Pith. sign in

REVIEW 3 major objections 5 minor 36 references

On the Detectability of Active Gradient Inversion Attacks in Federated Learning

T0 review · 3 major / 5 minor · reviewed 2026-08-03 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Active gradient-inversion attacks claimed to be stealthy are detectable by the very clients they target.

desk verdict First systematic client-side detectability study of four active GIAs; solid detectors and broad evaluation for isolated attacks, but the conclusions overreach because the tested threat model only covers one-shot attacks with a trusted previous model. read the letter →

arxiv 2511.10502 v1 pith:T54EW26B submitted 2025-11-13 cs.CR cs.AI

Vincenzo Carletti , Pasquale Foggia , Carlo Mazzocca , Giuseppe Parrella , Mario Vento This is my paper · ORCID
classification cs.CRcs.AI
keywords federatedlearninggradientinversionattacksactiveserverclient-sidedetectionanomalymodelmanipulationprivacyleakagelossdynamics
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that four advanced active gradient-inversion attacks on federated learning—attacks where a malicious server manipulates the global model to reconstruct client data—are not actually stealthy. The authors propose client-side detection that requires no changes to the federated learning protocol: statistical inspection of linear-layer weights catches handcrafted attacks, while comparing per-sample loss distributions and gradient norms against the client's previous trusted model catches learned attacks. In cross-silo and cross-device simulations, true positive rates are near 1.0 in all tested configurations, with false positive rates near zero in most cases and a few small-setup exceptions (up to 0.34) that drop to about 0.04 under conservative thresholds. If the paper is right, clients can reliably detect these attacks in realistic deployments without trusting the server.

What carries the argument

The load-bearing mechanism is the client's retained copy of its own trained model from the previous FL round, used as a behavioral baseline. Three algorithms operate against that baseline: a static parameter analysis that computes neuron diversity, rank ratio, weight entropy, and bias anomaly scores for each linear layer; a loss-based analysis that compares per-sample loss distributions of the new and previous models; and a gradient-based analysis that compares the L2 norms of per-sample gradients. The divergence between the manipulated model's local behavior and the established behavior of the previous model is the signal that reveals the attack.

What would settle it

Run the three detection algorithms in a simulation where the malicious server tampers with the global model in every round, or gradually drifts the weights, with clients selected after irregular gaps; a collapse in true positive rate or an unacceptable false positive rate would falsify the central claim. Alternatively, construct an active gradient-inversion attack that keeps per-sample losses and gradient norms statistically indistinguishable from a benign round while still enabling data reconstruction; if clients fail to flag it, the paper's core claim is false.

Watch

Extended reading notes

Core claim

The paper's central claim is that the stealthiness of modern active gradient-inversion attacks is confined to the geometry of weights and gradients the attacker controls, but the attacks cannot hide the behavioral side effects of the manipulation. Using the locally trained model from the previous round as a trusted baseline, a client can detect (1) handcrafted attacks through statistically improbable weight structures—collapsed neuron diversity, rank-deficient weight matrices, low weight entropy, or structured biases—and (2) learned attacks through anomalous per-sample loss dynamics (spikes, tail growth, increased variability) and suppressed or collapsed L2 gradient norms. The paper reports

Load-bearing premise

The detection scheme relies on the client retaining a trustworthy, legitimate model from its most recent training round as the comparison baseline, and the paper only tests attacks that happen in an isolated round against that trusted baseline.

Editorial extensions

If this is right

  • Clients in standard federated learning deployments can detect all four active gradient-inversion attacks without modifying the training protocol or adding trust in the server.
  • Attackers working on active gradient-inversion attacks must now preserve behavioral consistency between the manipulated model and the previous round's model, not just avoid weight-space artifacts.
  • The detection logic is model- and dataset-agnostic, so it should extend to future learned attacks that manipulate input-to-gradient mappings.
  • The cost model is concrete: static analysis is negligible, loss analysis costs two forward passes, and gradient analysis costs two backward passes—the main practical cost for resource-limited clients.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper evaluates isolated attack rounds against a trusted previous-round model; whether detection still works when the server tampers in every round, or drifts weights gradually, remains an open question.
  • Large benign divergence from long client absence or non-IID data may overlap with the loss and gradient signals, so deployment would likely require per-setting threshold tuning.
  • The behavioral side-channel identified here suggests a testable next step: any future active attack that succeeds must either accept detectable behavioral divergence or find a way to preserve benign local behavior while still enabling data reconstruction.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper presents a client-side detection framework for active gradient inversion attacks (GIAs) in federated learning. It analyzes four attacks: two handcrafted (binning-based [14] and paired-weight [13]) and two learned (SEER [6] and Geminio [15]). The detection uses three algorithms: Algorithm 1 inspects weight/bias structure for improbable patterns; Algorithm 2 compares per-sample loss statistics between the current global model and the client's previously retained model; Algorithm 3 compares gradient-norm statistics between the two models. The authors evaluate across multiple datasets, models, and federated configurations, reporting near-perfect TPR and low FPR with an ROC/AUC sensitivity analysis. The central claim is that learned GIAs, despite claimed stealth, can be reliably detected by capturing behavioral side effects intrinsic to the attack logic.

