Pith. sign in

REVIEW 4 major objections 5 minor 32 references

Mitigating Data Exfiltration Attacks through Layer-Wise Learning Rate Decay Fine-Tuning

T0 review · 4 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims fine-tuning with layer-wise learning-rate decay—high in early layers, low in late—at export corrupts hidden training data while preserving task accuracy, shown against Transpose and DEC attacks on three medical datasets.

desk verdict Reversed layer-wise LR decay is a genuinely simple and effective defense against Transpose, but the DEC evidence collapses and the abstract overclaims. read the letter →

arxiv 2509.00027 v1 pith:XHKTHZWF submitted 2025-08-20 cs.LG

Elie Thellier (EPIONE) , Huiyu Li (EPIONE) , Nicholas Ayache (EPIONE) , Hervé Delingette (EPIONE) This is my paper
classification cs.LG
keywords dataexfiltrationattackslayer-wiselearningratedecayfine-tuningdefensemodelmemorizationmedicalimageprivacyTransposeattackDECfederated
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Sensitive medical models trained in data lakes can secretly memorize or steganographically embed raw training images, so that an exported model still performs its task while letting an adversary reconstruct the data. This paper proposes a lightweight export-time defense: fine-tune the model with a layer-wise learning rate that decays from high in early layers to low in late layers, deliberately disturbing the layers where attacks hide data while leaving task-relevant later layers stable. On DermaMNIST, ChestMNIST, and MIMIC-CXR, the method reduces Transpose reconstructions to near-noise (SSIM as low as 13.3%) while keeping or improving utility, and it makes stolen data unusable for training a new classifier. The paper also positions this as the first targeted mitigation against neural data exfiltration attacks, applicable to centralized federated learning at model export or aggregation.

What carries the argument

The central mechanism is Layer-Wise Learning Rate Decay Fine-Tuning (LWLRD FT), a per-layer learning rate schedule that reverses the usual practice: early layers get the highest learning rate (10^-2) and later layers the lowest (10^-4), with exponential interpolation η_ℓ = η_high·(η_low/η_high)^((ℓ-1)/(L-1)). This targets the hypothesis that memorized or steganographically embedded data lives in early-layer parameters while task-relevant features concentrate in later layers. The high-rate updates corrupt the hidden data, and the low-rate updates on later layers preserve utility; the paper uses exponential decay, which restores classification faster than linear in ablations.

What would settle it

A concrete test: train a Transpose or DEC model, then apply LWLRD FT with the early layers frozen (or with the schedule reversed, high LR on late layers) and measure reconstruction SSIM; if reconstruction quality stays high, early-layer disruption is not the operative mechanism. Alternatively, run a variant of DEC that hides latent codes in late-layer weights and check whether it survives LWLRD FT, which would bound the defense's scope.

Watch

Extended reading notes

Core claim

The central claim is that data exfiltration attacks such as Transpose and DEC rely on early-layer stability, either by using early layers as a reconstruction head (model inversion) or by steganographically encoding compressed latent codes in early-layer parameters. LWLRD FT counters this by assigning each layer ℓ a learning rate η_ℓ = η_high·(η_low/η_high)^((ℓ-1)/(L-1)), with η_high=1e-2 on the first layer and η_low=1e-4 on the last, so early layers receive large updates that destroy embedded data while later layers are gently optimized to retain utility. Across DermaMNIST (ResNet18), ChestMNIST (ResNet18), and MIMIC-CXR (DenseNet121), the sanitized models show negligible or positive utility

Load-bearing premise

The defense assumes that exfiltrated data is stored predominantly in early layers and that high learning-rate updates to those layers destroy the embedded copies while leaving task-relevant features in later layers intact, and that the defender possesses the original training data and labels at export time.

