What Your Model Threw Away and Why You'll Want It Back: Masking, Fingerprinting, and Privacy from Discarded Geometry

Zachary P. Bradshaw

REVIEW 3 major objections 6 minor 38 references

What Your Model Threw Away and Why You'll Want It Back: Masking, Fingerprinting, and Privacy from Discarded Geometry

T0 review · 3 major / 6 minor · reviewed 2026-08-02 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A smooth machine-learning model always has pointwise invisible input transformations—the 'null fiber'—even when it has no global symmetry, and these can be computed cheaply and used for masking, fingerprinting, and privacy.

desk verdict The pointwise-null-fiber idea is a genuine extension and the theory mostly holds up, but the spherical-MNIST experiments test argmax preservation, not the null fiber as defined. read the letter →

arxiv 2607.13046 v1 pith:6ALL7LFY submitted 2026-06-17 cs.LG cs.CRmath.RTstat.ML

Zachary P. Bradshaw This is my paper

classification cs.LGcs.CRmath.RTstat.ML

keywords nullfiberstabilizerLiegrouprepresentationpreimagetheoremPeter-Weyldatamaskingmodelfingerprintingprivacy-preservingmachinelearning

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Every smooth machine-learning model, no matter how free of global symmetries, discards information pointwise: at each generic input there is a positive-dimensional family of group transformations that leave the model's output exactly unchanged. The paper defines this family as the null fiber, proves via the preimage theorem that it has dimension at least dim G − 1 for real-valued models on any Lie group representation, and gives a Newton-iteration algorithm that finds its elements in about ten model evaluations. For compact groups acting on themselves, a Peter–Weyl Fourier characterization reduces the global stabilizer to intersections of row-space stabilizers of Fourier coefficients. These objects power three applications—data masking, model fingerprinting, and privacy-preserving inference—demonstrated on molecular property prediction under SO(3) and spherical image classification under the Möbius group. The key distinction is that the stabilizer is usually trivial for expressive models, while the null fiber is generically large, so applications should be built on the fiber rather than the stabilizer.

What carries the argument

The null fiber N_G(f,x) = {g ∈ G : f(π(g^{-1})·x) = f(x)} is the fiber over f(x) of the orbit map φ_x(g) = f(π(g^{-1})·x). The preimage theorem makes this fiber generically a dimension-(dim G − 1) submanifold; the Peter–Weyl theorem makes both the null fiber and stabilizer computable from Fourier coefficient matrices on compact groups; and Newton iteration on the orbit map, starting from the kernel of the Jacobian J = −∇f(x)^T dπ(E_i)·x, converges quadratically to exact null fiber elements using roughly ten forward/backward passes.

What would settle it

On spherical MNIST under PSL(2,C), transform a test image by a Möbius map at full spherical resolution, re-expand to bandlimit L=10, and compare with applying the same map directly to the L=10 coefficients. If the two coefficient sets differ measurably, the group action on the model's inputs is not exact, and the exact masking identity used in the paper's experiment fails.

Watch

Extended reading notes

Core claim

The paper defines the null fiber of a function f at x as the set of group elements g for which f(π(g^{-1})·x) = f(x), and the stabilizer as the intersection of all null fibers. It proves via the preimage theorem that for smooth real-valued f the null fiber at a generic point is a smooth submanifold of dimension at least dim G − 1, regardless of architecture, even when the stabilizer is trivial. For compact groups acting on themselves, the Peter–Weyl theorem gives a spectral characterization: the stabilizer is the intersection of row-space stabilizers of the Fourier coefficient matrices, and the null fiber at a point is a single scalar equation. The paper also gives a Newton iteration on the

Load-bearing premise

The whole scheme assumes the group really acts on exactly what the model sees and that the input is not a degenerate point where the model's sensitivity to the group vanishes; when either assumption fails, the exact invisibility identities can break.

