Pith. sign in

REVIEW 4 major objections 5 minor 67 references

A client-side detect-and-purify pipeline lifts adversarial accuracy on brain MRI from 49.5% to 87.3% while preserving clean accuracy.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 23:31 UTC pith:ZAZAZ4TC

load-bearing objection Integration of MAE detection and diffusion purification into personalized FL is new, but the headline robustness number is against a defense-unaware PGD attack and needs a heavier evaluation before it can be trusted. the 4 major comments →

arxiv 2511.11625 v2 pith:ZAZAZ4TC submitted 2025-11-07 cs.LG cs.AIcs.CR

MedFedPure: A Medical Federated Framework with MAE-based Detection and Diffusion Purification for Inference-Time Attacks

Mohammad Karami , Mohammad Reza Nemati , Aidin Kazemi , Ali Mikaeili Barzili , Hamid Azadegan , Behzad Moshiri This is my paper
classification cs.LG cs.AIcs.CR
keywords adversarial robustnessfederated learningmedical imagingbrain tumor detectionmasked autoencoderdiffusion purificationinference-time attackpersonalized federated learning
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

MedFedPure aims to protect federated medical classifiers against inference-time adversarial attacks without centralizing data or degrading normal-image accuracy. The paper argues that a three-stage client-side pipeline—a masked autoencoder that flags suspicious scans, an adaptive diffusion process that cleans only flagged inputs, and a personalized mixture-of-experts classifier—can neutralize bounded PGD perturbations. On the Br35H brain MRI benchmark, the authors report adversarial accuracy rising from 49.50% to 87.33% under an ℓ∞ PGD attack while clean accuracy remains 97.67%. If correct, this indicates that test-time defenses can be effective in decentralized, heterogeneous medical settings, where training-time robustness methods are costly and accuracy-degrading.

Core claim

On the Br35H brain MRI dataset, MedFedPure claims to raise adversarial accuracy from 49.50% (a personalized federated defense baseline) to 87.33% under a 7-step ℓ∞ PGD attack with perturbation budget 0.015, while clean accuracy stays effectively flat at 97.67%. The mechanism is a client-side pipeline: a Masked Autoencoder trained on benign images flags inputs whose per-patch reconstruction error sits in the top 18% of the score distribution; only those flagged inputs are passed through a diffusion-based purifier, whose reverse-denoising depth is scaled by the detector's confidence; the purified image is then classified by a personalized mixture-of-experts network. Because the defense runs lo

What carries the argument

The load-bearing object is the detection-gated purification loop. The Masked Autoencoder (MAE)—a Transformer-based reconstructor trained only on clean scans—computes a per-patch mean-squared-error reconstruction score; any input whose score falls in the top κ% is treated as adversarial (κ=18% on Br35H). Flagged inputs are run through a U-Net diffusion model that executes a partial reverse diffusion process: the perturbation is degraded by forward noising and then reconstructed back toward the clean-data manifold, with the number of timesteps increasing with the detector's confidence. The final classification comes from a personalized ensemble of three residual networks gated by an input-depe

Load-bearing premise

The reported robustness rests on two assumptions: the attacker optimizes against the classifier alone rather than the full defense pipeline, and adversarial inputs reliably rank in the top fraction of MAE reconstruction errors—the paper's future-work section acknowledges adaptive attacks remain open, so both premises are untested against an adaptive adversary.

What would settle it

Run a PGD attack with the same ε=0.015 that maximizes classifier loss while minimizing MAE reconstruction error (or backpropagates through the full pipeline) and measure Br35H adversarial accuracy; a large drop below 87.33% would show the defense's threat model is the load-bearing assumption. Also count how many successful adversarial images fall below the 18% reconstruction-error threshold—if a substantial share avoid the top quantile, the detector is not flagging the attacks the defense claims to neutralize.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Federated medical deployments can add inference-time protection without changing the training protocol or sending raw data to a server, addressing regulatory constraints at the point of diagnosis.
  • Adaptive purification depth creates a tunable robustness–fidelity knob: clinicians can shift the detection threshold to favor fewer altered benign scans or stronger adversarial suppression.
  • The defense operates on the client model, so each institution's personalized classifier is protected independently, avoiding a uniform filter that could penalize atypical local data distributions.
  • Because the same pipeline improved robustness on both CIFAR-10 and a 224×224 brain MRI dataset, the design is not tied to one image domain, though retraining the MAE and diffusion components per domain is required.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • An adaptive adversary who runs PGD end-to-end through the detector and purifier—or adds a penalty that keeps MAE reconstruction error low—would likely puncture the reported 87.33%; the paper's future-work section acknowledges adaptive attacks remain open, so this is the first stress test to run.
  • The rank-based detector flags the top 18% of reconstruction scores on Br35H, which implies a nonzero fraction of benign scans are purified; the paper does not report how often clean images are altered or what that does to diagnostic confidence.
  • If the true goal is clinical deployment, the threshold κ should be chosen per hospital using its own benign-image score distribution; otherwise a site with unusual acquisition protocols may see most of its normal scans purified.
  • The architecture suggests a natural extension to other modalities (CT, histopathology, multi-sequence MRI), but the MAE and diffusion models are dataset-specific, so the transfer requires new pretraining rather than plug-and-play reuse.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper presents MedFedPure, a client-side inference-time defense for federated medical image classification. It combines a pFedDef-style personalized mixture-of-experts classifier, a Masked Autoencoder (MAE) detector that flags inputs by top-κ% reconstruction error, and a diffusion-based purifier applied only to flagged inputs. Experiments on Br35H and CIFAR-10 under PGD attacks report large robustness gains (e.g., Br35H adversarial accuracy from 49.50% to 87.33% at 97.67% clean accuracy) relative to pFedDef. The paper concludes that the framework preserves diagnostic reliability under strong adversarial interference.