Editorial extensions

If this is right

  • Data-lake and federated-learning operators can apply LWLRD FT at export/aggregation time, using only training data already in hand, to neutralize Transpose-style and DEC-style exfiltration without retraining from scratch.
  • Exported models remain useful: on the Transpose attack, utility is competitive or better than no mitigation (e.g., ChestMNIST AUC 74.3 vs 67.9), while reconstruction quality drops to near-noise levels.
  • Stolen datasets become unusable for downstream training: after LWLRD FT, classifiers trained on reconstructed images perform at or below chance (AUC ≈ 51% on DermaMNIST, below 50% on ChestMNIST and MIMIC-CXR).
  • Because DEC's steganographic encoding is fragile, essentially all tested fine-tuning defenses disrupt it; LWLRD FT's edge is maintaining utility while doing so, though it struggles on DenseNet121/MIMIC-CXR in the DEC setting.
  • The defense is lightweight: mitigation time is only about 27% longer than Vanilla FT in the Transpose evaluation, making export-time sanitization practical.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: if the early-layer hypothesis is correct, the defense should generalize to any attack that embeds data in early layers, including future learned-steganography variants; attacks that hide data in later or all layers would escape it.
  • Editorial inference: the same layer-wise disruption could be paired with per-layer attribution (e.g., measuring reconstruction quality after freezing each layer group) to identify where memorization actually lives, turning the defense into a diagnostic.
  • Editorial inference: the near-chance usability-test results suggest LWLRD FT is not just lowering image fidelity but destroying task-relevant information in the hidden copies, which implies defenses could target the representational alignment between encoder and decoder rather than raw weight perturbation.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes Layer-Wise Learning Rate Decay Fine-Tuning (LWLRD FT), an export-time mitigation that fine-tunes a trained model with a layer-wise learning rate schedule (η_l = η_high · (η_low/η_high)^((ℓ−1)/(L−1)), with η_high = 1e−2 and η_low = 1e−4) to disrupt early layers that are assumed to store exfiltrated data while preserving later task-relevant layers. It evaluates LWLRD FT against the Transpose attack and a modified DEC attack on DermaMNIST, ChestMNIST, and MIMIC-CXR, comparing against Vanilla FT, High LR FT, Super-FT, WD FT, RWP, Fine-Pruning, and RWD. The Transpose experiments show large reductions in SSIM/PSNR and increases in LPIPS with competitive utility. The DEC experiments are acknowledged to be driven by the fragility of the custom steganographic encoding, and LWLRD FT fails to recover utility on MIMIC-CXR. The paper also includes a usability test, an ablation study, and a discussion of adaptive attacks.

Significance. If the Transpose result is representative, the contribution is a simple, inexpensive, export-time defense against a concrete state-of-the-art exfiltration attack, with a useful comparison to prior fine-tuning/pruning defenses and a practical usability test. The threat model is clearly specified, and the layer-wise schedule has a clear rationale. However, the breadth of the claims exceeds the evidence: the DEC half is invalid as an attack evaluation, utility maintenance is contradicted on MIMIC-CXR, and there is no clean-model utility baseline or variance reporting. The paper's value currently rests on one attack and one schedule; with these gaps addressed it could be a solid empirical contribution.

