Pith. sign in

REVIEW 3 major objections 5 minor 40 references

PDLRecover: Privacy-preserving Decentralized Model Recovery with Machine Unlearning

T0 review · 3 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that a poisoned decentralized model can be restored to near-retrained accuracy at about two-thirds the runtime, without exposing client updates.

desk verdict A real decentralized-recovery problem with plausible experiments, but the privacy-preserving core doesn't hold up: L-BFGS is nonlinear, so Shamir shares don't reconstruct the way the proof claims. read the letter →

arxiv 2506.15112 v1 pith:7TNJWVVE submitted 2025-06-18 cs.CR

Xiangman Li , Xiaodong Wu , Jianbing Ni , Mohamed Mahmoud , Maazen Alsabaan This is my paper · ORCID
classification cs.CR
keywords decentralizedlearningmachineunlearningpoisonattackrecoverysecretsharingL-BFGSHessian-vectorproductprivacypreservationfederated
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

PDLRecover is a decentralized machine-unlearning method that removes the influence of malicious or dropped clients from an already trained global model without retraining from scratch. The paper claims that by combining an L-BFGS approximation of the Hessian-vector product with Shamir secret sharing, clients can jointly reconstruct the global update direction needed to roll the model back to a clean state, while each client's local gradients stay private. The intended payoff is that a poisoned global model recovers to accuracy comparable to retraining with the malicious clients removed, at roughly two-thirds the runtime, and the recovery works in a fully decentralized setting rather than requiring a trusted server. The method also includes periodic exact updates to keep curvature information fresh and a final exact phase to remove accumulated approximation error.

What carries the argument

The load-bearing object is SS-L-BFGS, an extension of the L-BFGS algorithm that computes an approximate Hessian-vector product on secret shares. In Algorithm 2, each client forms matrices from its local buffers, $\tilde{W}$ and $\tilde{G}$, and solves a small linear system to produce a local approximated direction $\tilde{H}^{(x_j)}v$. The paper assumes that because every step of this computation is an affine combination, Lagrange interpolation of the local approximations yields the true global Hessian-vector product, so that equation (27) follows. The other key ingredient is the periodic exact update: every $T_r$ iterations clients recompute true gradients and refresh the buffers, preserving accurate local curvature information, and a final $T_f$ exact-update phase drives the recovered model to a stable, accurate state.

What would settle it

Compute the exact global Hessian-vector product for a small convex model with a known Hessian, then compare it with the value reconstructed from a few clients' SS-L-BFGS shares; if the two differ beyond quantization error, the identity in equation (27) fails and the recovery guarantee collapses.

Watch

Extended reading notes

Core claim

The paper's central claim is that recovering a poisoned global model can be posed as a privacy-preserving, decentralized unlearning problem. The starting point is Cauchy's mean value theorem: a client's gradient at the recovered model equals its historical gradient plus a Hessian-vector product times the difference between the recovered and historical model parameters. Since the true integrated Hessian is intractable, the paper approximates it with L-BFGS using two buffers, global model differences and client gradient differences, and then protects those buffers with Shamir secret sharing. The core claim is that the secret-shared version, SS-L-BFGS, preserves gradient fidelity: aggregating each client's local approximated direction and interpolating gives the global direction, so the recovered model converges to the model that would be obtained by retraining with malicious clients removed. Experiments on MNIST, FashionMNIST, and HAR are offered as evidence, reporting recovery accuracy within about one to two percentage points of drop-client retraining while saving roughly 33 to 35 percent of runtime.

Load-bearing premise

The method depends on the assumption that each client's L-BFGS Hessian-vector product can be computed independently on secret shares, and that Lagrange interpolation of those local products reproduces the true global Hessian-vector product, even though L-BFGS involves products, ratios, and a matrix inversion that are not linear operations.

