Pith. sign in

REVIEW 3 major objections 5 minor 37 references

IntraShuffler: A Privacy Preserving Framework for Heterogeneous DP Federated Learning

T0 review · 3 major / 5 minor · reviewed 2026-07-14 · grok-4.5

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Heterogeneous private federated learning still leaks client traits through gradient structure; IntraShuffler breaks that structure without killing ε-aware aggregation.

desk verdict Solid middleware fix for a real HDP-FL leakage path: privacy-compatible buckets + parameter-level shuffle that keeps ε-aware aggregation, with clean empirics and only the usual trusted-shuffler caveat. read the letter →

arxiv 2606.02563 v2 pith:JJPS6GTX submitted 2026-06-01 cs.LG cs.CRcs.DC

Farhin Farhad Riya , Olivera Kotevska , Jinyuan Stella Sun This is my paper
classification cs.LGcs.CRcs.DC
keywords federatedlearningheterogeneousdifferentialprivacyshufflemodelparameter-levelshufflingsourceinferencegradientstructureε-awareaggregationmiddleware
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Federated learning with client-chosen privacy budgets often re-weights updates by those budgets so the model still converges. The paper shows that non-IID data leaves lasting geometric patterns in gradients, and that the visible privacy tiers let an honest-but-curious server denoise updates and train a surrogate that recovers coarse client traits and links the same client across rounds. Ordinary message shuffling cannot fix this because the server still needs the privacy tier for correct aggregation. IntraShuffler therefore sits between clients and server, buckets clients whose privacy budgets are compatible, and randomly swaps individual parameters inside each bucket. The bucket multiset is preserved so weighted aggregation still works, yet the per-client gradient vector is destroyed. On four datasets the method cuts recoverable cosine similarity by more than 60 percent, drops surrogate accuracy from 0.78 to 0.33, and drives cross-round linkage to near chance while leaving final model quality essentially unchanged.

What carries the argument

IntraShuffler: a middleware that first forms adaptive privacy-compatible buckets (merging under-populated adjacent ε groups to enforce a minimum anonymity size) then applies independent random permutations to every parameter coordinate inside each bucket, so each forwarded vector is a parameter-wise mixture rather than a coherent client gradient.

What would settle it

Run the same ε-aware denoiser-plus-surrogate pipeline on IntraShuffler outputs for high-ε clients under realistic non-IID partitions and check whether surrogate accuracy or top-1 cross-round linkage rises well above chance (e.g., above 0.5) while model utility stays comparable; sustained high attack success would refute the central claim.

Watch

Extended reading notes

Core claim

Privacy leakage in heterogeneous-DP federated learning is driven by persistent, client-specific gradient structure that survives local noise and becomes more exploitable once the server sees each update’s privacy tier. A server that denoise-conditions on those tiers and feeds the recovered directions into a surrogate model can infer distributional attributes and re-identify clients across rounds. IntraShuffler stops the attack by privacy-compatible bucketing plus parameter-level mixing inside each bucket, which exponentially enlarges the recombination space while leaving the weighted sum needed for ε-aware aggregation intact.

Load-bearing premise

The shuffler is trusted and never colludes with the server; if it does, the extra anonymity disappears and only ordinary local differential privacy remains.

Editorial extensions

If this is right

  • HDP-FL systems that keep ε-aware re-weighting can still obtain meaningful source anonymity without rewriting client training or server optimizers.
  • High-ε clients, previously the most exposed, lose their disproportionate vulnerability once parameter-level mixing is applied inside buckets.
  • Message-level shuffle defenses are insufficient whenever aggregation must condition on privacy tiers; parameter-level mixing becomes the necessary granularity.
  • The recombination search space grows as n_k^d, rendering exhaustive reconstruction of a coherent client update computationally infeasible for ordinary model sizes and modest bucket populations.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Any future HDP protocol that exposes per-update noise scales will face the same structural-leakage channel unless it also randomizes coordinate-to-client assignment.
  • Adaptive bucketing that jointly considers system heterogeneity (compute, participation frequency) could further enlarge anonymity sets when privacy budgets alone produce tiny buckets.
  • The same parameter-mixing idea may transfer to other weighted aggregation schemes beyond DP, such as quality- or reliability-weighted federated updates.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper studies privacy leakage in heterogeneous differential privacy federated learning (HDP-FL) under ε-aware server aggregation. It shows that an honest-but-curious server can exploit non-IID gradient structure via ε-aware denoising and surrogate modeling to recover distributional attributes and link client updates across rounds. Existing message-level shuffle defenses are argued to be incompatible with ε-aware aggregation. The authors propose IntraShuffler, a middleware that forms privacy-compatible buckets (with adaptive merging under a minimum population n_min) and applies parameter-level shuffling within each bucket, preserving bucket-level weighted sums for aggregation. Empirically, across four datasets and multiple aggregators (FedAvg, FedProx, FedOpt), IntraShuffler reduces cosine recoverability by >60%, drops surrogate inference accuracy from 0.78 to 0.33, and drives cross-round linkage near random while matching Shuffle-DP utility. Theoretical support is limited to post-processing of local DP and multiset/recombination-space arguments.