major comments (4)
  1. [§4.2 and §5] The DEC evaluation cannot support the paper's central claim. Section 3.1 replaces the original HiFiC compressor with an AE-GAN and hides codes via a custom 16-bit float format, and Section 5 admits this encoding is 'not reversible, causing precision loss even without mitigation, which degrades latent codes into noise.' Accordingly, Fig. 4 shows all methods 'effectively neutralizing DEC.' The privacy improvement observed is therefore an artifact of the broken attack, not of LWLRD FT. Please either evaluate against the original DEC (or a robust learned-steganography variant) and report reconstruction quality without mitigation, or remove DEC from the headline claims and restrict them to Transpose.
  2. [Abstract and §4.2] The abstract's 'without degrading task performance' and 'maintains utility task performance' are contradicted by Section 4.2: 'LWLRD FT fails to recover utility on MIMIC-CXR.' Since the DEC attack is the setting where this failure occurs, the utility claim must be qualified to Transpose and to datasets where utility is actually recovered. Please report utility relative to a clean model for each dataset and attack, and soften the abstract/conclusion claims accordingly.
  3. [§3.2 and Table 1] The claim that LWLRD FT 'maintains utility' is not supported by the table because there is no clean-model utility baseline. 'No Mitigation' is the malicious Transpose model whose AUC is already depressed by multi-task training (e.g., 49.7 on MIMIC-CXR), so an improvement over No Mitigation does not show preservation of the original task model's performance. Please report the utility of a model trained only on the classification task, with per-run standard deviations/confidence intervals; Table 1 currently gives no error bars despite Section 3.2's statement that results were averaged over runs.
  4. [§2] The central mechanism is asserted rather than measured: the paper states DEC 'encodes sensitive content via steganography in early-layer parameters' and Transpose models 'repurpose early layers as a reconstruction head,' but no layer-wise analysis is provided. Since the method's promise is that early-layer disruption destroys exfiltration while late-layer preservation maintains utility, please include layer-wise attribution (e.g., reconstruction quality and utility when freezing/perturbing specific layer blocks) or a direct comparison of alternate schedules that isolates the layer direction. Without this, the privacy-utility trade-off could reflect generic fine-tuning rather than the proposed mechanism.
minor comments (5)
  1. [Table 1 heading] The heading reads 'T able 1' rather than 'Table 1'.
  2. [§1.1 and Table 1] There are spacing typos in baseline names, e.g., 'R WP + FT' and 'R WD + FT'.
  3. [§3.1] The custom 16-bit format (shift by 1, scale by 20,000) is described only verbally; please provide the exact encoding/decoding equations so the DEC implementation is reproducible.
  4. [§3.2 / §4] No code, model checkpoints, or training configurations are provided. Since the Transpose attack is nontrivial to implement, this limits verifiability of the one attack that supports the central claim.
  5. [§5] The adaptive-attack discussion (learned steganography) is labeled preliminary and gives no quantitative results; please either add experiments or clearly mark this as speculation/future work.

Circularity Check

1 steps flagged · score 6.0 of 10

DEC evaluation reduces by construction: the authors' own lossy steganography makes all methods 'neutralize' DEC, so the privacy claim rests on Transpose alone; the utility claim is also contradicted on MIMIC-CXR.

  1. other [Section 3.1 (DEC attack construction); Section 4.2 (DEC results); Section 5 (Discussion)]
    "Our custom float-to-bit encoding is not reversible, causing precision loss even without mitigation, which degrades latent codes into noise. ... Consequently, privacy metrics show minimal variation, with all methods effectively neutralizing DEC, though accuracy differs."

    The DEC attack is an author-modified variant assembled from the authors' own prior work [10,16] with a custom 16-bit float-to-bit steganographic encoding. Section 5 admits the encoding 'is not reversible, causing precision loss even without mitigation, which degrades latent codes into noise.' Section 4.2 then reports that 'all methods effectively neutralizing DEC' with 'minimal variation' across privacy metrics. Thus the observed privacy improvement is not an effect of LWLRD FT; it is entailed by the lossy encoding the authors chose to implement. The DEC benchmark therefore cannot support the claim that LWLRD FT disrupts DEC, and the central claim reduces to the external Transpose result alone.

