are not load-bearing.

Assumptions & free parameters 2 free parameters · 9 assumptions · 0 invented entities

The paper's central claim rests on standard optimization assumptions plus two fragile additions: Assumption 6 introduces a stronger convexity requirement that the authors acknowledge does not match the main nonconvex setting, and the convergence proof imports an unstated κ ≤ 1 inequality. No new physical or mathematical entities are introduced. The unspecified constant c in the noise formula is a hidden free parameter that affects the validity of the privacy guarantee.

free parameters (2)
  • Noise constant c in Theorem 2 = unspecified positive constant
    The privacy noise variance in Eq. (18) includes an unspecified constant c. The (θ,γ)-DP guarantee holds only if c is chosen sufficiently large, but the paper gives no concrete value or validation, making the guarantee existential.
  • Per-agent noise standard deviation σ in experiments = σ = 1 for DLG experiments
    In Section 6.2 the noise level is set to σ = 1 by hand; the corresponding privacy budget (θ,γ) is never reported, so the empirical setting is not tied to the theoretical privacy guarantee.
assumptions (9)
  • domain assumption Assumption 1: each local function is L-smooth
    Standard smoothness condition used throughout the convergence proof in Section 5.1.
  • domain assumption Assumption 2: unbiased stochastic gradients with bounded variance σ^2
    Standard bounded-variance assumption for stochastic gradients, used in Lemma 9 and Lemma 12.
  • domain assumption Assumption 3: objective Φ is lower bounded
    Standard assumption for nonconvex optimization guarantees.
  • domain assumption Assumption 4: doubly stochastic mixing matrix with spectral gap λ ∈ [0,1)
    Standard network connectivity assumption used in consensus error bounds, Lemma 10 and Lemma 11.
  • domain assumption Assumption 5: each f_i is μ-strongly concave in y
    Core structure assumption for the nonconvex-strongly-concave min-max problem in Theorem 1.
  • ad hoc to paper Assumption 6: f is ρ-strongly-convex-strongly-concave in both x and y
    Used in Section 5.2 for the privacy analysis, but contradicts the nonconvex-strongly-concave setting of the convergence analysis. The paper's own remark admits this is restrictive and defers clarification to a revised version.
  • domain assumption Assumption 7: bounded gradient norm ||∇F_i|| ≤ L_g
    Standard bounded-sensitivity assumption for DP analysis, used in the sensitivity bound of the privacy proof.
  • ad hoc to paper κ = L/μ ≤ 1
    Eq. (96) in Appendix A.2 asserts 'by the definition of κ = L/μ ≤ 1' to simplify bounds, but this is not stated as an assumption and is generally false for condition numbers. It is load-bearing for the final convergence-rate simplification.
  • standard math Moments accountant composition and Rényi divergence bounds (Lemma 14, 16)
    Standard DP composition results imported from Abadi et al. and Bun & Steinke, used in the privacy proof.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Enhancing Privacy in Decentralized Min-Max Optimization: A Differentially Private Approach." pith.science (2026). https://pith.science/paper/LAEFJ2FE

@misc{pith2026250807505,
  author       = {Pith},
  title        = {Pith review of: Enhancing Privacy in Decentralized Min-Max Optimization: A Differentially Private Approach},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LAEFJ2FE}},
  note         = {Machine review of arXiv:2508.07505}
}
read the original abstract

Decentralized min-max optimization allows multi-agent systems to collaboratively solve global min-max optimization problems by facilitating the exchange of model updates among neighboring agents, eliminating the need for a central server. However, sharing model updates in such systems carry a risk of exposing sensitive data to inference attacks, raising significant privacy concerns. To mitigate these privacy risks, differential privacy (DP) has become a widely adopted technique for safeguarding individual data. Despite its advantages, implementing DP in decentralized min-max optimization poses challenges, as the added noise can hinder convergence, particularly in non-convex scenarios with complex agent interactions in min-max optimization problems. In this work, we propose an algorithm called DPMixSGD (Differential Private Minmax Hybrid Stochastic Gradient Descent), a novel privacy-preserving algorithm specifically designed for non-convex decentralized min-max optimization. Our method builds on the state-of-the-art STORM-based algorithm, one of the fastest decentralized min-max solutions. We rigorously prove that the noise added to local gradients does not significantly compromise convergence performance, and we provide theoretical bounds to ensure privacy guarantees. To validate our theoretical findings, we conduct extensive experiments across various tasks and models, demonstrating the effectiveness of our approach.

