Pith. sign in

REVIEW 2 major objections 5 minor 50 references

Beyond Parameter Space: NTK-Guided Personalized Aggregation for Robust Federated Learning

T0 review · 2 major / 5 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Across five datasets and nine baselines, LIGHTYEAR claims that choosing aggregation partners by an NTK agreement score in function space, evaluated on private validation data, keeps federated clients accurate even when most neighbors…

desk verdict A plausible P2P FL selection rule with broad experiments, undermined by a concrete blind spot: the final-layer NTK agreement score ignores the classification head, so a head-only malicious update passes the filter. read the letter →

arxiv 2608.12108 v2 pith:H2FQM2CJ submitted 2026-08-12 cs.LG

Mirko Konstantin , Stefan Zachow , Anirban Mukhopadhyay This is my paper · ORCID
classification cs.LG
keywords federatedlearningpersonalizedaggregationneuraltangentkernelfunctionspacepeer-to-peerByzantinerobustnessnon-IIDdataclientdrift
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes LIGHTYEAR, a peer-to-peer federated learning method in which each client decides which neighbor updates to accept by evaluating, on its own private validation set, how similarly the two models respond to small parameter changes. The claim is that this final-layer neural tangent kernel (NTK) agreement score captures predictive behavior better than parameter-space distance, so it separates beneficial updates from updates caused by data heterogeneity or malfunctioning clients. If the claim holds, federated systems can personalize aggregation per client without a central server ever seeing local data, and remain stable even when the majority of clients are corrupted. The paper supports the claim with experiments on five datasets spanning classification and segmentation, comparing against nine baselines including FedAvg, robust aggregation methods, and P2P approaches.

What carries the argument

The load-bearing object is the empirical final-layer NTK matrix $K_\theta(V_i)$, whose entry $(a,b)$ is $\frac{1}{C}\langle J_\theta(x_a), J_\theta(x_b)\rangle$ for validation inputs $x_a,x_b$ and output dimension $C$; it is centered and Frobenius-normalized with $H=I-\frac{1}{|V_i|}\mathbf{1}\mathbf{1}^{\top}$. The agreement score is the Frobenius inner product of the two normalized kernel matrices, $A(\theta_i,\theta_j;V_i)$, a centered kernel alignment. Selection applies the threshold $\tau$ (fixed at 0.6 in the experiments) to build $S_i$, and aggregation applies $\bar\theta_i^{(t+1)}=\bar\theta_i^{(t)}+\gamma_t\frac{1}{|S_i|}\sum_{j\in S_i}(\theta_j-\bar\theta_i^{(t)})$, with $\gamma_t$ interpreted as a round-dependent decay that stabilizes training under heterogeneity.

What would settle it

Measure, across many random client partitions and malfunction settings, the correlation between each incoming update's NTK agreement score and the actual change in that client's held-out test error after aggregating the update; if a substantial number of low-scoring updates improve performance or high-scoring updates degrade it, the selection premise fails. A direct adversarial test would craft a malicious model whose final-layer kernel on the validation set matches the victim's kernel, but whose predictions on held-out target data are wrong; if LIGHTYEAR accepts it, the score is not safety-critical.

Watch

Extended reading notes

Core claim

The central discovery is that the final-layer NTK agreement score, defined as the centered Frobenius-normalized kernel alignment between two models evaluated on the local validation set, is a reliable selector for personalized federated aggregation. The paper argues that models with similar local predictive sensitivities on a client's data will not harm that client's target domain, whereas parameter-space proximity gives no such guarantee. Using this score, each client selects the subset of neighbor updates whose agreement exceeds a threshold $\tau$, then averages the selected updates with a round-dependent contraction factor $\gamma_t$; setting $\gamma=1$ reduces the rule to standard FedAvg over the selected set. Empirically, the paper finds that LIGHTYEAR maintains stable accuracy and Dice scores across all datasets and malfunction types, including cases where malfunctioning clients outnumber healthy ones, while centralized baselines collapse to near-random performance on segmentation tasks.

Load-bearing premise

The method assumes that two models which look similar in how they would respond to small training changes on a client's own data will actually help that client's task, an assumption the paper states as intuitive rather than proving.