Editorial extensions

If this is right

Any real-valued smooth model on a d-dimensional group representation has null fibers of dimension at least d−1 at generic inputs, so pointwise masking is available even when the stabilizer is trivial.
Null fiber elements can be found in about ten model evaluations, independent of group dimension, whereas brute-force Haar sampling essentially never lands on the measure-zero fiber.
Null fibers fingerprint models: on QM9, rotations invisible to one model move another model's prediction by hundreds of eV, a ten-order-of-magnitude gap that enables reliable challenge-response verification.
Under non-isometric group actions such as Möbius boosts on spherical images, null-fiber masking destroys visual content while preserving the classifier, reducing attack accuracy from 99.5% to 54% at zero utility cost; under isometric rotations it hides only orientation.
For compact groups acting on themselves, full-rank Fourier coefficients force the stabilizer to be trivial (Corollary 5), so practical applications must rely on null fibers rather than stabilizers.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If the generic dimension bound transfers to piecewise-smooth networks away from their nondifferentiable boundaries, then every trained classifier has an entire surface of inputs it cannot distinguish—an observation that could motivate a new class of adversarial examples beyond additive perturbations.
The exact-masking identity depends on the group action being realized on the representation space; when inputs are only approximately group-covariant, users should verify the action by comparing full-image re-expansion against coefficient-space transformation, since the paper's spherical-MNIST experiment uses bandlimited coefficients where PSL(2,C) mixes all harmonic degrees.
The fingerprint protocol can be hardened by requiring large group displacements, since the paper notes that near-identity null fiber elements transfer across models and that filtering rotation angles above 20° eliminates most cross-model passes.
A testable extension is to monitor the rank of the orbit-map Jacobian during training: if the rank collapses on a positive-measure set, the Newton construction degenerates and the 'generic regular point' hypothesis is violated, which would limit the practical range of the method.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick read before you invest: the theoretical part is worth your time; the spherical-MNIST application is not what the headline claims. The authors define a null fiber N_G(f,x) for a group action and show that for smooth scalar f it has dimension dimG−1 at regular points, even when the global stabilizer is trivial. That distinction between pointwise and global invariance is a real extension of the translation null-space work, and the Peter–Weyl characterization in Theorem 4 is a clean new statement. The Newton-on-the-orbit-map algorithm is sensible and the cost claim is plausible. The QM9 regression experiment is the honest test: scalar target, exact equality verified to 1e-12 eV, and the cross-model fingerprint gap is striking.

Now the soft spots, in size order. The spherical-MNIST experiments do not instantiate a null fiber. The classifier is f: V -> R^10, and G=PSL(2,C) has dimension 6; the preimage theorem gives no positive-dimensional fiber when m > dimG. What they actually find are transformations that preserve the argmax — an open condition, as the paper itself concedes in §4.2.1. The binary-channel result (logit ordering preserved) is also not equality of f. So the masking/privacy demonstrations on spherical images are about the decision region, not the null fiber. On top of that, the Möbius action on bandlimited harmonics is only approximate, so even a scalar margin wouldn't be an exact representation. The theory in §2–3 doesn't require that experiment, but the paper's headline applications lean on it.

Other concerns are minor or fixable: no code, no error bars, and the security model is explicitly heuristic — the adversary doesn't know f or g, which is an assumption, not a proof. The lookup-table failure on QM9 and success on spherical MNIST is an honest negative result.

Who this is for: someone working on null spaces, geometric ML, or model fingerprinting will get a new concept and a usable algorithm. A security researcher will not find formal guarantees. I'd send it to a serious referee: the theoretical core is real, and the experimental flaw is identifiable and fixable — rerun the spherical experiments with a scalar margin and exact equality, and handle the truncation. That's a major revision, not a rejection.

Referee Report

3 major / 6 minor

Summary. The paper proposes a framework for the information a machine learning model discards when its input space carries a Lie group action. It defines the null fiber N_G(f,x) = {g : f(π(g^{-1})x)=f(x)}, the pointwise set of invisible group elements, and contrasts it with the global stabilizer Stab_G(f). The central theoretical claims are: (i) Proposition 3, that for smooth real-valued f the null fiber is generically a codimension-one submanifold, so every smooth model has pointwise invariant directions even with trivial global stabilizer; (ii) Theorem 4, a Peter–Weyl spectral characterization for compact groups acting on themselves; and (iii) a Newton-type algorithm that computes exact null-fiber elements with a few model evaluations. These tools are applied to data masking, model fingerprinting, and privacy-preserving inference, with experiments on QM9 under SO(3) and spherical MNIST under PSL(2,C).