Figures

Figures reproduced from arXiv: 2508.07505 by the authors.

Figure 1
Figure 1. DLG Attack Reconstruction Results [PITH_FULL_IMAGE:figures/full_fig_p008_1.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

97 extracted references · 62 canonical work pages

  1. [1]

    Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. 2016. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security. 308–318

    2016

  2. [2]

    Mohammed Adnan, Shivam Kalra, Jesse C Cresswell, Graham W Taylor, and Hamid R Tizhoosh. 2022. Federated learning and differential privacy for medical image analysis. Scientific reports 12, 1 (2022), 1953

    2022

  3. [3]

    Babak Barazandeh, Tianjian Huang, and George Michailidis. 2021. A decentral- ized adaptive momentum method for solving a class of min-max optimization problems. Signal Processing 189 (2021), 108245

    2021

  4. [4]

    Raef Bassily, Cristóbal Guzmán, and Michael Menart. 2023. Differentially private algorithms for the stochastic saddle point problem with optimal rates for the strong gap. In The Thirty Sixth Annual Conference on Learning Theory . PMLR, 2482–2508

    2023

  5. [5]

    Monik Raj Behera, Suresh Shetty, Robert Otter, et al. 2021. Federated learning using peer-to-peer network for decentralized orchestration of model weights. Authorea Preprints (2021)

    2021

  6. [6]

    Aleksandr Beznosikov, Eduard Gorbunov, Hugo Berard, and Nicolas Loizou. 2023. Stochastic gradient descent-ascent: Unified theory and new efficient methods. In International conference on artificial intelligence and statistics . PMLR, 172–235

    2023

  7. [7]

    Sayan Biswas, Mathieu Even, Laurent Massoulié, Anne-Marie Kermarrec, Rafael Pereira Pires, Rishi Sharma, and Martijn de Vos. 2024. Noiseless privacy- preserving decentralized learning. In The 25th Privacy Enhancing Technologies Symposium, Vol. 2025. Privacy Enhancing Technologies Symposium Advisory Board, 824–844

    2024

  8. [8]

    Digvijay Boob and Cristóbal Guzmán. 2024. Optimal algorithms for differentially private stochastic monotone variational inequalities and saddle-point problems. Mathematical Programming 204, 1 (2024), 255–297

    2024

Show all 97 references
  1. [9]

    Francesco Bullo, Jorge Cortés, and Sonia Martinez. 2009. Distributed control of robotic networks: a mathematical approach to motion coordination algorithms . Princeton University Press

    2009

  2. [10]

    Mark Bun and Thomas Steinke. 2016. Concentrated differential privacy: Simpli- fications, extensions, and lower bounds. In Theory of cryptography conference . Springer, 635–658

    2016

  3. [11]

    Xiaoyu Cao, Minghong Fang, Jia Liu, and Neil Zhenqiang Gong. 2021. Fltrust: Byzantine-robust federated learning via trust bootstrapping. In NDSS

    2021

  4. [12]

    Chih-Chung Chang and Chih-Jen Lin. 2011. LIBSVM: a library for support vector machines. In ACM transactions on intelligent systems and technology (TIST)

    2011

  5. [13]

    Kamalika Chaudhuri, Claire Monteleoni, and Anand D Sarwate. 2011. Differen- tially private empirical risk minimization. Journal of Machine Learning Research 12, 3 (2011)

    2011

  6. [14]

    Lesi Chen, Haishan Ye, and Luo Luo. 2024. An Efficient Stochastic Algorithm for Decentralized Nonconvex-Strongly-Concave Minimax Optimization. In Interna- tional Conference on Artificial Intelligence and Statistics . PMLR, 1990–1998