Significance. If the central claim holds, this is a meaningful contribution to the GIA detectability literature. The paper is the first to systematically analyze four recent active GIAs from a client-side perspective, and it leverages official attack implementations, which strengthens reproducibility. The insight that behavioral divergence (loss and gradient-norm dynamics relative to a previously trusted model) can expose learned attacks is a useful alternative to static gradient-space metrics like D-SNR. However, the evaluation currently only covers isolated attack rounds with an otherwise honest server, which leaves a significant gap relative to the paper's own active-and-malicious threat model.

major comments (3)
  1. [Section 6 (Attack Implementation); Sections 3 and 5.3] The evaluation restricts the attacker to 'operates honestly except during designated attack rounds' (Section 6). Algorithms 2 and 3 compare the new model θ_t against θ_{t-1}, which Section 3 assumes to be a legitimate, trustworthy baseline. Under the paper's own threat model of a continuously malicious server, θ_{t-1} is itself attacker-controlled after the first attack round. For SEER's gradient-norm suppression, both θ_{t-1} and θ_t would exhibit suppressed norms, making the relative reductions r_norm and r_var small and B1–B3 unlikely to fire. For Geminio, the elevated spiky loss landscape would be present in both models, so r_ℓmax, r_p95, and r_CV would be near 1 and Algorithm 2 may not flag the attack. The reported perfect TPR is therefore an artifact of injecting isolated attacks into an otherwise honest trajectory. The claim in T-3 ('can successfully identify the learned GIAs') is
  2. [Table 3 (handcrafted GIA rows, Cross-Silo)] The standard parameter configuration yields average FPRs of 0.339 ± 0.165 and 0.243 ± 0.218 for the Shi et al. attack on CIFAR-10 and FMNIST. These are not 'very low rates' as stated in Section 7; a client would abort training on roughly one in three to one in four benign rounds, which is practically disruptive. The conservative configuration reduces FPR to 0.041/0.037, but the paper still reports the standard-configuration results as the primary outcome. Please present the FPR/TPR trade-off for each operating point explicitly, and discuss how an operator would select thresholds in practice without knowledge of the attack.
  3. [Table 2; Section 7 (Sensitivity Analysis)] All thresholds (τ_D, τ_H, τ_R, τ_B, τ_count, τ_lmax, τ_spikes, τ_p95, τ_cv, τ_gnorm, τ_gvar) are hand-set. The sensitivity analysis shows a good AUC (0.9741) under linear interpolation between the Conservative and Aggressive settings, but the paper does not provide a principled procedure for setting these thresholds on a given deployment (e.g., based on a benign calibration set). Since the detection decision is a hard OR/COUNT rule over many thresholds, the absence of a calibration methodology is a load-bearing gap for the claim of deployability. Please add a calibration procedure or a discussion of how the thresholds can be chosen by a real client.
minor comments (5)
  1. [Table 3] The 'Number of Runs' column reports values like '101.000 ±0.000' but the text says results are averaged over 10 runs; this appears to be a typo (10.000).
  2. [Section 7, first paragraph] The sentence 'all client-side detection algorithms (Algorithm 1, Algorithm 2, and Algorithm 2) were enabled' should read 'Algorithm 1, Algorithm 2, and Algorithm 3'.
  3. [Table 2] The formatting of several threshold entries is garbled (e.g., τ_spikes '0.510 −1 10−2', τ_gnorm '0.8 0.510 −5', τ_gvar '0.4 0.210 −5'). Please render these as proper numerical values.
  4. [Section 7 (Sensitivity Analysis)] The text says 'we report the analysis for the experimental setup that yielded the highest TPR values', but all TPR values are 1.0, so this is ambiguous. Clarify which configuration was chosen and why.
  5. [Appendix D] The first-round detection discussion assumes a random or publicly pretrained model as a legitimate baseline. This assumption is plausible for round 1 but the section also claims it covers 'the first time into an attack round' under partial participation; if the server has been malicious in prior rounds, the client's previous retained model is not legitimate. This should be reconciled with the continuous-attacker concern above.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the detection algorithms are signature-based detectors built from the cited attacks' own mechanisms and validated empirically on independent implementations; the trusted-θ_{t-1} assumption is a scope limitation, not a circular derivation.