Significance. If the claims hold, the paper offers a genuinely architecture-agnostic geometric invariant for trained models and a practical way to exploit it for masking and fingerprinting. The core derivations have real strengths: Proposition 3 and Theorem 4 are standard and cleanly proved, no fitted constants enter the theory, the QM9 regression experiment verifies exact level-set preservation to 10^{-12} eV, and the cross-model fingerprinting gap of about ten orders of magnitude is a convincing demonstration for the scalar case. The main unresolved issue is that the spherical-MNIST experiments do not actually instantiate null fibers: they use a 10-class vector-valued classifier and report argmax preservation, which is an open condition, not the equality required by Eq. (1). A second issue is that the PSL(2,C) action is applied to bandlimited spherical-harmonic coefficients, which is not a representation. These are load-bearing problems for the paper's advertised applications, though not for the core theory.

major comments (3)

[§4.1.1, §4.3.1, Eq. (1)] The spherical-MNIST experiments use a 10-class classifier f:V→R^10 and report 'null-fiber elements' as transformations that 'the classifier still labels correctly.' For f:V→R^10 and G=PSL(2,C) with dim G=6, the orbit map at any x maps a 6-dimensional group into R^10, so the hypotheses of Proposition 3(3) cannot hold and no positive-dimensional null fiber is guaranteed. The paper itself states in §4.2.1 that 'the argmax-preserving region in G is open, not a measure-zero level set.' Therefore the objects found in §4.1.1 and §4.3.1 are elements of {g : argmax f(π(g^{-1})x) = argmax f(x)}, not of N_G(f,x). Claims such as 'null-fiber Möbius boost' and 'the null fiber achieves privacy at zero utility cost' are not supported by those experiments. I ask the authors either to use a scalar f (e.g., a logit margin), verify |f(π(g^{-1})x)-f(x)| to numerical tolerance for each sampled g, and report t
[§4.1.1, §2 (representation assumption)] The inputs for the spherical-MNIST experiment are spherical-harmonic coefficients bandlimited to L=10. The Möbius group PSL(2,C) does not preserve bandlimits: a Möbius transformation of a bandlimited function generally has full spherical-harmonic spectrum. Acting on truncated coefficients, or transforming a pixel image and then re-expanding to L=10, is not a group representation, so the identity π(g1)π(g2)=π(g1g2) and the smooth-orbit-map hypothesis of Proposition 3 fail exactly. The paper should either define V as the full L^2(S^2) and explain how the finite-dimensional network operates on the infinite-dimensional representation, or state explicitly that the truncated coefficient space carries only an approximate action and quantify the truncation error in the reported masking identity.
[Abstract and §5, Definition 1] The abstract says the dimension bound holds 'regardless of architecture.' Proposition 3 requires f to be smooth and the identity to be a regular point of the orbit map. Many practical networks use ReLU or other non-smooth activations, and the null fiber of a non-smooth model need not be a manifold. The statement should be qualified as applying to smooth (or locally C^1) models at regular inputs; otherwise the 'regardless of architecture' phrasing overclaims. This is not fatal to the theory, but it affects how the results are advertised.

minor comments (6)

[§2, Proposition 3] The proposition assumes a continuous representation, but part (3) needs a smooth action. Please state explicitly that π is smooth (or C^1) for the manifold conclusion.
[§2.1, Theorem 4] Equation (8) is called a 'single scalar equation,' but for complex-valued f it is one complex equation, i.e., two real equations. The text explains the 2m codimension issue in the introduction, but the sentence after Eq. (8) should not call it a single scalar equation without this qualifier.
[§2.2, Eq. (14)] The Newton convergence claim δ_{k+1}=O(δ_k^2) requires J_{v_k} to be bounded away from zero and the line search to be specified. The backtracking rule 'accept if |δ_{k+1}|<|δ_k|' can in principle stall at a nonzero residual; the paper later reports ~0.5% own-model failures. Please state the stopping criterion and the safeguard for small J.
[§4.1] The security analysis is informal. Eve is assumed to lack both f and g, but Bob recovers f(x) and may leak information through the returned value; the protocol is not compared to standard adversary models. A sentence clarifying the intended threat model would help.
[§4.1.1] The precomputed lookup-table experiment reports median nearest-reference distances and preservation rates, but no standard deviations or confidence intervals. Given the small number of reference digits (200) and the strong claims about coverage, error bars would be useful.
[References] Reference [4] is the sole self-citation and is contextual, not load-bearing; this is fine. Please check the rendering of 'Möbius' in the PDF, which appears with a spurious accent in several places.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the null-fiber identities are definitional, the dimension bound is an external theorem, and the experiments validate an algorithm against independent random/brute-force baselines.