Editorial extensions

If this is right

  • A client can reject corrupted or misaligned updates without any server-side anomaly detection, because the decision is made locally on its own data.
  • Federated training remains usable when more than half of participants malfunction, a regime where parameter-space robust aggregators such as Krum and clustered methods degrade sharply.
  • The same agreement score can be reused as a per-client stopping criterion or trust score, since it separates benign from malfunctioning updates across datasets and attack types.
  • The regularized aggregation with $\gamma_t<1$ provides a simple remedy for client drift that is independent of the selection mechanism.
  • The method's quadratic communication cost in the number of clients confines it to small, reliability-critical federations, which the paper argues is the right regime for medical imaging.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the paper is right, the same final-layer NTK alignment could be applied in centralized FL by having the server evaluate incoming updates on a public proxy validation set, at the cost of weakening the privacy assumption that motivated the P2P design.
  • Because the score uses only the final layer, it measures task-head alignment rather than representation shifts; a natural extension is to test whether full-network or intermediate-layer NTK alignment improves selection in realistic covariate-shift settings.
  • The threshold $\tau$ is fixed globally at 0.6; per-client or round-adaptive thresholds could push the method further in highly heterogeneous federations without changing the machinery.
  • A minimal-validation-size analysis would tell practitioners how much local data each client must hold before the agreement score is trustworthy.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 5 minor

Summary. The paper proposes LIGHTYEAR, a peer-to-peer federated learning method for personalized aggregation under data heterogeneity and client malfunctions. Instead of comparing updates in parameter space, each client computes an agreement score between its own final-layer neural tangent kernel and that of each neighbor on a local validation set (Eqs. 11-15), selects neighbors whose score exceeds a threshold tau (Eq. 16), and aggregates selected updates with a round-decayed mixing coefficient gamma^t (Eq. 17). The authors evaluate on five datasets (FEMNIST, Camelyon17, ISIC19, ultrasound, chest X-ray) with ANA, sign-flipping, random, and dynamic malfunctions against nine baselines, reporting mean accuracy/Dice with standard deviations, and claim consistent superiority.

Significance. If the method works as claimed, the function-space selection idea and P2P evaluation are a useful contribution. Strengths include a broad benchmark spanning classification and segmentation, three malfunction types plus a dynamic setting, inclusion of two P2P baselines, open-source code, and a detailed reproducibility appendix. However, the central equivalence between the final-layer NTK agreement score and predictive alignment is not established and, as detailed below, is false for head-only corruptions. The empirical claim of consistent superiority is also contradicted by the appendix tables in low-malfunction regimes. With those issues addressed, the paper could be a solid contribution to robust personalized federated learning.

major comments (2)
  1. [§4.5, Eqs. (11)-(15)] The final-layer NTK agreement score is invariant to the final linear layer, which undermines the selection mechanism for head-only corruptions. For a network with h = W_L phi(x), the Jacobian in Eq. (11) is dh/dtheta^(L) = phi(x) plus a bias-constant term, independent of W_L; consequently the kernel in Eq. (12), its centered/normalized form in Eq. (13), and the score in Eq. (14) depend only on the feature extractor. A malfunctioning client that copies the feature extractor and flips the sign of the classification head has chance-level accuracy on V_i but score A = 1, passes the threshold in Eq. (16), and corrupts the aggregate in Eq. (17). The attacks in §4.2 (ANA, SFA, random init) all perturb the feature extractor, so the separation shown in Fig. 7 does not test this failure mode. The manuscript should either prove a property that rules out this case, change the score to include output-space agreement on V_i, or compute the NTK over all layers; as it stands, the central claim that the score measures predictive behavior on the target domain is not supported.
  2. [§7 and Appendix C, Tables 13, 14, 17, 18, 20] The abstract and §7 claim that LIGHTYEAR consistently outperforms all baseline approaches, but several low-malfunction rows in the paper's own tables contradict this. For example, Ultrasound ANA with one malfunction: AFA 86.1 vs LIGHTYEAR 83.1 (Table 13); XRay ANA with one malfunction: AFA 86.8 vs LIGHTYEAR 84.4 (Table 17); Ultrasound SFA with one malfunction: CFL 86.6 vs LIGHTYEAR 83.6 (Table 14); XRay dynamic with one malfunction: AFA 87.4 vs LIGHTYEAR 82.7 (Table 20). No significance tests are reported, and the reported standard deviations overlap in most of these cases. The authors should replace the global superiority claim with a precise statement of the regimes where LIGHTYEAR is superior, e.g., high malfunction rates, and report paired significance tests or effect sizes.
minor comments (5)
  1. [§4.3, Eq. (5)] Eq. (5) is presented as an equality, but the target error of the corrupted model is at most the sum of the two displayed terms by the triangle inequality; Eq. (9) correctly uses an inequality. Please correct Eq. (5) or state it as an upper bound.
  2. [§4.7, Eq. (17)] Eq. (17) mixes notation: neighbor models are written theta_j while the client model is written bar_theta_i. Please clarify whether neighbors send their raw local models or their aggregated bar_theta_j updates.
  3. [Appendix C, Tables 9-12] Several table captions are mismatched: Table 9 is numbered as dynamically changing malfunction but reports ANA, Table 10 reports SFA, Table 11 reports Random, and Table 12 spells Dyanmic. Please fix the captions.
  4. [Figures 6 and 7] The dataset name casing is inconsistent (Femnist vs FEMNIST) and the x-axis labels in Fig. 7 are duplicated; please harmonize the labels across figures and tables.
  5. [§4.7] The text calls gamma^t a regularization parameter, but it is a time-decay mixing coefficient rather than a penalty on a norm; consider renaming it to avoid confusion with regularization in optimization.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the NTK agreement score is computed from model Jacobians on local validation data, and the claimed gains are measured on held-out test sets; the self-citations are not load-bearing.