full rationale

The paper's central claim is an empirical detection claim, not a predicted quantity derived from fitted inputs. Algorithm 1 checks for weight/bias structure (neuron diversity, rank ratio, entropy, bias anomaly) that directly reflects the transformation rules of the binning and paired-weight attacks (Eqs. 7 and 9) taken from the external attack papers [13], [14]; Algorithms 2 and 3 check for loss spikes and gradient-norm suppression that Section 5.3 explicitly says are 'drawn directly from the attack logic' of SEER [6] and Geminio [15]. That is standard signature-based detector design rather than a circular derivation: the attacks and their implementations are external, and the detectors are then evaluated across multiple datasets, models, FL configurations, benign rounds, and threshold settings, with TPR/FPR and ROC/AUC results backing the findings. The self-citation [4] is used only for background and research-gap framing and is not load-bearing for the detection results. The main weakness is scope, not circularity: Algorithms 2 and 3 compare against a 'previous trusted model' θ_{t-1}, and Section 6 tests only isolated attack rounds with an otherwise honest server; a continuously malicious server that poisons θ_{t-1} is not covered, and Appendix D acknowledges the difficulty when no trusted previous model exists. This limits generalization but does not reduce any claimed result to its own input by construction.

Assumptions & free parameters 13 free parameters · 4 assumptions · 0 invented entities

The central claim rests on hand-set detection thresholds and on the client's ability to compare against a trusted previous model. The experimental design assumes isolated attack rounds, not a continuously malicious server. First-round detection uses an ad hoc baseline that is not experimentally validated. These are the main 'unpaid' premises.

free parameters (13)
  • τ_D (neuron diversity threshold) = 1e-3 (standard)
    Hand-set threshold on mean pairwise Euclidean distance of neuron weight vectors; used in Algorithm 1, no calibration from benign distributions.
  • τ_H (weight entropy threshold) = 3.0 (standard)
    Hand-set threshold on discretized weight entropy; used in Algorithm 1, not derived from benign model statistics.
  • τ_R (rank ratio threshold) = 0.8 (standard)
    Hand-set threshold on rank(W)/min(n,d); flags rank-deficient weight matrices expected from handcrafted attacks.
  • τ_B (bias spacing threshold) = not reported
    Used in Algorithm 1 for regular-spacing bias check, but omitted from Table 2; value is unknown to the reader.
  • τ_count (minimum condition count) = 2
    Number of simultaneous conditions required to flag an anomaly in Algorithm 2; affects FPR/TPR tradeoff.
  • τ_lmax (max loss increase ratio) = 10.0 (standard)
    Threshold on ratio of max per-sample loss between new and previous model; used in Algorithm 2.
  • τ_mi (max increase threshold) = 10.0 (standard)
    Threshold on maximum loss increase in Algorithm 2; hand-set.
  • τ_spikes (distributed spikes ratio) = 0.1 (standard)
    Threshold on fraction of samples whose loss exceeds previous mean + 3σ; used in Algorithm 2.
  • τ_p95 (95th percentile increase ratio) = 3.0 (standard)
    Threshold on ratio of 95th percentile loss between new and previous model; used in Algorithm 2.
  • τ_cv (coefficient of variation ratio) = 1.5 (standard)
    Threshold on ratio of loss CV between new and previous model; used in Algorithm 2.
  • τ_gnorm (gradient norm reduction threshold) = 0.5 (standard, inferred from Table 2)
    Threshold on relative drop in mean gradient norm in Algorithm 3; hand-set.
  • τ_gvar (gradient norm variability reduction threshold) = 0.2 (standard, inferred from Table 2)
    Threshold on relative drop in gradient-norm standard deviation in Algorithm 3; hand-set.
  • entropy discretization bins = unspecified
    Algorithm 1 computes weight entropy H = -Σ p_i log p_i after discretization, but the number of bins is not specified. This is a hidden free parameter.
assumptions (4)
  • domain assumption Client retains and can compare against the previous global model θ_{t-1} from its most recent participating round (assumed benign).
    Needed for Algorithms 2/3; stated in Section 3 Threat Model and Appendix D.
  • domain assumption Server behaves honestly except during isolated attack rounds; the previous model is therefore a legitimate baseline.
    If the server manipulates every round or gradually drifts, the behavioral divergence signal weakens; this limitation is not analyzed.
  • domain assumption The client can compute per-sample losses and gradients over its entire local dataset in every round for detection.
    Algorithms 2/3 require two full forward/backward passes; assumed affordable and measured only on A100.
  • ad hoc to paper For first-round or first-selection detection, a random or public pre-trained model is a valid legitimate baseline.
    Introduced in Appendix D to handle missing θ_{t-1}; no experimental evaluation is reported for this scenario.

