Pith. sign in

REVIEW 4 major objections 4 minor 45 references

Federated Learning with Enhanced Privacy via Model Splitting and Random Client Participation

T0 review · 4 major / 4 minor · reviewed 2026-08-04 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that splitting each client's model into a public and private part, with random client check-in and local data subsampling, makes the global differential-privacy cost scale as O(p q εℓ) instead of O(εℓ), so federated learni

desk verdict The O(pqε) CDP claim collapses under the paper's own threat model: Algorithm 1 reveals the participant set to the server, so the client-sampling amplification vanishes. read the letter →

arxiv 2509.25906 v2 pith:57YSPWZU submitted 2025-09-30 cs.LG

Yiwei Li , Shuai Wang , Zhuojun Tian , Xiuhua Wang , Shijian Su This is my paper
classification cs.LG
keywords federatedlearningdifferentialprivacyamplificationmodelsplittingclientsamplingrandomcheck-indatasubsamplingprivacy-utilitytrade-off
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

MS-PAFL is a proposal for federated learning in which each client splits its model into a locally kept private part and a shared public part, adds calibrated Gaussian noise only to the public part, and lets each client decide its own participation probability. The paper's central claim is that random client check-in and local data subsampling amplify privacy jointly: the global public model's differential-privacy loss ε_c^t is bounded by max_i ln[1 + (p_i/(1−δ'))(exp(2q_i εℓ)−1)], which in the uniform case is O(p q εℓ) instead of the O(εℓ) baseline. If true, this means a target central privacy guarantee can be met with substantially less noise, so model accuracy degrades much less under strong privacy. The paper backs the analysis with experiments on a logistic-regression task showing better privacy-utility trade-offs than standard DP-FedAvg, and derives total-loss bounds after T rounds that scale as O(q_i√(p_i T)).

What carries the argument

The central object is the split model: a public submodel w_p, which is clipped, noised, and aggregated, and a private submodel w_α, kept on the client. The engine of the proof is the Hoeffding-conditioned aggregation argument in Theorem 2: the participant count is a sum of independent Bernoulli check-ins, so with high probability it stays within βN of its mean, and the analysis conditions on that high-probability event and on the event that a given client checked in. Lemma 3 converts each client's (εℓ, δℓ)-LDP public update, amplified by data subsampling to (2q_i εℓ, q_i δℓ), into the aggregated bound. The moments accountant (Theorem 3) then turns per-round amplification into a total client

What would settle it

Fix the realized participant set S in a logged run and recompute the DP guarantee conditioned on S; the p_i factor in Theorem 2's bound should vanish, turning O(p q εℓ) into roughly O(q εℓ). Concretely, with N=100, p=0.1, q=0.1, the claimed bound is about 0.01 εℓ, but a bound conditioned on the observed set should be about 0.1 εℓ. If membership-inference experiments on the logged protocol instead match the smaller value, the conditioning argument is empirically confirmed; if they track the larger value, the amplification requires an additional hiding mechanism.

Watch

Extended reading notes

Core claim

The paper's central discovery is that structural model splitting and statistical sampling amplify privacy multiplicatively. Theorem 2 bounds the single-round central privacy loss of the aggregated public submodel by max_i ln[1 + (p_i/(1−δ'))(exp(2q_i εℓ)−1)], and Corollary 1 shows the uniform-case bound is O(p q εℓ), a factor p q tighter than the O(εℓ) baseline for DP-FedAvg. Because the Gaussian noise is injected only into the public submodel, the private submodel is never perturbed; the paper concludes that the same target (ε,δ) can be reached with less noise and hence higher accuracy.

Load-bearing premise

The analysis assumes an adversary who sees only the aggregated global public submodel and cannot observe which clients actually checked in; if the realized participation set is visible to the server, the privacy amplification attributed to random check-in disappears and the central bound reverts to roughly O(q εℓ).

