Embedding-Based Federated Data Sharing via Differentially Private Conditional VAEs

Christian Ledig; Francesco Di Salvo; Hanh Huyen My Nguyen

REVIEW 3 major objections 5 minor 32 references

Embedding-Based Federated Data Sharing via Differentially Private Conditional VAEs

T0 review · 3 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Federated DP-CVAE on foundation-model embeddings yields synthetic medical data that beats traditional federated classifiers.

desk verdict A sensible empirical pipeline for federated synthetic embeddings, but the central DP guarantee is unaccounted for and needs a proper composition analysis before the paper can be trusted on privacy. read the letter →

arxiv 2507.02671 v1 pith:7PD4RD2P submitted 2025-07-03 cs.LG cs.CVeess.IV

Francesco Di Salvo , Hanh Huyen My Nguyen , Christian Ledig This is my paper · ORCID

classification cs.LGcs.CVeess.IV

keywords federatedlearningdifferentialprivacyconditionalvariationalautoencodersyntheticdatagenerationmedicalimagingfeatureembeddingsfoundationmodelsprivacy-preservingsharing

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that federated learning can be replaced by a data-sharing scheme in which clients jointly train a differentially private conditional variational autoencoder on embeddings extracted by a pre-trained foundation model, and that the synthetic data generated this way support downstream classifiers that outperform traditional federated classifiers. If true, hospitals and other data silos could share the statistical content of their datasets without moving raw images or training task-specific models, while still obtaining formal differential privacy guarantees. The paper also claims that this CVAE-based approach produces synthetic embeddings closer to the real distribution than a differentially private GAN while using about five times fewer parameters, which would make it a practical choice for resource-constrained federated settings.

What carries the argument

The central object is the conditional VAE operating on foundation-model embeddings. The machinery combines four pieces: a frozen pre-trained foundation model that compresses raw images into compact, task-relevant embeddings; a lightweight three-layer CVAE trained on those embeddings with mean-squared-error reconstruction plus KL divergence to a standard normal prior; DP-SGD applied locally at each client to clip and noise per-sample gradients; and FedAvg aggregation of the shared decoder weights across clients while encoders remain personalized. The decoder, once aggregated, samples synthetic embeddings from a standard normal latent space conditioned on class labels, producing a global synthetic dataset for any downstream task. This design carries the argument because the embedding space makes a small generative model sufficient, the DP-SGD mechanism provides the formal privacy claim, and the decoder-only aggregation reduces communication while capturing cross-client variation.

What would settle it

A recomputation of the privacy loss of the full federated protocol using standard DP composition theorems, taking into account all local DP-SGD steps and the FedAvg averaging across clients and rounds, would settle whether the claimed (epsilon=1.0, delta=1e-4) guarantee actually holds.

Watch

Extended reading notes

Core claim

The paper's central claim is that a federated, differentially private Conditional Variational Autoencoder (CVAE) trained on feature embeddings from a shared foundation model can act as a privacy-preserving data-sharing mechanism. Each client extracts compact embeddings from its private images using a frozen pre-trained model, then trains a CVAE locally with DP-SGD. Only the decoder weights are shared and aggregated with FedAvg; each client then generates a synthetic global dataset from the aggregated decoder, and combines a local classifier with a classifier trained on synthetic data through a learned interpolation weight. Across an 11-class abdominal CT dataset and a binary histopathology dataset, this scheme achieves higher balanced accuracy than FedAvg, FedProx, and a personalized FedLambda baseline, even though those baselines do not provide differential privacy. In a separate fidelity comparison, the CVAE decoder reconstructs the embedding distribution with lower Wasserstein distance than a DP-CGAN while using about five times fewer parameters.

Load-bearing premise

The paper assumes that applying DP-SGD per client and then averaging the decoders with FedAvg for 50 rounds yields the claimed overall differential privacy for the released global decoder and the synthetic embeddings, but it does not supply the noise multiplier, the number of gradient steps, or a composition analysis for the federated protocol.