full rationale

The core derivation is self-contained. Definition 1 defines N_G(f,x) as the exact level set of the orbit map; Proposition 3's dimension bound is an application of the standard preimage theorem with no fitted constants; Theorem 4 is Peter-Weyl analysis. The masking/fingerprinting identities (Eq. 15 and Section 4.3) are true by definition of the null fiber and are used as exact preservation guarantees, not as empirical predictions. The gradient/Newton algorithm solves the equation psi(v)=psi(0) by construction, and the experiments validate it against brute-force sampling and cross-model/random baselines rather than fitting the reported accuracies. The only self-citation, [4], appears in a related-work list on group-equivariant networks and is not load-bearing; no uniqueness theorem or ansatz is imported from the authors' prior work. A skeptical concern remains that the spherical-MNIST classifier experiments preserve the 10-class argmax rather than the full output vector f(pi(g^{-1})x)=f(x), so those particular demonstrations may not instantiate the null-fiber equality; but this is a correctness/validity gap, not a circular derivation, and does not affect the circularity score.

Assumptions & free parameters 3 free parameters · 6 assumptions · 0 invented entities

The theoretical result is parameter-free and rests only on standard theorems plus smoothness/regularity. The experimental demonstrations introduce hand choices (bandlimit, thresholds) and an approximation to the group action.

free parameters (3)

Spherical-harmonic bandlimit L=10 = 10
Experimental choice for spherical MNIST; determines the finite coefficient space where the Möbius action is approximated rather than exact.
Fingerprint verification thresholds epsilon = 0.01, 0.1, 1.0 (eV)
Verification thresholds used to define own/cross pass rates; not fitted to derive null fiber theory.
Newton stopping tolerance = machine precision, 4-5 iterations
Algorithmic stopping rule, not a fitted constant.

assumptions (6)

standard math Preimage theorem / constant rank theorem: level sets of a smooth map of maximal rank are submanifolds of codimension equal to the codomain dimension.
Used in Proposition 3 to bound dim N_G(f,x) = dim G - m at regular points.
standard math Peter-Weyl theorem: for compact G, L^2(G) decomposes into matrix coefficients of irreducible unitary representations.
Basis for Theorem 4 Fourier characterization of stabilizer and null fibers.
domain assumption The learned function f is smooth and e is a regular point of the orbit map.
Needed for the codimension-one fiber dimension; ReLU networks are only piecewise smooth, so the guarantee is not literally architecture-independent.
domain assumption The model input space V is a genuine representation space and the action is exact on the actual inputs.
Enters in Definition 1 and all applications; violated by the truncated Möbius action on bandlimited spherical harmonic coefficients in §4.1.1.
standard math Newton's method converges for the orbit-map level set (nonzero Jacobian along iterates, backtracking where nonlinear).
Used in §2.2 to assert machine-precision null fiber elements after 4-5 iterations.
domain assumption Security model: adversary Eve has access to neither f nor the masking element g.
Privacy/fingerprinting arguments in §4.1 and §4.2 depend on evaluating f being hard for the adversary; not a cryptographic guarantee.

how reviews work

0 comments

Cite this review

Pith. "Pith review of What Your Model Threw Away and Why You'll Want It Back: Masking, Fingerprinting, and Privacy from Discarded Geometry." pith.science (2026). https://pith.science/paper/6ALL7LFY