Editorial extensions

If this is right

  • The same target central (ε,δ) can be achieved with a smaller Gaussian noise variance, so models trained under strong privacy retain higher accuracy than standard DP-FedAvg.
  • A client's total privacy loss over T rounds scales as O(q_i√(p_i T)); clients with sensitive data can lower cumulative exposure by participating less often or subsampling more aggressively.
  • Sampling local data with replacement gives at least as much amplification as sampling without replacement, so under a fixed budget it supports slightly higher accuracy.
  • The two sampling rates p and q become explicit tuning knobs: lowering either tightens ε_c^t but slows convergence, giving system designers a quantified trade-off.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The protocol as written transmits each noisy public submodel directly to the server, so the server can see who actually participated; the random-check-in amplification in Theorem 2 therefore only bites if an additional mechanism hides the realized participant set, such as secure aggregation or a trusted shuffler.
  • The same O(p q ε) analysis could be adapted to heterogeneous settings where each client sets its own p_i and q_i, turning the privacy budget into a per-client knob rather than a global constant.
  • A direct empirical check of the mechanism would be to fix noise and εℓ, vary p and q, and measure actual membership-inference success; the prediction is that attack success tracks p·q, not p or q alone.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes MS-PAFL, a federated-learning framework that partitions each client's model into a private submodel, retained locally, and a public submodel, which is clipped, Gaussian-noised, and uploaded for aggregation. Client participation is random via private check-in probabilities, and local training uses data subsampling. The central theoretical claims are (i) Theorem 2 and Corollary 1, a single-round CDP guarantee for the aggregated public submodel with ε_c^t = O(pq ε_ℓ), and (ii) Theorem 3, a total local privacy-loss bound of O(q_i √(p_i T)) ε_ℓ. Experiments on the Adult dataset compare MS-PAFL against DP-FedAvg.

Significance. If the results held, the structural idea of confining noise to a public submodel is natural, and the claimed joint amplification via client check-in and data subsampling would be practically valuable: it would allow FL to satisfy a target CDP guarantee with substantially less Gaussian noise. The algorithmic presentation and empirical trend plots are strengths. However, the advertised privacy theorem is not matched to the stated threat model, and the total-loss proof does not establish an upper bound. The central claims are therefore not currently supported by the manuscript.

