REVIEW 3 major objections 3 minor 42 references
Poison to Detect: Detection of Targeted Overfitting in Federated Learning
T0 review · 3 major / 3 minor · reviewed 2026-08-04 · deepseek-v4-flash
Pith's one-line read Clients can detect a malicious server's targeted overfitting within one to two training rounds, using three client-side integrity tests.
desk verdict Client-side tripwires for detecting a selectively-aggregating FL server: a legitimate idea, honestly reported, but the evaluation overfits its own thresholds and the threat model is a sitting duck. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The central machinery is the client-planted detection signal, verified after the global model is returned. The Poison Effectiveness Score (PES) is the accuracy difference on the flipped-label subset between the local model and the aggregated global model: a high score means the global model corrected the poison (honest aggregation), a low score suggests the client's update was disproportionately favored. The Trigger Influence Score measures the fraction of trigger-pattern inputs the global model classifies as the target label, indicating whether a client-specific backdoor survived aggregation. The fingerprint method injects a secret vector into the local update and computes its dot product (
What would settle it
Run a single-client targeted overfitting attack where the orchestrator first applies a small norm clipping or additive noise to each client update before aggregation; if the detection scores (PES, trigger influence, or fingerprint strength) drop to levels indistinguishable from honest aggregation, the non-adaptive assumption is refuted. Alternatively, have the orchestrator inspect updates and remove the fingerprint direction; a drop in detection accuracy would confirm the dependency.
Extended reading notes
Core claim
Targeted overfitting can be detected at the client side by planting a distinctive signal in the local update and checking whether that signal survives the server's aggregation. The paper develops three such signals: a poison effectiveness score from deliberately flipped labels, a trigger influence score from a backdoor pattern, and a fingerprint strength from a secret vector added to the gradient or weights. Under an honest aggregation, the signal is diluted by other clients' updates; under a malicious subset aggregation, the signal persists. In experiments across five datasets and two attack scenarios, the methods detect single-client targeting within 1-2 rounds with F1 scores up to 0.7, an
Load-bearing premise
The malicious orchestrator is non-adaptive: it returns to targeted clients the unmodified result of aggregating only the targeted clients' updates, and it does not detect, clip, add noise to, or strip the client-planted signals (flipped labels, backdoor triggers, or fingerprints).
Editorial extensions
If this is right
- If a single client is targeted, all three methods can raise an alert within the first or second training round, allowing the client to disengage before significant overfitting and privacy leakage occurs.
- Client-side integrity testing can complement prevention mechanisms like differential privacy, providing a detection layer that does not incur a permanent utility cost.
- The label-flipping method remains effective when a fixed subset of clients is targeted, offering a practical detection path for multi-client attacks.
- The fingerprint method is the most reliable for single-client attacks but requires the server's optimizer to send the same type of update (gradients or weights) as it receives, and it degrades when a subset is targeted because stronger fingerprints would interfere with training.
- The proposed methods are optimizer-agnostic and do not require client-to-client communication, making them deployable in standard horizontal federated learning settings.
Reading between the lines
- An adaptive orchestrator could defeat all three methods by clipping update norms, adding noise, or excluding clients whose updates carry anomalous signals; testing such countermeasures is a natural next step.
- The label-flip and backdoor methods rely on the server not detecting the planted poison; a server that inspects update content could strip or relabel the flipped samples, so their robustness depends on the attacker's blindness.
- Combining the three signals—for example, using fingerprinting for fast single-client detection and label-flip as a fallback for subset attacks—could yield a more resilient client-side detector than any single method.
- The paper's threshold calibration for backdoor triggers uses a statistical bound or empirical quantiles, which suggests a practical deployment could tune sensitivity to false-positive requirements without needing a trusted calibration round.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper studies a threat in horizontal federated learning in which a malicious orchestrator deliberately aggregates updates from a targeted client or subset of clients, causing those clients' local models to overfit on their own data. The authors propose three client-side tripwire mechanisms---label flipping, backdoor trigger injection, and gradient/weight fingerprinting---and evaluate them on five datasets under two scenarios: targeting a single client (Scenario I) and targeting a fixed subset (Scenario II). The reported results are detection within 1--2 rounds in Scenario I, with label flipping and backdoor triggers also providing partial detection in Scenario II. The abstract claims early, effective, and scalable client-side integrity testing, but the evaluation is limited by post hoc threshold selection, a trivial single-client setting, and a non-adaptive malicious-server model.