full rationale

The core LWLRD FT method is a straightforward fine-tuning schedule and is not circular: it assigns higher learning rates to early layers and lower rates to later layers, and its success against the external Transpose attack is an independent, non-constructed result. However, the paper's central claim that the method 'effectively disrupts state-of-the-art exfiltration attacks' is supported by two benchmarks, one of which collapses by construction. The authors build a custom DEC variant from their own prior work, admit that its steganographic encoding is non-reversible and degrades latent codes into noise even without mitigation, and then report that all methods equally neutralize DEC. The DEC privacy numbers therefore carry no information about LWLRD FT; they are an artifact of the attack implementation, not a measured defense effect. Additionally, the abstract's claim of preserving task performance 'without degrading task performance' is directly contradicted by Section 4.2's admission that 'LWLRD FT fails to recover utility on MIMIC-CXR.' This is a correctness inconsistency rather than a circularity, but it further weakens the general claim. The paper also provides no code or error bars, so the remaining Transpose result is the sole verifiable support. Because one of two central evaluation pillars reduces by construction to the authors' own fragile attack, a partial-circularity score of 6 is appropriate.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central method depends on four hand-tuned hyperparameters (eta_high, eta_low, epochs, decay schedule) and on several domain assumptions about where memorization lives and what the defender controls. No new physical or computational entities are introduced; the AE-GAN compressor and custom bit encoding are modifications of the authors' prior attack components.

free parameters (4)
  • eta_high = 1e-2
    Learning rate for the first layer; chosen by hand and via ablation in Fig 5 on the same datasets that produce the headline results.
  • eta_low = 1e-4
    Learning rate for the last layer; chosen to match vanilla fine-tuning, a free design choice.
  • fine-tuning_epochs = 3 to 10 depending on dataset (ablation up to 14)
    Number of fine-tuning epochs is dataset-dependent and tuned; reconstruction is disrupted early but utility recovery depends on duration.
  • decay_schedule = exponential (formula in Section 2)
    The geometric layer-wise decay is chosen over linear decay; ablation shows exponential recovers utility faster, so this choice affects the central results.
assumptions (5)
  • domain assumption Memorized/exfiltrated data resides predominantly in early layers
    Section 2 asserts DEC and Transpose embed data in early-layer parameters without measuring layer-wise content.
  • domain assumption Later layers hold task-relevant features that survive low learning rate updates
    Section 2 states later layers 'where task-relevant features reside' are preserved; this is assumed, not demonstrated.
  • domain assumption Defender has access to original training data and labels at export time
    Section 3 says the mitigation uses 'only the original training data, hyperparameters and additional method-dependent settings'; if the defender lacks this, the method is inapplicable.
  • domain assumption The attack implementations are faithful to state-of-the-art
    Section 3.1 describes their own implementation of Transpose and a modified DEC; the DEC fidelity is questionable given the authors later admit their encoding is lossy.
  • domain assumption SSIM/LPIPS/PSNR measure actual privacy leakage
    Reconstruction quality metrics are used as proxies for data leakage; the paper does not establish that low perceptual similarity guarantees unusable private information.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Mitigating Data Exfiltration Attacks through Layer-Wise Learning Rate Decay Fine-Tuning." pith.science (2026). https://pith.science/paper/XHKTHZWF

@misc{pith2026250900027,
  author       = {Pith},
  title        = {Pith review of: Mitigating Data Exfiltration Attacks through Layer-Wise Learning Rate Decay Fine-Tuning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XHKTHZWF}},
  note         = {Machine review of arXiv:2509.00027}
}
read the original abstract

Data lakes enable the training of powerful machine learning models on sensitive, high-value medical datasets, but also introduce serious privacy risks due to potential leakage of protected health information. Recent studies show adversaries can exfiltrate training data by embedding latent representations into model parameters or inducing memorization via multi-task learning. These attacks disguise themselves as benign utility models while enabling reconstruction of high-fidelity medical images, posing severe privacy threats with legal and ethical implications. In this work, we propose a simple yet effective mitigation strategy that perturbs model parameters at export time through fine-tuning with a decaying layer-wise learning rate to corrupt embedded data without degrading task performance. Evaluations on DermaMNIST, ChestMNIST, and MIMIC-CXR show that our approach maintains utility task performance, effectively disrupts state-of-the-art exfiltration attacks, outperforms prior defenses, and renders exfiltrated data unusable for training. Ablations and discussions on adaptive attacks highlight challenges and future directions. Our findings offer a practical defense against data leakage in data lake-trained models and centralized federated learning.