Significance. If the reported numbers survive a proper threat-model evaluation, the paper would make a practical contribution: a test-time defense that fits inside federated client deployment, preserves privacy, and avoids clean-accuracy loss. The modular design is clearly stated and uses standard, reproducible building blocks. The main limitation is evaluation: the only attack is classifier-only PGD, with no adaptive attacks through the defense, no detector statistics, and no confidence intervals. Thus the magnitude of the claimed improvement is not yet established. I found no internal logical inconsistency in the pipeline; the concern is external validity of the robustness claim.

major comments (4)
  1. [IV.D / Eq. (3)] The robustness numbers in Tables I and II are measured against PGD defined in Eq. (3), which optimizes only the classifier loss l(f_theta(x_adv), y). The MAE detector and diffusion purifier are never included in the attack optimization. Because the defense physically modifies inputs before classification, a white-box adversary for the deployed system would be able to attempt detector evasion or purification-survival. Therefore the reported 87.33% Br35H adversarial accuracy is an upper bound for a defense-unaware adversary, not a property of MedFedPure. The Future Work section (Section VI) explicitly lists adaptive attacks as open, but the abstract and conclusion describe 'strong attacks' and 'neutralized.' Please add BPDA/surrogate-gradient attacks through the full pipeline, or at minimum an adaptive attack that optimizes against the detector score, and report both detection-aware attack
  2. [III.B.3, Table II] The detector's operating point is chosen post hoc: kappa=5% on CIFAR-10 and 18% on Br35H, described as selected from the empirical reconstruction-error distribution. The paper never reports how many adversarial inputs are actually in the flagged set, nor the clean false-positive rate, nor an ROC/AUC curve. If adversarial inputs are not concentrated in the top-kappa% quantile, the selective-purification stage is not doing the work attributed to it. The percentile selection on the same dataset/test distribution can also leak information into the final accuracy. Please report detection confusion matrices for the exact PGD setting, and an ablation over kappa or over a threshold on s_det.
  3. [III.C] The adaptive purification depth is central to the method but formally unspecified. Section III.C states that 'the purification depth is adaptively determined from s_det(x)' and that stronger denoising is applied to 'heavily perturbed inputs,' but no mapping from s_det to the number of diffusion timesteps is given, and Algorithm 3 only calls DiffusionPurify(x) once the threshold is exceeded. Without this mapping the adaptive component is not reproducible and the tables cannot be interpreted. Please define the mapping, the step-count schedule, and report the distribution of steps used in the experiments.
  4. [IV.D / Tables I and II] The experimental section claims comparison with a 'comprehensive set of state-of-the-art test-time defenses,' but only pFedDef is compared. The related-work defenses (STRIP, TeCo, NAB, ZIP, MAE-repair) are not evaluated. In addition, every accuracy number is a single point estimate; there are no standard deviations, confidence intervals, or repeated runs, and the Br35H data split among the 10 clients is not described. For a paper whose headline is a quantitative robustness gain, this level of statistical reporting is insufficient. Please provide repeated-trial statistics, describe the federated data partition, and include at least one non-federated test-time defense as an upper-bound reference.
minor comments (5)
  1. [General] No code availability or reproducibility statement is provided. Given the number of components (MAE, diffusion U-Net, personalized FL), a code release or detailed hyperparameter appendix would be needed for the results to be actionable.
  2. [III.B.3 / III.C] The fixed threshold tau used in the pipeline description is inconsistent with the rank-based top-kappa mechanism actually adopted. Please reconcile the notation and specify how tau, if used, relates to the percentile.
  3. [IV.B] There is a typo: 'MoblieNetV2' should be 'MobileNetV2'.
  4. [Algorithm 3] The local update uses 'the gradient of L_client,' but L_client is never defined; Eq. (9) gives L_i. Please define this symbol explicitly.
  5. [References] Reference [37] appears incomplete (no year/venue), and several self-citations are only arXiv preprints without a DOI. Please update.