    2024

  7. [15]

    Hsin-Pai Cheng, Patrick Yu, Haojing Hu, Syed Zawad, Feng Yan, Shiyu Li, Hai Li, and Yiran Chen. 2019. Towards decentralized deep learning with differential privacy. In International Conference on Cloud Computing . Springer, 130–145

    2019

  8. [16]

    Ashok Cutkosky and Francesco Orabona. 2019. Momentum-based variance reduction in non-convex sgd. Advances in neural information processing systems 32 (2019)

    2019

  9. [17]

    Edwige Cyffers and Aurélien Bellet. 2022. Privacy amplification by decentral- ization. In International Conference on Artificial Intelligence and Statistics . PMLR, 5334–5353

    2022

  10. [18]

    Edwige Cyffers, Mathieu Even, Aurélien Bellet, and Laurent Massoulié. 2022. Muffliato: Peer-to-peer privacy amplification for decentralized optimization and averaging. Advances in Neural Information Processing Systems 35 (2022), 15889– 15902

    2022

  11. [19]

    Cynthia Dwork. 2006. Differential privacy. In International colloquium on au- tomata, languages, and programming . Springer, 1–12

    2006

  12. [20]

    Dwork and A

    C. Dwork and A. Roth. 2014. The Algorithmic Foundations of Differential Privacy. Foundations and Trends® in Theoretical Computer Science 9, 3–4 (2014), 211–407

    2014

  13. [21]

    Cong Fang, Chris Junchi Li, Zhouchen Lin, and Tong Zhang. 2018. Spider: Near-optimal non-convex optimization via stochastic path-integrated differential estimator. Advances in neural information processing systems 31 (2018)

    2018

  14. [22]

    Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Gong. 2020. Local model poisoning attacks to Byzantine-robust federated learning. In USENIX Security Symposium

    2020

  15. [23]

    Minghong Fang, Zifan Zhang, Hairi, Prashant Khanduri, Jia Liu, Songtao Lu, Yuchen Liu, and Neil Gong. 2024. Byzantine-robust decentralized federated learning. In CCS

    2024

  16. [24]

    Chong Fu, Xuhong Zhang, Shouling Ji, Jinyin Chen, Jingzheng Wu, Shanqing Guo, Jun Zhou, Alex X Liu, and Ting Wang. 2022. Label inference attacks against vertical federated learning. In 31st USENIX security symposium (USENIX Security 22). 1397–1414

    2022

  17. [25]

    Hongchang Gao. 2022. Decentralized stochastic gradient descent ascent for finite-sum minimax problems. arXiv preprint arXiv:2212.02724 (2022)

    2022 arXiv

  18. [26]

    Hongchang Gao, Yubin Duan, Yihan Zhang, and Jie Wu. 2024. Decentralized Stochastic Compositional Gradient Descent for AUPRC Maximization. In Pro- ceedings of the 2024 SIAM International Conference on Data Mining (SDM) . SIAM, 226–234

    2024

  19. [27]

    Arvind Giridhar and PR Kumar. 2006. Toward a theory of in-network computation in wireless sensor networks.IEEE Communications magazine 44, 4 (2006), 98–107

    2006

  20. [28]

    Tomás González, Cristóbal Guzmán, and Courtney Paquette. 2024. Mirror descent algorithms with nearly dimension-independent rates for differentially-private stochastic saddle-point problems. arXiv preprint arXiv:2403.02912 (2024)

    2024

  21. [29]

    Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. 2014. Generative adversarial nets. Advances in neural information processing systems 27 (2014)

    2014

  22. [30]

    Ishaan Gulrajani, Faruk Ahmed, Martin Arjovsky, Vincent Dumoulin, and Aaron C Courville. 2017. Improved training of wasserstein gans. Advances in neural information processing systems 30 (2017)

    2017

  23. [31]

    Ehsan Hallaji, Roozbeh Razavi-Far, Mehrdad Saif, Boyu Wang, and Qiang Yang

  24. [32]

    Songyang Han, Sanbao Su, Sihong He, Shuo Han, Haizhao Yang, and Fei Miao

  25. [33]