Figures

Figures reproduced from arXiv: 2509.00027 by the authors.

Figure 1
Figure 1. Overview of our export-time mitigation. A malicious model trained on the data lake may retain both utility and private data. At export, we apply LWLRD FT using training data to disrupt early-layer memorization while preserving task performance. The sanitized model retains utility but loses reconstruction ability. LWLRD FT is especially effective against threats like Transpose and DEC, which exploit early-layer stabi… view at source ↗
Figure 2
Figure 2. Mitigation methods against the Transpose attack. Points show AUC (utility) vs. SSIM (leakage); lower-right is better. Size represents mitigation time [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Transpose reconstructions by mitigation method. Each row shows the original image (left) and mitigated reconstructions with SSIM scores. 4.2 Performance Against the DEC Attack [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: shows similar mitigation results against the DEC attack across methods, as the steganographic latent code is fragile: small bit flips or noise easily destroy the hidden data. Our adapted DEC, using a custom bit representation, reconstructs latent codes within the AE-GA…
Figure 5
Figure 5. Figure 5: LWLRD FT hyperparameter study under Transpose Attack. AUC and SSIM over epochs for varying ηhigh and decay (solid: exponential, dashed: linear). 5 Discussion and Conclusion Our novel mitigation method disrupts current data exfiltration attacks, though adaptive techniqu…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

32 extracted references · 24 canonical work pages

  1. [1]

    Procedia Computer Science225, 1302–1311 (2023)

    Gentner, T., Neitzel, T., Schulze, J., Gerschner, F., Theissler, A.: Data lakes in healthcare: applications and benefits from the perspective of data sources and players. Procedia Computer Science225, 1302–1311 (2023)

    work page 2023

  2. [2]

    Nature Machine Intelligence 2(6), 305–311 (2020)

    Kaissis, G.A., Makowski, M.R., Rückert, D., Braren, R.F.: Secure, privacy- preserving and federated machine learning in medical imaging. Nature Machine Intelligence 2(6), 305–311 (2020)

    work page 2020

  3. [3]

    Hidden Data Privacy Breaches in Federated Learning

    Gong, X., Wang, Y., Li, S., Sun, M., Li, S., Wang, Q., Lam, K.Y., Chen, C.: Hid- den data privacy breaches in federated learning. arXiv preprint arXiv:2411.18269 (2024)

    work page Pith review arXiv 2024

  4. [4]

    arXiv preprint arXiv:2011.00177 (2020)

    Wu, M., Zhang, X., Ding, J., Nguyen, H., Yu, R., Pan, M., Wong, S.T.: Evalua- tion of inference attack models for deep learning on medical data. arXiv preprint arXiv:2011.00177 (2020)

    arXiv 2011

  5. [5]

    In: International Conference on Neural Information Processing

    Xu, T., Liu, C., Zhang, K., Zhang, J.: Membership inference attacks against medi- cal databases. In: International Conference on Neural Information Processing. pp. 15–25. Springer (2023)

    work page 2023

  6. [6]

    In: 2023 IEEE 36th Computer Security Foundations Symposium (CSF)

    Dibbo, S.V.: Sok: Model inversion attack landscape: Taxonomy, challenges, and future roadmap. In: 2023 IEEE 36th Computer Security Foundations Symposium (CSF). pp. 439–456. IEEE (2023)

    work page 2023

  7. [7]

    arXiv preprint arXiv:2411.14516 (2024)

    Luzon, E., Amit, G., Weiss, R., Mirsky, Y.: Memory backdoor attacks on neural networks. arXiv preprint arXiv:2411.14516 (2024)

    work page arXiv 2024

  8. [8]

    In: 2018 IEEE 31st computer security foundations symposium (CSF)