Circularity Check

0 steps flagged

No significant circularity: robustness numbers are empirical measurements under an explicitly stated non-adaptive PGD threat model.

full rationale

MedFedPure makes no derivation claim that reduces to its inputs. The core results (Br35H: 49.50% to 87.33% adversarial accuracy; CIFAR-10 gains) are empirical accuracies defined in Eq. (24) and obtained by running the PGD procedure of Eq. (3) against the classifier only, then passing attacked inputs through the learned MAE detector (Eq. (22)) and diffusion purifier (Eq. (15)). None of these quantities is defined in terms of the final accuracy: the MAE is trained with the reconstruction loss of Eq. (21) on benign samples, the diffusion model with Eq. (16), and the classifier with Eq. (9). The accuracy numbers are measurements, not solved-for outputs of fitted parameters. The rank-based detector percentile (kappa = 5%/18%) is a calibrated hyperparameter, not a fitted parameter renamed as a prediction; it does not by construction determine the reported adversarial accuracy. Self-citations are present (e.g., Refs. [22], [31], [34], [37], [54]), but they support background claims about FL privacy/robustness and client-side defenses and are not load-bearing for the central empirical comparison, which is against external baselines pFedDef and FedAvg. The paper's own Future Work states: "Broader threat modeling is needed to encompass adaptive attacks, backdoor triggers, model inversion, and membership inference... Designing defenses that can withstand coordinated and adaptive adversaries remains an open challenge." This is a genuine evaluation limitation of the threat model, not a circularity, because Eq. (3) explicitly defines the attack used and the paper does not claim otherwise in its derivation. Therefore no circular step can be exhibited, and the honest finding is no significant circularity.

Axiom & Free-Parameter Ledger

3 free parameters · 4 axioms · 0 invented entities

The paper introduces no new physical or conceptual entity; it relies on the manifold hypothesis, a non-adaptive threat model, and per-dataset threshold fitting. The main unspecified choice is the adaptive purification depth, which is a free parameter in practice even though it is motivated qualitatively.

free parameters (3)
  • k (flagging percentile) = k=5% (CIFAR-10), k=18% (Br35H)
    Chosen from reconstruction-error distribution per dataset; sets false-positive rate by construction and directly affects which inputs are purified.
  • Adaptive purification depth mapping = not specified
    Paper says number of diffusion timesteps is determined by detection confidence but never gives the mapping; this controls the clean-vs-robust tradeoff.
  • Regularization coefficients beta, gamma (Eq. 9) = not reported
    Entropy and L2 regularization on attention weights affect pFedDef training and final clean/robust accuracy, but values are not reported.
axioms (4)
  • domain assumption Adversarial inputs lie off the benign data manifold and therefore produce larger MAE reconstruction errors.
    Central to the detector; asserted in Section III.B.3 with no ROC, detection-rate, or false-positive analysis.
  • ad hoc to paper The top-k% of MAE reconstruction errors are adversarial samples.
    Rank-based criterion in Section III.B.3; k is set per dataset from the empirical error distribution, and detection performance on actual adversarial examples is not reported.
  • domain assumption PGD attack is non-adaptive: it optimizes only the classifier loss, not the full detector+purifier+classifier pipeline.
    Threat model in Section III.A.2 and evaluation in Section IV.D; Future Work acknowledges adaptive attacks remain open.
  • domain assumption Diffusion reverse process trained on clean data maps adversarial images back onto the benign manifold.
    Standard diffusion-purification assumption from prior work [51, 62], inherited in Section III.B.2.

pith-pipeline@v1.3.0-alltime-deepseek · 15870 in / 12541 out tokens · 106848 ms · 2026-08-03T23:31:19.198119+00:00 · methodology

0 comments
read the original abstract

Artificial intelligence (AI) has shown great potential in medical imaging, particularly for brain tumor detection using Magnetic Resonance Imaging (MRI). However, the models remain vulnerable at inference time when they are trained collaboratively through Federated Learning (FL), an approach adopted to protect patient privacy. Adversarial attacks can subtly alter medical scans in ways invisible to the human eye yet powerful enough to mislead AI models, potentially causing serious misdiagnoses. Existing defenses often assume centralized data and struggle to cope with the decentralized and diverse nature of federated medical settings. In this work, we present MedFedPure, a personalized federated learning defense framework designed to protect diagnostic AI models at inference time without compromising privacy or accuracy. MedFedPure combines three key elements: (1) a personalized FL model that adapts to the unique data distribution of each institution; (2) a Masked Autoencoder (MAE) that detects suspicious inputs by exposing hidden perturbations; and (3) an adaptive diffusion-based purification module that selectively cleans only the flagged scans before classification. Together, these steps offer robust protection while preserving the integrity of normal, benign images. We evaluated MedFedPure on the Br35H brain MRI dataset. The results show a significant gain in adversarial robustness, improving performance from 49.50% to 87.33% under strong attacks, while maintaining a high clean accuracy of 97.67%. By operating locally and in real time during diagnosis, our framework provides a practical path to deploying secure, trustworthy, and privacy-preserving AI tools in clinical workflows. Index Terms: cancer, tumor detection, federated learning, masked autoencoder, diffusion, privacy

Figures

Figures reproduced from arXiv: 2511.11625 by Aidin Kazemi, Ali Mikaeili Barzili, Behzad Moshiri, Hamid Azadegan, Mohammad Karami, Mohammad Reza Nemati.