how reviews work

0 comments
Cite this review

Pith. "Pith review of On the Detectability of Active Gradient Inversion Attacks in Federated Learning." pith.science (2026). https://pith.science/paper/T54EW26B

@misc{pith2026251110502,
  author       = {Pith},
  title        = {Pith review of: On the Detectability of Active Gradient Inversion Attacks in Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/T54EW26B}},
  note         = {Machine review of arXiv:2511.10502}
}
read the original abstract

One of the key advantages of Federated Learning (FL) is its ability to collaboratively train a Machine Learning (ML) model while keeping clients' data on-site. However, this can create a false sense of security. Despite not sharing private data increases the overall privacy, prior studies have shown that gradients exchanged during the FL training remain vulnerable to Gradient Inversion Attacks (GIAs). These attacks allow reconstructing the clients' local data, breaking the privacy promise of FL. GIAs can be launched by either a passive or an active server. In the latter case, a malicious server manipulates the global model to facilitate data reconstruction. While effective, earlier attacks falling under this category have been demonstrated to be detectable by clients, limiting their real-world applicability. Recently, novel active GIAs have emerged, claiming to be far stealthier than previous approaches. This work provides the first comprehensive analysis of these claims, investigating four state-of-the-art GIAs. We propose novel lightweight client-side detection techniques, based on statistically improbable weight structures and anomalous loss and gradient dynamics. Extensive evaluation across several configurations demonstrates that our methods enable clients to effectively detect active GIAs without any modifications to the FL training protocol.

Figures

Figures reproduced from arXiv: 2511.10502 by the authors.

Figure 1
Figure 1. Graphical illustration of an active GIA workflow. [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Even passive adversaries can exploit this property [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 2
Figure 2. Graphical illustration of linear layer leakage. Ar [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figures from the paper (7 more)
Figure 3
Figure 3. Figure 3: Neuron diversity collapse visualized via 3D PCA. [PITH_FULL_IMAGE:figures/full_fig_p006_3.png]
Figure 4
Figure 4. Figure 4: Victim client local accuracy (64 samples) showing [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: 3D comparison of loss surfaces. The loss of a le [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: Comparison of L2 gradient norm surfaces. The plot contrasts the initial legitimate model (θt−1), shown as a solid pre-manipulation surface, with the wireframe surfaces representing a legitimate update (θt) and a manip￾ulated update (θ A t from Eqn. 12). 6. Experimental…
Figure 7
Figure 7. Figure 7: This indicates that the algorithms remain capable [PITH_FULL_IMAGE:figures/full_fig_p012_7.png]
Figure 7
Figure 7. Figure 7: ROC curve evaluating the detector’s performance [PITH_FULL_IMAGE:figures/full_fig_p013_7.png]
Figure 8
Figure 8. Figure 8: High-level model architecture of machine-learning [PITH_FULL_IMAGE:figures/full_fig_p015_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

36 extracted references · 5 linked inside Pith

  1. [14]

    Scale-mia: A scalable model inversion attack against secure federated learning via latent space reconstruction,

    S. Shi, N. Wang, Y . Xiao, C. Zhang, Y . Shi, Y . T. Hou, and W. J. Lou, “Scale-mia: A scalable model inversion attack against secure federated learning via latent space reconstruction,” in32nd Annual Network and Distributed System Security Symposium, NDSS, 2025

    2025

  2. [13]

    Maximum knowledge orthogonality reconstruction with gradients in federated learning,

    F. Wang, S. Velipasalar, and M. C. Gursoy, “Maximum knowledge orthogonality reconstruction with gradients in federated learning,” in2024 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), 2024, pp. 3872–3881

