Communication-Learning Co-Design for Differentially Private Over-the-Air Federated Distillation

(2) The Hong Kong University of Science; Jia Yan (2); Technology (Guangzhou)); Ying-Jun Angela Zhang (1) ((1) The Chinese University of Hong Kong; Zihao Hu (1)

REVIEW 3 major objections 2 minor 12 references

Communication-Learning Co-Design for Differentially Private Over-the-Air Federated Distillation

T0 review · 3 major / 2 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Differentially private over-the-air federated distillation has a closed-form co-design: optimal per-round transmit powers and a closed-form optimal total number of training rounds, derived from an analytical convergence bound and a moment-a

desk verdict The privacy analysis rests on a wrong sensitivity bound (B_i instead of per-class B_i^k), so the paper's central DP guarantee fails as stated, though the framework is likely repairable. read the letter →

arxiv 2508.06557 v1 pith:2X5KBEMV submitted 2025-08-06 cs.IT cs.LGeess.SPmath.IT

Zihao Hu (1) , Jia Yan (2) , Ying-Jun Angela Zhang (1) ((1) The Chinese University of Hong Kong , (2) The Hong Kong University of Science , Technology (Guangzhou)) This is my paper · ORCID

classification cs.ITcs.LGeess.SPmath.IT

keywords federateddistillationdifferentialprivacyover-the-aircomputationcommunication-learningco-designconvergencerateGaussianmechanismsoft-labelsharingwirelessedgelearning

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper aims to prove that differentially private over-the-air federated distillation (FD) can be jointly optimized in closed form: given a privacy requirement, the best per-round transmit powers, the post-processing scalars, and the total number of training rounds all have explicit formulas. The key trick is replacing model-parameter sharing with per-class averaged soft predictions, so each device sends only $K^2$ symbols per round and the disclosed-signal dimension no longer grows with model size. The authors derive a convergence bound and a differential-privacy noise condition, then optimize against those expressions. If the derivation holds, private FD delivers a better learning–privacy trade-off with far lower uplink communication than conventional differentially private federated learning.

What carries the argument

The load-bearing object is the per-class averaged soft-prediction vector $q^k_{i,t}\in\mathbb{R}^K$, whose entries lie in the probability simplex $\{q\succeq 0, \mathbf{1}^\top q=1\}$. Because the simplex diameter is $\sqrt{2}$, the $\ell_2$ sensitivity of one device's disclosed class-$k$ signal is bounded by $\sqrt{2K}|h_{i,t}P^k_{1,i,t}|/B_i$ (Lemma 1). Three mechanisms carry the argument: (i) the Gaussian mechanism, whose per-round noise variance must scale with the sensitivity and the privacy budget; (ii) the moment accountant [10], which accumulates the $T$ rounds of privacy loss and turns the per-round requirement into the aggregate condition (17); and (iii) the over-the-air superposit

What would settle it

Run a rare-class attack: choose a device with $B_i^k=1$, $B_i=1000$; for all possible neighboring datasets that differ in that single class-$k$ sample, compute the exact $\ell_2$ difference of the disclosed $\hat q^k_{i,t}$ with $\theta_{i,t}$ held fixed and also with $\theta_{i,t}$ retrained after the swap; if the observed maximum exceeds $\sqrt{2K}|h_{i,t}P^k_{1,i,t}|/B_i$, then Lemma 1 is false and the Gaussian noise prescribed by (17) is too small to deliver $(\varepsilon_i,\delta_i)$-DP after $T$ rounds.

Watch

Extended reading notes

Core claim

The paper's central claim is that the communication-learning co-design for differentially private over-the-air FD reduces to a handful of closed-form quantities. Per round, the optimal knowledge-transmit coefficients make the channel-adjusted signal exactly match the class-weight, i.e., $h_{i,t}P^{k*}_{1,i,t}\sqrt{K}/\lambda^{k*}_t = B^k_i/B^k$, which zeros the misalignment term $\Phi_{1,i,t}$ in the convergence bound. The DP noise powers are then chosen so that the aggregate noise variance satisfies $\sum_{j=1}^M |h_{j,t}P^{k*}_{2,j,t}|^2 + \sigma_n^2 = 4T(\lambda^{k*}_t)^2 \max_{i}(B^k_i/B^k)^2 \rho_i$ when $T$ is large, and can be set to zero when $T$ is small enough that channel noise al