    Diba Hashemi, Lie He, and Martin Jaggi. 2024. CoBo: Collaborative Learning via Bilevel Optimization. arXiv:2409.05539 [cs.LG] https://arxiv.org/abs/2409.05539

    2024 arXiv

  26. [34]

    Sihong He, Songyang Han, Sanbao Su, Shuo Han, Shaofeng Zou, and Fei Miao

  27. [35]

    Hongsheng Hu, Zoran Salcic, Lichao Sun, Gillian Dobbie, and Xuyun Zhang

  28. [36]

    Rui Hu, Yuanxiong Guo, Hongning Li, Qingqi Pei, and Yanmin Gong. 2020. Personalized federated learning with differential privacy. IEEE Internet of Things Journal 7, 10 (2020), 9530–9539

    2020

  29. [37]

    Feihu Huang and Songcan Chen. 2023. Near-optimal decentralized momentum method for nonconvex-PL minimax problems. arXiv preprint arXiv:2304.10902 (2023)

    2023 arXiv

  30. [38]

    Feihu Huang, Xidong Wu, and Heng Huang. 2021. Efficient mirror descent ascent methods for nonsmooth minimax problems. Advances in Neural Information Processing Systems 34 (2021), 10431–10443

    2021

  31. [39]

    Yilin Kang, Yong Liu, Jian Li, and Weiping Wang. 2022. Stability and generalization of differentially private minimax problems.arXiv preprint arXiv:2204.04858 (2022)

    2022 arXiv

  32. [40]

    Sai Praneeth Karimireddy, Martin Jaggi, Satyen Kale, Mehryar Mohri, Sashank J Reddi, Sebastian U Stich, and Ananda Theertha Suresh. 2020. Mime: Mim- icking centralized stochastic algorithms in federated learning. arXiv preprint arXiv:2008.03606 (2020)

    2020 arXiv

  33. [41]

    Harsh Kasyap and Somanath Tripathy. 2021. Privacy-preserving decentralized learning framework for healthcare system. ACM Transactions on Multimedia Computing, Communications, and Applications (TOMM) 17, 2s (2021), 1–24

    2021

  34. [42]

    Prashant Khanduri, Pranay Sharma, Haibo Yang, Mingyi Hong, Jia Liu, Ketan Rajawat, and Pramod Varshney. 2021. Stem: A stochastic two-sided momentum algorithm achieving near-optimal sample and communication complexities for federated learning. Advances in Neural Information Pro...

    2021

  35. [43]

    Juno Kim, Tai Nakamaki, and Taiji Suzuki. 2024. Transformers are Minimax Optimal Nonparametric In-Context Learners. arXiv preprint arXiv:2408.12186 MobiHoc 2025, June 2025, Houston, USA Yueyang Quan et al. (2024)

    2024 arXiv

  36. [44]

    Alec Koppel, Felicia Y Jakubiec, and Alejandro Ribeiro. 2015. A saddle point algorithm for networked online convex optimization. IEEE Transactions on Signal Processing 63, 19 (2015), 5149–5164

    2015

  37. [45]

    Alex Krizhevsky, Geoffrey Hinton, et al. 2009. Learning multiple layers of features from tiny images. (2009)

    2009

  38. [46]

    Tsung-Ting Kuo and Lucila Ohno-Machado. 2018. Modelchain: Decentral- ized privacy-preserving healthcare predictive modeling framework on private blockchain networks. arXiv preprint arXiv:1802.01746 (2018)

    2018 arXiv

  39. [47]

    Jonathan Lee, Annie Xie, Aldo Pacchiano, Yash Chandak, Chelsea Finn, Ofir Nachum, and Emma Brunskill. 2024. Supervised pretraining can learn in-context reinforcement learning. Advances in Neural Information Processing Systems 36 (2024)

    2024

  40. [48]

    Xiangru Lian, Ce Zhang, Huan Zhang, Cho-Jui Hsieh, Wei Zhang, and Ji Liu

  41. [49]

    Tianyi Lin, Chi Jin, and Michael Jordan. 2020. On gradient descent ascent for nonconvex-concave minimax problems. In International Conference on Machine Learning. PMLR, 6083–6093

    2020

  42. [50]

    Tianyi Lin, Chi Jin, and Michael I. Jordan. 2020. Near-Optimal Algorithms for Minimax Optimization. In Proceedings of Thirty Third Conference on Learning Theory (Proceedings of Machine Learning Research, Vol. 125) , Jacob Abernethy and Shivani Agarwal (Eds.). PMLR, 2738–2779. ...