Figure 1
Figure 1. Figure 1: Federated learning overview in our setting: each site [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Overview of the proposed federated defense framework. (a) Overall architecture with FedAvg; (b) client workflow [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Convergence of clean and adversarial accuracy across [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

67 extracted references · 9 canonical work pages

  1. [1]

    2025.URL: https: //www.who.int/news-room/fact-sheets/detail/cancer

    World Health Organization.Cancer. 2025.URL: https: //www.who.int/news-room/fact-sheets/detail/cancer. 10

    2025

  2. [2]

    International patterns and trends in the brain cancer incidence and mortality: An observational study based on the global burden of disease

    Irena Ilic and Milena Ilic. “International patterns and trends in the brain cancer incidence and mortality: An observational study based on the global burden of disease”. In:Heliyon9.7 (July 2023).ISSN: 2405-8440. DOI: 10.1016/j.heliyon.2023.e18222.URL: https://doi. org/10.1016/j.heliyon.2023.e18222

    work page doi:10.1016/j.heliyon.2023.e18222.url: 2023

  3. [3]

    Brain tumor detection and screening using artificial intelligence techniques: Cur- rent trends and future perspectives

    U Raghavendra et al. “Brain tumor detection and screening using artificial intelligence techniques: Cur- rent trends and future perspectives”. en. In:Comput. Biol. Med.163.107063 (Sept. 2023), p. 107063

    2023

  4. [4]

    A review on brain tumor diagnosis from MRI images: Practical impli- cations, key achievements, and lessons learned

    Mahmoud Khaled Abd-Ellah et al. “A review on brain tumor diagnosis from MRI images: Practical impli- cations, key achievements, and lessons learned”. In: Magnetic Resonance Imaging61 (2019), pp. 300–318. ISSN: 0730-725X.DOI: https://doi.org/10.1016/j.mri. 2019 . 05 . 028.URL: https : / / www. sciencedirect . com / science/article/pii/S0730725X18304302

    work page doi:10.1016/j.mri 2019

  5. [5]

    Multiple- Point Metamaterial-Inspired Microwave Sensors for Early-Stage Brain Tumor Diagnosis

    Nantakan Wongkasem and Gabriel Cabrera. “Multiple- Point Metamaterial-Inspired Microwave Sensors for Early-Stage Brain Tumor Diagnosis”. In:Sensors24.18 (2024).ISSN: 1424-8220.DOI: 10 . 3390 / s24185953. URL: https://www.mdpi.com/1424-8220/24/18/5953

    2024

  6. [6]

    A Comprehen- sive Systematic Review of MRI Techniques for the Early Detection of Brain Tumors: Clinical Implications and Diagnostic Accuracy

    Arwan Firmansyah and Arya Utama. “A Comprehen- sive Systematic Review of MRI Techniques for the Early Detection of Brain Tumors: Clinical Implications and Diagnostic Accuracy”. In:The International Jour- nal of Medical Science and Health Research4.3 (Sept. 2024), pp. 1–19.DOI: 10.70070/y3bchb22.URL: https: / / internationalmedicaljournal . org / index . p...

    work page doi:10.70070/y3bchb22.url: 2024

  7. [7]

    An early detection and segmen- tation of Brain Tumor using Deep Neural Network

    Mukul Aggarwal et al. “An early detection and segmen- tation of Brain Tumor using Deep Neural Network”. In: BMC Medical Informatics and Decision Making23.1 (Apr. 2023), p. 78.ISSN: 1472-6947.DOI: 10 . 1186 / s12911- 023- 02174- 8.URL: https://doi.org/10.1186/ s12911-023-02174-8

    2023

  8. [8]

    Brain Tumor Segmentation Using 2D-UNET Convolu- tional Neural Network

    Khushboo Munir, Fabrizio Frezza, and Antonello Rizzi. “Brain Tumor Segmentation Using 2D-UNET Convolu- tional Neural Network”. In:Deep Learning for Cancer Diagnosis. Ed. by Utku Kose and Jafar Alzubi. Sin- gapore: Springer Singapore, 2021, pp. 239–248.ISBN: 978-981-15-6321-8.DOI: 10.1007/978-981-15-6321- 8 14.URL: https://doi.org/10.1007/978-981-15-6321- 8 14

    work page doi:10.1007/978-981-15-6321- 2021

  9. [9]

    Deep Learning for Brain Tumor Segmentation

    Khushboo Munir, Fabrizio Frezza, and Antonello Rizzi. “Deep Learning for Brain Tumor Segmentation”. In: Deep Learning for Cancer Diagnosis. Ed. by Utku Kose and Jafar Alzubi. Singapore: Springer Singapore, 2021, pp. 189–201.ISBN: 978-981-15-6321-8.DOI: 10.1007/ 978-981-15-6321-8 11.URL: https://doi.org/10.1007/ 978-981-15-6321-8 11

    2021

  10. [10]

    2021.DOI: 10.3390/brainsci11030352

    Isselmou Abd El Kader et al.Differential Deep Con- volutional Neural Network Model for Brain Tumor Classification. 2021.DOI: 10.3390/brainsci11030352. URL: https://doi.org/10.3390/brainsci11030352

    work page doi:10.3390/brainsci11030352 2021

  11. [11]