Load-bearing premise

The load-bearing premise is Lemma 1's sensitivity estimate, which puts the device's total sample count $B_i$ in the denominator even though the disclosed signal averages only the $B_i^k$ samples of class $k$, and treats the local model as unchanged when one sample is altered; if the true sensitivity is $O(\sqrt{2K}|h_{i,t}P^k_{1,i,t}|/B_i^k)$ or includes a label change, the required DP noise is larger and the paper's claimed $(\varepsilon_i,\delta_i)$ guarantee does not follo

Editorial extensions

If this is right

Given any total round count $T$, the optimal per-round transmit powers and post-processing scalars are explicit (Proposition 1), so no iterative transceiver optimization is needed.
The optimal round count $T^*$ balances convergence (more rounds reduce the gradient-norm bound's first term) against privacy (more rounds demand more noise), giving a parameter-free training schedule from loss bounds, Lipschitz constants, privacy parameters, and class counts.
The per-round communication cost is $K^2$ symbols, independent of model dimension, so the scheme scales to large models where conventional FL's model-dimension-proportional DP noise and uplink cost become prohibitive.
Condition (17) is on the sum of all devices' noise powers plus channel noise, meaning the DP burden is shared across devices; when $T$ is small, channel noise alone can satisfy the privacy constraint, so no artificial DP noise is needed.
Numerically, the proposed FD co-design reaches higher testing accuracy at lower uplink time than constant-$T$ FD and over-the-air FL baselines under the same or stricter DP requirements.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If the sensitivity bound in Lemma 1 is corrected to use the per-class count $B_i^k$ rather than $B_i$, then the privacy condition (17) and the optimal round count $T^*$ would both change: rare classes would require more noise, and the paper's claimed DP guarantee for imbalanced datasets would need re-verification. This is a direct test of the paper's load-bearing step, not a claim the paper makes.
The framework suggests a channel-aware fairness interpretation the paper does not develop: condition (17) lets devices with stronger channels carry a larger share of the DP noise, so weaker devices can spend power on knowledge transmission; whether this improves worst-case accuracy is an open question.
The same low-dimensional-signaling structure would extend to multi-label or regression tasks if the probability-simplex bound is replaced by a range bound on the disclosed outputs; the closed-form design would then depend on the output range rather than the class count.
Since the optimal $T^*$ depends on constants ($f_{i,\max}$, $L_1$, $L_2$, $\gamma$, $\eta_0$) that a device may not know a priori, a practical implementation could estimate these quantities online and re-solve the closed forms periodically; the paper's static analysis leaves this adaptation unexamined.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Here's my take. The paper is a direct extension of the authors' earlier over-the-air FL co-design (ref [5]) and over-the-air FD (ref [6]) to the differentially private setting. It has a clean structure: a convergence bound, a DP-noise condition, then closed-form transceiver and round-count choices. The writing is clear, and the convergence analysis (Theorem 1) is internally consistent under Assumptions 1-3. The idea of co-designing per-round transceivers with the total number of privacy-preserving rounds is genuinely useful, and the low-dimensional output sharing in FD is a sensible way to reduce both uplink cost and DP noise.

The problem is that the central DP guarantee is built on Lemma 1, and Lemma 1 is wrong. The disclosed quantity q^k_{i,t} is the average of soft predictions over only the B_i^k samples in class k, but the sensitivity bound in (16) divides by the total sample count B_i. Appendix B, Eq. (38), literally sums over all samples and then divides by B_i. Replacing one class-k sample changes the average by order 1/B_i^k, not 1/B_i. For imbalanced data, say B_i=100 and B_i^k=1, the claimed bound is 100x too small in l2, and the resulting Gaussian noise variance in condition (17) is 10^4x too small, so the (epsilon,delta) guarantee does not follow. This error propagates directly into Proposition 1 (P2*) and Proposition 2 (T*).