major comments (4)
  1. [Algorithm 1 / Sec. III.A / Appendix A / Theorem 2, Eq. (15a)] The main CDP amplification claim is invalid for the adversary the paper says it targets. Section II.B explicitly includes honest-but-curious servers, and Algorithm 1 (lines 14–19) has every participating client send its noisy public submodel \tilde w_{i,p} directly to the PS; the PS therefore observes the realized participation set X^t and the individual noisy updates. The proof of Theorem 2 in Appendix A, however, uses \hat p_i^t = P(E_i | |X^t|−μ|<βN) (Eqs. (A.3)–(A.4)) to insert the p_i/(1−δ') factor into the bound. For an honest-but-curious server who actually sees whether client i sent a message, this conditional probability is 1 (if i∈X^t) or 0, so the p_i factor disappears. The server-side guarantee is at best O(q_i ε_ℓ) for participating clients, not O(pq ε_ℓ) as claimed in Corollary 1/Eq. (17). If the intended adversary is an external observer who sees only the final aggregate a
  2. [Theorem 3 / Appendix C, Eq. (C.8)] Theorem 3 states an equality, \bar ε_i^T = c_0 q_i ε_ℓ sqrt(p_i T/(1−q_i)), with an unspecified constant c_0. The proof in Appendix C derives, at Eq. (C.8), only a lower bound on \bar ε_i^T. A lower bound on the privacy-loss parameter is not an upper bound and does not establish the claimed privacy guarantee; it is vacuous for the theorem's stated purpose. Moreover, a privacy bound containing an unspecified constant c_0 cannot be verified or used as a tight guarantee unless c_0 is specified in terms of the known parameters. This is a load-bearing issue because the paper advertises 'tight bounds' on total privacy loss.
  3. [Appendix B, Eq. (B.5)] The proof of Lemma 3 contains an invalid probability substitution. In Eq. (B.5)(b), the authors replace P(|X^t|=A^t | A, E_i) with P(|X^t|=A^t_{-i} | A). Under the standard reading, E_i is the event i∈X^t, so the first probability is over sets containing i, while the event |X^t|=A^t_{-i} (with A^t_{-i} denoting A^t with i removed) is a set not containing i. These are not equal, and the subsequent sum therefore does not bound the quantity under E_i. This invalidates Lemma 3 and hence the derivation of Theorem 2 even apart from the threat-model issue above.
  4. [Theorem 1 / Appendix C] Two load-bearing components are taken from the authors' own prior work without proof or a self-contained statement: Theorem 1, the data-subsampling amplification bound, is quoted from [8], and the proof of Theorem 3 'follows the work of [2]'. Since the manuscript's central contribution depends on these results, a reader cannot verify the correctness of the chain without consulting external papers. The authors should either provide full proofs or state very precisely the exact theorem and conditions from [2], [8] that are being used, especially because the amplification lemma concerns LDP mechanisms with an unusual factor of 2q ε_ℓ.
minor comments (4)
  1. [Sec. III.B(3)] The stage is called 'secure aggregation' but Algorithm 1 does not specify any cryptographic masking or aggregation protocol; clients simply send their noisy submodels to the PS. This label is misleading and should be removed or replaced by a concrete protocol.
  2. [Theorem 2 / Lemma 2] The parameter δ' = 2 exp(−2β²N) is said to hold for any β>0, but for small β this exceeds 1, making the denominator 1−δ' negative or the bound trivial. The valid range of β (or a requirement that δ'<1) should be stated explicitly.
  3. [Figures 5 and 6] Notation for the total local privacy loss is inconsistent: the text uses \bar ε_i^T, while Figure 5 uses ε_i^T. Please unify.
  4. [Sec. V.A] The description 'each client holding only a subset of the labels' is ambiguous for the binary Adult dataset; clarify whether this means non-IID label imbalance and how it is generated.

Circularity Check

1 steps flagged · score 6.0 of 10

The advertised O(pqεℓ) central-DP bound rests on the server not knowing the check-in set, but Algorithm 1 reveals that set to the server; the p-factor is thus assumed, not derived.

  1. self definitional [Section III.A / Algorithm 1 lines 14–15; Theorem 2 Eq. (15a); Appendix A Eq. (A.4)]
    "Specifically, each client independently decides whether to “check-in” for a training round with a private probability p_i^t that is hidden from the PS. The PS only observes the realized set of participating clients... Update ewt i,p by (12). Send ewt i,p to the PS for global model update."

    Appendix A obtains the p/(1−δ′) factor in Eq. (15a) from Eq. (A.4), where Phat p_i^t is the probability that i∈X^t given |X^t| is near its mean. This factor is exactly the adversary's uncertainty about whether i checked in. But the paper itself defines honest-but-curious servers as adversaries (Sec. II.B), and Algorithm 1 sends each client's noisy public submodel directly to the PS (lines 14–15), so such a server observes the realized X^t. For that server's view, P(i∈X^t | view)=1, not p_i^t. Hence the O(pqεℓ) central-DP claim in Corollary 1 (Eq. 17) is the assumed hiddenness of the check-in set restated as a conclusion, not a property of the messages Algorithm 1 actually transmits.

full rationale

The main advertised result (Theorem 2 Eq. (15a), Corollary 1 Eq. (17)) is not an independent consequence of the implemented MS-PAFL protocol: the p/(1−δ′) factor is obtained by treating client i's check-in as an event hidden from the mechanism's output, but the mechanism sends individually identified noisy public submodels to the PS. Against the honest-but-curious server that the paper names as an adversary, the check-in event is observed, so the privacy amplification from client check-in disappears. This is a by-construction reduction of the predicted O(pqεℓ) bound to the assumed hiddenness of X^t, rather than a derived property of Algorithm 1. I therefore score 6. I did not separately score the self-citations (Theorem 1 from [8], Theorem 3 following [2]) as circular: Theorem 1 is a standard subsampling-amplification bound and Theorem 3 is restated through the moments accountant, so those are support concerns rather than assumption-of-the-conclusion. The data-subsampling q-factor itself is a legitimate external building block; the failure is the client-sampling p-factor under the paper's own threat model.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The central privacy bounds rest on standard DP composition and concentration inequalities, but the analysis also depends on the authors' own subsampling theorem, a Hoeffding-concentration trick, an unspecified constant, and the unstated assumption that the server cannot use the realized participation set or individual messages. The ledger below lists these.