    Attention- Based Segmentation of Brain Tumors Using Feature Level Fusion and UNet Architecture

    Ali Mikaeili Barzili and Behzad Moshiri. “Attention- Based Segmentation of Brain Tumors Using Feature Level Fusion and UNet Architecture”. In:2025 Fifth National and the First International Conference on Applied Research in Electrical Engineering (AREE). 2025, pp. 1–6.DOI: 10 . 1109 / AREE63378 . 2025 . 10880261

    2025

  12. [12]

    Ahmed Hamada.Br35H :: Brain Tumor Detection

  13. [13]

    Computer-Aided Brain Tumor Di- agnosis: Performance Evaluation of Deep Learner CNN Using Augmented Brain MRI

    Asma Naseer et al. “Computer-Aided Brain Tumor Di- agnosis: Performance Evaluation of Deep Learner CNN Using Augmented Brain MRI”. In:International Jour- nal of Biomedical Imaging2021.1 (2021), p. 5513500. DOI: https : / / doi . org / 10 . 1155 / 2021 / 5513500. eprint: https://onlinelibrary.wiley.com/doi/pdf/10.1155/2021/ 5513500.URL: https://onlinelibra...

    doi:10.1155/2021/ 2021

  14. [14]

    Brain Tumor Detection Using Convolutional Neural Network

    Falak Chhatre et al. “Brain Tumor Detection Using Convolutional Neural Network”. In:J. Stud. Res12 (2023)

    2023

  15. [15]

    Md Ashik Khan and Rafath Bin Zafar Auvee.Compar- ative Analysis of Resource-Efficient CNN Architectures for Brain Tumor Classification. 2024. arXiv: 2411 . 15596[eess.IV].URL: https://arxiv.org/abs/2411. 15596

    2024

  16. [16]

    Brain Tumor Detec- tion and Localization with YOLOv8

    Burcu Selcuk and Tacha Serif. “Brain Tumor Detec- tion and Localization with YOLOv8”. In:2023 8th International Conference on Computer Science and Engineering (UBMK). 2023, pp. 477–481.DOI: 10 . 1109/UBMK59864.2023.10286729

    arXiv 2023

  17. [17]

    Federated learning for predicting clinical outcomes in patients with COVID-19

    Ittai Dayan et al. “Federated learning for predicting clinical outcomes in patients with COVID-19”. In:Na- ture Medicine27.10 (Oct. 2021), pp. 1735–1743.ISSN: 1546-170X.DOI: 10.1038/s41591-021-01506-3.URL: https://doi.org/10.1038/s41591-021-01506-3

    work page doi:10.1038/s41591-021-01506-3.url: 2021

  18. [18]

    A review of applications in federated learning

    Li Li et al. “A review of applications in federated learning”. In:Computers & Industrial Engineering149 (2020), p. 106854.ISSN: 0360-8352.DOI: https : / / doi . org / 10 . 1016 / j . cie . 2020 . 106854.URL: https : / / www . sciencedirect . com / science / article / pii / S0360835220305532

    2020

  19. [19]

    Communication-Efficient Learning of Deep Networks from Decentralized Data

    Brendan McMahan et al. “Communication-Efficient Learning of Deep Networks from Decentralized Data”. In:Proceedings of the 20th International Conference on Artificial Intelligence and Statistics. Ed. by Aarti Singh and Jerry Zhu. V ol. 54. Proceedings of Machine Learn- ing Research. PMLR, 20–22 Apr 2017, pp. 1273–1282. URL: https://proceedings.mlr.press/v5...

    2017

  20. [20]

    The Impact of Ad- versarial Attacks on Federated Learning: A Survey

    Kummari Naveen Kumar, Chalavadi Krishna Mohan, and Linga Reddy Cenkeramaddi. “The Impact of Ad- versarial Attacks on Federated Learning: A Survey”. In: IEEE Transactions on Pattern Analysis and Machine Intelligence46.5 (2024), pp. 2672–2691.DOI: 10.1109/ TPAMI.2023.3322785

    arXiv 2024

  21. [21]

    Federated Machine Learning: Con- cept and Applications

    Qiang Yang et al. “Federated Machine Learning: Con- cept and Applications”. In:ACM Trans. Intell. Syst. Technol.10.2 (Jan. 2019).ISSN: 2157-6904.DOI: 10. 1145/3298981.URL: https://doi.org/10.1145/3298981. 11

    doi:10.1145/3298981 2019

  22. [22]

    A survey on data distribution challenges and solutions in vertical and horizontal federated learning

    Khalil Jahani, Behzad Moshiri, and Babak Hossein Khalaj. “A survey on data distribution challenges and solutions in vertical and horizontal federated learning”. In:Journal of Artificial Intelligence, Applications and Innovations1.2 (2024), pp. 55–71

    2024

  23. [23]

    Federated Multi-Task Learning

    Virginia Smith et al. “Federated Multi-Task Learning”. In:Advances in Neural Information Processing Systems. Ed. by I. Guyon et al. V ol. 30. Curran Associates, Inc., 2017.URL: https://proceedings.neurips.cc/paper files/ paper/2017/file/6211080fa89981f66b1a0c9d55c61d0f- Paper.pdf

    arXiv 2017

  24. [24]