Editorial extensions

If this is right

If the method works as claimed, institutions can share a global generative model instead of exchanging raw images or task-specific weights, enabling any downstream task (classification, anomaly detection, out-of-distribution detection) from the same synthetic dataset.
The performance comparison suggests that even with formal differential privacy at epsilon = 1.0, the generative data-sharing approach can match or exceed non-private federated classifiers, so privacy may not cost accuracy in this setting.
The fidelity and parameter-count comparison indicates that CVAEs are a more lightweight and faithful generative choice for embedding spaces than GANs under DP, which is particularly relevant for communication- and compute-limited federated networks.
The robustness across different feature extractors and client counts suggests the approach degrades gracefully as per-client data shrinks, making it suitable for rare-disease or small-hospital settings.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A natural extension the paper leaves implicit is to apply the same DP-CVAE data-sharing scheme to non-classification tasks like segmentation or survival prediction, since the synthetic dataset decouples from task.
The privacy accounting deserves scrutiny: the paper does not provide a composition analysis covering multiple clients, multiple rounds, and the FedAvg aggregation, so the effective epsilon across the released global decoder is not established by the current argument.
A testable extension is to use class-specific or learned latent variance in the decoder, as the paper itself mentions, to see whether synthetic embeddings become more useful for downstream classifiers, especially under class imbalance.
Another implicit consequence is that the quality of the shared synthetic dataset is bounded by the quality of the chosen foundation model; if the embeddings lose discriminative information, the downstream classifiers inherit that ceiling.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

This paper combines three known building blocks—CVAEs trained on foundation-model embeddings (their own earlier work), FedAvg, and per-client DP-SGD—into a protocol for sharing synthetic embeddings across medical institutions. The empirical work is genuine: two medical imaging datasets, IID and non-IID splits, several feature extractors, and comparisons against FedAvg, FedProx, a kNN-Per variant, and DP-CGAN. The accuracy results mostly support the claim that this generative data-sharing approach beats federated classifiers; the gains on Camelyon (limited data) and the 5x parameter reduction over DP-CGAN are concrete. The paper is clearly written and the ablation on client count is a nice touch.

The soft spot is exactly where the stress-test note lands. The (1.0, 1e-4) guarantee is asserted without the noise multiplier, without a composition analysis across the 50 FedAvg rounds, and without specifying how Opacus is invoked per client. Standard DP-SGD gives a guarantee for a single training run from an initialization independent of the data; here, round t+1 starts from the aggregated decoder that already contains the client's own gradient history, so the per-round guarantees compose across rounds. Reporting a target (epsilon, delta) and clipping norm without the accountant is not enough—the actual privacy loss under a correct DP-FedAvg composition is likely much larger than 1.0. This is not a minor detail; the paper's title and abstract hinge on the DP claim. The accuracy results don't rescue the privacy claim, though they stand as empirical evidence that the pipeline works in practice.

A secondary issue: the abstract's unqualified 'outperforming traditional FL classifiers' is contradicted by the CT non-IID BACC in Table 1 (57.58 vs 58.74 for FedAvg). The body does acknowledge this, so the fix is to temper the language. Missing hyperparameters (noise multiplier, number of gradient steps) and the unverified code link should also be supplied.

Who is this for? Researchers working on federated generative models or privacy-preserving medical imaging. The idea is worth discussing, and the experimental protocol is a good starting point, but the paper should not be cited as providing a formal DP guarantee until the accounting is fixed.

Recommendation: send it to peer review, but insist on a proper DP-FedAvg accountant (e.g., RDP composition across rounds), explicit noise multiplier, and a revised abstract. The empirical contribution is solid enough to warrant revision rather than rejection.

Referee Report

3 major / 5 minor

Summary. The paper proposes a federated data-sharing method in which clients extract embeddings from raw medical images using a frozen foundation model (DINOv2), train a Conditional VAE locally under DP-SGD, and share only decoder weights that are aggregated via FedAvg. The global decoder is then used locally to synthesize embedding-level data for downstream classification, with each client interpolating between a local classifier and a classifier trained on the synthetic global data. The authors report accuracy and balanced accuracy on three medical imaging settings, compare against FedAvg, FedProx, and a kNN-Per adaptation, and claim that the approach outperforms traditional federated classifiers while providing (ε=1.0, δ=1e-4) differential privacy, and that DP-CVAE achieves higher embedding fidelity than DP-CGAN with roughly 5× fewer parameters.