Significance. If the results hold under the stated threat model, the paper identifies a concrete, previously under-emphasized leakage channel in practical HDP-FL: persistent client-specific gradient geometry that survives LDP and is amplified by server-visible privacy tiers. The defense is architecturally attractive because it is middleware-only, preserves ε-aware aggregation, and remains compatible with standard FL optimizers without changing client training. The evaluation is multi-dataset (energy forecasting and CIFAR-10), multi-model, and multi-metric (cosine recovery, linkage, ARI, bucket-level attack rates, utility), which strengthens the empirical claim. The main practical caveat is the trusted non-colluding shuffler assumption, which the authors themselves document; under that assumption the contribution is a useful systems-level fix for a real deployment tension between HDP utility and unlinkability.

major comments (3)
  1. [Threat Model / Appendix B] Threat Model and Appendix B: the central privacy claim depends on a trusted, non-colluding shuffler. The paper correctly states that collusion collapses protection to baseline LDP, but the abstract and introduction still present IntraShuffler as a general HDP-FL defense without quantifying residual risk under partial compromise or weaker trust (e.g., distributed shuffle with one malicious party). For a systems privacy paper this is load-bearing; the manuscript should either (i) elevate the assumption more prominently in the abstract/claims, or (ii) add a short residual-risk analysis (what the server still learns from bucket labels and ε-aware weights alone).
  2. [Section 5 / Tables 1-2] Section 5 Stage 1 and Tables 1–2: the attack strength rests on an ε-conditioned learned denoiser trained on synthetic clean/noisy pairs generated from the known DP mechanism. The paper does not report how sensitive the 0.78 o0.33 drop is to denoiser misspecification (wrong C, wrong noise calibration, domain shift between synthetic and real gradients). Because the headline privacy numbers are measured after this denoising step, a short ablation on denoiser quality / knowledge mismatch is needed to show that the attack is not an artifact of an unrealistically strong offline denoiser.
  3. [Definition 1 / Algorithm 1 / Section 9] Definition 1, Algorithm 1, and Section 9: adaptive merging under n_min can mix heterogeneous ε values, which both weakens fine-grained ε-aware reweighting and can create small or singleton buckets when participation is sparse and ε values are diverse. Table 4 shows bucketing helps utility, and Table 5 shows bucket-level attack rates, but there is no systematic report of realized bucket sizes, merge frequency, or attack/utility as functions of n_min and the ε distribution. Without that, it is hard to judge whether the >60% recoverability reduction holds in the sparse-participation regimes the limitations section itself flags as fundamental.
minor comments (5)
  1. [Section 2] Related Work: the comparison to Athanasiou et al. (ICLR’26) is important; please make the threat-model differences (client-side LDP present vs. absent; prior knowledge of target distribution) more explicit in a short table or bullet list so readers can place the recombination argument of Proposition 2.
  2. [Figures 2 and 5] Figure 2 vs. Figure 5: axis scales and client sampling differ slightly across panels; a common y-scale and explicit statement of which clients/rounds are plotted would improve readability of the “>60% reduction” claim.
  3. [Section 3 / Experimental Setup] Notation: ε is sometimes written as the per-round privacy parameter and sometimes as a client budget without composition discussion; a one-sentence clarification of the accounting horizon would help.
  4. [Table 6] Table 6: the recombination runtime column assumes 1 eval/sec; stating that this is a lower-bound illustration rather than a measured wall-clock would avoid over-interpretation.
  5. [Abstract / Introduction] Minor typos and formatting: missing spaces after periods in the abstract PDF text; “Inthis work” / “Wepropose” style concatenations appear in the introduction; fix for camera-ready.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: empirical defense evaluation and standard post-processing arguments are self-contained against external baselines.