free parameters (5)
  • participation probability p_i = e.g., 0.1, 0.3, 0.7
    Chosen by hand in experiments; the central bound scales linearly with p_i.
  • data subsampling ratio q_i = derived from batch sizes b=1,5,13
    Chosen via batch size; the central bound scales linearly with q_i.
  • Hoeffding parameter β = 0.25
    Chosen to bound δ'; not derived from any optimality condition.
  • unspecified constant c_0 in Theorem 3 = not given
    The theorem's equality holds only for some c_0; no value or range is provided, making the bound vacuous.
  • clipping threshold C = 1
    Chosen by hand in experiments; the sensitivity bound depends on it.
assumptions (4)
  • standard math Hoeffding's inequality for binomial random variable |X_t|
    Used in Appendix A to define δ' = 2exp(-2β²N).
  • domain assumption Privacy amplification by data subsampling gives (2qε, qδ)-LDP (Theorem 1 from [8])
    Load-bearing for Theorem 2; cited from the authors' own prior work.
  • ad hoc to paper The server's view is limited to the aggregated public submodel; realized participation set is not used in the privacy analysis
    The algorithm transmits individual noisy submodels to the PS, but the proof analyzes only the aggregate w_p^t (Appendix A, Eq. A.5). This is a structural assumption not justified by the algorithm.
  • domain assumption The moments accountant log-moment is L_i^t(λ) = q_i² λ(λ+1)εℓ² / (4 s² ln(1.25/δℓ)) from [23]/[2]
    Used in Appendix C to derive Theorem 3; contains the self-cited framework.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Federated Learning with Enhanced Privacy via Model Splitting and Random Client Participation." pith.science (2026). https://pith.science/paper/57YSPWZU

@misc{pith2026250925906,
  author       = {Pith},
  title        = {Pith review of: Federated Learning with Enhanced Privacy via Model Splitting and Random Client Participation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/57YSPWZU}},
  note         = {Machine review of arXiv:2509.25906}
}
read the original abstract

Federated Learning (FL) often adopts differential privacy (DP) to protect client data, but the added noise required for privacy guarantees can substantially degrade model accuracy. To resolve this challenge, we propose model-splitting privacy-amplified federated learning (MS-PAFL), a novel framework that combines structural model splitting with statistical privacy amplification. In this framework, each client's model is partitioned into a private submodel, retained locally, and a public submodel, shared for global aggregation. The calibrated Gaussian noise is injected only into the public submodel, thereby confining its adverse impact while preserving the utility of the local model. We further present a rigorous theoretical analysis that characterizes the joint privacy amplification achieved through random client participation and local data subsampling under this architecture. The analysis provides tight bounds on both single-round and total privacy loss, demonstrating that MS-PAFL significantly reduces the noise necessary to satisfy a target privacy protection level. Extensive experiments validate our theoretical findings, showing that MS-PAFL consistently attains a superior privacy-utility trade-off and enables the training of highly accurate models under strong privacy guarantees.

Figures

Figures reproduced from arXiv: 2509.25906 by the authors.