Significance. If the claims were fully supported, the method would be a practically attractive alternative to federated model sharing: it decouples data sharing from downstream tasks, works on compact embeddings, and provides a formal privacy guarantee. The empirical setup is well grounded: multiple datasets, multiple feature extractors in the ablation, comparison to standard FL baselines, and publicly available code. The paper also includes a useful fidelity comparison of DP-CVAE against DP-CGAN. However, the central privacy contribution is not substantiated in the manuscript as written: no noise multiplier, step count, or composition analysis is provided for the DP-SGD/FedAvg protocol, so the claimed (1.0, 1e-4) guarantee is not verifiable and is likely under-counted under standard accounting. The accuracy claim also needs qualification because the balanced-accuracy result on CT non-IID is below FedAvg. These issues directly affect the abstract's core claims, but they are fixable within the manuscript's scope, so major revision is appropriate.

major comments (3)

[§2.2 and §3.1] The claimed (ε=1.0, δ=1e-4) differential privacy guarantee is not established by the reported protocol. Section 3.1 reports only the target ε, δ, clipping norm 1.5, 50 communication rounds, and 5 local epochs per round; it does not report the noise multiplier, batch size, number of gradient steps per client, or the privacy accountant used. Standard DP-SGD accounting assumes that the model initialization is independent of the private data, but in FedAvg each round t+1 starts from the aggregated decoder of round t, which already contains the same clients' earlier contributions; per-client Opacus accounting therefore under-counts composition across the 50 rounds. To support the central privacy claim, the authors need to specify the full DP-SGD configuration and provide a federated composition analysis (e.g., a DP-FedAvg accountant), or explicitly restrict and re-derive the guarantee. As written, the 'ensuring differential privacy' contribution in the abstract and contributions list is unsupported.
[Abstract and Table 1] The abstract's unqualified claim that the approach 'outperforming traditional FL classifiers' conflicts with Table 1: on CT (α=0.3), the balanced accuracy of DP-CVAE is 57.58±3.33, which is below FedAvg (58.74±2.93) and below FedProx (58.66±5.84). The text in §3.2 partially acknowledges this ('comparable or slightly lower balanced accuracy'), but the abstract and the contributions list do not carry the qualification. Because the method's advantage is presented as broad, the accuracy claim must be stated with the metric- and setting-specific caveats.
[§2.3, §3.1, and §3.2] The comparison against non-private federated classifiers is used to argue for the value of privacy-preserving data sharing, but the baselines FedAvg, FedProx, and FedLambda do not receive any DP treatment. This would be acceptable if the DP guarantee were independently established; given the missing privacy accounting in §2.2, the comparison currently conflates two differences: sharing mechanism (data versus model) and privacy mechanism (DP versus none). Please either provide a validated privacy accounting or present the accuracy results without claiming a formal privacy guarantee for the released decoder and synthetic embeddings.

minor comments (5)

[§2.2, Eq. (1)] The DP definition is written for output S_hat_m, but the mechanism that is actually privatized is the training procedure producing the decoder weights; the notation should be aligned with the released object, and the post-processing step that turns decoder weights into synthetic embeddings should be stated explicitly.
[§3.1 and Figure 2] To make the '5× fewer parameters' claim reproducible, the paper should provide the exact architectures, layer sizes, and parameter counts for DP-CGAN and DP-CVAE, and state the DP hyperparameters used for DP-CGAN (noise multiplier, clipping, number of steps).
[Figure 3] The dashed 'Upper bound: BACC on real embeddings' line is not per-backbone in the figure; please clarify whether the same upper bound is used for all backbones and how it was computed.
[Section 4] The limitations paragraph discusses data imbalance, fixed unit variance, and conditioning on confounders, but it does not mention the DP-SGD/FedAvg composition issue raised in the major comments; this should be addressed in the main text or explicitly listed as a limitation.
[Throughout] There are minor typographical issues, such as 'Tomitigatetransmissioncosts' in the Introduction and 'c.f.' instead of 'cf.' in Section 3.1; a careful proofreading pass is recommended.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper's empirical claims are self-contained against external baselines; the only self-citation supplies motivation, not a forced result.