full rationale

The paper's central claims are (1) an empirical Privacy Inference Attack that recovers structure via an ε-aware denoiser and surrogate model trained on synthetic/auxiliary data, and (2) IntraShuffler (privacy-compatible bucketing + parameter-level shuffling) that reduces measured recoverability, surrogate accuracy, and cross-round linkage while preserving ε-aware aggregation utility. These are evaluated against held-out clean gradients, historical auxiliary sets, and standard FL baselines (Plain FL-DP, Shuffle-DP) on four datasets; the reported numbers (cosine drop >60%, surrogate accuracy 0.78 o0.33, near-random linkage, RMSE/accuracy parity) are not forced by construction from fitted inputs. Theorem 1 is ordinary DP post-processing; Propositions 1–2 are elementary multiset/combinatorial facts. No self-definitional loop, no fitted parameter re-labeled as prediction, no load-bearing uniqueness theorem imported from the authors, and no ansatz smuggled via self-citation. The trusted non-colluding shuffler is an explicit threat-model assumption (not a circular derivation). Score 0 is therefore the correct finding.

Assumptions & free parameters 3 free parameters · 4 assumptions · 1 invented entities

The central empirical claim rests on standard DP post-processing, the honest-but-curious non-colluding shuffler, non-IID gradient structure, and a handful of design hyper-parameters (n_min, ε set, clipping). No new physical entities are postulated; the free parameters are ordinary engineering knobs.

free parameters (3)
  • n_min (minimum bucket population)
    Design hyper-parameter that controls anonymity-set size; chosen by the authors and directly trades privacy against utility when privacy budgets are sparse.
  • privacy budget set {ε}
    Discrete set {0.5,1,2,4,8} used for all experiments; not derived from first principles.
  • clipping norm C and δ=1e-5
    Standard DP-SGD knobs fixed for the evaluation; affect both utility and attack surface.
assumptions (4)
  • standard math Post-processing property of differential privacy: any (possibly randomized) function of an (ε,δ)-DP output remains (ε,δ)-DP.
    Invoked in Theorem 1 to claim that bucketing and parameter shuffling do not weaken local DP.
  • domain assumption The shuffler is trusted and non-colluding with the server.
    Stated in Threat Model and Appendix B; without it the anonymity guarantee collapses.
  • domain assumption Non-IID client data induce persistent, client-specific expected gradient directions that survive local Gaussian noise sufficiently for denoising and linkage.
    Core premise of the Privacy Inference Attack (Section 5); if gradients were already homogeneous the attack would fail and the defense would be unnecessary.
  • domain assumption Server knows the DP mechanism (C, δ) and the privacy tier of each received update, enabling ε-aware denoising.
    Required for the attack pipeline and for ε-aware aggregation itself.
invented entities (1)
  • IntraShuffler middleware (privacy-compatible buckets + parameter-level shuffle)
    purpose: Disrupt client-specific gradient geometry while preserving the multiset needed for ε-aware aggregation.
    The concrete mechanism is new to this paper; independent evidence is the empirical reduction in attack metrics on four datasets.

how reviews work

0 comments
Cite this review

Pith. "Pith review of IntraShuffler: A Privacy Preserving Framework for Heterogeneous DP Federated Learning." pith.science (2026). https://pith.science/paper/JJPS6GTX

@misc{pith2026260602563,
  author       = {Pith},
  title        = {Pith review of: IntraShuffler: A Privacy Preserving Framework for Heterogeneous DP Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JJPS6GTX}},
  note         = {Machine review of arXiv:2606.02563}
}
abstract

Heterogeneous Differential Privacy (HDP) in Federated Learning (FL) allows clients to select individual privacy budgets ($\varepsilon_i$) according to institutional policies and data sensitivity. In practice, many HDP-FL systems employ $\varepsilon$-aware server aggregation to improve model utility by re-weighting client updates according to their declared privacy budgets. However, gradient updates in FL retain structural patterns induced by non-independent and identically-distributed (non-IID) data, and these additional signals exposed by $\varepsilon$-aware aggregation create new opportunities for inference by an honest-but-curious server. In this work, we first show that a server equipped with gradient denoising and surrogate modeling can mount a \emph{Privacy Inference Attack} that infers distributional attributes of clients and links updates from the same client across training rounds, measured via surrogate inference accuracy and linkage success, under realistic knowledge constraints. The Shuffle-Model has been widely studied as a defense against such inference risks by anonymizing update sources, but it is fundamentally incompatible with HDP-FL $\varepsilon$-aware aggregation. To address this challenge, we propose \textbf{IntraShuffler}, a middleware defense framework designed for HDP-FL systems. IntraShuffler introduces a privacy-aware shuffling mechanism that groups clients into privacy-compatible buckets and performs parameter-level shuffling within each bucket to disrupt persistent gradient structure while preserving $\varepsilon$-aware aggregation. Experiments across four different datasets show that IntraShuffler reduces gradient recoverability by over 60% and decreases surrogate inference accuracy from 0.78 to 0.33 while maintaining comparable model utility across multiple FL aggregation rules.

