Pith. sign in

REVIEW 3 major objections 4 minor 27 references

Targeted Label-Flipping and Oversampling Attacks on Federated Conditional GANs

T0 review · 3 major / 4 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Targeted label flipping in federated conditional GANs shifts a chosen class-conditional output toward the source class at a rate linear in the poisoning strength, while the deviation from the true target distribution grows only…

desk verdict A clean Taylor-expansion story about label-flipping attacks on federated cGANs, but the load-bearing assumption that the trained generator equals the poisoned training-label mixture is never verified, and the experiments are too coarse to close that gap. read the letter →

arxiv 2608.09314 v1 pith:AZMYRK4J submitted 2026-08-10 cs.LG

Panav Shah , Avishek Ghosh This is my paper · ORCID
classification cs.LG
keywords federatedlearningconditionalGANlabelflippingoversamplingattackpoisoningKLdivergenceclass-conditionaldistributionprojectiondiscriminator
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that a data-only attack on a federated conditional GAN—malicious clients relabel a fraction of source-class samples to the target label and optionally upweight them—distorts the target class toward the source class at a rate that is linear in an effective poisoning strength $\beta$, while the deviation of the target class from its true distribution grows only quadratically in $\beta$. Concretely, the poisoned target distribution is modeled as $\widetilde P_t = (1-\beta)P_t + \beta P_s$, with $\beta = \Delta/(\Pi_t+\Delta)$ and $\Delta = \alpha p r \Pi_s$, where $\alpha$ is the fraction of adversarial clients, $p$ the flip probability, $r$ the oversampling factor, and $\Pi_s,\Pi_t$ the class priors. Under this mixture, $\mathrm{KL}(P_s \| \widetilde P_t)$ decreases linearly and $\mathrm{KL}(P_t \| \widetilde P_t)$ increases quadratically, an asymmetry the authors verify with non-parametric KL estimates on FEMNIST, MNIST, and CIFAR-10. The paper further reports that aggregate FID moves by less than six percent even at $\beta \approx 0.83$, meaning the attack is effective yet hard to detect from label-agnostic metrics. If the claim is right, defending federated conditional generators requires monitoring class-conditional statistics rather than aggregate generation quality.

What carries the argument

The load-bearing object is the mixture identity of Eq. (1), $\widetilde P_t = (1-\beta)P_t + \beta P_s$, together with the definition of the effective poisoning strength $\beta = \Delta/(\Pi_t+\Delta)$, $\Delta = \alpha p r \Pi_s$, which folds the adversarial fraction, flip probability, oversampling factor, and class priors into one scalar. The proofs are Taylor expansions of the log-likelihood ratio around $\beta=0$; the linear coefficient in $\mathrm{KL}(P_s \| \widetilde P_t)$ turns out to be the negative Pearson chi-squared divergence $\chi^2(P_s \| P_t)$, and the vanishing first-order term in $\mathrm{KL}(P_t \| \widetilde P_t)$ follows from $\int P_s = \int P_t = 1$. The same expansion, applied to the general mixture $\widetilde P_t = (1-\beta_t)P_t + \beta_t \bar P_{-t}$ with contamination profile $\pi_{\cdot|t}$, yields the multi-source results of Appendix B, where the second-order term is governed by $\chi^2(\bar P_{-t} \| P_t)$ and is convex in the contaminating mixture.

What would settle it

Estimate the generator's actual target-class conditional distribution at several values of $\beta$ (for instance by drawing samples and computing density estimates or using a classifier to measure the source fraction), and test whether it matches $(1-\beta)P_t + \beta P_s$; if $\mathrm{KL}(P_s \| \widetilde P_t)$ does not decrease linearly in $\beta$, or if the generator's output deviates from the mixture, the central claim fails. A sharper test repeats the experiment with a concatenation-based conditional GAN instead of a projection discriminator, since the paper's mechanism relies on the label-feature inner product of the projection head.