full rationale

The paper's derivation chain is empirical rather than analytic, and no step reduces to its own input by construction. The core contributions are (i) training a DP-CVAE on foundation-model embeddings in a federated setting via FedAvg, and (ii) comparing downstream classification accuracy and reconstruction fidelity (Wasserstein distance) against baselines such as FedAvg, FedProx, FedLambda, and DP-CGAN. Equation (2) is standard FedAvg aggregation; Equation (3) defines synthetic data generation from the aggregated decoder; Equations (4)-(5) define a validation-tuned interpolation. None of these equations encodes the reported accuracy or fidelity numbers. The only self-citation is reference [5], which is used to motivate the choice of a CVAE on embeddings ('A recent work has demonstrated that generating synthetic feature embeddings using a CVAE preserved classification performance... [5]'). That citation is not load-bearing in the present argument because the paper's central results are directly measured against external competitors and public benchmarks, and the claimed CVAE-over-CGAN fidelity advantage is empirically demonstrated in Figure 2 rather than imported from [5]. The paper does contain a rigor gap: the claimed (epsilon=1.0, delta=1e-4) DP guarantee is not substantiated because no noise multiplier or composition analysis for 50 FedAvg rounds is reported, and standard DP-SGD guarantees do not automatically compose in that protocol. However, an unsubstantiated privacy claim is a correctness or completeness issue, not a circularity: the accuracy and fidelity results are not derived from the DP claim. No fitted parameter is renamed as a prediction, no uniqueness theorem is invoked to force a choice, and no known result is merely relabeled. Therefore the appropriate finding is no significant circularity.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The paper introduces no new entities. Its free parameters are mostly standard FL/DP hyperparameters, but the crucial DP noise multiplier is omitted, and the interpolation coefficients are per-client fitted values. The main unstated assumptions concern the validity of the DP guarantee in the federated protocol and the representational power of DINOv2 embeddings.

free parameters (5)

interpolation coefficient lambda_m = chosen from {0.0, 0.1, ..., 1.0} per client on validation set
Controls the trade-off between local and global classifiers in Eq. (4); tuned per client on validation data, so it is a fitted value.
gradient clipping norm C = 1.5
Set by hand; governs DP noise and utility trade-off in DP-SGD.
DP budget (epsilon, delta) = (1.0, 1e-4)
Chosen to balance privacy and utility; not derived from any analysis.
DP noise multiplier sigma = not reported
Required to implement DP-SGD; its absence prevents reproducing or auditing the claimed privacy guarantee.
CVAE architecture sizes = not reported
The paper says 'three linear layers' and 'symmetric architecture' but gives no layer widths or latent dimension.

assumptions (4)

domain assumption DP-SGD with Opacus yields (1.0, 1e-4)-DP for each client's local training
Stated in Section 2.2 without reporting noise multiplier or step count; relies on the library's accounting.
domain assumption FedAvg of DP-trained decoders preserves DP for all clients
The paper treats aggregation as post-processing but does not analyze composition across rounds or the effect of sharing the global decoder back to clients.
domain assumption DINOv2 embeddings capture diagnostically relevant information and do not leak raw-image content
Used as the feature basis in Section 2.1; the paper offers no leakage analysis of the embeddings themselves.
domain assumption Averaging decoders yields a global decoder that approximates the global data distribution
Standard FedAvg convergence assumption, invoked without proof.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Embedding-Based Federated Data Sharing via Differentially Private Conditional VAEs." pith.science (2026). https://pith.science/paper/7PD4RD2P

@misc{pith2026250702671,
  author       = {Pith},
  title        = {Pith review of: Embedding-Based Federated Data Sharing via Differentially Private Conditional VAEs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/7PD4RD2P}},
  note         = {Machine review of arXiv:2507.02671}
}

abstract

Deep Learning (DL) has revolutionized medical imaging, yet its adoption is constrained by data scarcity and privacy regulations, limiting access to diverse datasets. Federated Learning (FL) enables decentralized training but suffers from high communication costs and is often restricted to a single downstream task, reducing flexibility. We propose a data-sharing method via Differentially Private (DP) generative models. By adopting foundation models, we extract compact, informative embeddings, reducing redundancy and lowering computational overhead. Clients collaboratively train a Differentially Private Conditional Variational Autoencoder (DP-CVAE) to model a global, privacy-aware data distribution, supporting diverse downstream tasks. Our approach, validated across multiple feature extractors, enhances privacy, scalability, and efficiency, outperforming traditional FL classifiers while ensuring differential privacy. Additionally, DP-CVAE produces higher-fidelity embeddings than DP-CGAN while requiring $5{\times}$ fewer parameters.

Figures

Figures reproduced from arXiv: 2507.02671 by the authors.