Figure 1
Figure 1. FL system with random client check-in scheme. [PITH_FULL_IMAGE:figures/full_fig_p011_1.png] view at source ↗
Figure 2
Figure 2. Comparison of different client participation levels (p [PITH_FULL_IMAGE:figures/full_fig_p019_2.png] view at source ↗
Figure 3
Figure 3. Privacy protection level of global model [PITH_FULL_IMAGE:figures/full_fig_p020_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Comparison of total privacy loss ϵ T c under W.O.R. and (a) various values of pi when qi = 0.2, (b) different values of qi when pi = 0.5. results show that sampling with replacement consistently yields smaller privacy loss compared with sampling without replacement. Ad…
Figure 5
Figure 5. Figure 5: Comparison of ϵ T i under (a) ϵℓ = 0.1 and (b) ϵℓ = 1. 0 20 40 60 80 100 0 10 20 30 40 50 9.66 1.45 43.88 (a) 0 20 40 60 80 100 0 10 20 30 40 1.43 9.14 36.39 (b) [PITH_FULL_IMAGE:figures/full_fig_p021_5.png]
Figure 6
Figure 6. Figure 6: Comparison of ϵ T c when b ∈ {1, 5, 13} under (a) W.O.R. and (b) W.R. VI. CONCLUSIONS In this paper, we proposed MS-PAFL, a novel framework that addresses the fundamental trade￾off between privacy and utility in FL. By combining a model-splitting strategy with statisti…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

45 extracted references · 4 linked inside Pith

  1. [8]

    Differentially private federated clustering over non-iid data,

    Y . Li, S. Wang, C.-Y . Chi, and T. Q. S. Quek, “Differentially private federated clustering over non-iid data,”IEEE Internet of Things Journal, vol. 11, no. 4, pp. 6705–6721, 2024

    2024

  2. [2]

    Differentially private federated stochastic primal-dual learning for internet of vehicles,

    Y . Li, S. Wang, and T.-H. Chang, “Differentially private federated stochastic primal-dual learning for internet of vehicles,” IEEE Internet of Things Journal, vol. 12, no. 11, pp. 17 034–17 050, 2025

    2025

  3. [1]

    On safeguarding privacy and security in the framework of federated learning,

    C. Ma, J. Li, M. Ding, H. H. Yang, F. Shu, T. Q. Quek, and H. V . Poor, “On safeguarding privacy and security in the framework of federated learning,”IEEE Network, vol. 34, no. 4, pp. 242–248, 2020

    2020

  4. [3]

    FedPD: A federated learning framework with adaptivity to non-IID data,

    X. Zhang, M. Hong, S. Dhople, W. Yin, and Y . Liu, “FedPD: A federated learning framework with adaptivity to non-IID data,”IEEE Trans. on Signal Processing, vol. 69, pp. 6055–6070, 2021

    2021

  5. [4]

    On the convergence of FedAvg on non-IID data,

    X. Li, K. Huang, W. Yang, S. Wang, and Z. Zhang, “On the convergence of FedAvg on non-IID data,” inProc. International Conference on Learning Representations (ICLR), 2020, pp. 1–26

    2020

  6. [6]

    Differentially private and heterogeneity-robust federated learning with theoretical guarantee,

    X. Wang, S. Wang, Y . Li, F. Fan, S. Li, and X. Lin, “Differentially private and heterogeneity-robust federated learning with theoretical guarantee,”IEEE Trans. Artificial Intelligence, vol. 5, no. 12, pp. 6369–6384, 2024

    2024

  7. [7]

    Privacy-preserving federated primal-dual learning for non-convex and non-smooth problems with model sparsification,

    Y . Li, C.-W. Huang, S. Wang, C.-Y . Chi, and T. Q. Quek, “Privacy-preserving federated primal-dual learning for non-convex and non-smooth problems with model sparsification,”IEEE Internet of Things Journal, vol. 11, no. 15, pp. 25 853–25 866, 2024

    2024

  8. [9]

    Robust and secure federated learning with verifiable differential privacy,

    C. Zhang, J. Weng, J. Weng, Y . Zhong, J.-N. Liu, and C. Deng, “Robust and secure federated learning with verifiable differential privacy,”IEEE Trans. Dependable and Secure Computing, vol. 22, no. 5, pp. 5713–5729, 2025

    2025

Show all 45 references
  1. [10]

    Heterogeneous differential-private federated learning: Trading privacy for utility truthfully,