Watch

Extended reading notes

Core claim

The paper's central claim is that the class-conditional output of a federated conditional GAN trained under targeted label flipping is the mixture $\widetilde P_t = (1-\beta)P_t + \beta P_s$, with $\beta = \Delta/(\Pi_t+\Delta)$ and $\Delta = \alpha p r \Pi_s$, so that the effective poisoning strength $\beta$ subsumes every attack knob. From this mixture, Lemma 5.1 gives $\mathrm{KL}(P_s \| \widetilde P_t) = \mathrm{KL}(P_s \| P_t) - \beta\,\chi^2(P_s \| P_t) + O(\beta^2)$, and Lemma 5.2 gives $\mathrm{KL}(P_t \| \widetilde P_t) = \frac{\beta^2}{2}\chi^2(P_s \| P_t) + O(\beta^3)$, where $\chi^2$ is the Pearson chi-squared divergence. The first-order term in the target deviation vanishes because the mixture contains $P_t$ itself, so to leading order the poisoned generator looks like the true target even though it has already collapsed substantially toward the source. Oversampling enters only through $\beta$, which is why the two attack variants coincide analytically at matched $\beta$. The appendix generalizes the expansion to arbitrary confusion matrices and shows that spreading contamination across source classes can shrink the second-order detection signal even further.

Load-bearing premise

The analysis assumes the trained federated cGAN's target-class output exactly equals the corrupted training-label mixture $(1-\beta)P_t + \beta P_s$, an equality the paper asserts rather than derives from GAN optimization or FedAvg dynamics.

Editorial extensions

If this is right

  • If the generator converges to the mixture $(1-\beta)P_t + \beta P_s$, then the attacker can make the target class output resemble the source class at a rate linear in $\beta$, while the deviation of the target class from its true distribution grows only as $\beta^2$.
  • Oversampling by a factor $r$ amplifies the attack purely by increasing $\beta$, so at matched $\beta$ the oversampling and simple-flip attacks produce the same class-conditional distortion; the operational difference is that oversampling reaches large $\beta$ with fewer adversarial clients.
  • Label-agnostic aggregate metrics such as FID are structurally insensitive: even at $\beta \approx 0.83$ the aggregate FID moves by less than 6% on FEMNIST and CIFAR-10, while the target-class FID grows roughly quadratically.
  • A defender who does not know the source-target pair must effectively scan $C(C-1)$ ordered pairs, which reduces to a label-agnostic per-pair check whose noise overwhelms the linear-in-$\beta$ signal (per the paper's discussion).
  • Spreading contamination across multiple source classes can further suppress the second-order detection term, because the chi-squared divergence to the target is convex in the contaminating mixture (Appendix B).

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The mixture form (1) is a modeling assertion, so an immediate next step is to fit the mixture to real generator samples and measure the residual; if the residual grows with $\beta$, the linear/quadratic gap would narrow accordingly.
  • Because the asymmetry is a property of the mixture objective, not of GAN training specifically, conditional diffusion or autoregressive models trained on the same relabeled data would likely inherit the same linear damage and quadratic detectability profile.
  • The source class itself loses training mass as its samples are relabeled, so a defender could monitor source-class degradation as a second detection channel; the paper does not test this.
  • Since $\beta$ is proportional to the source prior $\Pi_s$, rare source classes give the attacker more leverage per flipped sample, suggesting minority classes are the natural targets and per-class prior monitoring is a cheap defense signal.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper studies targeted label-flipping and oversampling attacks on federated conditional GANs. It defines an effective poisoning strength beta and assumes that the poisoned target class-conditional generator distribution is the convex mixture P_tilde_t = (1-beta)P_t + beta P_s (Eq. (1)). Under this assumption, it proves two KL-divergence expansions: the source-to-poisoned-target KL decreases linearly in beta (Lemma 5.1), while the true-target-to-poisoned-target KL grows only quadratically (Lemma 5.2), giving an asymmetry between semantic damage and detectability. The authors report experiments on FEMNIST, MNIST, and CIFAR-10 with KL estimates from generator samples and aggregate/target FID values, claiming qualitative confirmation of the linear/quadratic laws.

Significance. If the main premise is granted, the paper identifies a clean and mechanistically interpretable vulnerability: a data-only attack can corrupt a chosen class-conditional distribution while leaving label-agnostic metrics nearly unchanged. The mathematical core given Eq. (1) is correct and clearly presented, with full proofs in Appendix B and a useful general confusion-matrix extension. However, the significance is conditional on Eq. (1) being an accurate description of what a trained federated cGAN actually produces, and that link is not established. The empirical validation is qualitative, lacks uncertainty quantification, and contains non-monotonic rows that are hard to reconcile with the predicted monotone laws. The paper could become a solid contribution if the mixture assumption is either derived from the training dynamics or directly tested, and if the empirical claims are made quantitative with repeated seeds and fits.