full rationale

LIGHTYEAR's derivation chain is self-contained and does not reduce to its inputs by construction. The agreement score A(theta_i, theta_j; V_i) in Eq. 14 is a closed-form kernel alignment computed directly from the final-layer Jacobians of the two models on the local validation set V_i, with no fitted parameter entering its definition. Selection in Eq. 16 is a threshold operation on this computed score, and aggregation in Eq. 17 applies a fixed, round-dependent scalar gamma. The only tuned quantities are the global hyperparameters gamma and tau, which are scalars selected via ablations and an agreement-score distribution plot; they are not outputs of the model and do not define the score. The paper's headline claim is evaluated on client test sets that are disjoint from the validation sets used for selection, so the empirical comparison is not statistically forced by the selection rule. The NTK formulation itself is attributed to external prior work [21, 45], and the two self-citations in the paper ([24, 25]) appear only in the related-work and introductory context; neither is invoked as a uniqueness theorem or as the justification for the agreement-score construction. The paper does contain a substantive correctness risk: the final-layer NTK is invariant to the output head, and the assumption that kernel agreement tracks beneficial predictive behavior on the target domain is asserted by intuition rather than proven. However, that concern is about validity and threat modeling, not about circularity: no equation in the paper is defined in terms of the quantity it is used to predict, and no fitted parameter is renamed as a prediction. Accordingly, the appropriate circularity finding is a clean non-finding with score 0.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The central claim rests on the representativeness of the local validation set, the heuristic link between final-layer NTK agreement and update benefit, and the standard Ben-David domain adaptation bound. The only numeric free parameters are the global selection threshold tau and the aggregation decay gamma. No new entities are postulated.

free parameters (2)
  • tau (selection threshold) = 0.6
    Global threshold on the NTK agreement score in Eq. 16, chosen from the score distributions in Figure 7 and used for all experiments.
  • gamma (regularization decay) = 0.95
    Decay factor in Eq. 17, selected from the ablation in Figure 6 and fixed across all experiments.
assumptions (4)
  • domain assumption Local validation set V_i is representative of client i's target distribution (D_val approximately D_i)
    Invoked in Section 4.5 to justify using V_i in place of D_i for the agreement score; biased validation data would break the selection mechanism.
  • domain assumption Models with similar final-layer NTK structure on V_i exhibit similar predictive behavior
    Stated as an intuition in Section 4.5 and used to define the selection rule in Eq. 16; no proof is provided.
  • standard math Ben-David domain adaptation bound (Eq. 7) applies to the client model class
    Cited from [5] and used in Section 4.3 to decompose error into exchangeability and corruption terms.
  • domain assumption Parameter-space distance is a poor proxy for predictive behavior in heterogeneous settings
    Motivates the function-space approach; supported by citation [6] rather than by analysis in this paper.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Beyond Parameter Space: NTK-Guided Personalized Aggregation for Robust Federated Learning." pith.science (2026). https://pith.science/paper/H2FQM2CJ