Significance. If the proposal were validated, it would be a useful complement to existing privacy defenses: clients could autonomously verify aggregation integrity without collusion, and could disengage before overfitting enables membership inference or reconstruction attacks. The three mechanisms are simple and the paper provides concrete pseudocode, including a statistical threshold heuristic for the backdoor method and an analytical fingerprint threshold in Algorithm 4. However, the current evidence does not establish the claimed effectiveness. The headline Scenario I results reduce to checking whether the server returned the client's own model, and the reported accuracies and F1 scores are in-sample optima obtained by choosing thresholds per dataset on the evaluated runs. The threat model also assumes the malicious orchestrator does not adapt its aggregation in response to the tripwires. These issues affect the central quantitative claim, so the paper needs substantial revision before its conclusions can be accepted.
major comments (3)
- [Section 3, Scenario I] In Scenario I, S^t_mal = {i*}, so the malicious global model is exactly the target client's own local model, \tilde W = A({W_i*}) = W_i* under FedAvg. Then PES = Acc(M_local,D_flip) - Acc(M_agg,D_flip) = 0 by construction, the backdoor score is the client's own trigger persistence, and the fingerprint strength is the client's own injected component. Detection in Scenario I is therefore a tautology: it detects that the server returned the client's own update, not targeted overfitting as an emergent behavior. The abstract's 'within 1--2 rounds' claim is an artifact of this construction. The non-trivial evaluation is Scenario II, where the results are considerably weaker (e.g., backdoor accuracy 0.52--0.60, fingerprint largely failing). The paper should either drop Scenario I as evidence or reframe it as a sanity check.
- [Table 1; Figures 4--5] The headline metrics are in-sample optima. Table 1 reports the 'best performing accuracy and F1 score thresholds by dataset', and Figures 4 and 5 sweep detection thresholds over the same runs used to compute accuracy, precision, recall, and F1. Selecting the threshold that maximizes the metric on the evaluation set and then reporting that metric overstates operational performance; there is no evidence that any fixed a priori threshold would achieve these scores on new data. The evaluation should use a threshold selected on a calibration set or cross-validation, or should report threshold-independent metrics such as AUC. The statistical bound in Section 4.2 is a step in the right direction, but it is not used for the reported numbers.
- [Section 3, 4, and 6] The detection mechanisms assume the malicious orchestrator returns the unmodified subset aggregation \tilde W. The orchestrator, however, controls the aggregation and can post-process the returned model---e.g., add noise, clip updates, or subtract the component along the client's fingerprint direction---while continuing to favor the targeted client's data. Such post-processing would dilute PES, the trigger influence score, and the fingerprint strength. Section 6 explicitly lists 'more nuanced schemas of aggregation' as future work, acknowledging the gap. Since the adversary is the orchestrator, this is an internal limitation of the threat model, not just a matter of broader consensus. The authors should either restrict the threat model to a server that cannot alter the returned model beyond the prescribed aggregation (and state this clearly) or evaluate an adaptive server and show whethe
minor comments (3)
- [Section 4.3] Algorithm 3 is referred to as 'algorithm 7' in the text; the reference should be to Algorithm 3.
- [Figure 2(b) caption] The caption says for the backdoor method 'the higher the threshold, the more sensitive the method will become', but the flagging condition is S >= tau, so a higher threshold makes detection less sensitive. This should be corrected.
- [Notation and Table 2] The symbol alpha is used for the Dirichlet concentration (Eq. 1), the label-flip ratio (Algorithm 1), the fingerprint strength (Algorithm 3), and as a generic threshold in Figures 4--5. This is confusing and should be disambiguated. Also, Table 2(a) uses dashes for fingerprint Scenario II without explanation, and the CIFAR100 label-flip detection round of 10 is not discussed.
Circularity Check
Detection methods are tripwires and not circular, but the reported detection performance is partly an artifact of selecting thresholds on the same evaluation runs.
-
fitted input called prediction
[Section 5.4 / Table 1 / Figures 4-5]
"Table 1: Best performing accuracy and F1 score thresholds by dataset across scenarios for Label Flip and Backdoor Trigger attacks. The corresponding data is plotted on Figures 3a and 3b. ... To better understand the impact of the detection thresholds α and τ on both methods, we have examined the variability of metrics (accuracy, precision, recall, and f1score) depending on the nine different thresholds we derived in our experiments."