    A Federated Learning Based Privacy- Preserving Smart Healthcare System

    Jiachun Li et al. “A Federated Learning Based Privacy- Preserving Smart Healthcare System”. In:IEEE Trans- actions on Industrial Informatics18.3 (2022), pp. 2021– 2031.DOI: 10.1109/TII.2021.3098010

    arXiv 2022

  25. [25]

    Distributed Federated Learning-Based Deep Learning Model for Privacy MRI Brain Tumor Detection

    Lisang Zhou, Meng Wang, and Ning Zhou. “Distributed Federated Learning-Based Deep Learning Model for Privacy MRI Brain Tumor Detection”. In:Journal of Information, Technology and Policy(Dec. 2023), pp. 1– 12.DOI: 10.62836/jitp.2023.158

    work page doi:10.62836/jitp.2023.158 2023

  26. [26]

    Integrated approach of federated learning with transfer learning for classification and diagnosis of brain tumor

    Eid Albalawi et al. “Integrated approach of federated learning with transfer learning for classification and diagnosis of brain tumor”. In:BMC Medical Imaging 24.1 (May 2024), p. 110.ISSN: 1471-2342.DOI: 10. 1186/s12880- 024- 01261- 0.URL: https://doi.org/10. 1186/s12880-024-01261-0

    2024

  27. [27]

    The future of digital health with federated learning

    Nicola Rieke et al. “The future of digital health with federated learning”. In:npj Digital Medicine3.1 (Sept. 2020), p. 119.ISSN: 2398-6352.DOI: 10.1038/s41746- 020- 00323- 1.URL: https://doi.org/10.1038/s41746- 020-00323-1

    doi:10.1038/s41746- 2020

  28. [28]

    Fed- erated learning in a medical context: a systematic literature review

    Bjarne Pfitzner, Nico Steckhan, and Bert Arnrich. “Fed- erated learning in a medical context: a systematic literature review”. In:ACM Transactions on Internet Technology (TOIT)21.2 (2021), pp. 1–31

    2021

  29. [29]

    Federated learning enables big data for rare cancer boundary detection

    Sarthak Pati et al. “Federated learning enables big data for rare cancer boundary detection”. In:Nature Communications13.1 (Dec. 2022), p. 7346.ISSN: 2041- 1723.DOI: 10.1038/s41467-022-33407-5.URL: https: //doi.org/10.1038/s41467-022-33407-5

    work page doi:10.1038/s41467-022-33407-5.url: 2022

  30. [30]

    Can machine learning be secure?

    Marco Barreno et al. “Can machine learning be secure?” In:Proceedings of the 2006 ACM Symposium on Infor- mation, computer and communications security. 2006, pp. 16–25

    2006

  31. [31]

    PPFL: Privacy-Preserving Techniques in Fed- erated Learning

    Khalil Jahani, Behzad Moshiri, and Babak Hossein Khalaj. “PPFL: Privacy-Preserving Techniques in Fed- erated Learning”. In:Journal of Artificial Intelligence, Applications and Innovations1.3 (2024), pp. 49–67

    2024

  32. [32]

    Privacy and Robustness in Feder- ated Learning: Attacks and Defenses

    Lingjuan Lyu et al. “Privacy and Robustness in Feder- ated Learning: Attacks and Defenses”. In:IEEE Trans- actions on Neural Networks and Learning Systems35.7 (2024), pp. 8726–8746.DOI: 10.1109/TNNLS.2022. 3216981

    doi:10.1109/tnnls.2022 2024

  33. [33]

    Adversarial Attacks and Defenses in Deep Learning

    Kui Ren et al. “Adversarial Attacks and Defenses in Deep Learning”. In:Engineering6.3 (2020), pp. 346– 360.ISSN: 2095-8099.DOI: https://doi.org/10.1016/j. eng.2019.12.012.URL: https://www.sciencedirect.com/ science/article/pii/S209580991930503X

    doi:10.1016/j 2020

  34. [34]

    Secure PDM: A novel Byzantine Fault Tolerant federated learning framework using a robust PCA-based anomaly detection approach

    Khalil Jahani, Behzad Moshiri, and Babak Hossein Khalaj. “Secure PDM: A novel Byzantine Fault Tolerant federated learning framework using a robust PCA-based anomaly detection approach”. In:International Jour- nal of Industrial Electronics Control and Optimization (2025)

    2025

  35. [35]

    Personalized and Private Peer-to- Peer Machine Learning

    Aur ´elien Bellet et al. “Personalized and Private Peer-to- Peer Machine Learning”. In:Proceedings of the Twenty- First International Conference on Artificial Intelligence and Statistics. Ed. by Amos Storkey and Fernando Perez-Cruz. V ol. 84. Proceedings of Machine Learning Research. PMLR, Sept. 2018, pp. 473–481.URL: https: //proceedings.mlr.press/v84/be...