major comments (3)
  1. [Section 5, Eq. (1) and 'Justifying Delta' paragraph] The central theoretical result is conditional on Eq. (1), which is asserted rather than derived. The 'Justifying Delta' paragraph computes the effective label distribution in the pooled training data, but it does not show that the trained generator's class-conditional output equals this mixture. GAN training, especially with a projection discriminator, need not converge to the empirical class-conditional mixture: non-convergence, mode collapse, or label-feature misalignment can produce fixed points outside the family (1-beta)P_t + beta P_s. Since Lemmas 5.1 and 5.2 are Taylor expansions of the assumed mixture, the linear/quadratic asymmetry is a property of Eq. (1) rather than an emergent consequence of federated cGAN training. The Limitations section does not flag this gap. To support the paper's claims, the authors would need either a derivation of Eq. (1) from the cGAN objective under FedAvg or an explicit empirical test that the trained target conditional is the mixture (1-beta)P_t + beta P_s.
  2. [Section 6.3-6.4, Tables 1, 3-5] The empirical evaluation does not test the quantitative predictions. The KL estimates are compared only by eye to 'approximately linear' and 'approximately quadratic'; no slope is estimated from the data, no chi-squared value is computed, and no goodness-of-fit test is reported. The data also contain non-monotonic rows inconsistent with the predictions: in Table 3, simple flipping on FEMNIST at beta=0.0909 gives KL(P_s||P_tilde)=222.87, above the beta=0 baseline of 220.99, and KL(P_t||P_tilde) falls from 39.87 at beta=0.0909 to 22.97 at beta=0.1667, contradicting a quadratic increase. The ratio KL(P_t||P_tilde)/beta^2 varies by a factor of roughly 4-5 over the beta range (e.g., MNIST Table 4: 18.42/0.0909^2 is about 2229, while 11.74/0.1667^2 is about 422), so the claimed beta^2 law is not supported at the stated precision. No error bars, seeds, or repeated runs are reported, so the significance of the observed trends cannot be assessed.
  3. [Section 6.4, Table 2 and the 'diluted by ~1/C' claim] The claim that aggregate FID is insensitive to the attack because the per-class deviation is 'diluted by ~1/C' is not justified. FID is not an average of per-class conditional FIDs; it is computed from the mean and covariance of pooled deep feature vectors, so the dilution argument needs a derivation or a direct empirical check. Moreover, Table 2 reports single FID values without confidence intervals, and the 'less than 6%' movement is not statistically characterized. Since the conclusion that the attack is hard to detect from label-agnostic metrics is one of the paper's two main claims, this needs quantitative support, such as multiple seeds, a distribution of aggregate FID under attack versus benign training, or a derived bound on the aggregate FID shift.
minor comments (4)
  1. [Section 6.1 and Tables 3-5] The beta values in the tables are not reproducible from the described setup: the formula beta = alpha p r Pi_s / (Pi_t + alpha p r Pi_s) requires the class priors Pi_s and Pi_t, which are not reported and are not well-defined under client-specific non-IID Dirichlet partitions.
  2. [Algorithm 1, line 7] The instruction to upweight all source samples by r (not only flipped ones) is not reflected in Delta = alpha p r Pi_s, which counts only flipped samples; for p < 1 the unflipped source mass enters the source class pool but is absent from the model. All experiments use p=1, so the discrepancy does not affect the reported numerical results, but the algorithm and theory should be aligned.
  3. [Appendix B.5] The regularity assumptions (A1)-(A3) on shared support and bounded likelihood ratios are stated but not verified for the image distributions used in the experiments; the KL estimates are computed on HOG features, while the expansions are for distributions on images, so the connection between the theoretical and measured quantities is not made explicit.
  4. [Front matter and references] The manuscript still contains ACM template artifacts, including the 2018 copyright line, placeholder conference name and DOI, and 'Conference acronym 'XX', and some reference dates are inconsistent; these should be cleaned before publication.

Circularity Check

1 steps flagged · score 6.0 of 10

The linear/quadratic asymmetry is a Taylor-expansion property of the mixture assumed in Eq. (1); the paper never derives that a federated cGAN converges to that mixture, so the central prediction reduces to the assumed form by construction.

  1. self definitional [Section 5, Eq. (1), 'Justifying Δ' paragraph, and Lemmas 5.1–5.2 (with proof of Lemma 5.2)]
    "Δ:=𝛼𝑝𝑟Π 𝑠, resulting in a poisoned target-class distribution ˜𝑃𝑡 = (Π𝑡𝑃𝑡+Δ𝑃𝑠)/(Π𝑡+Δ) =(1−𝛽)𝑃𝑡+𝛽𝑃𝑠, 𝛽:= Δ/(Π𝑡+Δ). (1) ... The first-order term vanishes because ˜𝑃𝑡 is, by construction, a convex combination involving 𝑃𝑡 itself — so to leading order ˜𝑃𝑡 'looks like' 𝑃𝑡 even when 𝛽 is non-negligible."