@misc{pith2026260713046,
  author       = {Pith},
  title        = {Pith review of: What Your Model Threw Away and Why You'll Want It Back: Masking, Fingerprinting, and Privacy from Discarded Geometry},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6ALL7LFY}},
  note         = {Machine review of arXiv:2607.13046}
}

abstract

We develop a framework for the information discarded by machine learning models whose inputs carry a Lie group action. Given a representation $\pi$ of a Lie group $G$ on a space $V$ and a learned function $f\colon V \to \mathbb{R}$, we define two objects measuring the symmetry invisible to $f$. The null fiber at a point $x \in V$ is the set $N_G(f,x) = \{g \in G : f(\pi(g^{-1}) \cdot x) = f(x)\}$ of group elements whose inverse action on $x$ is undetectable by $f$. When $N_G(f,x)$ is independent of $x$, it coincides with the stabilizer $\mathrm{Stab}_G(f)$, the largest subgroup of $G$ under which $f$ is invariant. For smooth maps to $\mathbb{R}$, the preimage theorem guarantees that null fibers have dimension at least $\dim G - 1$ at generic inputs, regardless of architecture. For compact groups acting on themselves, the Peter--Weyl theorem yields a spectral characterization of both objects in terms of the Fourier coefficient matrices of $f$. We show that null fiber elements can be computed efficiently via Newton iteration on the orbit map, at a cost comparable to a few gradient evaluations. Applications to data masking, model fingerprinting, and privacy-preserving computation are developed and tested experimentally on molecular property prediction under $\mathrm{SO}(3)$ and spherical image classification under the M\"obius group $\mathrm{PSL}(2, \mathbb{C})$. The framework applies uniformly to classical neural networks and variational quantum circuits.

Figures

Figures reproduced from arXiv: 2607.13046 by the authors.

**Figure 2.** The null fiber masking protocol. Alice masks her data [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗

**Figure 3.** Gradient-based null fiber computation versus brute-force sampling on a QM9 test molecule [PITH_FULL_IMAGE:figures/full_fig_p011_3.png] view at source ↗

Figures from the paper (7 more)

**Figure 4.** Figure 4: M¨obius steganography on spherical MNIST. (a) Raw MNIST digit 2. (b) The same [PITH_FULL_IMAGE:figures/full_fig_p012_4.png]

**Figure 5.** Figure 5: Hidden binary channel on spherical MNIST. Top row: a true 2 is M¨obius-masked and [PITH_FULL_IMAGE:figures/full_fig_p013_5.png]

**Figure 6.** Figure 6: Model fingerprinting via null fibers on QM9 regression. Distribution of prediction error [PITH_FULL_IMAGE:figures/full_fig_p014_6.png]

**Figure 7.** Figure 7: Classification fingerprinting on spherical MNIST via the full argmax with SO(3) rotations. [PITH_FULL_IMAGE:figures/full_fig_p015_7.png]

**Figure 8.** Figure 8: Scalar pair-margin fingerprinting on spherical MNIST. Left: SO(3) with rotation angle [PITH_FULL_IMAGE:figures/full_fig_p016_8.png]

**Figure 9.** Figure 9: Trusted-third-party masking protocol for outsourced inference on HIPAA-protected data. [PITH_FULL_IMAGE:figures/full_fig_p017_9.png]

**Figure 10.** Figure 10: Privacy-preserving M¨obius masking on spherical MNIST. Null-fiber masking preserves [PITH_FULL_IMAGE:figures/full_fig_p018_10.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

38 extracted references · 6 linked inside Pith

[1]

Quantum machine learning.Nature, 549(7671):195–202, 2017

Jacob Biamonte, Peter Wittek, Nicola Pancotti, Patrick Rebentrost, Nathan Wiebe, and Seth Lloyd. Quantum machine learning.Nature, 549(7671):195–202, 2017

2017
[2]

Practical secure aggregation for privacy-preserving machine learning

Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth. Practical secure aggregation for privacy-preserving machine learning. Inproceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pages 1175–1191, 2017

2017
[3]

Sampling using su (n) gauge equivariant flows.Physical Review D, 103(7):074504, 2021

Denis Boyda, Gurtej Kanwar, S´ ebastien Racani` ere, Danilo Jimenez Rezende, Michael S Al- bergo, Kyle Cranmer, Daniel C Hackett, and Phiala E Shanahan. Sampling using su (n) gauge equivariant flows.Physical Review D, 103(7):074504, 2021

2021
[4]

Learning equivariant maps with variational quantum circuits.Physical Review Applied, 23(4):044007, 2025

Zachary P Bradshaw, Ethan N Evans, Matthew Cook, and Margarite L LaBorde. Learning equivariant maps with variational quantum circuits.Physical Review Applied, 23(4):044007, 2025

2025
[5]