@misc{pith2026260812108,
  author       = {Pith},
  title        = {Pith review of: Beyond Parameter Space: NTK-Guided Personalized Aggregation for Robust Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/H2FQM2CJ}},
  note         = {Machine review of arXiv:2608.12108}
}
read the original abstract

Federated learning (FL) enables collaborative model training across distributed clients while keeping data local. A central challenge is determining which client updates are beneficial for aggregation with respect to each client's target domain. Existing methods typically address this problem in parameter space by comparing model parameters or gradients. However, parameter-space similarity can be a poor proxy for predictive behavior, especially under heterogeneous, non-IID data. Consequently, updates that are misaligned with a client's target domain, including those caused by heterogeneous data or malfunctioning clients, may degrade local model performance. We propose Local Inference Guided Aggregation for Heterogeneous Training Environments to Yield Enhancement Through Agreement and Regularization (LIGHTYEAR), a federated learning framework that performs update selection in function space. LIGHTYEAR uses an NTK-based agreement score to characterize predictive behavior and determine a personalized aggregation set for each client. By relating model parameters to local predictive responses, the Neural Tangent Kernel (NTK) provides a more expressive criterion for update selection than parameter-space similarity alone. Because function-space information is not available before aggregation in conventional centralized FL, LIGHTYEAR uses a peer-to-peer (P2P) topology in which clients exchange updates directly and evaluate incoming models on private validation data. Each client selects only updates that are beneficial for its own target domain and aggregates them using a regularized rule that improves stability under heterogeneity. Across five datasets and nine baseline methods, LIGHTYEAR consistently outperforms centralized FL baselines and existing P2P approaches.

Figures

Figures reproduced from arXiv: 2608.12108 by the authors.

Figure 1
Figure 1. Illustration of the discrepancy between parameter space and function space. While [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Illustration of the decomposition of the prediction error. The boxplot displays the [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Average performance under three client malfunction types, aggregated over all [PITH_FULL_IMAGE:figures/full_fig_p011_3.png] view at source ↗
Figures from the paper (8 more)
Figure 7
Figure 7. Figure 7: Distribution of the agreement score across all evaluated scenarios and clients, [PITH_FULL_IMAGE:figures/full_fig_p014_7.png]
Figure 8
Figure 8. Figure 8: Sample images from each client, illustrating distinct differences in their data dis [PITH_FULL_IMAGE:figures/full_fig_p019_8.png]
Figure 9
Figure 9. Figure 9: Sample images from each client, illustrating distinct differences in their data dis [PITH_FULL_IMAGE:figures/full_fig_p020_9.png]
Figure 10
Figure 10. Figure 10: Sample images with the corresponding segmentation masks from the ultrasound [PITH_FULL_IMAGE:figures/full_fig_p021_10.png]
Figure 11
Figure 11. Figure 11: Sample images with the corresponding segmentation masks from the xray dataset [PITH_FULL_IMAGE:figures/full_fig_p021_11.png]
Figure 12
Figure 12. Figure 12: Comparison of communication costs between centralized and P2P topology as [PITH_FULL_IMAGE:figures/full_fig_p022_12.png]
Figure 13
Figure 13. Figure 13: Training performance on FEMNIST under varying levels of corruption. Each plot [PITH_FULL_IMAGE:figures/full_fig_p026_13.png]
Figure 14
Figure 14. Figure 14: Training performance on Camelyon17 under varying levels of corruption. Each [PITH_FULL_IMAGE:figures/full_fig_p027_14.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

50 extracted references · 32 canonical work pages

  1. [1]

    Benchmarking robustness and privacy- preserving methods in federated learning.Future Generation Computer Systems, 155: 18–38, 2024

    Zeinab Alebouyeh and Amir Jalaly Bidgoly. Benchmarking robustness and privacy- preserving methods in federated learning.Future Generation Computer Systems, 155: 18–38, 2024

    work page 2024

  2. [2]

    Federated learning for privacy preservation in smart healthcare systems: A comprehensive survey

    Mansoor Ali, Faisal Naeem, Muhammad Tariq, and Georges Kaddoum. Federated learning for privacy preservation in smart healthcare systems: A comprehensive survey. IEEE journal of biomedical and health informatics, 27(2):778–789, 2022

    work page 2022

  3. [3]