    2020

  43. [51]

    Wanyu Lin, Baochun Li, and Cong Wang. 2022. Towards private learning on decentralized graphs with local differential privacy. IEEE Transactions on Infor- mation Forensics and Security 17 (2022), 2936–2946

    2022

  44. [52]

    Weijie Liu, Aryan Mokhtari, Asuman Ozdaglar, Sarath Pattathil, Zebang Shen, and Nenggan Zheng. 2019. A decentralized proximal point-type method for saddle point problems. arXiv preprint arXiv:1910.14380 (2019)

    2019 arXiv

  45. [53]

    Liu and R

    Y. Liu and R. Liu. 2021. BOML: A modularized bilevel optimization library in Python for meta-learning. In 2021 IEEE International Conference on Multimedia & Expo Workshops (ICMEW). IEEE, 1–2

    2021

  46. [54]

    Songtao Lu, Siliang Zeng, Xiaodong Cui, Mark Squillante, Lior Horesh, Brian Kingsbury, Jia Liu, and Mingyi Hong. 2022. A stochastic linearized augmented Lagrangian method for decentralized bilevel optimization. Advances in Neural Information Processing Systems (2022)

    2022

  47. [55]

    Luo Luo, Haishan Ye, Zhichao Huang, and Tong Zhang. 2020. Stochastic recursive gradient descent ascent for stochastic nonconvex-strongly-concave minimax problems. Advances in Neural Information Processing Systems 33 (2020), 20566– 20577

    2020

  48. [56]

    David Mateos-Núnez and Jorge Cortés. 2015. Distributed subgradient methods for saddle-point problems. In 2015 54th IEEE Conference on Decision and Control (CDC). IEEE, 5462–5467

    2015

  49. [57]

    Milad Nasr, Reza Shokri, and Amir Houmansadr. 2019. Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In2019 IEEE symposium on security and privacy (SP). IEEE, 739–753

    2019

  50. [58]

    Angelia Nedic and Asuman Ozdaglar. 2009. Distributed subgradient methods for multi-agent optimization. IEEE Trans. Automat. Control 54, 1 (2009), 48

    2009

  51. [59]

    Anh Ninh and Zuo-Jun Max Shen. 2024. Stochastic Resource Allocation Problems: Minmax and Maxmin Solutions. Manufacturing & Service Operations Management 26, 6 (2024), 2322–2335

    2024

  52. [60]

    Poon and G

    C. Poon and G. Peyré. 2021. Smooth bilevel programming for sparse regularization. In Advances in Neural Information Processing Systems , Vol. 34. 1543–1555

    2021

  53. [61]

    Rajeswaran, C

    A. Rajeswaran, C. Finn, S. M. Kakade, and S. Levine. 2019. Meta-learning with implicit gradients. In Advances in Neural Information Processing Systems , Vol. 32

    2019

  54. [62]

    Christopher Regan, Mohammad Nasajpour, Reza M Parizi, Seyedamin Pouriyeh, Ali Dehghantanha, and Kim-Kwang Raymond Choo. 2022. Federated IoT attack detection using decentralized edge data. Machine Learning with Applications 8 (2022), 100263

    2022

  55. [63]

    Shoupeng Ren, Lipeng He, Tianyu Tu, Di Wu, Jian Liu, Kui Ren, and Chun Chen

  56. [64]

    Devansh Shah, Parijat Dube, Supriyo Chakraborty, and Ashish Verma. 2021. Adversarial training in communication constrained federated learning. arXiv preprint arXiv:2103.01319 (2021)