    2024

  3. [6]

    Hiding in plain sight: Disguising data stealing attacks in federated learning,

    K. Garov, D. I. Dimitrov, N. Jovanovi ´c, and M. Vechev, “Hiding in plain sight: Disguising data stealing attacks in federated learning,” in The Twelfth International Conference on Learning Representations, ICLR 2024, 2024

    2024

  4. [15]

    Geminio: Language-guided gradient inversion attacks in federated learning,

    J. Shan, Z. Zhao, J. Lu, R. Zhang, S. M. Yiu, and K.-H. Chow, “Geminio: Language-guided gradient inversion attacks in federated learning,” inInternational Conference on Computer Vision, 2025

    2025

  5. [1]

    When machine learning meets privacy: A survey and outlook,

    B. Liu, M. Ding, S. Shaham, W. Rahayu, F. Farokhi, and Z. Lin, “When machine learning meets privacy: A survey and outlook,”ACM Comput. Surv., vol. 54, no. 2, Mar. 2021

    2021

  6. [2]

    Communication-efficient learning of deep networks from decentral- ized data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentral- ized data,” inArtificial intelligence and statistics. PMLR, 2017, pp. 1273–1282

    2017

  7. [3]

    Decentralised Learning in Federated Deployment Environments: A System-Level Survey,

    P. Bellavista, L. Foschini, and A. Mora, “Decentralised Learning in Federated Deployment Environments: A System-Level Survey,”ACM Computing Surveys (CSUR), vol. 54, no. 1, pp. 1–38, 2021

    2021

  8. [4]

    Sok: Gradient inversion attacks in federated learning,

    V . Carletti, P. Foggia, C. Mazzocca, G. Parrella, and M. Vento, “Sok: Gradient inversion attacks in federated learning,” in34th USENIX Security Symposium (USENIX Security 25). USENIX Association, 2025, pp. 6439–6459. [Online]. Available: https: //www.usenix.org/conference/usenixsecurity25/presentation/carletti

    2025

Show all 36 references
  1. [5]

    Sok: Gradient leakage in federated learning,

    J. Du, J. Hu, Z. Wang, P. Sun, N. Z. Gong, and K. Ren, “Sok: Gradient leakage in federated learning,” in34rd USENIX Security Symposium (USENIX Security 25), 2025

    2025

  2. [7]

    Hear no evil: Detecting gradient leakage by mali- cious servers in federated learning,

    F. Wang and B. Li, “Hear no evil: Detecting gradient leakage by mali- cious servers in federated learning,”arXiv preprint arXiv:2506.20651, 2025

    2025 arXiv

  3. [8]

    Robbing the fed: Directly obtaining private data in federated learning with modified models

    L. H. Fowl, J. Geiping, W. Czaja, M. Goldblum, and T. Goldstein, “Robbing the fed: Directly obtaining private data in federated learning with modified models.” inICLR. OpenReview.net, 2022

    2022

  4. [9]

    Loki: Large-scale data reconstruction attack against federated learning through model manipulation,

    J. C. Zhao, A. Sharma, A. R. Elkordy, Y . H. Ezzeldin, S. Avestimehr, and S. Bagchi, “Loki: Large-scale data reconstruction attack against federated learning through model manipulation,” in2024 IEEE Sym- posium on Security and Privacy (SP). IEEE, 2024, pp. 1287–1305

    2024

  5. [10]

    Fishing for user data in large-batch federated learning via gradient magnification,

    Y . Wen, J. A. Geiping, L. Fowl, M. Goldblum, and T. Goldstein, “Fishing for user data in large-batch federated learning via gradient magnification,” inInternational Conference on Machine Learning. PMLR, 2022, pp. 23 668–23 684

    2022

  6. [11]

    When the curious abandon honesty: Fed- erated learning is not private,

    F. Boenisch, A. Dziedzic, R. Schuster, A. S. Shamsabadi, I. Shu- mailov, and N. Papernot, “When the curious abandon honesty: Fed- erated learning is not private,” in2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P). IEEE, 2023, pp. 175–199

    2023

  7. [12]

    Reconstructing individual data points in federated learning hardened with differential privacy and secure aggregation,

    ——, “Reconstructing individual data points in federated learning hardened with differential privacy and secure aggregation,” in2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P). IEEE, 2023, pp. 241–257

    2023

  8. [16]

    Deep leakage from gradients,

    L. Zhu, Z. Liu, and S. Han, “Deep leakage from gradients,”Advances in neural information processing systems, vol. 32, 2019

    2019

  9. [17]

    Inverting gradients - how easy is it to break privacy in federated learning?