    Lemmas 5.1 and 5.2 are Taylor expansions of KL divergences against the distribution P̃_t defined in Eq. (1). Given P̃_t = (1−β)P_t + βP_s, the zero first-order term in KL(P_t||P̃_t) and the linear coefficient −χ²(P_s||P_t) in KL(P_s||P̃_t) are calculus identities for any convex combination anchored at P_t; they are not consequences of GAN optimization, the projection discriminator, or FedAvg dynamics. The paper's own proof of Lemma 5.2 says the first-order term vanishes 'by construction', confirming that the quadratic detectability is built into the assumed mixture. The 'Justifying Δ' paragraph only computes effective label frequencies in the pooled training data; it never establishes that the trained conditional generator's output equals this label mixture.

full rationale

The paper's derivation chain is: attack parameters → effective mass transfer Δ → mixture P̃_t = (1−β)P_t + βP_s → KL expansions. The last step is mathematically correct but is a direct Taylor expansion of the defined mixture; KL(P_t||·) has no linear term for any mixture of the form (1−β)P_t + βQ, and KL(P_s||·) has a linear term proportional to the χ² divergence. This is not a nontrivial consequence of the federated GAN training objective. The only load-bearing link from the attack to the mixture is the assertion 'resulting in a poisoned target-class distribution' in Eq. (1), supported only by the 'Justifying Δ' paragraph describing the pooled label frequencies. No theorem shows that a cGAN with a projection discriminator trained under FedAvg converges to the empirical class-conditional mixture; GAN non-convergence, mode collapse, and label-feature coupling could make the actual generator distribution different. The experiments test KL trends using generator samples and show the qualitative linear/quadratic pattern, which gives some independent support; however, the reported numbers do not verify the exact mixture prediction (e.g., the implied χ² from the quadratic term at one β would predict a much larger linear drop than observed in Table 1), so the theory is not quantitatively grounded by the experiments. There are no load-bearing self-citations or imported uniqueness theorems. The partial circularity consists in the central theoretical claim being a property of the assumed mixture rather than a derived consequence of the training dynamics, while the experimental validation only checks qualitative shape and does not close that gap. Score 6 reflects one or more central 'predictions' reducing by construction, with independent empirical content preventing a fully idempotent derivation.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The central derivation rests on one load-bearing modeling assumption: the poisoned target distribution is exactly a convex mixture of the true target and source distributions. The paper does not derive this from GAN training dynamics, and the bounded-likelihood-ratio regularity needed for the Taylor expansions is unverified. No fitted constants appear in the theory; p and r are chosen attack settings. No new physical or model entities are introduced.

free parameters (2)
  • flip probability p = 1.0 (fixed in all experiments)
    Attack setting chosen by the authors, not fitted; it enters beta through Delta = alpha p r Pi_s.
  • oversampling factor r = 5 (oversampling variant), 1 (simple variant)
    Attack setting chosen by the authors; it amplifies beta multiplicatively. Reported curves are indexed by beta, so the exact value of r is not fitted.
assumptions (3)
  • domain assumption Poisoned class-conditional distribution equals the population mixture P_tilde_t = (Pi_t P_t + Delta P_s) / (Pi_t + Delta)
    Eq (1) is asserted via effective mass transfer but never derived from FedAvg or GAN optimization; it assumes the global generator matches the corrupted training-label mixture at equilibrium.
  • domain assumption Federated cGAN training converges to the clean or corrupted data mixture under FedAvg
    The mixture model requires that sample-size-weighted averaging of local cGAN updates produces a generator whose class-conditional output equals the global training-label mixture; no convergence argument is given.
  • domain assumption Bounded likelihood ratios and shared support (Appendix B.5, assumptions A1 and A2)
    The uniform Taylor expansions require m <= P_i(x) / P_t(x) <= M on the support. For high-dimensional image distributions with disjoint supports or heavy tails, this may fail, and it is not verified experimentally.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Targeted Label-Flipping and Oversampling Attacks on Federated Conditional GANs." pith.science (2026). https://pith.science/paper/AZMYRK4J