    Peter Bandi, Oscar Geessink, Quirine Manson, Marcory Van Dijk, Maschenka Balken- hol, Meyke Hermsen, Babak Ehteshami Bejnordi, Byungjae Lee, Kyunghyun Paeng, Aoxiao Zhong, et al. From detection of individual metastases to classification of lymph node status at the patient level: the camelyon17 challenge.IEEE transactions on med- ical imaging, 38(2):550–560, 2018

    work page 2018

  4. [4]

    Analysis of representations for domain adaptation.Advances in neural information processing sys- tems, 19, 2006

    Shai Ben-David, John Blitzer, Koby Crammer, and Fernando Pereira. Analysis of representations for domain adaptation.Advances in neural information processing sys- tems, 19, 2006

    work page 2006

  5. [5]

    A theory of learning from different domains.Machine learning, 79:151–175, 2010

    Shai Ben-David, John Blitzer, Koby Crammer, Alex Kulesza, Fernando Pereira, and Jennifer Wortman Vaughan. A theory of learning from different domains.Machine learning, 79:151–175, 2010

    work page 2010

  6. [6]

    Measuring and regularizing networks in function space.arXiv preprint arXiv:1805.08289, 2018

    Ari S Benjamin, David Rolnick, and Konrad Kording. Measuring and regularizing networks in function space.arXiv preprint arXiv:1805.08289, 2018

    arXiv 2018

  7. [7]

    Machine learning with adversaries: Byzantine tolerant gradient descent.Advances in neural information processing systems, 30, 2017

    Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer. Machine learning with adversaries: Byzantine tolerant gradient descent.Advances in neural information processing systems, 30, 2017

    2017

  8. [8]

    Leaf: A benchmark for federated settings.arXiv preprint arXiv:1812.01097, 2018

    Sebastian Caldas, Sai Meher Karthik Duddu, Peter Wu, Tian Li, Jakub Kone ˇcn`y, H Brendan McMahan, Virginia Smith, and Ameet Talwalkar. Leaf: A benchmark for federated settings.arXiv preprint arXiv:1812.01097, 2018

    arXiv 2018

Show all 50 references
  1. [9]

    Fltrust: Byzantine- robust federated learning via trust bootstrapping.arXiv preprint arXiv:2012.13995, 2020

    Xiaoyu Cao, Minghong Fang, Jia Liu, and Neil Zhenqiang Gong. Fltrust: Byzantine- robust federated learning via trust bootstrapping.arXiv preprint arXiv:2012.13995, 2020

    2012 arXiv

  2. [10]

    Transunet: Rethinking the u-net architecture design for medical image segmentation through the lens of transformers

    Jieneng Chen, Jieru Mei, Xianhang Li, Yongyi Lu, Qihang Yu, Qingyue Wei, Xiangde Luo, Yutong Xie, Ehsan Adeli, Yan Wang, et al. Transunet: Rethinking the u-net architecture design for medical image segmentation through the lens of transformers. Medical Image Analysis, page 103...

    2024

  3. [11]

    Personalized federated learning with attention-based client selection

    Zihan Chen, Jundong Li, and Cong Shen. Personalized federated learning with attention-based client selection. InICASSP 2024-2024 IEEE International Confer- ence on Acoustics, Speech and Signal Processing (ICASSP), pages 6930–6934. IEEE, 2024

    2024

  4. [12]

    Noel CF Codella, David Gutman, M Emre Celebi, Brian Helba, Michael A Marchetti, Stephen W Dusza, Aadi Kalloo, Konstantinos Liopyris, Nabin Mishra, Harald Kittler, 16KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGA TION et al. Skin lesion analysis toward melanoma d...

    2017

  5. [13]

    Bcn20000: Dermoscopic lesions in the wild.arXiv preprint arXiv:1908.02288, 2019

    Marc Combalia, Noel CF Codella, Veronica Rotemberg, Brian Helba, Veronica Vila- plana, Ofer Reiter, Cristina Carrera, Alicia Barreiro, Allan C Halpern, Susana Puig, et al. Bcn20000: Dermoscopic lesions in the wild.arXiv preprint arXiv:1908.02288, 2019

    1908 arXiv

  6. [14]

    Fetal abdominal structures segmentation dataset using ultrasonic images

    C Da et al. Fetal abdominal structures segmentation dataset using ultrasonic images. Mendeley Data, 2023