There is a second, independent problem: theta_{i,t} itself is updated on the private data at every round via (4), so neighboring datasets diverge in model trajectories. Lemma 1 treats the local model as if it were fixed when bounding the per-round sensitivity. A correct argument needs either per-round conditional sensitivity given the previous transcript, or a clipping/sub-sampling analysis that accounts for this dependence. The paper does neither.

So the main new contribution—the DP analysis—does not hold as stated. That said, the flaw is concrete and likely repairable: fix the normalization to B_i^k, add a proper sensitivity or clipping argument for the evolving model, and re-derive the closed forms. The convergence analysis and the co-design formulation are solid enough to survive such a repair. It is probably worth refereeing seriously because the framework is relevant and the fix is plausible, but I would not cite or use the current version. It could also make a good reading-group example of how sensitivity proofs go wrong.

Referee Report

3 major / 2 minor

Summary. The paper proposes a differentially private over-the-air federated distillation (FD) framework in which each wireless device transmits noise-perturbed per-class average soft predictions. The authors derive a convergence bound for the FD loss (Theorem 1), a sensitivity bound for the disclosed signal (Lemma 1), and a DP condition after T rounds (Theorem 2). These are used to formulate a two-timescale communication-learning co-design problem and to obtain closed-form transceiver coefficients and an optimal number of training rounds (Propositions 1 and 2). Numerical results on MNIST are presented to compare the proposed scheme with over-the-air FL baselines.

Significance. If the theoretical results were correct, the paper would provide a complete and communication-efficient design for private over-the-air FD: the transmitted signal dimension depends on the number of classes rather than on the model size, and DP noise is shared across devices over the air. The closed-form nature of the design and the inclusion of a moment-accountant privacy analysis are valuable features. The numerical study is extensive. However, the central privacy analysis contains a normalization error in the sensitivity bound that invalidates the main DP guarantee, and the convergence proof also has an unaccounted factor. These are load-bearing for the paper's claims.

major comments (3)

[Appendix B / Lemma 1 (Eq. (16)) and Theorem 2 (Eq. (17))] The sensitivity bound uses the wrong normalization. The disclosed quantity q^k_{i,t} in Eq. (2) is an average over B_i^k class-k samples, not over all B_i samples. Replacing one class-k sample changes q^k by (G(u')-G(u))/B_i^k, so the l2 sensitivity (for fixed θ) scales as 1/B_i^k, not 1/B_i. Eq. (38) divides by B_i while summing over all samples, although only B_i^k terms contribute to q^k. For K=10, B_i=100, B_i^k=1, the bound is 100 times too small in standard deviation and 10^4 times too small in variance. Since Eq. (17) is derived from Eq. (38) via Eq. (39), the claimed (ε_i,δ_i)-DP guarantee fails. Additionally, changing a sample's label can affect two class averages simultaneously, a case not covered by the per-class derivation. All downstream closed-form results inherit the error.
[Lemma 1 / Section II.A (Eq. (4)) and Theorem 2] The sensitivity analysis treats θ_{i,t} as fixed, but θ_{i,t} is updated by Eq. (4) on the private dataset B_i. For neighboring datasets B_i and B_i', the local models differ after the first round. The disclosed vector q^k_{i,t} = (1/B_i^k) Σ G_{θ_{i,t}}(u) therefore depends on the dataset through both the sample average and the model parameters. Lemma 1 only perturbs the sample average while holding θ fixed; it does not bound the true sensitivity of the mechanism from data to output. The composition in Theorem 2 therefore does not establish DP for the full T-round algorithm.
[Appendix A, Eq. (25), step (e)] The inequality (e) ≤ 4γL2η_tS is not justified. From the preceding line, the quantity equals (4γL2/B_i)Σ_i ||Δθ_i||_2 Σ_k (B_i^k)^2/B^k. Since ||Δθ_i||_2 ≤ η_t S, this is at most (4γL2η_tS/B_i)Σ_i Σ_k (B_i^k)^2/B^k. The double sum is not bounded by B_i in general (e.g., M=2, K=1, B_1=1, B_2=100 gives Σ=100.01). Thus Theorem 1's convergence bound is not a valid upper bound without a data-distribution-dependent factor. This invalidates the stated analytical convergence rate, although the factor is constant in the optimization variables and may not change the optimizer.