Geometric deep learning: Grids, groups, graphs, geodesics, and gauges.arXiv preprint arXiv:2104.13478, 2021

Michael M Bronstein, Joan Bruna, Taco Cohen, and Petar Veliˇ ckovi´ c. Geometric deep learning: Grids, groups, graphs, geodesics, and gauges.arXiv preprint arXiv:2104.13478, 2021

arXiv 2021
[6]

Geometric deep learning: going beyond euclidean data.IEEE Signal Processing Magazine, 34(4):18–42, 2017

Michael M Bronstein, Joan Bruna, Yann LeCun, Arthur Szlam, and Pierre Vandergheynst. Geometric deep learning: going beyond euclidean data.IEEE Signal Processing Magazine, 34(4):18–42, 2017

2017
[7]

Ipguard: Protecting intellectual property of deep neural networks via fingerprinting the classification boundary

Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. Ipguard: Protecting intellectual property of deep neural networks via fingerprinting the classification boundary. InProceedings of the 2021 ACM asia conference on computer and communications security, pages 14–25, 2021

2021
[8]

Variational quan- tum algorithms.Nature Reviews Physics, 3(9):625–644, 2021

Marco Cerezo, Andrew Arrasmith, Ryan Babbush, Simon C Benjamin, Suguru Endo, Keisuke Fujii, Jarrod R McClean, Kosuke Mitarai, Xiao Yuan, Lukasz Cincio, et al. Variational quan- tum algorithms.Nature Reviews Physics, 3(9):625–644, 2021

2021

Show all 38 references

[9]

Digital image steganog- raphy: Survey and analysis of current methods.Signal processing, 90(3):727–752, 2010

Abbas Cheddad, Joan Condell, Kevin Curran, and Paul Mc Kevitt. Digital image steganog- raphy: Survey and analysis of current methods.Signal processing, 90(3):727–752, 2010

2010
[10]

Group equivariant convolutional networks

Taco Cohen and Max Welling. Group equivariant convolutional networks. InInternational conference on machine learning, pages 2990–2999. PMLR, 2016

2016
[11]

Spherical cnns.arXiv preprint arXiv:1801.10130, 2018

Taco S Cohen, Mario Geiger, Jonas K¨ ohler, and Max Welling. Spherical cnns.arXiv preprint arXiv:1801.10130, 2018

2018 arXiv
[12]

University of Florida, 2025

Matthew Cook.Competency Awareness Using Null Space Projections. University of Florida, 2025

2025
[13]

Outlier detection through null space analysis of neural networks.arXiv preprint arXiv:2007.01263, 2020

Matthew Cook, Alina Zare, and Paul Gader. Outlier detection through null space analysis of neural networks.arXiv preprint arXiv:2007.01263, 2020. 20

2007 arXiv
[14]

Differential privacy: A survey of results

Cynthia Dwork. Differential privacy: A survey of results. InInternational conference on theory and applications of models of computation, pages 1–19. Springer, 2008

2008
[15]

Calibrating noise to sensi- tivity in private data analysis

Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensi- tivity in private data analysis. InTheory of cryptography conference, pages 265–284. Springer, 2006

2006
[16]

Se (3)-transformers: 3d roto- translation equivariant attention networks.Advances in neural information processing systems, 33:1970–1981, 2020

Fabian Fuchs, Daniel Worrall, Volker Fischer, and Max Welling. Se (3)-transformers: 3d roto- translation equivariant attention networks.Advances in neural information processing systems, 33:1970–1981, 2020

1970
[17]

Fully homomorphic encryption using ideal lattices

Craig Gentry. Fully homomorphic encryption using ideal lattices. InProceedings of the forty- first annual ACM symposium on Theory of computing, pages 169–178, 2009

2009
[18]

Geometric deep learning and equivariant neural networks

Jan E Gerken, Jimmy Aronsson, Oscar Carlsson, Hampus Linander, Fredrik Ohlsson, Christof- fer Petersson, and Daniel Persson. Geometric deep learning and equivariant neural networks. Artificial Intelligence Review, 56(12):14605–14662, 2023

2023
[19]

Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy

Ran Gilad-Bachrach, Nathan Dowlin, Kim Laine, Kristin Lauter, Michael Naehrig, and John Wernsing. Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy. InInternational conference on machine learning, pages 201–210. PMLR, 2016

2016
[20]