The detection thresholds are chosen after seeing the results, as the best-performing values for each dataset and scenario. The reported accuracy, F1, and 'early detection' claims are then computed using these in-sample optimized thresholds. This is a fitted parameter—the decision threshold—being used to produce the very performance numbers that support the abstract's claim that the methods 'reliably detect' targeted overfitting. The empirical support is thus partly a consequence of fitting the decision boundary to the evaluation data, rather than an evaluation of a fixed, pre-specified detection rule.
full rationale
The three proposed methods are client-side tripwires: they plant a signal (flipped labels, backdoor trigger, or fingerprint) and then check whether the returned global model retains it. This logic is not circular—it is a valid integrity check for the specific malicious aggregation defined in Section 3. The paper also does not rely on self-citations to justify its central mechanism. However, the evaluation has a significant circular element: Table 1 explicitly reports 'best performing' thresholds per dataset, and Figures 4-5 sweep thresholds to reveal performance variability. The headline results (e.g., detection within 1-2 rounds, F1 scores) are obtained using thresholds selected on the same runs used to compute those metrics, so the reported performance is an in-sample optimum rather than a prediction from a fixed rule. The non-adaptive threat model (the orchestrator returns the unmodified subset aggregation) is a stated limitation acknowledged in Section 6, but that is a threat-model weakness, not a circular derivation. Overall, the detection concept is self-contained, but the evaluation's threshold fitting inflates the empirical claims, giving a partial circularity score of 5.
Assumptions & free parameters
free parameters (5)
- PES detection threshold (label flip) =
e.g., <0.01 (MNIST Scenario I), <0.9 (PATHMNIST Scenario II), Table 1
- Backdoor trigger threshold tau =
e.g., >0.99 (MNIST), >0.1 (EUROSAT Scenario II), Table 1
- Fingerprint strength alpha =
not reported; suggested range 1e-3 to 1e-2 (Section 4.3)
- Fingerprint sparsity s and detection margin gamma =
not reported
- Label flip ratio alpha (Algorithm 1 input) =
not reported
assumptions (4)
- domain assumption The malicious orchestrator sends the exact, unmodified output of the subset aggregation to targeted clients (no noise, clipping, or watermark removal).
- domain assumption The orchestrator does not detect or remove client-planted signals (flipped labels, backdoor triggers, fingerprints).
- domain assumption Client data follows non-IID Dirichlet partitioning with a concentration parameter that is not specified.
- domain assumption Targeted overfitting increases membership inference and reconstruction risk, giving the attack real privacy harm.
Cite this review
Pith. "Pith review of Poison to Detect: Detection of Targeted Overfitting in Federated Learning." pith.science (2026). https://pith.science/paper/UBIFEHEK
@misc{pith2026250911974,
author = {Pith},
title = {Pith review of: Poison to Detect: Detection of Targeted Overfitting in Federated Learning},
year = {2026},
howpublished = {\url{https://pith.science/paper/UBIFEHEK}},
note = {Machine review of arXiv:2509.11974}
}
read the original abstract
Federated Learning (FL) enables collaborative model training among clients without centralising data, making it a widely adopted privacy-enhancing technology (PET). Despite its privacy benefits, FL remains vulnerable to orchestrator-driven privacy attacks. In this paper, we study an underexplored threat in which a dishonest orchestrator intentionally manipulates the aggregation process to induce targeted overfitting in local models of specific clients. Although prior work focuses on reducing information leakage during training, we emphasise early client-side detection of targeted overfitting, allowing clients to disengage before significant harm occurs. To this end, we propose three detection techniques -- label flipping, backdoor trigger injection, and model fingerprinting -- which enable clients to verify the integrity of the global aggregation. We evaluated our methods across multiple datasets and attack scenarios. In single-client attacks, all three methods detect orchestrator-induced overfitting within 1-2 training rounds with F1 scores up to 0.7. Scalability experiments further show that detection effectiveness is influenced by cohort composition and method parameters. These results demonstrate that client-side integrity testing can provide early, effective, and scalable detection, supporting safer deployment of FL systems.