minor comments (2)

[References] Reference [10] is cited as 'A. Mart´ın, A. Chu, I. Goodfellow, ...' but 'Martín' is part of the first author's given name (Martín Abadi); the surname is Abadi. Please correct the citation.
[Throughout] There are several typographical errors: 'intial learning rate' in Theorem 1; 'Regrading the impact of data distributions' in Section IV; 'wiht' in Section II. Please proofread the manuscript.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper's closed-form transceiver and training-round designs are derived from stated assumptions and optimization of its own analytical bounds, not from fitted data or self-citation chains.

full rationale

The derivation chain is self-contained. Theorem 1 is a convergence bound obtained from Assumptions 1--3 by a standard descent analysis, and Theorem 2 follows from Lemma 1's sensitivity bound combined with an external moments-accountant result [8]. Proposition 1 and Proposition 2 are obtained by minimizing the derived upper bound in closed form; no parameter is fitted to simulation outputs and no experimental curve is used to set the theory's constants. The only self-citations ([5], [6]) supply the baseline and the FD system model, and are not load-bearing for the central learning--privacy trade-off claim. The skeptical concern about Lemma 1's sensitivity denominator (B_i versus B_i^k) is a correctness or conservativeness issue, not a circularity: it does not make the conclusion equivalent to the premise by construction. Accordingly, the circularity score is 0.

Assumptions & free parameters 2 free parameters · 7 assumptions · 0 invented entities

No new physical entities are introduced. The free parameters are the distillation weight gamma (chosen by hand, unspecified for the experiments) and the Lipschitz/boundedness constants that the closed forms depend on but the paper never quantifies. The axioms are the three stated smoothness/boundedness assumptions, the channel and downlink idealizations, the borrowed moments-accountant theorem, and the unstated premise that the local model's data-dependence does not affect the sensitivity, which is the fragile one.

free parameters (2)

gamma (distillation loss weight) = not stated for experiments
Enters the convergence bound, the transceiver design, and T* in Prop. 2; the numerical setup lists eta0, P_i, sigma_n^2, path loss, epsilon_i, delta_i, but not gamma, so the closed forms cannot be evaluated from the paper alone.
L1, L2, S, f_{i,max} = not estimated
Lipschitz and boundedness constants required by Assumptions 1-3 and used in Theorem 1 and Prop. 2; the paper gives no way to compute them for the CNN, so the bound and T* are not quantitatively evaluable in the experiments.

assumptions (7)

domain assumption Assumption 1: gradient of local loss F_i is L1-Lipschitz continuous
Section III-A; standard smoothness assumption used throughout the proof of Theorem 1.
domain assumption Assumption 2: model output map G_theta(.) is L2-Lipschitz in theta
Section III-A; used to bound the distillation-loss mismatch B1 and the gradient terms; also implicitly bounds model drift, but the drift path is never bounded explicitly in the privacy analysis.
domain assumption Assumption 3: gradient norm uniformly bounded by S
Section III-A; used in (25) and (33); needed to make Theorem 1's bound explicit since ||grad F_i(theta_{i,t})|| appears on the right-hand side.
domain assumption Empirical local loss upper bounded by f_{i,max}
Theorem 1 and Prop. 2; no value or estimation procedure is given for the experiments.
domain assumption Block fading with perfect CSI at the PS and error-free broadcast downlink
Sections II-A and II-C; the transmit equalization and normalization require the PS to know all channel coefficients and the broadcast to be noiseless.
standard math Moments-accountant composition sigma = Delta sqrt(2T ln(1/delta))/epsilon from Theorem 1 of [8]
Used in Appendix B to derive Theorem 2; the composition argument assumes conditional per-round sensitivity, which the paper does not verify for the data-dependent local models.
ad hoc to paper Per-round disclosure sensitivity is data-independent given the model (model treated as privacy-inert)
Needed for the T-round composition argument but never stated or bounded; local models are trained on raw data via (4), so their outputs are data-dependent across rounds.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Communication-Learning Co-Design for Differentially Private Over-the-Air Federated Distillation." pith.science (2026). https://pith.science/paper/2X5KBEMV