    X. Lin, J. Wu, J. Li, C. Sang, S. Hu, and M. J. Deen, “Heterogeneous differential-private federated learning: Trading privacy for utility truthfully,”IEEE Trans. Dependable and Secure Computing, vol. 20, no. 6, pp. 5113–5129, 2023

    2023

  2. [11]

    Differentially private deep learning with dynamic privacy budget allocation and adaptive optimization,

    L. Chen, D. Yue, X. Ding, Z. Wang, K.-K. R. Choo, and H. Jin, “Differentially private deep learning with dynamic privacy budget allocation and adaptive optimization,”IEEE Trans. Information Forensics and Security, vol. 18, pp. 4422–4435, 2023

    2023

  3. [12]

    Differentially private federated learning in edge networks: The perspective of noise reduction,

    Y . Li, S. Wang, C.-Y . Chi, and T. Q. Quek, “Differentially private federated learning in edge networks: The perspective of noise reduction,”IEEE Network, vol. 36, no. 5, pp. 167–172, 2022

    2022

  4. [13]

    Shuffled model of differential privacy in federated learning,

    A. Girgis, D. Data, S. Diggavi, P. Kairouz, and A. T. Suresh, “Shuffled model of differential privacy in federated learning,” inProc. International Conference on Artificial Intelligence and Statistics, 2021, pp. 2521–2529. 28

    2021

  5. [14]

    Privacy amplification by iteration,

    V . Feldman, I. Mironov, K. Talwar, and A. Thakurta, “Privacy amplification by iteration,” inPorc. IEEE Annual Symposium on Foundations of Computer Science (FOCS), 2018, pp. 521–532

    2018

  6. [15]

    Privacy amplification by subsampling: Tight analyses via couplings and divergences,

    B. Balle, G. Barthe, and M. Gaboardi, “Privacy amplification by subsampling: Tight analyses via couplings and divergences,” inProc. ACM Neural Information Processing Systems (NIPS), 2018, pp. 6277–6287

    2018

  7. [16]

    Composition of differential privacy & privacy amplification by subsampling,

    T. Steinke, “Composition of differential privacy & privacy amplification by subsampling,”arXiv preprint arXiv:2210.00597, 2022

    2022 arXiv

  8. [17]

    Amplification by shuffling: From local to central differential privacy via anonymity,

    ´U. Erlingsson, V . Feldman, I. Mironov, A. Raghunathan, K. Talwar, and A. Thakurta, “Amplification by shuffling: From local to central differential privacy via anonymity,” inProc. ACM-SIAM Symposium on Discrete Algorithms, 2019, pp. 2468–2479

    2019

  9. [18]

    Distributed differential privacy via shuffling versus aggregation: A curious study,

    Y . Wei, J. Jia, Y . Wu, C. Hu, C. Dong, Z. Liu, X. Chen, Y . Peng, and S. Wang, “Distributed differential privacy via shuffling versus aggregation: A curious study,”IEEE Trans. Information Forensics and Security, vol. 19, pp. 2501–2516, 2024

    2024

  10. [19]

    Shuffle differential private data aggregation for random population,

    S. Wang, X. Luo, Y . Qian, Y . Zhu, K. Chen, Q. Chen, B. Xin, and W. Yang, “Shuffle differential private data aggregation for random population,”IEEE Trans. Parallel and Distributed Systems, vol. 34, no. 5, pp. 1667–1681, 2023

    2023

  11. [20]

    Community-oriented duplex privacy amplification and active poisoning resistance for heterogeneous federated learning,

    Z. Zhou, J. Zhao, S. Yang, H. Li, T. Ma, and C. Xu, “Community-oriented duplex privacy amplification and active poisoning resistance for heterogeneous federated learning,”IEEE Trans. Dependable and Secure Computing, vol. 22, no. 5, pp. 5015–5032, 2025

    2025

  12. [21]

    SLDP-LoRA: A privacy-preserving split learning framework with low-rank adaptation,