Figures
Figures from the paper (2 more)
Reference graph
Works this paper leans on
-
[1]
Baffle: Backdoor detection via feedback-based federated learning
Sebastien Andreina, Giorgia Azzurra Marson, Helen Möllering, and Ghassan Karame. Baffle: Backdoor detection via feedback-based federated learning. In2021 IEEE 41st International Conference on Distributed Computing Systems (ICDCS), pages 852–863. IEEE, 2021
2021
-
[2]
How to backdoor federated learning
Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. How to backdoor federated learning. InInternational conference on artificial intelligence and statistics, pages 2938–2948. PMLR, 2020
2020
-
[3]
Reconstructing training data with informed adversaries
Borja Balle, Giovanni Cherubin, and Jamie Hayes. Reconstructing training data with informed adversaries. In 2022 IEEE Symposium on Security and Privacy (SP), pages 1138–1156. IEEE, 2022
2022
-
[4]
Reconstruction attacks on machine unlearning: Simple models are vulnerable.Advances in Neural Information Processing Systems, 37:104995–105016, 2024
Martin Bertran, Shuai Tang, Michael Kearns, Jamie H Morgenstern, Aaron Roth, and Steven Z Wu. Reconstruction attacks on machine unlearning: Simple models are vulnerable.Advances in Neural Information Processing Systems, 37:104995–105016, 2024
2024
-
[5]
Poisoning attacks against support vector machines
Battista Biggio, Blaine Nelson, and Pavel Laskov. Poisoning attacks against support vector machines. In Proceedings of the 29th International Coference on International Conference on Machine Learning, ICML’12, page 1467–1474, Madison, WI, USA, 2012. Omnipress
2012
-
[6]
Machine learning with adver- saries: Byzantine tolerant gradient descent
Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer. Machine learning with adver- saries: Byzantine tolerant gradient descent. In I. Guyon, U. V on Luxburg, S. Bengio, H. Wallach, R. Fergus, 14 APREPRINT- SEPTEMBER21, 2025 S. Vishwanathan, and R. Garnett, editors,Advances in Neural Information Processing Systems, volume 30. Curran Ass...
2025
-
[7]
Federated learning attacks and defenses: A survey
Yao Chen, Yijie Gui, Hong Lin, Wensheng Gan, and Yongdong Wu. Federated learning attacks and defenses: A survey. In2022 IEEE International Conference on Big Data (Big Data), pages 4256–4265, 2022
2022
-
[8]
The mnist database of handwritten digit images for machine learning research [best of the web].IEEE signal processing magazine, 29(6):141–142, 2012
Li Deng. The mnist database of handwritten digit images for machine learning research [best of the web].IEEE signal processing magazine, 29(6):141–142, 2012
2012
Show all 42 references
-
[9]
Local model poisoning attacks to Byzantine-Robust federated learning
Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Gong. Local model poisoning attacks to Byzantine-Robust federated learning. In29th USENIX Security Symposium (USENIX Security 20), pages 1605–1622. USENIX Association, August 2020
2020
-
[10]
Model inversion attacks that exploit confidence infor- mation and basic countermeasures
Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confidence infor- mation and basic countermeasures. InProceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, CCS ’15, page 1322–1333, New York, NY , USA, 20...
2015
-
[11]
A novel data poisoning attack in federated learning based on inverted loss function.Computers & Security, 130:103270, 2023
Prajjwal Gupta, Krishna Yadav, Brij B Gupta, Mamoun Alazab, and Thippa Reddy Gadekallu. A novel data poisoning attack in federated learning based on inverted loss function.Computers & Security, 130:103270, 2023
2023
-
[12]
Deep residual learning for image recognition
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 770–778, 2016
2016
-
[13]
Zecheng He, Tianwei Zhang, and Ruby B. Lee. Model inversion attacks against collaborative inference. In Proceedings of the 35th Annual Computer Security Applications Conference, ACSAC ’19, page 148–162, New York, NY , USA, 2019. Association for Computing Machinery
2019
-
[14]
Patrick Helber, Benjamin Bischke, Andreas Dengel, and Damian Borth. Eurosat: A novel dataset and deep learning benchmark for land use and land cover classification.IEEE Journal of Selected Topics in Applied Earth Observations and Remote Sensing, 12(7):2217–2226, 2019
2019
-
[15]
Loadaboost: Loss-based adaboost federated machine learning with reduced computational complexity on iid and non-iid intensive care data.Plos one, 15(4):e0230706, 2020
Li Huang, Yifeng Yin, Zeng Fu, Shifa Zhang, Hao Deng, and Dianbo Liu. Loadaboost: Loss-based adaboost federated machine learning with reduced computational complexity on iid and non-iid intensive care data.Plos one, 15(4):e0230706, 2020
2020
-
[16]
Advances and open problems in federated learning.Foundations and trends® in machine learning, 14(1–2):1–210, 2021
Peter Kairouz, H Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, et al. Advances and open problems in federated learning.Foundations and trends® in machine learning, 14(1–2...