@misc{pith2026250806557,
  author       = {Pith},
  title        = {Pith review of: Communication-Learning Co-Design for Differentially Private Over-the-Air Federated Distillation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2X5KBEMV}},
  note         = {Machine review of arXiv:2508.06557}
}

read the original abstract

The ever-growing learning model size nowadays challenges the communication efficiency and privacy preservation of the traditional federated learning (FL). In this paper, we propose a novel differentially private (DP) over-the-air federated distillation (FD) framework, where wireless devices (WDs) periodically share noise-perturbed model outputs with the parameter server by harnessing the superposition property of multi-access channels. Accordingly, over-the-air FD enables the shared responsibility of the DP preservation on the low-dimensional disclosed signals among WDs. We study the communication-learning co-design problem in differentially private over-the-air FD, aiming to maximize the learning convergence rate while meeting the transmit power and DP requirements of WDs. The main challenge is rooted in the intractable learning and privacy analysis in over-the-air FD, together with the strong coupling among the decision variables spanning two timescales. To tackle this problem, we first derive the analytical learning convergence rate and privacy losses of WDs, based on which the optimal transceiver design per FD round and long-term training rounds decision are obtained in the closed forms. Numerical results demonstrate that the proposed differentially private over-the-air FD approach achieves a better learning-privacy trade-off with largely-reduced communication overhead than the conventional FL benchmarks.

Figures

Figures reproduced from arXiv: 2508.06557 by the authors.

**Figure 2.** (a) The effective variance Φ2,i,t of aggregated DP-preserving and channel noises at the PS per training round versus the DP requirement ε, and (b) the average testing accuracies versus the uplink communication time. variables across training rounds. All the methods are evaluated on the image classification task over the MNIST database, which consists of 60000 training samples and 10000 testing images from K = 10 cla… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

12 extracted references · 12 canonical work pages

[5]

Communication-Learning Co-Design for Differentially Private Over-the-Air Federated Learni ng with Device Sampling,

Z. Hu, J. Y an, and Y .-J. A. Zhang, “Communication-Learning Co-Design for Differentially Private Over-the-Air Federated Learni ng with Device Sampling,” in IEEE TWC, vol. 23, no. 11, pp. 16788-16804, Nov. 2024

work page 2024
[6]

Optimal Transceiver Design in Over-the-Air Federated Distillation

Z. Hu, J. Y an, Y .-J. A. Zhang, J. Zhang, and K. B. Letaief, “ Opti- mal Transceiver Design in Over-the-Air Federated Distilla tion,” arXiv preprint arXiv:2507.15256, 2025

work page Pith review arXiv 2025
[1]

Communication-efﬁcient learning of deep networks from de centralized data,

B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. Y . Ar cas, “Communication-efﬁcient learning of deep networks from de centralized data,” in Proc. 20th AISTATS, vol. 54, Apr. 2017, pp.1273–1282

work page 2017
[2]

Broadband Analog Aggregat ion for Low-Latency Federated Edge Learning,

G. Zhu, Y . Wang, and K. Huang, “Broadband Analog Aggregat ion for Low-Latency Federated Edge Learning,” in IEEE TWC, vol. 19, no. 1, pp. 491-506, Jan. 2020

work page 2020
[3]

Dwork, and A

C. Dwork, and A. Roth, The Algorithmic F oundations of Differential Privacy, now, 2014

work page 2014
[4]

Privacy Amp liﬁcation for Federated Learning via User Sampling and Wireless Aggre gation,

M. S. E. Mohamed, W.-T. Chang, and R. Tandon, “Privacy Amp liﬁcation for Federated Learning via User Sampling and Wireless Aggre gation,” in IEEE JSAC, vol. 39, no. 12, pp. 3821-3835, Dec. 2021

work page 2021
[7]

Selective knowledge sharin g for privacy- preserving federated distillation without a good teacher,

J. Shao, F. Wu, and J. Zhang, “Selective knowledge sharin g for privacy- preserving federated distillation without a good teacher, ” Nature Com- mun., vol. 15, no. 1, pp. 1–11, Jan. 2024

work page 2024
[8]

User-Level Privacy-Preserving Federated Learning: Analysis and Performance Optimization,