    2023

  7. [15]

    Byzantine-robust decentralized federated learning

    Minghong Fang, Zifan Zhang, Hairi, Prashant Khanduri, Jia Liu, Songtao Lu, Yuchen Liu, and Neil Gong. Byzantine-robust decentralized federated learning. InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 2874–2888, 2024

    2024

  8. [16]

    A survey on decentralized federated learning.arXiv preprint arXiv:2308.04604, 2023

    Edoardo Gabrielli, Giovanni Pica, and Gabriele Tolomei. A survey on decentralized federated learning.arXiv preprint arXiv:2308.04604, 2023

    2023

  9. [17]

    Chexmask: a large-scale dataset of anatomical segmentation masks for multi-center chest x-ray images.Scientific Data, 11(1):511, 2024

    Nicolás Gaggion, Candelaria Mosquera, Lucas Mansilla, Julia Mariel Saidman, Mar- tina Aineseder, Diego H Milone, and Enzo Ferrante. Chexmask: a large-scale dataset of anatomical segmentation masks for multi-center chest x-ray images.Scientific Data, 11(1):511, 2024

    2024

  10. [18]

    Byzantine-robust decentralized learning via clippedgossip.arXiv preprint arXiv:2202.01545, 2022

    Lie He, Sai Praneeth Karimireddy, and Martin Jaggi. Byzantine-robust decentralized learning via clippedgossip.arXiv preprint arXiv:2202.01545, 2022

    2022 arXiv

  11. [19]

    Densely connected convolutional networks

    Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. InProceedings of the IEEE conference on computer vision and pattern recognition, pages 4700–4708, 2017

    2017

  12. [20]

    Fedclust: Optimizing federated learning on non-iid data through weight-driven client clustering

    Md Sirajul Islam, Simin Javaherian, Fei Xu, Xu Yuan, Li Chen, and Nian-Feng Tzeng. Fedclust: Optimizing federated learning on non-iid data through weight-driven client clustering. In2024 IEEE International Parallel and Distributed Processing Symposium Workshops (IPDPSW), pages...

    2024

  13. [21]

    Neural tangent kernel: Conver- gence and generalization in neural networks.Advances in neural information process- ing systems, 31, 2018

    Arthur Jacot, Franck Gabriel, and Clément Hongler. Neural tangent kernel: Conver- gence and generalization in neural networks.Advances in neural information process- ing systems, 31, 2018

    2018

  14. [22]

    Mimic-cxr, a de-identified publicly available database of chest radiographs with free-text reports

    Alistair EW Johnson, Tom J Pollard, Seth J Berkowitz, Nathaniel R Greenbaum, Matthew P Lungren, Chih-ying Deng, Roger G Mark, and Steven Horng. Mimic-cxr, a de-identified publicly available database of chest radiographs with free-text reports. Scientific data, 6(1):317, 2019

    2019

  15. [23]

    Detecting change in data streams

    Daniel Kifer, Shai Ben-David, and Johannes Gehrke. Detecting change in data streams. InVLDB, volume 4, pages 180–191. Toronto, Canada, 2004

    2004

  16. [24]

    Asmr: Angular support for malfunctioning client resilience in federated learning

    Mirko Konstantin, Moritz Fuchs, and Anirban Mukhopadhyay. Asmr: Angular support for malfunctioning client resilience in federated learning. InMedical Imaging with Deep Learning, pages 754–767. PMLR, 2024. KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGA TION17

    2024

  17. [25]

    Equitable federated learning with nca

    Nick Lemke, Mirko Konstantin, Henry John Krumb, John Kalkhof, Jonathan Stieber, and Anirban Mukhopadhyay. Equitable federated learning with nca. InInternational Conference on Medical Image Computing and Computer-Assisted Intervention, pages 168–177. Springer, 2025

    2025

  18. [26]

    Learning to detect malicious clients for robust federated learning.arXiv preprint arXiv:2002.00211, 2020

    Suyi Li, Yong Cheng, Wei Wang, Yang Liu, and Tianjian Chen. Learning to detect malicious clients for robust federated learning.arXiv preprint arXiv:2002.00211, 2020

    2002 arXiv

  19. [27]

    Federated optimization in heterogeneous networks.Proceedings of Ma- chine learning and systems, 2:429–450, 2020