**Figure 1.** Illustration of our proposed methodology. (1) Each client H encodes its imagebased dataset D into an embedding-based dataset S using a large, pre-trained foundation model Φ, reducing data storage requirements and computational overhead. (2) Clients collaboratively train a lightweight DP-CVAE (E, D) and periodically share decoder weights, which are aggregated into a global decoder D g . This shared decoder capture… view at source ↗

**Figure 2.** Reconstruction fidelity, measured by the Wasserstein distance (W ↓) between real and synthetic samples, comparing DPCVAE and DP-CGAN. Results are analyzed in relation to the number of model parameters. 2 5 7 10 Number of clients 60.0 62.5 65.0 67.5 70.0 72.5 75.0 77.5 80.0 BACC DINO DINOv2 ViT Upper bound: BACC on real embeddings [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

32 extracted references · 24 canonical work pages

[1]

In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (2016)

Abadi, M., Chu, A., Goodfellow, I., McMahan, H.B., Mironov, I., Talwar, K., Zhang, L.: Deep learning with differential privacy. In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (2016)

work page 2016
[2]

In: 2023 IEEE Wireless Communications and Networking Conference (WCNC)

Chen, B., Li, H., Guo, L., Wang, L.: Label-wise distribution adaptive federated learning on non-iid data. In: 2023 IEEE Wireless Communications and Networking Conference (WCNC). pp. 1–6 (2023)

work page 2023
[3]

In: International Conference on Medical Image Computing and Computer-Assisted Intervention

Chen, M., Jiang, M., Dou, Q., Wang, Z., Li, X.: Fedsoup: improving generalization and personalization in federated learning via selective model interpolation. In: International Conference on Medical Image Computing and Computer-Assisted Intervention. pp. 318–328. Springer (2023)

work page 2023
[4]

In: International conference on machine learning

Collins, L., Hassani, H., Mokhtari, A., Shakkottai, S.: Exploiting shared represen- tations for personalized federated learning. In: International conference on machine learning. pp. 2089–2099. PMLR (2021)

work page 2021
[5]

The 35th British Machine Vision Conference (2024)

Di Salvo, F., Tafler, D., Doerrich, S., Ledig, C.: Privacy-preserving datasets by capturing feature distributions with conditional vaes. The 35th British Machine Vision Conference (2024)

work page 2024
[6]

In: International Conference on Learning Representations (2021)

Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., Gelly, S., Uszkoreit, J., Houlsby, N.: An image is worth 16x16 words: Transformers for image recognition at scale. In: International Conference on Learning Representations (2021)

2021
[7]

In: Proceedings of the 33rd International Col- loquium on Automata, Languages and Programming

Dwork, C.: Differential privacy. In: Proceedings of the 33rd International Col- loquium on Automata, Languages and Programming. pp. 1–12. Springer Berlin Heidelberg (2006)

work page 2006
[8]

A Systematic Review of Federated Generative Models

Gargary, A.V., De Cristofaro, E.: A systematic review of federated generative mod- els. arXiv preprint arXiv:2405.16682 (2024)

work page Pith review arXiv 2024

Show all 32 references

[9]

Advances in neural infor- mation processing systems27(2014)

Goodfellow, I., Pouget-Abadie, J., Mirza, M., Xu, B., Warde-Farley, D., Ozair, S., Courville, A., Bengio, Y.: Generative adversarial nets. Advances in neural infor- mation processing systems27(2014)

2014
[10]

Advances in neural information processing systems33, 6840–6851 (2020)

Ho, J., Jain, A., Abbeel, P.: Denoising diffusion probabilistic models. Advances in neural information processing systems33, 6840–6851 (2020)

2020
[11]

In: 2023 IEEE Symposium on Computers and Communications (ISCC)

Kaspour, S., Yassine, A.: Variational auto-encoder model and federated approach for non-intrusive load monitoring in smart homes. In: 2023 IEEE Symposium on Computers and Communications (ISCC). pp. 1110–1115 (2023)

2023
[12]

Radiology312(3), e232471 (2024)

Koetzier, L.R., Wu, J., Mastrodicasa, D., Lutz, A., Chung, M., Koszek, W.A., Pratap, J., Chaudhari, A.S., Rajpurkar, P., Lungren, M.P., et al.: Generating syn- thetic data for medical imaging. Radiology312(3), e232471 (2024)

2024
[13]

In: International conference on machine learning (2021)