    Yeom, S., Giacomelli, I., Fredrikson, M., Jha, S.: Privacy risk in machine learning: Analyzing the connection to overfitting. In: 2018 IEEE 31st computer security foundations symposium (CSF). pp. 268–282. IEEE (2018) 10 E. Thellier et al

    work page 2018

Show all 32 references
  1. [9]

    arXiv preprint arXiv:2311.07389 (2023)

    Amit, G., Levy, M., Mirsky, Y.: Transpose attack: Stealing datasets with bidirec- tional training. arXiv preprint arXiv:2311.07389 (2023)

    2023 arXiv

  2. [10]

    Li, H., Ayache, N., Delingette, H.: Data stealing attack on medical images: Is it safe to export networks from data lakes? In: International Workshop on Distributed, Collaborative, and Federated Learning. pp. 28–36. Springer (2022)

    2022

  3. [11]

    In: 32nd USENIX Security Symposium (USENIX Security 23)

    Carlini, N., Hayes, J., Nasr, M., Jagielski, M., Sehwag, V., Tramer, F., Balle, B., Ippolito, D., Wallace, E.: Extracting training data from diffusion models. In: 32nd USENIX Security Symposium (USENIX Security 23). pp. 5253–5270 (2023)

    2023

  4. [12]

    Adnan, M., Kalra, S., Cresswell, J.C., Taylor, G.W., Tizhoosh, H.R.: Federated learninganddifferentialprivacyformedicalimageanalysis.Scientificreports 12(1), 1953 (2022)

    1953

  5. [13]

    Medical and Bi- ological Engineering and Computing44, 619–631 (2006)

    Giakoumaki, A., Pavlopoulos, S., Koutsouris, D.: Secure and efficient health data management through multiple watermarking on medical images. Medical and Bi- ological Engineering and Computing44, 619–631 (2006)

    2006

  6. [14]

    In: International symposium on research in attacks, intrusions, and defenses

    Liu, K., Dolan-Gavitt, B., Garg, S.: Fine-pruning: Defending against backdoor- ing attacks on deep neural networks. In: International symposium on research in attacks, intrusions, and defenses. pp. 273–294. Springer (2018)

    2018

  7. [15]

    arXiv preprint arXiv:2212.09067 (2022)

    Sha, Z., He, X., Berrang, P., Humbert, M., Zhang, Y.: Fine-tuning is all you need to mitigate backdoor attacks. arXiv preprint arXiv:2212.09067 (2022)

    2022 arXiv

  8. [16]

    In: 2025 IEEE 22nd International Symposium on Biomedical Imaging (ISBI)

    Li, H., Ayache, N., Delingette, H.: Generative medical image anonymization based on latent code projection and optimization. In: 2025 IEEE 22nd International Symposium on Biomedical Imaging (ISBI). pp. 1–4. IEEE (2025)

    2025

  9. [17]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Seo, J., Lee, S.H., Lee, T.Y., Moon, S., Park, G.M.: Generative unlearning for any identity. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 9151–9161 (2024)

    2024

  10. [18]

    In: ICLR2018 Conference (2018)

    Ginsburg, B., Gitman, I., You, Y.: Large batch training of convolutional networks with layer-wise adaptive rate scaling. In: ICLR2018 Conference (2018)

    2018

  11. [19]

    In: Proceedings of the AAAI Conference on Artificial Intelligence (AAAI-21)

    Ro, Y., Choi, J.Y.: Autolr: Layer-wise pruning and auto-tuning of learning rates in fine-tuning of deep networks. In: Proceedings of the AAAI Conference on Artificial Intelligence (AAAI-21). pp. 2486–2494 (2021)

    2021

  12. [20]

    arXiv preprint arXiv:2212.06138 (2022)

    Dong, X., Bao, J., Zhang, T., Chen, D., Gu, S., Zhang, W., Yuan, L., Chen, D., Wen, F., Yu, N.: Clip itself is a strong fine-tuner: Achieving 85.7% and 88.0% top-1 accuracy with vit-b and vit-l on imagenet. arXiv preprint arXiv:2212.06138 (2022)