    2018

  36. [36]

    Privacy, accuracy, and model fair- ness trade-offs in federated learning

    Xiuting Gu et al. “Privacy, accuracy, and model fair- ness trade-offs in federated learning”. In:Computers & Security122 (2022), p. 102907.ISSN: 0167-4048. DOI: https : / / doi . org / 10 . 1016 / j . cose . 2022 . 102907. URL: https://www.sciencedirect.com/science/article/pii/ S0167404822003005

    2022

  37. [37]

    OptiGradTrust: Byzantine- Robust Federated Learning Framework for Secure Multi-Institutional Alzheimer’s MRI Diagnosis

    Mohammad Karami et al. “OptiGradTrust: Byzantine- Robust Federated Learning Framework for Secure Multi-Institutional Alzheimer’s MRI Diagnosis”. In: ()

  38. [38]

    Model optimization techniques in personalized federated learning: A survey

    Fahad Sabah et al. “Model optimization techniques in personalized federated learning: A survey”. In:Expert Syst. Appl.243.C (June 2024).ISSN: 0957-4174.DOI: 10.1016/j.eswa.2023.122874.URL: https://doi.org/10. 1016/j.eswa.2023.122874

    arXiv 2024

  39. [39]

    Manoj Ghuhan Arivazhagan et al.Federated Learning with Personalization Layers. 2019. arXiv: 1912.00818 [cs.LG].URL: https://arxiv.org/abs/1912.00818

    Pith/arXiv arXiv 2019

  40. [40]

    Personalized Federated Learning: A Meta-Learning Ap- proach

    Alireza Fallah, Aryan Mokhtari, and Asuman Ozdaglar. Personalized Federated Learning: A Meta-Learning Ap- proach. 2020. arXiv: 2002 . 07948[cs.LG].URL: https://arxiv.org/abs/2002.07948

    Pith/arXiv arXiv 2020

  41. [41]

    FedBN: Federated Learning on Non-IID Features via Local Batch Normalization

    Xiaoxiao Li et al. “FedBN: Federated Learning on Non-IID Features via Local Batch Normalization”. In: International Conference on Learning Representations. 2021.URL: https : / / openreview . net / forum ? id = 6YEQUn0QICG

    2021

  42. [42]

    SCAFFOLD: Stochas- tic Controlled Averaging for Federated Learning

    Sai Praneeth Karimireddy et al. “SCAFFOLD: Stochas- tic Controlled Averaging for Federated Learning”. In: Proceedings of the 37th International Conference on Machine Learning. Ed. by Hal Daum ´e III and Aarti Singh. V ol. 119. Proceedings of Machine Learning Research. PMLR, 13–18 Jul 2020, pp. 5132–5143.URL: https : / / proceedings . mlr. press / v119 / k...

    2020

  43. [43]

    Layer-Wised Model Aggregation for Personalized Federated Learning

    Xiaosong Ma et al. “Layer-Wised Model Aggregation for Personalized Federated Learning”. In:Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). June 2022, pp. 10092– 10101

    2022

  44. [44]

    Yishay Mansour et al.Three Approaches for Personal- ization with Applications to Federated Learning. 2020. arXiv: 2002.10619[cs.LG].URL: https://arxiv.org/ abs/2002.10619

    Pith/arXiv arXiv 2020

  45. [45]

    An Efficient Framework for Clustered Federated Learning

    Avishek Ghosh et al. “An Efficient Framework for Clustered Federated Learning”. In:Advances in Neural 12 Information Processing Systems. Ed. by H. Larochelle et al. V ol. 33. Curran Associates, Inc., 2020, pp. 19586– 19597.URL: https://proceedings.neurips.cc/paper files/ paper/2020/file/e32cc80bf07915058ce90722ee17bb71- Paper.pdf

    2020

  46. [46]

    FedProto: Federated Prototype Learning across Heterogeneous Clients

    Yue Tan et al. “FedProto: Federated Prototype Learning across Heterogeneous Clients”. In:Proceedings of the AAAI Conference on Artificial Intelligence36.8 (June 2022), pp. 8432–8440.DOI: 10.1609/aaai.v36i8.20819. URL: https://ojs.aaai.org/index.php/AAAI/article/view/ 20819

    doi:10.1609/aaai.v36i8.20819 2022

  47. [47]

    Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Per- spective

    Baoyuan Wu et al. “Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Per- spective”. In:arXiv preprint arXiv:2302.09457(2024)

    Pith/arXiv arXiv 2024

  48. [48]

    BapFL: You Can Backdoor Person- alized Federated Learning

    Tiandi Ye et al. “BapFL: You Can Backdoor Person- alized Federated Learning”. In:ACM Trans. Knowl. Discov. Data18.7 (2024), p. 166.DOI: 10 . 1145 / 3649316

    2024

  49. [49]

    Strip: A defence against trojan attacks on deep neural networks

    Yansong Gao et al. “Strip: A defence against trojan attacks on deep neural networks”. In:Proceedings of the 35th annual computer security applications conference. 2019, pp. 113–125

    2019

  50. [50]

    Detecting Backdoors During the Inference Stage Based on Corruption Robustness Consistency

    Xiaogeng Liu et al. “Detecting Backdoors During the Inference Stage Based on Corruption Robustness Consistency”. In:Proc. of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). 2023, pp. 16363–16372.DOI: 10 . 1109 / CVPR52729 . 2023.01570

    arXiv 2023

  51. [51]