Kaitlin Gili.Do quantum models make good generative learners?PhD thesis, University of Oxford, 2023

2023
[21]

Hall.Lie Groups, Lie Algebras, and Representations: An Elementary Introduction

Brian C. Hall.Lie Groups, Lie Algebras, and Representations: An Elementary Introduction. Springer, 2015

2015
[22]

Advances and open problems in federated learning

Peter Kairouz and H Brendan McMahan. Advances and open problems in federated learning. Foundations and trends in machine learning, 14(1-2):1–210, 2021

2021
[23]

Equivariant flow-based sampling for lattice gauge theory.Physical Review Letters, 125(12):121601, 2020

Gurtej Kanwar, Michael S Albergo, Denis Boyda, Kyle Cranmer, Daniel C Hackett, S´ ebastien Racaniere, Danilo Jimenez Rezende, and Phiala E Shanahan. Equivariant flow-based sampling for lattice gauge theory.Physical Review Letters, 125(12):121601, 2020

2020
[24]

On the generalization of equivariance and convolution in neural networks to the action of compact groups

Risi Kondor and Shubhendu Trivedi. On the generalization of equivariance and convolution in neural networks to the action of compact groups. InInternational conference on machine learning, pages 2747–2755. PMLR, 2018

2018
[25]

A review of applications in federated learning

Li Li, Yuxi Fan, Mike Tse, and Kuo-Yi Lin. A review of applications in federated learning. Computers & Industrial Engineering, 149:106854, 2020

2020
[26]

Null space properties of neural networks with applications to image steganography.Mathematics, 13(21):3394, 2025

Xiang Li and Kevin M Short. Null space properties of neural networks with applications to image steganography.Mathematics, 13(21):3394, 2025

2025
[27]

Deep neural network fingerprinting by conferrable adversarial examples.arXiv preprint arXiv:1912.00888, 2019

Nils Lukas, Yuxuan Zhang, and Florian Kerschbaum. Deep neural network fingerprinting by conferrable adversarial examples.arXiv preprint arXiv:1912.00888, 2019

1912 arXiv
[28]

Federated learning: Opportunities and challenges.arXiv preprint arXiv:2101.05428, 2021

Priyanka Mary Mammen. Federated learning: Opportunities and challenges.arXiv preprint arXiv:2101.05428, 2021

2021 arXiv
[29]

Communication-efficient learning of deep networks from decentralized data

Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Ar- cas. Communication-efficient learning of deep networks from decentralized data. InArtificial intelligence and statistics, pages 1273–1282. Pmlr, 2017. 21

2017
[30]

An overview of image steganography

Tayana Morkel, Jan HP Eloff, and Martin S Olivier. An overview of image steganography. In Issa, volume 1, pages 1–11, 2005

2005
[31]

Finger- printing deep neural networks globally via universal adversarial perturbations

Zirui Peng, Shaofeng Li, Guoxing Chen, Cheng Zhang, Haojin Zhu, and Minhui Xue. Finger- printing deep neural networks globally via universal adversarial perturbations. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 13430–13439, 2022

2022
[32]

Quantum chemistry structures and properties of 134 kilo molecules.Scientific data, 1(1):1–7, 2014

Raghunathan Ramakrishnan, Pavlo O Dral, Matthias Rupp, and O Anatole Von Lilienfeld. Quantum chemistry structures and properties of 134 kilo molecules.Scientific data, 1(1):1–7, 2014

2014
[33]

Protecting artificial intelligence ips: a survey of watermarking and fingerprinting for machine learning.CAAI Transactions on Intelligence Technology, 6(2):180–191, 2021

Francesco Regazzoni, Paolo Palmieri, Fethulah Smailbegovic, Rosario Cammarota, and Ilia Polian. Protecting artificial intelligence ips: a survey of watermarking and fingerprinting for machine learning.CAAI Transactions on Intelligence Technology, 6(2):180–191, 2021

2021
[34]

Enumeration of 166 billion organic small molecules in the chemical universe database gdb-17.Journal of chemical information and modeling, 52(11):2864–2875, 2012

Lars Ruddigkeit, Ruud Van Deursen, Lorenz C Blum, and Jean-Louis Reymond. Enumeration of 166 billion organic small molecules in the chemical universe database gdb-17.Journal of chemical information and modeling, 52(11):2864–2875, 2012