    2021 arXiv

  57. [65]

    Chamani Shiranthika, Parvaneh Saeedi, and Ivan V Bajić. 2023. Decentralized learning in healthcare: a review of emerging techniques. IEEE Access 11 (2023), 54188–54209

    2023

  58. [66]

    Bernardo Camajori Tedeschini, Stefano Savazzi, Roman Stoklasa, Luca Barbieri, Ioannis Stathopoulos, Monica Nicoli, and Luigi Serio. 2022. Decentralized fed- erated learning for healthcare networks: A case study on tumor segmentation. IEEE access 10 (2022), 8693–8708

    2022

  59. [67]

    Stacey Truex, Ling Liu, Ka-Ho Chow, Mehmet Emre Gursoy, and Wenqi Wei

  60. [68]

    Ioannis Tsaknakis, Mingyi Hong, and Sijia Liu. 2020. Decentralized min-max optimization: Formulations, algorithms and applications in network poisoning attack. In ICASSP 2020-2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) . IEEE, 5755–5759

    2020

  61. [69]

    arXiv preprint arXiv:2401.07261 (2024)

    LookAhead: Preventing DeFi Attacks via Unveiling Adversarial Contracts. arXiv preprint arXiv:2401.07261 (2024)

    2024 arXiv

  62. [70]

    Di Wang, Marco Gaboardi, and Jinhui Xu. 2018. Empirical risk minimization in non-interactive local differential privacy revisited.Advances in Neural Information Processing Systems 31 (2018)

    2018

  63. [71]

    Di Wang, Minwei Ye, and Jinhui Xu. 2017. Differentially private empirical risk minimization revisited: Faster and more general. Advances in Neural Information Processing Systems 30 (2017)

    2017

  64. [72]

    Yongqiang Wang and Tamer Başar. 2023. Decentralized nonconvex optimization with guaranteed privacy and accuracy. Automatica 150 (2023), 110858

    2023

  65. [73]

    Kang Wei, Jun Li, Ming Ding, Chuan Ma, Howard H Yang, Farhad Farokhi, Shi Jin, Tony QS Quek, and H Vincent Poor. 2020. Federated learning with differential privacy: Algorithms and performance analysis. IEEE transactions on information forensics and security 15 (2020), 3454–3469

    2020

  66. [74]

    Wenhan Xian, Feihu Huang, Yanfu Zhang, and Heng Huang. 2021. A faster decentralized algorithm for nonconvex minimax problems. Advances in Neural Information Processing Systems 34 (2021), 25865–25877

    2021

  67. [75]

    Han Xiao, Kashif Rasul, and Roland Vollgraf. 2017. Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms. arXiv preprint arXiv:1708.07747 (2017)

    2017 arXiv

  68. [76]

    Hoi-To Wai, Mingyi Hong, Zhuoran Yang, Zhaoran Wang, and Kexin Tang

  69. [77]

    Yangyang Xu. 2024. Decentralized gradient descent maximization method for composite nonconvex strongly-concave minimax problems. SIAM Journal on Optimization 34, 1 (2024), 1006–1044

    2024

  70. [78]

    Zhixiong Yang, Arpita Gang, and Waheed U Bajwa. 2019. Adversary-resilient inference and machine learning: From distributed to decentralized. stat 1050 (2019), 23

    2019

  71. [79]

    Zhenhuan Yang, Shu Hu, Yunwen Lei, Kush R Vashney, Siwei Lyu, and Yiming Ying. 2022. Differentially private sgda for minimax problems. In Uncertainty in Artificial Intelligence. PMLR, 2192–2202

    2022

  72. [80]

    Liang Zhang, Kiran K Thekumparampil, Sewoong Oh, and Niao He. 2022. Bring your own algorithm for optimal differentially private stochastic minimax opti- mization. Advances in Neural Information Processing Systems 35 (2022), 35174– 35187

    2022

  73. [81]

    Xinwei Zhang, Xiangyi Chen, Mingyi Hong, Zhiwei Steven Wu, and Jinfeng Yi

  74. [82]