Editorial extensions

If this is right

  • If PDLRecover works as claimed, a compromised decentralized model can be restored without full retraining, cutting recovery time by about a third while keeping test accuracy close to drop-client retraining.
  • The method removes the privacy bottleneck of earlier server-based recovery schemes: individual local gradients are never revealed, only Shamir shares, so a curious aggregator cannot reconstruct a client's update unless enough clients collude.
  • Because recovery uses cached global model history and refreshed curvature buffers, it remains usable when clients drop out mid-training, not only after a detected attack.
  • The paper's convergence analysis gives an accuracy-cost trade-off: spending more recovery rounds shrinks the difference between the recovered and retrained model exponentially, so the number of recovery rounds can be tuned against budget.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A direct testable extension would be to run SS-L-BFGS on a small quadratic problem with a known Hessian and compare the secret-shared Hessian-vector product against the exact global product; the paper's correctness claim predicts exact agreement, while any gap would expose the linearity assumption.
  • The privacy argument likely depends on the finite-field quantization of gradients not leaking information on its own, so checking how k-bit fixed-point rounding affects reconstructed model accuracy would show whether privacy and fidelity trade off in practice.
  • If the linearity assumption holds, the same share-then-interpolate trick could apply to other second-order or preconditioned updates, such as Newton steps or natural gradients, whenever they can be written as affine functions of the shares.
  • The paper leaves open how buffer staleness interacts with nonconvex loss surfaces; a practical stress test would measure recovery accuracy as the periodic refresh interval $T_r$ grows, since stale curvature buffers could degrade the recovered model.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes PDLRecover, a decentralized model-recovery framework that removes the influence of malicious or dropped clients from a poisoned global model without full retraining. The method combines historical gradient/model buffers, an L-BFGS-based Hessian-vector product approximation, and Shamir secret sharing. Each client computes a local approximate update direction on its secret-shared gradient history, and the global direction is reconstructed by Lagrange interpolation. The authors claim that the recovered model matches a retrained model in accuracy while saving roughly one third of the runtime, and that the secret-shared L-BFGS construction preserves privacy and gradient fidelity. Experimental results on MNIST, FashionMNIST, and HAR are reported, and a correctness proof plus two privacy theorems are given.

Significance. If the proposed construction were sound, this would be a useful contribution to machine unlearning and decentralized learning: it addresses an underexplored problem, recovering a compromised global model using historical information, and it attempts to add a privacy guarantee to the recovery procedure. The experimental comparison against drop-client retraining and existing unlearning baselines is a practical strength, and the paper states its efficiency claims clearly. However, the central privacy-preserving mechanism is not sound as presented: the correctness proof in Section VII-A establishes only linearity of Lagrange interpolation for sums, whereas the L-BFGS computation in Algorithm 2 is nonlinear. The global Hessian approximation is defined to be the interpolation of the local HVPs, making the claimed gradient fidelity a tautology rather than a derived property. Because this flaw undermines the paper's main technical claim, the current manuscript does not support the stated contribution.

major comments (3)
  1. [Section VII-A, Eqs. (24)-(28); Algorithm 2] The correctness proof does not establish that Lagrange interpolation of per-client SS-L-BFGS outputs recovers the true global Hessian-vector product. Eq. (18)-(23) prove only that Shamir reconstruction is linear for sums of secrets. The extension to L-BFGS is asserted: in Eq. (26), the term \sum_j \tilde{H}^{(x_j)}(\hat{w}_t - \bar{w}_t) \ell_j(0) is relabeled as \tilde{H}(\hat{w}_t - \bar{w}_t), and the global Hessian approximation is then defined as the Lagrange interpolation of the local HVPs, so Eq. (27) holds by definition. This is circular. More importantly, Algorithm 2 is not linear: line 4 computes a ratio \rho = (\Delta g^T \Delta w)/(\Delta w^T \Delta w), and line 5 computes a matrix inverse. These are rational, not linear, functions of the secret-shared inputs. Therefore the local value \tilde{H}^{(x_j)}v computed on a masked/share vector is not a Shamir share of the true global HVP, and the reconstruction in Eq. (16) does not yield the correct aggregate update direction.
  2. [Section VII-C, Theorem 1 and Eq. (32)] The convergence bound is not well-defined. Eq. (32) contains an undefined quantity M, while Assumption 2 (Eq. (31)) defines a bound Z on the HVP approximation error and Eq. (33) uses Z; the relationship between M and Z is never stated. The proof of Theorem 1 is a single sentence stating that PDLRecover recursively bounds the difference in each iteration, which does not substantiate the displayed inequality. Corollary 1 then concludes convergence to the retrained model when the HVP is computed exactly, but the antecedent is not established for the secret-shared L-BFGS procedure, and in light of the nonlinearity issue above it is not clear in what sense exactness could hold.
  3. [Section VII-B, Theorems 1 and 2] The privacy analysis is informal and does not match the protocol. Theorem 1 claims that an external attacker who steals one client's stored subsecrets cannot recover complete local update information, but the argument appeals to collusion of k clients recovering only the sum; this does not quantify the number of shares needed or the threshold used in the Shamir scheme. Theorem 2 claims that a malicious client cannot obtain honest clients' local updates unless more than k malicious clients collude, but the protocol description in Section V has each client send shares of its gradient to all others, so every client holds one share of every other client's polynomial. The analysis does not state the reconstruction threshold, does not define the attacker model precisely, and does not address the recovery phase, where each client broadcasts its locally computed \hat{g}^{(x_j)}_t. Even if the privacy statements were correct for sums of shares, they do not repair the correctness failure of the SS-L-BFGS reconstruction.
minor comments (5)
  1. [Abstract and Section I] The abstract contains the typo "degradate" instead of "degrade." In the Introduction, the placeholder "[references]" appears after "existing defenses [references]" and should be replaced with actual citations.
  2. [Section V, Eq. (11)] The secret-sharing polynomial in Eq. (11) is stated to have degree at most n, but the Shamir construction in Section III-B uses a polynomial of degree t-1 and the text later refers to a threshold t (or tth). The relationship among n, t, and the number of malicious clients is never made precise, which matters for the privacy claims in Section VII-B.
  3. [Algorithm 1, line 19] Line 19 uses t as both the iteration index and the number of shares in the Lagrange sum: \hat{g}_t = \sum_{j=1}^{t} \hat{g}^{(x_j)}_t \cdot \prod_{1\le i \le t, i\ne j} \frac{0-x_i}{x_j-x_i}. This is confusing and likely a typo; the sum should be over the n clients and the Lagrange basis should use their distinct share points x_j.
  4. [Section VII-A, Remarks on Quantization] The remarks state that real-valued vectors are quantized to fixed-point integers and mapped into F_q, but the paper does not analyze the error introduced by quantization or the handling of negative values and modular wraparound in the finite field. This matters because L-BFGS involves divisions and matrix inversions, which are sensitive to field-arithmetic precision.
  5. [Section VI] The experimental section reports accuracy and runtime for a single configuration but does not state the number of runs, variance, or error bars. Given that the recovery process involves randomized secret sharing and stochastic training, reporting mean and standard deviation across seeds would strengthen the comparison.