    J. Geiping, H. Bauermeister, H. Dr ¨oge, and M. Moeller, “Inverting gradients - how easy is it to break privacy in federated learning?” in Proceedings of the 34th International Conference on Neural Infor- mation Processing Systems, ser. NIPS ’20. Red Hook, NY , USA: Curran Ass...

    2020

  10. [18]

    Flower: A friendly federated learning research framework,

    D. J. Beutel, T. Topal, A. Mathur, X. Qiu, J. Fernandez-Marques, Y . Gao, L. Sani, K. H. Li, T. Parcollet, P. P. B. De Gusm ˜aoet al., “Flower: A friendly federated learning research framework,”arXiv preprint arXiv:2007.14390, 2020

    2007 arXiv

  11. [19]

    Measuring the effects of non- identical data distribution for federated visual classification,

    T.-M. H. Hsu, H. Qi, and M. Brown, “Measuring the effects of non- identical data distribution for federated visual classification,”arXiv preprint arXiv:1909.06335, 2019

    1909 arXiv

  12. [20]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky, G. Hintonet al., “Learning multiple layers of features from tiny images,” 2009

    2009

  13. [21]

    Imagenet: A large-scale hierarchical image database,

    J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “Imagenet: A large-scale hierarchical image database,” in2009 IEEE conference on computer vision and pattern recognition. Ieee, 2009, pp. 248–255

    2009

  14. [22]

    The mnist database of handwritten digit images for machine learning research [best of the web],

    L. Deng, “The mnist database of handwritten digit images for machine learning research [best of the web],”IEEE Signal Processing Magazine, vol. 29, pp. 141–142, 2012. [Online]. Available: https://api.semanticscholar.org/CorpusID:5280072

    2012

  15. [23]

    Fashion-mnist: a novel im- age dataset for benchmarking machine learning algorithms,

    H. Xiao, K. Rasul, and R. V ollgraf, “Fashion-mnist: a novel im- age dataset for benchmarking machine learning algorithms,”arXiv preprint arXiv:1708.07747, 2017

    2017 arXiv

  16. [24]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” inProceedings of the IEEE conference on computer vision and pattern recognition, 2016, pp. 770–778

    2016

  17. [25]

    Gradient-based learning applied to document recognition,

    Y . LeCun, L. Bottou, Y . Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,”Proceedings of the IEEE, vol. 86, no. 11, pp. 2278–2324, 2002

    2002

  18. [26]

    Very deep convolutional networks for large-scale image recognition,

    K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,”arXiv preprint arXiv:1409.1556, 2014

    2014 arXiv

  19. [27]

    The resource problem of using linear layer leak- age attack in federated learning,

    J. C. Zhao, A. R. Elkordy, A. Sharma, Y . H. Ezzeldin, S. Avestimehr, and S. Bagchi, “The resource problem of using linear layer leak- age attack in federated learning,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 3974–3983. E...

    2023

  20. [28]

    CIFAR-100 [20] ResNet18 [24] 31.000 ±0.000 0.005±0.009

  21. [29]

    CIFAR-10 [20] ResNet18 [24] 31.000 ±0.000 0.000±0.000

  22. [30]

    Tiny-ImageNet [21] ResNet18 [24] 31.000 ±0.000 0.000±0.000

  23. [32]

    CIFAR-10 [20] ResNet34 [24] 31.000 ±0.000 0.000±0.000

  24. [33]

    Tiny-ImageNet [21] ResNet34 [24] 31.000 ±0.000 0.228±0.106 Cross-Device (100 clients)

  25. [34]

    CIFAR-100 [20] ResNet18 [24] 31.000 ±0.000 0.017±0.020

  26. [35]

    CIFAR-10 [20] ResNet18 [24] 31.000 ±0.000 0.004±0.002

  27. [36]

    CIFAR-100 [20] ResNet34 [24] 31.000 ±0.000 0.000±0.000

  28. [37]

    All experiments simulate an IID data distribution

    CIFAR-10 [20] ResNet34 [24] 31.000 ±0.000 0.000±0.000 TABLE 5: Summary of analyzed experiment configurations and detection results. All experiments simulate an IID data distribution. TPR/FPR values are averaged across several runs and presented asmean ±std. In each run, 20% of...

Pith tools

Reviewed August 3, 2026 · model on record in the stance chip above.