    Tian Li, Anit Kumar Sahu, Manzil Zaheer, Maziar Sanjabi, Ameet Talwalkar, and Vir- ginia Smith. Federated optimization in heterogeneous networks.Proceedings of Ma- chine learning and systems, 2:429–450, 2020

    2020

  20. [28]

    Ditto: Fair and robust federated learning through personalization

    Tian Li, Shengyuan Hu, Ahmad Beirami, and Virginia Smith. Ditto: Fair and robust federated learning through personalization. InInternational conference on machine learning, pages 6357–6368. PMLR, 2021

    2021

  21. [29]

    Threats, attacks and defenses to federated learning: issues, taxonomy and perspectives.Cybersecurity, 5(1):4, 2022

    Pengrui Liu, Xiangrui Xu, and Wei Wang. Threats, attacks and defenses to federated learning: issues, taxonomy and perspectives.Cybersecurity, 5(1):4, 2022

    2022

  22. [30]

    Federated conformal predictors for distributed uncertainty quantification

    Charles Lu, Yaodong Yu, Sai Praneeth Karimireddy, Michael Jordan, and Ramesh Raskar. Federated conformal predictors for distributed uncertainty quantification. In International Conference on Machine Learning, pages 22942–22964. PMLR, 2023

    2023

  23. [31]

    Communication-efficient learning of deep networks from decentralized data

    Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication-efficient learning of deep networks from decentralized data. InArtificial intelligence and statistics, pages 1273–1282. PMLR, 2017

    2017

  24. [32]

    The hidden vulnera- bility of distributed learning in byzantium.arXiv preprint arXiv:1802.07927, 2018

    El Mahdi El Mhamdi, Rachid Guerraoui, and Sébastien Rouault. The hidden vulnera- bility of distributed learning in byzantium.arXiv preprint arXiv:1802.07927, 2018

    2018 arXiv

  25. [33]

    Byzantine-robust federated machine learning through adaptive model averaging.arXiv preprint arXiv:1909.05125, 2019

    Luis Muñoz-González, Kenneth T Co, and Emil C Lupu. Byzantine-robust federated machine learning through adaptive model averaging.arXiv preprint arXiv:1909.05125, 2019

    1909 arXiv

  26. [34]

    Flamby: Datasets and benchmarks for cross-silo federated learning in realistic healthcare settings

    Jean Ogier du Terrail, Samy-Safwan Ayed, Edwige Cyffers, Felix Grimberg, Chaoyang He, Regis Loeb, Paul Mangold, Tanguy Marchand, Othmane Marfoq, Erum Mushtaq, Boris Muzellec, Constantin Philippenko, Santiago Silva, Maria Tele ´nczuk, Shadi Albarqouni, Salman Avestimehr, Auréli...

    2022

  27. [35]

    Robust aggregation for feder- ated learning.IEEE Transactions on Signal Processing, 70:1142–1154, 2022

    Krishna Pillutla, Sham M Kakade, and Zaid Harchaoui. Robust aggregation for feder- ated learning.IEEE Transactions on Signal Processing, 70:1142–1154, 2022. 18KONSTANTIN ET AL.: NTK-GUIDED PERSONALIZED AND ROBUST AGGREGA TION

    2022

  28. [36]

    On the byzantine robustness of clustered federated learning

    Felix Sattler, Klaus-Robert Müller, Thomas Wiegand, and Wojciech Samek. On the byzantine robustness of clustered federated learning. InICASSP 2020-2020 IEEE In- ternational Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 8861–8865. IEEE, 2020

    2020

  29. [37]

    Enhancing privacy in federated learning: Secure ag- gregation for real-world healthcare applications

    Riccardo Taiello, Sergen Cansiz, Marc Vesin, Francesco Cremonesi, Lucia Innocenti, Melek Önen, and Marco Lorenzi. Enhancing privacy in federated learning: Secure ag- gregation for real-world healthcare applications. InInternational Conference on Med- ical Image Computing and C...