    Y . Huang, J.-L. Yin, Z. Tan, Q. Wang, and X. Liu, “SLDP-LoRA: A privacy-preserving split learning framework with low-rank adaptation,”IEEE Trans. Network Science and Engineering, pp. 1–17, 2025

    2025

  13. [22]

    Enhancing accuracy-privacy trade-off in differentially private split learning,

    N. D. Pham, K. T. Phan, and N. Chilamkurti, “Enhancing accuracy-privacy trade-off in differentially private split learning,” IEEE Trans. Emerging Topics in Computational Intelligence, vol. 9, no. 1, pp. 988–1000, 2025

    2025

  14. [23]

    Deep learning with differential privacy,

    M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” inProc. ACM SIGSAC Conference on Computer and Communications Security, Oct. 2016, pp. 308–318

    2016

  15. [24]

    Communication-efficient learning of deep networks from decentralized data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. Y Arcas, “Communication-efficient learning of deep networks from decentralized data,” inProc. Artificial Intelligence and Statistics, 2017, pp. 1273–1282

    2017

  16. [25]

    Secure federated averaging algorithm with differential privacy,

    Y . Li, T.-H. Chang, and C.-Y . Chi, “Secure federated averaging algorithm with differential privacy,” inProc. IEEE International Workshop on Machine Learning for Signal Processing (MLSP), 2020, pp. 1–6

    2020

  17. [26]

    Federated learning with differential privacy: Algorithms and performance analysis,

    K. Wei, J. Li, M. Ding, C. Ma, H. H. Yang, F. Farokhi, S. Jin, T. Q. S. Quek, and H. Vincent Poor, “Federated learning with differential privacy: Algorithms and performance analysis,”IEEE Trans. Information Forensics and Security, vol. 15, pp. 3454–3469, 2020

    2020

  18. [27]

    Advances and open problems in federated learning,

    P. Kairouz, H. B. McMahan, B. Avent, Belletet al., “Advances and open problems in federated learning,”Foundations and Trends in Machine Learning, vol. 14, no. 1–2, pp. 1–210, 2021

    2021

  19. [28]

    Federated learning with Bayesian differential privacy,

    A. Triastcyn and B. Faltings, “Federated learning with Bayesian differential privacy,” inProc. IEEE International Conference on Big Data, 2019, pp. 2587–2596

    2019

  20. [29]

    LDP-Fed: Federated learning with local differential privacy,

    S. Truex, L. Liu, K.-H. Chow, M. E. Gursoy, and W. Wei, “LDP-Fed: Federated learning with local differential privacy,” inProc. of ACM International Workshop on Edge Systems, Analytics and Networking, 2020, pp. 61–66

    2020

  21. [30]

    Stronger privacy amplification by shuffling for r´enyi and approximate differential privacy,

    V . Feldman, A. McMillan, and K. Talwar, “Stronger privacy amplification by shuffling for r´enyi and approximate differential privacy,” inProc. Annual ACM-SIAM Symposium on Discrete Algorithms (SODA), 2023, pp. 4966–4981

    2023

  22. [31]

    Privacy amplification for matrix mechanisms,

    C. A. Choquette-Choo, A. Ganesh, T. Steinke, and A. Thakurta, “Privacy amplification for matrix mechanisms,”arXiv preprint arXiv:2310.15526, 2023

    2023 arXiv

  23. [32]

    Privacy amplification by sampling under user-level differential privacy,

    J. Fang and K. Yi, “Privacy amplification by sampling under user-level differential privacy,”ACM on Management of Data, vol. 2, no. 1, pp. 1–26, 2024. 29

    2024

  24. [33]

    Privacy amplification by random allocation,

    V . Feldman and M. Shenfeld, “Privacy amplification by random allocation,”arXiv preprint arXiv:2502.08202, 2025

    2025

  25. [34]

    Privacy amplification via random check-ins,

    B. Balle, P. Kairouz, B. McMahan, O. Thakkar, and A. Guha Thakurta, “Privacy amplification via random check-ins,” in Proc. Advances in Neural Information Processing Systems (NIPS), 2020, pp. 4623–4634