K. Wei, et al. , “User-Level Privacy-Preserving Federated Learning: Analysis and Performance Optimization,” in IEEE TMC, vol. 21, no. 9, pp. 3388-3401, 1 Sept. 2022

work page 2022

Show all 12 references

[9]

Joint Channe l Esti- mation and Feedback for mm-Wave System Using Federated Lear ning,

L. Zhao, H. Xu, Z. Wang, X. Chen, and A. Zhou, “Joint Channe l Esti- mation and Feedback for mm-Wave System Using Federated Lear ning,” in IEEE Commun. Letters, vol. 26, no. 8, pp. 1819-1823, Aug. 2022

2022
[10]

Deep learning with differential priv acy,

A. Mart´ ın, A. Chu, I. Goodfellow, H. B. McMahan, I. Miro nov, K. Talwar, and L. Zhang, “Deep learning with differential priv acy,” in Proc. ACM CCS, Vienna, Austria, Oct. 2016, pp. 308–318

2016
[11]

IEEE 802.11ac: 5th g eneration wiﬁ networking,

A. Haque, P . Kumar, and A. K. Singh, “IEEE 802.11ac: 5th g eneration wiﬁ networking,” in WAP ,vol. 2, no. 4, pp. 235–241, 2012

2012
[12]

On the conver gence of step decay step-size for stochastic optimization,

X. Wang, S. Magn´ usson, and M. Johansson, “On the conver gence of step decay step-size for stochastic optimization,” Advances in Neural Information Processing Systems, vol. 34, pp. 14226-14238, 2021

2021

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [5]

Communication-Learning Co-Design for Differentially Private Over-the-Air Federated Learni ng with Device Sampling,

Z. Hu, J. Y an, and Y .-J. A. Zhang, “Communication-Learning Co-Design for Differentially Private Over-the-Air Federated Learni ng with Device Sampling,” in IEEE TWC, vol. 23, no. 11, pp. 16788-16804, Nov. 2024

work page 2024

[2] [6]

Optimal Transceiver Design in Over-the-Air Federated Distillation

Z. Hu, J. Y an, Y .-J. A. Zhang, J. Zhang, and K. B. Letaief, “ Opti- mal Transceiver Design in Over-the-Air Federated Distilla tion,” arXiv preprint arXiv:2507.15256, 2025

work page Pith review arXiv 2025

[3] [1]

Communication-efﬁcient learning of deep networks from de centralized data,

B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. Y . Ar cas, “Communication-efﬁcient learning of deep networks from de centralized data,” in Proc. 20th AISTATS, vol. 54, Apr. 2017, pp.1273–1282

work page 2017

[4] [2]

Broadband Analog Aggregat ion for Low-Latency Federated Edge Learning,

G. Zhu, Y . Wang, and K. Huang, “Broadband Analog Aggregat ion for Low-Latency Federated Edge Learning,” in IEEE TWC, vol. 19, no. 1, pp. 491-506, Jan. 2020

work page 2020

[5] [3]

Dwork, and A

C. Dwork, and A. Roth, The Algorithmic F oundations of Differential Privacy, now, 2014

work page 2014

[6] [4]

Privacy Amp liﬁcation for Federated Learning via User Sampling and Wireless Aggre gation,

M. S. E. Mohamed, W.-T. Chang, and R. Tandon, “Privacy Amp liﬁcation for Federated Learning via User Sampling and Wireless Aggre gation,” in IEEE JSAC, vol. 39, no. 12, pp. 3821-3835, Dec. 2021

work page 2021

[7] [7]

Selective knowledge sharin g for privacy- preserving federated distillation without a good teacher,

J. Shao, F. Wu, and J. Zhang, “Selective knowledge sharin g for privacy- preserving federated distillation without a good teacher, ” Nature Com- mun., vol. 15, no. 1, pp. 1–11, Jan. 2024

work page 2024

[8] [8]

User-Level Privacy-Preserving Federated Learning: Analysis and Performance Optimization,

K. Wei, et al. , “User-Level Privacy-Preserving Federated Learning: Analysis and Performance Optimization,” in IEEE TMC, vol. 21, no. 9, pp. 3388-3401, 1 Sept. 2022

work page 2022