Figures

Figures reproduced from arXiv: 2606.02563 by the authors.

Figure 1
Figure 1. Overview of the IntraShuffler Framework. [PITH_FULL_IMAGE:figures/full_fig_p006_1.png] view at source ↗
Figure 2
Figure 2. Comparison of denoiser performance in terms of average cosine similarity. [PITH_FULL_IMAGE:figures/full_fig_p010_2.png] view at source ↗
Figure 3
Figure 3. Privacy leakage via ε-aware denoising. Server-side denoising of LDP gra￾dients enables a surrogate model to partially infer client behavioral groups. traShuffler pipeline, including group formation, adaptive bucket merging, parameter￾level shuffling, and subsequent server-side processing, preserves the same (εi , δi) privacy guarantees for each client. Proof. All operations performed by IntraShuffler depend only on … view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Effect of IntraShuffler on data distribution inference. Client representa [PITH_FULL_IMAGE:figures/full_fig_p012_4.png]
Figure 5
Figure 5. Figure 5: Cosine similarity compar￾ison of denoised gradients before and after IntraShuffler Behavioral Inference. We next evaluate if this recovered structure enables inference about client data distributions. The server trains a surrogate model on a disjoint his￾torical datase…
Figure 6
Figure 6. Figure 6: Effect of IntraShuffler on gradient recovery. Without shuffling, denoising [PITH_FULL_IMAGE:figures/full_fig_p013_6.png]
Figure 7
Figure 7. Figure 7: Linkability analysis of a client participating in multiple rounds of FL (a) [PITH_FULL_IMAGE:figures/full_fig_p015_7.png]

Review history (2 revisions) →

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

37 extracted references · 2 linked inside Pith

  1. [1]

    A survey on federated learning,

    C. Zhang, Y. Xie, H. Bai, B. Yu, W. Li, and Y. Gao, “A survey on federated learning,”Knowledge-Based Systems, vol. 216, p. 106775, 2021

    2021

  2. [2]

    Federated learning: Opportunities and challenges,

    P. M. Mammen, “Federated learning: Opportunities and challenges,”arXiv preprint arXiv:2101.05428, 2021

    arXiv 2021

  3. [3]

    Exploiting unintended feature leakage in collaborative learning,

    L. Melis, C. Song, E. De Cristofaro, and V. Shmatikov, “Exploiting unintended feature leakage in collaborative learning,” in2019 IEEE symposium on security and privacy (SP). IEEE, 2019, pp. 691–706

    2019

  4. [4]

    Inverting gradients – how easy is it to break privacy in federated learning?

    J. Geiping, H. Bauermeister, J. Drögemüller, and M. Moeller, “Inverting gradients – how easy is it to break privacy in federated learning?” inNeurIPS, 2020. 16

    2020

  5. [5]

    Deep learning with differential privacy,

    M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” inProceedings of the 2016 ACM SIGSAC conference on computer and communications security, 2016

    2016

  6. [6]

    Federated learning with differential privacy: Algorithms and performance analysis,

    K.Wei,J.Li,M.Ding,C.Ma,H.H.Yang,F.Farokhi,S.Jin,T.Q.Quek,andH.V. Poor, “Federated learning with differential privacy: Algorithms and performance analysis,”IEEE transactions on information forensics and security, vol. 15, pp. 3454–3469, 2020

    2020

  7. [8]

    Efficient federated learning privacy preservation method with heterogeneous differential privacy,

    J. Ling, J. Zheng, and J. Chen, “Efficient federated learning privacy preservation method with heterogeneous differential privacy,”Computers & Security, vol. 139, p. 103715, 2024

    2024

  8. [9]

    Distributed differential privacy via shuffling,

    A. Cheu, A. Smith, J. Ullman, D. Zeber, and M. Zhilyaev, “Distributed differential privacy via shuffling,” inAdvances in Cryptology – EUROCRYPT 2019, ser. LNCS, vol. 11476. Springer, 2019, pp. 375–403

    2019

Show all 37 references
  1. [10]