2021
-
[17]
Scaffold: Stochastic controlled averaging for federated learning
Sai Praneeth Karimireddy, Satyen Kale, Mehryar Mohri, Sashank Reddi, Sebastian Stich, and Ananda Theertha Suresh. Scaffold: Stochastic controlled averaging for federated learning. InInternational conference on machine learning, pages 5132–5143. PMLR, 2020
2020
-
[18]
Schaefer
Muah Kim, Onur Günlü, and Rafael F. Schaefer. Federated learning with local differential privacy: Trade-offs between privacy, utility, and communication. InICASSP 2021 - 2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 2650–2654, 2021
2021
-
[19]
Learning multiple layers of features from tiny images
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009
2009
-
[20]
Learning multiple layers of features from tiny images.(2009), 2009
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images.(2009), 2009
2009
-
[21]
Data poisoning attacks on factorization-based collaborative filtering.Advances in neural information processing systems, 29, 2016
Bo Li, Yining Wang, Aarti Singh, and Yevgeniy V orobeychik. Data poisoning attacks on factorization-based collaborative filtering.Advances in neural information processing systems, 29, 2016
2016
-
[22]
Federated learning: Challenges, methods, and future directions.IEEE signal processing magazine, 37(3):50–60, 2020
Tian Li, Anit Kumar Sahu, Ameet Talwalkar, and Virginia Smith. Federated learning: Challenges, methods, and future directions.IEEE signal processing magazine, 37(3):50–60, 2020
2020
-
[23]
A blockchain-based decentralized federated learning framework with committee consensus.IEEE Network, 35(1):234–241, 2020
Yuzheng Li, Chuan Chen, Nan Liu, Huawei Huang, Zibin Zheng, and Qiang Yan. A blockchain-based decentralized federated learning framework with committee consensus.IEEE Network, 35(1):234–241, 2020
2020
-
[24]
On the over-memorization during natural, robust and catastrophic overfitting
Runqi Lin, Chaojian Yu, Bo Han, and Tongliang Liu. On the over-memorization during natural, robust and catastrophic overfitting. InProceedings of the Twelfth International Conference on Learning Representations, 2024
2024
-
[25]
Springer International Publishing, Cham, 2020
Lingjuan Lyu, Han Yu, Jun Zhao, and Qiang Yang.Threats to Federated Learning, pages 3–16. Springer International Publishing, Cham, 2020
2020
-
[26]
Communication- efficient learning of deep networks from decentralized data
Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication- efficient learning of deep networks from decentralized data. InArtificial intelligence and statistics, pages 1273–1282. PMLR, 2017. 15 APREPRINT- SEPTEMBER21, 2025
2017
-
[27]
Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning
Milad Nasr, Reza Shokri, and Amir Houmansadr. Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In2019 IEEE Symposium on Security and Privacy (SP), pages 739–753, 2019
2019
-
[28]
Dataset reconstruction attack against language models
Rrubaa Panchendrarajan and Suman Bhoi. Dataset reconstruction attack against language models. InCEUR Workshop, 2021
2021
-
[29]
Reddi, Zachary Charles, Manzil Zaheer, Zachary Garrett, Keith Rush, Jakub Koneˇcný, Sanjiv Kumar, and Hugh Brendan McMahan
Sashank J. Reddi, Zachary Charles, Manzil Zaheer, Zachary Garrett, Keith Rush, Jakub Koneˇcný, Sanjiv Kumar, and Hugh Brendan McMahan. Adaptive federated optimization. In9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021....