    2020

  26. [35]

    Split learning for health: Distributed deep learning without sharing raw patient data,

    P. Vepakomma, O. Gupta, T. Swedish, and R. Raskar, “Split learning for health: Distributed deep learning without sharing raw patient data,”arXiv preprint arXiv:1812.00564, 2018

    2018 arXiv

  27. [36]

    Splitfed: When federated learning meets split learning,

    C. Thapa, P. C. M. Arachchige, S. Camtepe, and L. Sun, “Splitfed: When federated learning meets split learning,” inProc. AAAI conference on Artificial Intelligence, vol. 36, no. 8, 2022, pp. 8485–8493

    2022

  28. [37]

    Privacy and efficiency of communications in federated split learning,

    Z. Zhang, A. Pinto, V . Turina, F. Esposito, and I. Matta, “Privacy and efficiency of communications in federated split learning,”IEEE Trans. Big Data, vol. 9, no. 5, pp. 1380–1391, 2023

    2023

  29. [38]

    The effectiveness of a simplified model structure for crowd counting,

    X. Gao, L. Chen, F. Chao, X. Chang, X. Gao, H. Jiang, L. Liu, and H. Zhang, “The effectiveness of a simplified model structure for crowd counting,”IEEE Trans. Instrumentation and Measurement, vol. 74, pp. 1–11, 2025

    2025

  30. [39]

    Split aggregation: Lightweight privacy-preserving federated learning resistant to byzantine attacks,

    Z. Lu, S. Lu, Y . Cui, X. Tang, and J. Wu, “Split aggregation: Lightweight privacy-preserving federated learning resistant to byzantine attacks,”IEEE Trans. Information Forensics and Security, vol. 19, pp. 5575–5590, 2024

    2024

  31. [40]

    Exploiting shared representations for personalized federated learning,

    L. Collins, H. Hassani, A. Mokhtari, and S. Shakkottai, “Exploiting shared representations for personalized federated learning,” inProc. International conference on machine learning (ICML), 2021, pp. 2089–2099

    2021

  32. [41]

    Distributed learning over networks with graph-attention-based personalization,

    Z. Tian, Z. Zhang, Z. Yang, R. Jin, and H. Dai, “Distributed learning over networks with graph-attention-based personalization,”IEEE Trans. Signal Processing, vol. 71, pp. 2071–2086, 2023

  33. [42]

    A novel privacy enhancement scheme with dynamic quantization for federated learning,

    Y . Wang, X. Cao, S. Jin, and M.-Y . Chow, “A novel privacy enhancement scheme with dynamic quantization for federated learning,”arXiv preprint arXiv:2405.16058, 2024

    2024 arXiv

  34. [43]

    The algorithmic foundations of differential privacy,

    C. Dwork, A. Rothet al., “The algorithmic foundations of differential privacy,”Foundations and Trends® in Theoretical Computer Science, vol. 9, no. 3–4, pp. 211–407, 2014

    2014

  35. [44]

    Privacy amplification for federated learning via user sampling and wireless aggregation,

    M. S. E. Mohamed, W.-T. Chang, and R. Tandon, “Privacy amplification for federated learning via user sampling and wireless aggregation,”IEEE Journal on Selected Areas in Communications, vol. 39, no. 12, pp. 3821–3835, 2021

    2021

  36. [45]

    Boosting and differential privacy,

    C. Dwork, G. N. Rothblum, and S. Vadhan, “Boosting and differential privacy,” inProc. IEEE Symposium on Foundations of Computer Science, 2010, pp. 51–60

    2010

  37. [46]

    UCI repository of machine learning databases,

    C. L. Blake and C. J. Merz, “UCI repository of machine learning databases,” 1998, Irvine. CA: University of California, Department of Information and Computer Science. [Online]. Available: http://www.ics.uci.edu/rvmlearnIMLRepository.html

    1998

Pith tools

Reviewed August 4, 2026 · model on record in the stance chip above.