    Amplification by shuffling: From local to central differential privacy via anonymity,

    Ú. Erlingsson, V. Feldman, I. Mironov, A. Raghunathan, K. Talwar, and A. Thakurta, “Amplification by shuffling: From local to central differential privacy via anonymity,” inProceedings of the Thirtieth Annual ACM-SIAM Symposium on Discrete Algorithms (SODA), 2019, pp. 2468–2479

    2019

  2. [11]

    Prochlo: Strong privacy for an- alytics in the crowd,

    A. Bittau, U. Erlingsson, P. Maniatis, I. Mironov, A. Raghunathan, D. Lie, M. Rudominer, U. Kode, J. Tinnes, and B. Seefeld, “Prochlo: Strong privacy for an- alytics in the crowd,” inProceedings of the 26th Symposium on Operating Systems Principles, ser. SOSP ’17. Association ...

    2017

  3. [12]

    Projected federated averaging with heterogeneous differential privacy,

    J. Liu, J. Lou, L. Xiong, J. Liu, and X. Meng, “Projected federated averaging with heterogeneous differential privacy,”Proceedings of the VLDB Endowment, vol. 15

  4. [13]

    The power of bias: Optimizing client selection in federated learning with heterogeneous differential privacy,

    J. Ma, Y. Zhou, Q. Li, Q. Z. Sheng, L. Cui, and J. Liu, “The power of bias: Optimizing client selection in federated learning with heterogeneous differential privacy,”IEEE Transactions on Dependable and Secure Computing, 2025

    2025

  5. [14]

    Optimal client sampling in federated learning with client-level heterogeneous differential privacy,

    J. Xu, R. Hu, and O. Kotevska, “Optimal client sampling in federated learning with client-level heterogeneous differential privacy,”IEEE Internet of Things, 2026

    2026

  6. [15]

    Deep leakage from gradients,

    L. Zhu, Z. Liu, and S. Han, “Deep leakage from gradients,” inNeurIPS, 2019

    2019

  7. [16]

    Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning,

    M. Nasr, R. Shokri, and A. Houmansadr, “Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning,” in2019 IEEE symposium on security and privacy (SP). IEEE, 2019, pp. 739–753

    2019

  8. [17]

    Source inference attacks in federated learning,

    H. Hu, Z. Salcic, L. Sun, G. Dobbie, and X. Zhang, “Source inference attacks in federated learning,” in2021 IEEE International Conference on Data Mining (ICDM). IEEE, 2021, pp. 1102–1107

    2021

  9. [18]

    Source infer- ence attacks: Beyond membership inference attacks in federated learning,

    H. Hu, X. Zhang, Z. Salcic, L. Sun, K.-K. R. Choo, and G. Dobbie, “Source infer- ence attacks: Beyond membership inference attacks in federated learning,”IEEE Transactions on Dependable and Secure Computing, vol. 21, pp. 3012–3029, 2023

    2023

  10. [19]

    Tor: The second-generation onion router,

    R. Dingledine, N. Mathewson, and P. Syverson, “Tor: The second-generation onion router,” inProceedings of the 13th USENIX Security Symposium. USENIX, 2004, pp. 303–320

    2004

  11. [20]

    Practical veri- fiable mix nets,

    S. Hohenberger, M. Kohlweiss, A. Lysyanskaya, and H. Shacham, “Practical veri- fiable mix nets,” inIEEE Symposium on Security and Privacy, 2014, pp. 123–137

    2014

  12. [21]

    Riposte:Ananonymousmessaging system handling millions of users,

    H.Corrigan-Gibbs,D.Boneh,andD.Mazieres,“Riposte:Ananonymousmessaging system handling millions of users,” inIEEE Symposium on Security and Privacy, 2015, pp. 321–338. 17

    2015

  13. [22]

    Secure multi-party shuffling for privacy- preserving data aggregation,

    S. Lu, R. Ostrovsky, and V. Zikas, “Secure multi-party shuffling for privacy- preserving data aggregation,” inAdvances in Cryptology – EUROCRYPT, 2019

    2019

  14. [23]

    Scalable secure shuffling via multi-party computa- tion,

    I. Abraham, G. Asharovet al., “Scalable secure shuffling via multi-party computa- tion,” inProceedings of the ACM Conference on Computer and Communications Security (CCS), 2020

    2020

  15. [24]