2012
[35]

Circuit-centric quantum classifiers.Physical Review A, 101(3):032308, 2020

Maria Schuld, Alex Bocharov, Krysta M Svore, and Nathan Wiebe. Circuit-centric quantum classifiers.Physical Review A, 101(3):032308, 2020

2020
[36]

Springer, 2012

Benjamin Steinberg.Representation theory of finite groups: an introductory approach, vol- ume 68. Springer, 2012

2012
[37]

Tensor field networks: Rotation-and translation-equivariant neural networks for 3d point clouds.arXiv preprint arXiv:1802.08219, 2018

Nathaniel Thomas, Tess Smidt, Steven Kearnes, Lusann Yang, Li Li, Kai Kohlhoff, and Patrick Riley. Tensor field networks: Rotation-and translation-equivariant neural networks for 3d point clouds.arXiv preprint arXiv:1802.08219, 2018

2018 arXiv
[38]

A survey on federated learning: challenges and applications.International journal of machine learning and cybernetics, 14(2):513–535, 2023

Jie Wen, Zhixia Zhang, Yang Lan, Zhihua Cui, Jianghui Cai, and Wensheng Zhang. A survey on federated learning: challenges and applications.International journal of machine learning and cybernetics, 14(2):513–535, 2023. 22

2023

Pith tools

Reviewed August 2, 2026 · model on record in the stance chip above.

[1] [1]

Quantum machine learning.Nature, 549(7671):195–202, 2017

Jacob Biamonte, Peter Wittek, Nicola Pancotti, Patrick Rebentrost, Nathan Wiebe, and Seth Lloyd. Quantum machine learning.Nature, 549(7671):195–202, 2017

2017

[2] [2]

Practical secure aggregation for privacy-preserving machine learning

Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth. Practical secure aggregation for privacy-preserving machine learning. Inproceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pages 1175–1191, 2017

2017

[3] [3]

Sampling using su (n) gauge equivariant flows.Physical Review D, 103(7):074504, 2021

Denis Boyda, Gurtej Kanwar, S´ ebastien Racani` ere, Danilo Jimenez Rezende, Michael S Al- bergo, Kyle Cranmer, Daniel C Hackett, and Phiala E Shanahan. Sampling using su (n) gauge equivariant flows.Physical Review D, 103(7):074504, 2021

2021

[4] [4]

Learning equivariant maps with variational quantum circuits.Physical Review Applied, 23(4):044007, 2025

Zachary P Bradshaw, Ethan N Evans, Matthew Cook, and Margarite L LaBorde. Learning equivariant maps with variational quantum circuits.Physical Review Applied, 23(4):044007, 2025

2025

[5] [5]

Geometric deep learning: Grids, groups, graphs, geodesics, and gauges.arXiv preprint arXiv:2104.13478, 2021

Michael M Bronstein, Joan Bruna, Taco Cohen, and Petar Veliˇ ckovi´ c. Geometric deep learning: Grids, groups, graphs, geodesics, and gauges.arXiv preprint arXiv:2104.13478, 2021

arXiv 2021

[6] [6]

Geometric deep learning: going beyond euclidean data.IEEE Signal Processing Magazine, 34(4):18–42, 2017

Michael M Bronstein, Joan Bruna, Yann LeCun, Arthur Szlam, and Pierre Vandergheynst. Geometric deep learning: going beyond euclidean data.IEEE Signal Processing Magazine, 34(4):18–42, 2017

2017

[7] [7]

Ipguard: Protecting intellectual property of deep neural networks via fingerprinting the classification boundary

Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. Ipguard: Protecting intellectual property of deep neural networks via fingerprinting the classification boundary. InProceedings of the 2021 ACM asia conference on computer and communications security, pages 14–25, 2021

2021

[8] [8]

Variational quan- tum algorithms.Nature Reviews Physics, 3(9):625–644, 2021

Marco Cerezo, Andrew Arrasmith, Ryan Babbush, Simon C Benjamin, Suguru Endo, Keisuke Fujii, Jarrod R McClean, Kosuke Mitarai, Xiao Yuan, Lukasz Cincio, et al. Variational quan- tum algorithms.Nature Reviews Physics, 3(9):625–644, 2021

2021