    2024

  30. [38]

    Efficientnet: Rethinking model scaling for convolutional neural networks

    Mingxing Tan and Quoc Le. Efficientnet: Rethinking model scaling for convolutional neural networks. InInternational conference on machine learning, pages 6105–6114. PMLR, 2019

    2019

  31. [39]

    The ham10000 dataset, a large collection of multi-source dermatoscopic images of common pigmented skin lesions

    Philipp Tschandl, Cliff Rosendahl, and Harald Kittler. The ham10000 dataset, a large collection of multi-source dermatoscopic images of common pigmented skin lesions. Scientific data, 5(1):1–9, 2018

    2018

  32. [40]

    Swarm learning for decen- tralized and confidential clinical machine learning.Nature, 594(7862):265–270, 2021

    Stefanie Warnat-Herresthal, Hartmut Schultze, Krishnaprasad Lingadahalli Shastry, Sathyanarayanan Manamohan, Saikat Mukherjee, Vishesh Garg, Ravi Sarveswara, Kristian Händler, Peter Pickkers, N Ahmad Aziz, et al. Swarm learning for decen- tralized and confidential clinical mac...

    2021

  33. [41]

    Byzantine-robust federated learning through collaborative malicious gradient filtering

    Jian Xu, Shao-Lun Huang, Linqi Song, and Tian Lan. Byzantine-robust federated learning through collaborative malicious gradient filtering. In2022 IEEE 42nd Inter- national Conference on Distributed Computing Systems (ICDCS), pages 1223–1235. IEEE, 2022

    2022

  34. [42]

    Byzantine-robust decentralized learning via remove- then-clip aggregation

    Caiyi Yang and Javad Ghaderi. Byzantine-robust decentralized learning via remove- then-clip aggregation. InProceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 21735–21743, 2024

    2024

  35. [43]

    Fedtrans: Client-transparent util- ity estimation for robust federated learning

    Mingkun Yang, Ran Zhu, Qing Wang, and Jie Yang. Fedtrans: Client-transparent util- ity estimation for robust federated learning. InInternational Conference on Learning Representations, volume 2024, pages 42668–42692, 2024

    2024

  36. [44]

    Byzantine-robust distributed learning: Towards optimal statistical rates

    Dong Yin, Yudong Chen, Ramchandran Kannan, and Peter Bartlett. Byzantine-robust distributed learning: Towards optimal statistical rates. InInternational conference on machine learning, pages 5650–5659. Pmlr, 2018

    2018

  37. [45]

    Neural tangent kernel empowered federated learning

    Kai Yue, Richeng Jin, Ryan Pilgrim, Chau-Wai Wong, Dror Baron, and Huaiyu Dai. Neural tangent kernel empowered federated learning. InInternational Conference on Machine Learning, pages 25783–25803. PMLR, 2022

    2022

  38. [46]

    Anomaly detec- tion and defense techniques in federated learning: a comprehensive review.Artificial Intelligence Review, 57(6):150, 2024

    Chang Zhang, Shunkun Yang, Lingfeng Mao, and Huansheng Ning. Anomaly detec- tion and defense techniques in federated learning: a comprehensive review.Artificial Intelligence Review, 57(6):150, 2024

    2024

  39. [47]

    Fedala: Adaptive local aggregation for personalized federated learning

    Jianqing Zhang, Yang Hua, Hao Wang, Tao Song, Zhengui Xue, Ruhui Ma, and Haib- ing Guan. Fedala: Adaptive local aggregation for personalized federated learning. In Proceedings of the AAAI conference on artificial intelligence, volume 37, pages 11237– 11244, 2023. KONSTANTIN ET...

    2023

  40. [48]

    Fldetector: Defend- ing federated learning against model poisoning attacks via detecting malicious clients

    Zaixi Zhang, Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. Fldetector: Defend- ing federated learning against model poisoning attacks via detecting malicious clients. InProceedings of the 28th ACM SIGKDD conference on knowledge discovery and data mining, pages 2545–2555, 2022

    2022

  41. [49]

    Federated learning with non-iid data.arXiv preprint arXiv:1806.00582, 2018

    Yue Zhao, Meng Li, Liangzhen Lai, Naveen Suda, Damon Civin, and Vikas Chandra. Federated learning with non-iid data.arXiv preprint arXiv:1806.00582, 2018

    2018 arXiv

  42. [50]

    Federated learning on non-iid data: A survey.Neurocomputing, 465:371–390, 2021

    Hangyu Zhu, Jinjin Xu, Shiqing Liu, and Yaochu Jin. Federated learning on non-iid data: A survey.Neurocomputing, 465:371–390, 2021. A Dataset Construction For each dataset we provide a csv-file containing the concrete splits. As mentioned in the main text, each client holds a ...

    2021

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.