    2022 arXiv

  13. [21]

    In: International Conference on Learning Representations (ICLR) (2019)

    Loshchilov, I., Hutter, F.: Decoupled weight decay regularization. In: International Conference on Learning Representations (ICLR) (2019)

    2019

  14. [22]

    In: IEEE 18th International Symposium on Biomedical Imaging (ISBI)

    Yang, J., Shi, R., Ni, B.: Medmnist classification decathlon: A lightweight automl benchmark for medical image analysis. In: IEEE 18th International Symposium on Biomedical Imaging (ISBI). pp. 191–195 (2021)

    2021

  15. [23]

    Scientific data p

    Tschandl, P., Rosendahl, C., Kittler, H.: The ham10000 dataset, a large collection of multi-source dermatoscopic images of common pigmented skin lesions. Scientific data p. 180161 (2018)

    2018

  16. [24]

    arXiv preprint arXiv:1902.03368 (2019)

    Codella, N., Rotemberg, V., Tschandl, P., Celebi, M.E., Dusza, S., Gutman, D., Helba,B.,Kalloo,A.,Liopyris,K., Marchetti,M., et al.:Skinlesionanalysis toward melanoma detection 2018: A challenge hosted by the international skin imaging collaboration (isic). arXiv preprint arXi...

    2018 arXiv

  17. [25]

    He,K.,Zhang,X.,Ren,S.,Sun,J.:Deepresiduallearningforimagerecognition.In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR). pp. 770–778 (2016)

    2016

  18. [26]

    Scientific Data 10(1), 41 (2023) Mitigating Data Exfiltration via Layer-Wise LR Decay FT 11

    Yang,J.,Shi,R.,Wei,D.,Liu,Z.,Zhao,L.,Ke,B.,Pfister,H.,Ni,B.:Medmnistv2- a large-scale lightweight benchmark for 2d and 3d biomedical image classification. Scientific Data 10(1), 41 (2023) Mitigating Data Exfiltration via Layer-Wise LR Decay FT 11

    2023

  19. [27]

    In: CVPR

    Wang, X., Peng, Y., et al.: Chestx-ray8: Hospital-scale chest x-ray database and benchmarks on weakly-supervised classification and localization of common thorax diseases. In: CVPR. pp. 3462–3471 (2017)

    2017

  20. [28]

    arXiv preprint arXiv:1901.07042 (2019)

    Johnson, A.E., Pollard, T.J., Greenbaum, N.R., Lungren, M.P., Deng, C.y., Peng, Y., Lu, Z., Mark, R.G., Berkowitz, S.J., Horng, S.: Mimic-cxr-jpg, a large publicly available database of labeled chest radiographs. arXiv preprint arXiv:1901.07042 (2019)

    1901 arXiv

  21. [29]

    In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    Huang, G., Liu, Z., Van Der Maaten, L., Weinberger, K.Q.: Densely connected convolutional networks. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR). pp. 4700–4708 (2017)

    2017

  22. [30]

    Li, H.: Data exfiltration and anonymization of medical images based on generative models. Ph.D. thesis, Université Côte d’Azur (2024)

    2024

  23. [31]

    IEEE Transactions on Image Process- ing 13(4), 600–612 (2004)

    Wang, Z., Bovik, A.C., Sheikh, H.R., Simoncelli, E.P.: Image quality assessment: From error visibility to structural similarity. IEEE Transactions on Image Process- ing 13(4), 600–612 (2004)

    2004

  24. [32]

    In: Proceedings of the IEEE conference on computer vision and pattern recognition

    Zhang, R., Isola, P., Efros, A.A., Shechtman, E., Wang, O.: The unreasonable effectiveness of deep features as a perceptual metric. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 586–595 (2018)

    2018

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.