    Rafls: Rdp-based adaptive federated learning with shuffle model,

    S. Wang, K. Gai, J. Yu, L. Zhu, H. Wu, C. Wei, Y. Yan, H. Zhang, and K.-K. R. Choo, “Rafls: Rdp-based adaptive federated learning with shuffle model,”IEEE Transactions on Dependable and Secure Computing, vol. 22, pp. 1181–1194, 2025

    2025

  16. [25]

    Secure shuffling for federated learning,

    R. Sunet al., “Secure shuffling for federated learning,” inNeurIPS Workshop, 2020

    2020

  17. [26]

    Privacy amplification in federated learning via shuffle mecha- nisms,

    M. Lebrunet al., “Privacy amplification in federated learning via shuffle mecha- nisms,”arXiv preprint, 2022

    2022

  18. [27]

    Shufflefl: Improving privacy in federated learning via shuffling,

    Z. Yanget al., “Shufflefl: Improving privacy in federated learning via shuffling,” arXiv preprint, 2023

    2023

  19. [28]

    Flame: Differentially private federated learning in the shuffle model,

    R. Liu, Y. Cao, H. Chen, R. Guo, and M. Yoshikawa, “Flame: Differentially private federated learning in the shuffle model,” inAAAI, 2021, pp. 8686–8694

    2021

  20. [29]

    Conservative or liberal? personalized dif- ferential privacy,

    Z. Jorgensen, T. Yu, and G. Cormode, “Conservative or liberal? personalized dif- ferential privacy,” inICDE, 2015

    2015

  21. [30]

    Heterogeneous differential- private federated learning: Trading privacy for utility truthfully,

    X. Lin, J. Wu, J. Li, C. Sang, S. Hu, and M. J. Deen, “Heterogeneous differential- private federated learning: Trading privacy for utility truthfully,”IEEE Transac- tions on Dependable and Secure Computing, vol. 20, no. 6, pp. 5113–5129, 2023

    2023

  22. [31]

    Tight bounds for privacy amplification by shuffling,

    V. Balceret al., “Tight bounds for privacy amplification by shuffling,”arXiv preprint, 2022

    2022

  23. [32]

    Echo of neighbors: Privacy amplification for personalized private federated learning with shuffle model,

    Y. Liu, S. Zhao, L. Xiong, Y. Liu, and H. Chen, “Echo of neighbors: Privacy amplification for personalized private federated learning with shuffle model,” in Proceedings of the AAAI Conference on Artificial Intelligence (AAAI), 2023

    2023

  24. [33]

    Clustered federated learning with adaptive local differential privacy on heterogeneous iot data,

    Z. He, L. Wang, and Z. Cai, “Clustered federated learning with adaptive local differential privacy on heterogeneous iot data,”IEEE Internet of Things Journal, vol. 11, no. 1, pp. 137–146, 2023

    2023

  25. [34]

    Protection against source infer- ence attacks in federated learning,

    A. Athanasiou, K. Jung, and C. Palamidessi, “Protection against source infer- ence attacks in federated learning,” inThe fourteenth International Conference on Learning Representations (ICLR), 2026

    2026

  26. [35]

    Federated learning with hetero- geneous differential privacy,

    T. Li, A. K. Sahu, A. Talwalkar, and V. Smith, “Federated learning with hetero- geneous differential privacy,” inInternational Conference on Artificial Intelligence and Statistics (AISTATS), 2022

    2022

  27. [36]

    Differential privacy in the shuffle model: A survey of separations,

    A. Cheu, “Differential privacy in the shuffle model: A survey of separations,” 2022. [Online]. Available: https://arxiv.org/abs/2107.11839

    2022 arXiv

  28. [37]

    Im- proving utility and security of the shuffler-based differential privacy,

    T. Wang, B. Ding, M. Xu, Z. Huang, C. Hong, J. Zhou, N. Li, and S. Jha, “Im- proving utility and security of the shuffler-based differential privacy,”Proc. VLDB Endow., vol. 13, no. 13, p. 3545–3558, 2020. Acknowledgment This material is based upon work supported by the U.S. D...

    2020

  29. [38]

    In theIID case, clients receive balanced class mix- tures, while in thenon-IIDcase, clients exhibit class-skew with imbalanced label distributions

    Both settings use the same number of clients and samples per client. In theIID case, clients receive balanced class mix- tures, while in thenon-IIDcase, clients exhibit class-skew with imbalanced label distributions. Partition Plain Shuffle Intra IID ≈1/n t ≈1/n t ≈1/n t Non-I...

Pith tools

Reviewed July 14, 2026 · model on record in the stance chip above.