@misc{pith2026260809314,
  author       = {Pith},
  title        = {Pith review of: Targeted Label-Flipping and Oversampling Attacks on Federated Conditional GANs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/AZMYRK4J}},
  note         = {Machine review of arXiv:2608.09314}
}
read the original abstract

In a federated learning setup for GANs, several adversarial attacks are possible. One such attack is label flipping, in which malicious clients deliberately alter label information during local training in order to manipulate the global generator. The objective of this attack is to skew the learned generation distribution so that samples conditioned on a target label are instead mapped to a source class. In this work, we investigate the effectiveness of label flipping attacks in federated GANs through both theoretical analysis and empirical evaluation. We further consider an oversampling based variant, in which malicious clients upweight poisoned samples during local training to amplify their influence on the aggregated global model. We quantify the resulting distributional shift by computing the Kullback Leibler divergence between the clean and poisoned class conditional distributions, and show both analytically and on FEMNIST, MNIST, and CIFAR10 that the semantic damage of the attack grows linearly in the effective poisoning strength while deviation from the true target distribution grows only quadratically, making the attack effective yet difficult to detect from label agnostic metrics.

Figures

Figures reproduced from arXiv: 2608.09314 by the authors.

Figure 1
Figure 1. KL divergence trends on FEMNIST as a function [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. HOG feature distributions for the source ( [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Target-label (𝑦 = 2) conditional generations under increasing adversarial participation (0, 5, . . . , 50). 𝑃𝑡 itself — so to leading order 𝑃˜ 𝑡 “looks like” 𝑃𝑡 even when 𝛽 is non-negligible. Implications. Together, Lemmas 5.1 and 5.2 describe a structural asymmetry: the semantic damage of the attack (the collapse of source–target divergence) accrues at order 𝛽, while the most natural detection signal — deviation fr… view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: KL divergence trends on FEMNIST as a function [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 6
Figure 6. Figure 6: Generated samples across all class labels on FEM [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 5
Figure 5. Figure 5: HOG feature distributions for the source ( [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 7
Figure 7. Figure 7: KL divergence trends on MNIST (𝑠 = 3, 𝑡 = 8) corre￾sponding to [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

27 extracted references · 7 canonical work pages

  1. [1]

    Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. 2020. How to backdoor federated learning. InInternational conference on artificial intelligence and statistics. PMLR, 2938–2948

    work page 2020

  2. [2]

    Arjun Nitin Bhagoji, Supriyo Chakraborty, Prateek Mittal, and Seraphin Calo

  3. [3]

    Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer

  4. [4]

    Brendan McMahan, Virginia Smith, and Ameet Talwalkar

    Sebastian Caldas, Sai Meher Karthik Duddu, Peter Wu, Tian Li, Jakub Konečný, H. Brendan McMahan, Virginia Smith, and Ameet Talwalkar. 2019. LEAF: A Benchmark for Federated Settings. arXiv:1812.01097 [cs.LG] https://arxiv.org/ abs/1812.01097

    arXiv 2019

  5. [5]

    Gregory Cohen, Saeed Afshar, Jonathan Tapson, and André van Schaik. 2017. EMNIST: an extension of MNIST to handwritten letters. arXiv:1702.05373 [cs.CV] https://arxiv.org/abs/1702.05373

    arXiv 2017

  6. [6]

    Dalal and B

    N. Dalal and B. Triggs. 2005. Histograms of oriented gradients for human detec- tion. In2005 IEEE Computer Society Conference on Computer Vision and Pattern Recognition (CVPR’05), Vol. 1. 886–893 vol. 1. doi:10.1109/CVPR.2005.177

    doi:10.1109/cvpr.2005.177 2005

  7. [7]

    Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Gong. 2020. Local model poisoning attacks to{Byzantine-Robust} federated learning. In29th USENIX security symposium (USENIX Security 20). 1605–1622

    work page 2020

  8. [8]

    Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde- Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio

    Ian J. Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde- Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. 2014. Generative Adversarial Networks. arXiv:1406.2661 [stat.ML] https://arxiv.org/abs/1406.2661

    arXiv 2014

Show all 27 references
  1. [9]

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014. Explaining and harnessing adversarial examples.arXiv preprint arXiv:1412.6572(2014)

    2014 arXiv

  2. [10]

    Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. 2017. Gans trained by a two time-scale update rule converge to a local nash equilibrium.Advances in neural information processing systems30 (2017)

    2017

  3. [11]

    Tzu-Ming Harry Hsu, Hang Qi, and Matthew Brown. 2019. Measuring the effects of non-identical data distribution for federated visual classification.arXiv preprint arXiv:1909.06335(2019)