    Xin Zhang, Minghong Fang, Zhuqing Liu, Haibo Yang, Jia Liu, and Zhengyuan Zhu. 2022. Net-fleet: Achieving linear convergence speedup for fully decentral- ized federated learning with heterogeneous data. In MobiHoc

    2022

  75. [83]

    Xin Zhang, Zhuqing Liu, Jia Liu, Zhengyuan Zhu, and Songtao Lu. 2021. Taming communication and sample complexities in decentralized policy evaluation for cooperative multi-agent reinforcement learning. Advances in Neural Information Processing Systems 34 (2021), 18825–18838

    2021

  76. [84]

    Ran Xin, Usman Khan, and Soummya Kar. 2021. A hybrid variance-reduced method for decentralized stochastic non-convex optimization. In International Conference on Machine Learning . PMLR, 11459–11469

    2021

  77. [85]

    Liyi Zhou, Xihan Xiong, Jens Ernstberger, Stefanos Chaliasos, Zhipeng Wang, Ye Wang, Kaihua Qin, Roger Wattenhofer, Dawn Song, and Arthur Gervais. 2023. Sok: Decentralized finance (defi) attacks. In 2023 IEEE Symposium on Security and Privacy (SP). IEEE, 2444–2461

    2023

  78. [86]

    Xinyu Zhou and Raef Bassily. 2024. Differentially private worst-group risk minimization. arXiv preprint arXiv:2402.19437 (2024)

    2024 arXiv

  79. [87]

    Ligeng Zhu, Zhijian Liu, and Song Han. 2019. Deep leakage from gradients. Advances in neural information processing systems 32 (2019)

    2019

  80. [88]

    Giulio Zizzo, Ambrish Rawat, Mathieu Sinn, and Beat Buesser. 2020. Fat: Federated adversarial training. arXiv preprint arXiv:2012.01791 (2020). Enhancing Privacy in Decentralized Min-Max Optimization: A Differentially Private Approach MobiHoc 2025, June 2025, Houston, USA A Pr...

    2020 arXiv

  81. [90]

    In International Conference on Machine Learning, ICML 2022

    Understanding clipping for federated learning: Convergence and client- level differential privacy. In International Conference on Machine Learning, ICML 2022

    2022

  82. [93]

    Canzhe Zhao, Yanjie Ze, Jing Dong, Baoxiang Wang, and Shuai Li. 2023. Differen- tially private temporal difference learning with stochastic nonconvex-strongly- concave optimization. In Proceedings of the Sixteenth ACM International Confer- ence on Web Search and Data Mining . 985–993

    2023

  83. [2017]

    InAdvances in Neural Information Processing Systems

    Can decentralized algorithms outperform centralized algorithms? A case study for decentralized parallel stochastic gradient descent. InAdvances in Neural Information Processing Systems. 5330–5340

  84. [2019]

    Advances in Neural Information Processing Systems 32 (2019)

    Variance reduced policy evaluation with smooth function approximation. Advances in Neural Information Processing Systems 32 (2019)

    2019

  85. [2020]

    In Proceedings of the third ACM international workshop on edge systems, analytics and networking

    LDP-Fed: Federated learning with local differential privacy. In Proceedings of the third ACM international workshop on edge systems, analytics and networking. 61–66

  86. [2021]

    In 2021 IEEE International Conference on Data Mining (ICDM)

    Source inference attacks in federated learning. In 2021 IEEE International Conference on Data Mining (ICDM) . IEEE, 1102–1107

    2021

  87. [2022]

    What is the Solution for State-Adversarial Multi-Agent Reinforcement Learning? arXiv preprint arXiv:2212.02705 (2022)

    2022 arXiv

  88. [2023]

    arXiv preprint arXiv:2307.16212 (2023)

    Robust multi-agent reinforcement learning with state uncertainty. arXiv preprint arXiv:2307.16212 (2023)

    2023 arXiv

  89. [2024]

    IEEE Transactions on Big Data (2024)

    Decentralized federated learning: A survey on security and privacy. IEEE Transactions on Big Data (2024)

    2024

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.