Koh, P.W., Sagawa, S., Marklund, H., Xie, S.M., Zhang, M., Balsubramani, A., Hu, W., Yasunaga, M., Phillips, R.L., Gao, I., et al.: Wilds: A benchmark of in-the-wild distribution shifts. In: International conference on machine learning (2021)

2021
[14]

Nature Medicine30(4) (2024) 10 F

Ktena, I., Wiles, O., Albuquerque, I., Rebuffi, S.A., Tanno, R., Roy, A.G., Azizi, S., Belgrave, D., Kohli, P., Cemgil, T., et al.: Generative models improve fairness of medical classifiers under distribution shifts. Nature Medicine30(4) (2024) 10 F. Di Salvo et al

2024
[15]

arXiv:2211.11434 (2022)

Lange, L., Schneider, M., Christen, P., Rahm, E.: Privacy in practice: Private covid-19 detection in x-ray images (extended version). arXiv:2211.11434 (2022)

2022
[16]

Proceedings of Machine learning and sys- tems2, 429–450 (2020)

Li, T., Sahu, A.K., Zaheer, M., Sanjabi, M., Talwalkar, A., Smith, V.: Federated optimization in heterogeneous networks. Proceedings of Machine learning and sys- tems2, 429–450 (2020)

2020
[17]

In: International Conference on Medical Image Computing and Computer-Assisted Intervention (2024)

Li, X., Zhang, W., Yu, Y., Zheng, W.S., Zhang, T., Wang, R.: Sift: A serial frame- work with textual guidance for federated learning. In: International Conference on Medical Image Computing and Computer-Assisted Intervention (2024)

2024
[18]

Medical image analysis42, 60–88 (2017)

Litjens, G., Kooi, T., Bejnordi, B.E., Setio, A.A.A., Ciompi, F., Ghafoorian, M., Van Der Laak, J.A., Van Ginneken, B., Sánchez, C.I.: A survey on deep learning in medical image analysis. Medical image analysis42, 60–88 (2017)

2017
[19]

In: International Conference on Machine Learning

Marfoq, O., Neglia, G., Vidal, R., Kameni, L.: Personalized federated learning through local memorization. In: International Conference on Machine Learning. pp. 15070–15092. PMLR (2022)

2022
[20]

In: Artificial intelligence and statistics

McMahan, B., Moore, E., Ramage, D., Hampson, S., y Arcas, B.A.: Communication-efficient learning of deep networks from decentralized data. In: Artificial intelligence and statistics. pp. 1273–1282. PMLR (2017)

2017
[21]

In: 2021 IEEE Symposium on Security and Privacy (S&P)

Nasr, M., Song, S., Thakurta, A., Papernot, N., Carlini, N.: Adversary instan- tiation: Lower bounds for differentially private machine learning. In: 2021 IEEE Symposium on Security and Privacy (S&P). IEEE (2021)

2021
[22]

Transactions on Machine Learning Research (2024)

Oquab, M., Darcet, T., Moutakanni, T., Vo, H.V., Szafraniec, M., Khalidov, V., Fernandez, P., HAZIZA, D., Massa, F., El-Nouby, A., Assran, M., Ballas, N., Galuba, W., Howes, R., Huang, P.Y., Li, S.W., Misra, I., Rabbat, M., Sharma, V., Synnaeve, G., Xu, H., Jegou, H., Mairal, ...

2024
[23]

In: Proceedings of the AAAI conference on Artificial Intelligence

Paul, S., Chen, P.Y.: Vision transformers are robust learners. In: Proceedings of the AAAI conference on Artificial Intelligence. vol. 36, pp. 2071–2081 (2022)

2022
[24]

arXiv:2211.11591 (2022)

Pfitzner, B., Arnrich, B.: Dpd-fvae: Synthetic data generation using federated vari- ational autoencoders with differentially-private decoder. arXiv:2211.11591 (2022)

2022 arXiv
[25]

Nature medicine26(1), 29–38 (2020)

Shilo, S., Rossman, H., Segal, E.: Axes of a revolution: challenges and promises of big data in healthcare. Nature medicine26(1), 29–38 (2020)

2020
[26]

IEEE journal of biomedical and health informatics 25(2), 325–336 (2020)

Stacke, K., Eilertsen, G., Unger, J., Lundström, C.: Measuring domain shift for deep learning in histopathology. IEEE journal of biomedical and health informatics 25(2), 325–336 (2020)

2020
[27]

In: International Con- ference on Medical Image Computing and Computer-Assisted Intervention (2023)