    Diffusion Models for Adversarial Purification

    Weili Nie et al. “Diffusion Models for Adversarial Purification”. In:Proc. of the 39th Int. Conf. on Machine Learning (ICML). V ol. 162. Proceedings of Machine Learning Research. 2022, pp. 16805–16827.URL: https: //proceedings.mlr.press/v162/nie22a.html

    2022

  52. [52]

    Backdoor Defense with Non-Adversarial Backdoor

    Min Liu, Alberto L. Sangiovanni-Vincentelli, and Xi- angyu Yue. “Backdoor Defense with Non-Adversarial Backdoor”. In:arXiv preprint arXiv:2307.15539(2023)

    Pith/arXiv arXiv 2023

  53. [53]

    Black-box Backdoor Defense via Zero-shot Image Purification

    Yucheng Shi et al. “Black-box Backdoor Defense via Zero-shot Image Purification”. In:Advances in Neural Information Processing Systems (NeurIPS) 36. 2023

    2023

  54. [54]

    FLGuard: Robust Federated Learning Using Dual Attention and Gradient Recon- struction

    Mohammad Karami et al. “FLGuard: Robust Federated Learning Using Dual Attention and Gradient Recon- struction”. In:2025 International Conference for Arti- ficial Intelligence, Applications, Innovation and Ethics (AI2E). 2025, pp. 1–6.DOI: 10.1109/AI2E64943.2025. 10983777

    arXiv 2025

  55. [55]

    Yun-Yun Tsai et al.Test-time Detection and Repair of Adversarial Samples via Masked Autoencoder. 2023. arXiv: 2303.12848[cs.CV].URL: https://arxiv.org/ abs/2303.12848

    Pith/arXiv arXiv 2023

  56. [56]

    Characterizing internal evasion at- tacks in federated learning

    Taejin Kim et al. “Characterizing internal evasion at- tacks in federated learning”. In:International Confer- ence on Artificial Intelligence and Statistics. PMLR. 2023, pp. 907–921

    2023

  57. [57]

    Deep residual learning for image recognition

    Kaiming He et al. “Deep residual learning for image recognition”. In:Proceedings of the IEEE conference on computer vision and pattern recognition. 2016, pp. 770– 778

    2016

  58. [58]

    Masked autoencoders are scalable vision learners

    Kaiming He et al. “Masked autoencoders are scalable vision learners”. In:Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 2022, pp. 16000–16009

    2022

  59. [59]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy et al. “An image is worth 16x16 words: Transformers for image recognition at scale”. In:arXiv preprint arXiv:2010.11929(2020)

    Pith/arXiv arXiv 2010

  60. [60]

    U-net: Convolutional networks for biomedical image segmentation

    Olaf Ronneberger, Philipp Fischer, and Thomas Brox. “U-net: Convolutional networks for biomedical image segmentation”. In:International Conference on Medical image computing and computer-assisted intervention. Springer. 2015, pp. 234–241

    2015

  61. [61]

    Towards Deep Learning Mod- els Resistant to Adversarial Attacks

    Aleksander Madry et al. “Towards Deep Learning Mod- els Resistant to Adversarial Attacks”. In:International Conference on Learning Representations. 2018.URL: https://openreview.net/forum?id=rJzIBfZAb

    2018

  62. [62]

    Diffusion Models for Adversarial Purification

    Weili Nie et al. “Diffusion Models for Adversarial Purification”. In:Proceedings of the 39th International Conference on Machine Learning. Ed. by Kamalika Chaudhuri et al. V ol. 162. Proceedings of Machine Learning Research. PMLR, 17–23 Jul 2022, pp. 16805– 16827.URL: https://proceedings.mlr.press/v162/nie22a. html

    2022

  63. [63]

    Alex Krizhevsky.Learning Multiple Layers of Features from Tiny Images. Tech. rep. Tech Report. University of Toronto, 2009

    2009

  64. [64]

    Accessed: 2024-08-08

    Ahmed Hamada.Brain Tumor Detection 2020 (BR35H). Accessed: 2024-08-08. 2020.URL: https://www.kaggle. com/datasets/ahmedhamada0/brain-tumor-detection

    2020

  65. [65]

    Mobilenetv2: Inverted residuals and linear bottlenecks

    Mark Sandler et al. “Mobilenetv2: Inverted residuals and linear bottlenecks”. In:Proceedings of the IEEE conference on computer vision and pattern recognition. 2018, pp. 4510–4520

    2018

  66. [66]

    Federated multi-task learning under a mixture of distributions

    Othmane Marfoq et al. “Federated multi-task learning under a mixture of distributions”. In:Advances in neural information processing systems34 (2021), pp. 15434– 15447

    2021

  67. [2020]

    21227 / tbkk - q937.URL: https : //dx.doi.org/10.21227/tbkk-q937

    2025.DOI: 10 . 21227 / tbkk - q937.URL: https : //dx.doi.org/10.21227/tbkk-q937

    work page doi:10.21227/tbkk-q937 2025