    2019 arXiv

  4. [12]

    Najeeb Moharram Jebreel, Josep Domingo-Ferrer, David Sánchez, and Alberto Blanco-Justicia. 2022. Defending against the Label-flipping Attack in Federated Learning. arXiv:2207.01982 [cs.CR] https://arxiv.org/abs/2207.01982

    2022 arXiv

  5. [13]

    2009.Learning multiple layers of features from tiny images

    Alex Krizhevsky. 2009.Learning multiple layers of features from tiny images. Technical Report

    2009

  6. [14]

    Yann LeCun, Corinna Cortes, and Christopher JC Burges. 1998. The MNIST database of handwritten digits.ATT Labs [Online]2 (1998)

    1998

  7. [15]

    Qinbin Li, Zeyi Wen, Zhaomin Wu, Sixu Hu, Naibo Wang, Yuan Li, Xu Liu, and Bingsheng He. 2023. A Survey on Federated Learning Systems: Vision, Hype and Reality for Data Privacy and Protection.IEEE Transactions on Knowledge and Data Engineering35, 4 (April 2023), 3347–3366. doi...

    2023

  8. [16]

    Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Agüera y Arcas

    H. Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Agüera y Arcas. 2023. Communication-Efficient Learning of Deep Net- works from Decentralized Data. arXiv:1602.05629 [cs.LG] https://arxiv.org/abs/ 1602.05629

    2023 arXiv

  9. [17]

    Mehdi Mirza and Simon Osindero. 2014. Conditional Generative Adversarial Nets. arXiv:1411.1784 [cs.LG] https://arxiv.org/abs/1411.1784

    2014 arXiv

  10. [18]

    Takeru Miyato and Masanori Koyama. 2018. cGANs with Projection Discrimina- tor. arXiv:1802.05637 [cs.LG] https://arxiv.org/abs/1802.05637

    2018 arXiv

  11. [19]

    Fernando Perez-Cruz. 2008. Kullback-Leibler Divergence Estimation of Con- tinuous Distributions.IEEE International Symposium on Information Theory - Proceedings, 1666 – 1670. doi:10.1109/ISIT.2008.4595271

    2008

  12. [20]

    Mohammad Rasouli, Tao Sun, and Ram Rajagopal. 2020. FedGAN: Federated Generative Adversarial Networks for Distributed Data. arXiv:2006.07228 [cs.LG] https://arxiv.org/abs/2006.07228

    2020 arXiv

  13. [21]

    Vale Tolpegin, Stacey Truex, Mehmet Emre Gursoy, and Ling Liu. 2020. Data poisoning attacks against federated learning systems. InEuropean symposium on research in computer security. Springer, 480–501

    2020

  14. [22]

    Yuezhou Wu, Yan Kang, Jiahuan Luo, Yuanqin He, Lixin Fan, Rong Pan, and Qiang Yang. 2022. FedCG: Leverage Conditional GAN for Protecting Privacy and Maintaining Competitive Performance in Federated Learning. InProceedings of the Thirty-First International Joint Conference on A...

    2022 doi

  15. [23]

    Geming Xia, Jian Chen, Chaodong Yu, and Jun Ma. 2023. Poisoning Attacks in Federated Learning: A Survey.IEEE Access11 (2023), 10708–10722. doi:10.1109/ ACCESS.2023.3238823

    2023

  16. [24]

    Dong Yin, Yudong Chen, Ramchandran Kannan, and Peter Bartlett. 2018. Byzantine-robust distributed learning: Towards optimal statistical rates. InInter- national conference on machine learning. Pmlr, 5650–5659. A Supplementary Tables and Figures Table 3: Full per-row KL diverge...

    2018

  17. [50]

    (c–d) Simple label flipping (𝑟= 1) exhibits the same trend with reduced magnitude

    (a–b) Oversampling-based attacks (𝑟= 5) induce a stronger collapse of the target-class feature distribution toward the source. (c–d) Simple label flipping (𝑟= 1) exhibits the same trend with reduced magnitude. Figure 6: Generated samples across all class labels on FEM- NIST un...

    2018

  18. [2017]

    Advances in neural information processing systems30 (2017)

    Machine learning with adversaries: Byzantine tolerant gradient descent. Advances in neural information processing systems30 (2017)

    2017

  19. [2019]

    InInternational conference on machine learning

    Analyzing federated learning through an adversarial lens. InInternational conference on machine learning. PMLR, 634–643

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.