Wu, N., Yu, L., Yang, X., Cheng, K.T., Yan, Z.: Fediic: Towards robust federated learning for class-imbalanced medical image classification. In: International Con- ference on Medical Image Computing and Computer-Assisted Intervention (2023)

2023
[28]

In: International Con- ference on Medical Image Computing and Computer-Assisted Intervention

Xia, Y., Ma, B., Dou, Q., Xia, Y.: Enhancing federated learning performance fair- ness via collaboration graph-based reinforcement learning. In: International Con- ference on Medical Image Computing and Computer-Assisted Intervention. pp. 263–272. Springer (2024)

2024
[29]

IEEE transactions on medical imaging 38(8), 1885–1898 (2019)

Xu, X., Zhou, F., Liu, B., Fu, D., Bai, X.: Efficient multiple organ localization in ct image using 3d region proposal network. IEEE transactions on medical imaging 38(8), 1885–1898 (2019)

2019
[30]

Scientific Data10(1), 41 (2023)

Yang,J.,Shi,R.,Wei,D.,Liu,Z.,Zhao,L.,Ke,B.,Pfister,H.,Ni,B.:Medmnistv2- a large-scale lightweight benchmark for 2d and 3d biomedical image classification. Scientific Data10(1), 41 (2023)

2023
[31]

arXiv:2109.12298 (2021) Embedding-Based Federated Data Sharing via DP-CVAE 11

Yousefpour, A., Shilov, I., Sablayrolles, A., Testuggine, D., Prasad, K., Malek, M., Nguyen, J., Ghosh, S., Bharadwaj, A., Zhao, J., Cormode, G., Mironov, I.: Opacus: User-friendly differential privacy library in PyTorch. arXiv:2109.12298 (2021) Embedding-Based Federated Data ...

2021 arXiv
[32]

IEEE Transactions on Pattern Analysis and Machine Intelligence (2023)

Zhang, Y., Kang, B., Hooi, B., Yan, S., Feng, J.: Deep long-tailed learning: A survey. IEEE Transactions on Pattern Analysis and Machine Intelligence (2023)

2023

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (2016)

Abadi, M., Chu, A., Goodfellow, I., McMahan, H.B., Mironov, I., Talwar, K., Zhang, L.: Deep learning with differential privacy. In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (2016)

work page 2016

[2] [2]

In: 2023 IEEE Wireless Communications and Networking Conference (WCNC)

Chen, B., Li, H., Guo, L., Wang, L.: Label-wise distribution adaptive federated learning on non-iid data. In: 2023 IEEE Wireless Communications and Networking Conference (WCNC). pp. 1–6 (2023)

work page 2023

[3] [3]

In: International Conference on Medical Image Computing and Computer-Assisted Intervention

Chen, M., Jiang, M., Dou, Q., Wang, Z., Li, X.: Fedsoup: improving generalization and personalization in federated learning via selective model interpolation. In: International Conference on Medical Image Computing and Computer-Assisted Intervention. pp. 318–328. Springer (2023)

work page 2023

[4] [4]

In: International conference on machine learning

Collins, L., Hassani, H., Mokhtari, A., Shakkottai, S.: Exploiting shared represen- tations for personalized federated learning. In: International conference on machine learning. pp. 2089–2099. PMLR (2021)

work page 2021

[5] [5]

The 35th British Machine Vision Conference (2024)

Di Salvo, F., Tafler, D., Doerrich, S., Ledig, C.: Privacy-preserving datasets by capturing feature distributions with conditional vaes. The 35th British Machine Vision Conference (2024)

work page 2024

[6] [6]

In: International Conference on Learning Representations (2021)

Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., Gelly, S., Uszkoreit, J., Houlsby, N.: An image is worth 16x16 words: Transformers for image recognition at scale. In: International Conference on Learning Representations (2021)

2021

[7] [7]

In: Proceedings of the 33rd International Col- loquium on Automata, Languages and Programming

Dwork, C.: Differential privacy. In: Proceedings of the 33rd International Col- loquium on Automata, Languages and Programming. pp. 1–12. Springer Berlin Heidelberg (2006)

work page 2006

[8] [8]

A Systematic Review of Federated Generative Models

Gargary, A.V., De Cristofaro, E.: A systematic review of federated generative mod- els. arXiv preprint arXiv:2405.16682 (2024)

work page Pith review arXiv 2024