2021
-
[30]
Fetchsgd: Communication-efficient federated learning with sketching
Daniel Rothchild, Ashwinee Panda, Enayat Ullah, Nikita Ivkin, Ion Stoica, Vladimir Braverman, Joseph Gonzalez, and Raman Arora. Fetchsgd: Communication-efficient federated learning with sketching. InInternational Conference on Machine Learning, pages 8253–8265. PMLR, 2020
2020
-
[31]
Membership inference attacks against machine learning models
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In2017 IEEE Symposium on Security and Privacy (SP), pages 3–18, 2017
2017
-
[32]
Data poisoning attacks against federated learning systems
Vale Tolpegin, Stacey Truex, Mehmet Emre Gursoy, and Ling Liu. Data poisoning attacks against federated learning systems. InComputer security–ESORICs 2020: 25th European symposium on research in computer security, ESORICs 2020, guildford, UK, September 14–18, 2020, proceedings...
2020
-
[33]
Beyond inferring class representatives: User-level privacy leakage from federated learning
Zhibo Wang, Mengkai Song, Zhifei Zhang, Yang Song, Qian Wang, and Hairong Qi. Beyond inferring class representatives: User-level privacy leakage from federated learning. InIEEE INFOCOM 2019-IEEE conference on computer communications, pages 2512–2520. IEEE, 2019
2019
-
[34]
Naughton
Xi Wu, Matt Fredrikson, Somesh Jha, and Jeffrey F. Naughton. A methodology for formalizing model-inversion attacks.2016 IEEE 29th Computer Security Foundations Symposium (CSF), pages 355–370, 2016
2016
-
[35]
Medmnist v2-a large-scale lightweight benchmark for 2d and 3d biomedical image classification.Scientific Data, 10(1):41, 2023
Jiancheng Yang, Rui Shi, Donglai Wei, Zequan Liu, Lin Zhao, Bilian Ke, Hanspeter Pfister, and Bingbing Ni. Medmnist v2-a large-scale lightweight benchmark for 2d and 3d biomedical image classification.Scientific Data, 10(1):41, 2023
2023
-
[36]
Robust federated learning with noisy labels.IEEE Intelligent Systems, 37(2):35–43, 2022
Seunghan Yang, Hyoungseob Park, Junyoung Byun, and Changick Kim. Robust federated learning with noisy labels.IEEE Intelligent Systems, 37(2):35–43, 2022
2022
-
[37]
Deep learning model inversion attacks and defenses: a comprehensive survey.Artificial Intelligence Review, 58(8):1–52, 2025
Wencheng Yang, Song Wang, Di Wu, Taotao Cai, Yanming Zhu, Shicheng Wei, Yiying Zhang, Xu Yang, Zhaohui Tang, and Yan Li. Deep learning model inversion attacks and defenses: a comprehensive survey.Artificial Intelligence Review, 58(8):1–52, 2025
2025
-
[38]
Privacy risk in machine learning: Analyzing the connection to overfitting
Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy risk in machine learning: Analyzing the connection to overfitting. In2018 IEEE 31st Computer Security Foundations Symposium (CSF), pages 268–282, 2018
2018
-
[39]
Curse or redemption? how data heterogeneity affects the robustness of federated learning
Syed Zawad, Ahsan Ali, Pin-Yu Chen, Ali Anwar, Yi Zhou, Nathalie Baracaldo, Yuan Tian, and Feng Yan. Curse or redemption? how data heterogeneity affects the robustness of federated learning. InProceedings of the AAAI conference on artificial intelligence, volume 35, pages 1080...
2021
-
[40]
A survey on class imbalance in federated learning
Jing Zhang, Chuanwen Li, Jianzgong Qi, and Jiayuan He. A survey on class imbalance in federated learning. arXiv preprint arXiv:2303.11673, 2023
2023 arXiv
-
[41]
Fldetector: Defending federated learning against model poisoning attacks via detecting malicious clients
Zaixi Zhang, Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. Fldetector: Defending federated learning against model poisoning attacks via detecting malicious clients. InProceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, KDD ’22, page 2545–2...
2022
-
[42]
Finp: Fairness-in-privacy in federated learning by addressing disparities in privacy risk.arXiv preprint arXiv:2502.17748, 2025
Tianyu Zhao, Mahmoud Srewa, and Salma Elmalaki. Finp: Fairness-in-privacy in federated learning by addressing disparities in privacy risk.arXiv preprint arXiv:2502.17748, 2025. 16
2025 arXiv
Reviewed August 4, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.