Circularity Check

1 steps flagged · score 8.0 of 10

Section VII-A's proof of gradient fidelity is definitional: the global Hessian approximation is defined as the Lagrange interpolation of local SS-L-BFGS HVPs, so Eq. (27) is true by construction rather than by derivation.

  1. self definitional [Section VII-A, Extension to SS-L-BFGS Approximation, Eqs. (25)-(27)]
    "By linearity of interpolation, ... which produces ĝ_t =∇L( ¯w_t)+ eH( ˆw_t− ¯w_t), where the global Hessian approximation is defined as eH =Σ_{j=1}^n eH(x_j)·ℓ_j(0). ... This confirms that the secure aggregation of local SS-L-BFGS approximations within the PDLRecover framework is mathematically sound and preserves gradient fidelity."

    The theorem's proof (Eqs. 18-23) establishes only that Shamir share aggregation and Lagrange interpolation commute for sums of field elements. SS-L-BFGS is not such a sum: Algorithm 2 computes ρ=(Δg^T Δw)/(Δw^T Δw) and a matrix inverse (lines 4-5), so the local HVP eH(x_j) is a rational, nonlinear function of the share value, not a degree-(t-1) polynomial evaluation in x_j. Hence eH(x_j) is not a Shamir share of any global HVP, and linearity cannot justify moving interpolation inside the HVP. The proof then defines the global Hessian approximation as the interpolated local HVPs, making Eq. (27) true by construction.

full rationale

The empirical accuracy and runtime comparisons are self-contained and are not circular; the recovered-model accuracy measured against Drop Client Retrain and historical-information baselines could stand independently. The circularity is confined to the paper's central theoretical claim in Section VII-A. The proof first derives linearity of Lagrange interpolation for sums of Shamir shares, then applies that linearity to SS-L-BFGS outputs without justification. Because the global Hessian approximation is defined as the interpolation of the local SS-L-BFGS HVPs, the reconstructed update is equal to its own construction by definition, and the assertion that this 'preserves gradient fidelity' is a tautology. No self-citation chain is involved; the reduction is internal to Eq. (27). Assumption 2 explicitly assumes the HVP approximation error is bounded, so the subsequent convergence bound is conditional rather than a derivation of the missing fidelity result.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The main free parameters are hyperparameters. The critical unsupported axiom is the linearity of L-BFGS computation over secret shares, which is load-bearing for the privacy-preserving recovery claim.

free parameters (5)
  • buffer size s = 4
    Set in Section VI-B; controls how many curvature pairs L-BFGS retains.
  • preparation rounds T_p = 25
    Set to 25 epochs in Section VI-B; the number of exact updates before approximate recovery.
  • periodic interval T_r = 30
    Set to 30 iterations; how often the exact update refreshes the L-BFGS buffers.
  • final exact rounds T_f = 25
    Set to 25; the number of final exact update steps.
  • secret sharing polynomial degree and threshold = unspecified
    Preparation uses degree at most n in Eq (11) but interpolation uses n points, implying degree n-1; the threshold is not specified.
assumptions (5)
  • domain assumption Loss functions are mu-strongly convex and L-smooth.
    Assumption 1 in Section VII-C is used in Theorem 1, but experiments train ResNet50, a non-convex deep network.
  • ad hoc to paper The HVP approximation error of SS-L-BFGS is bounded by a finite Z.
    Assumption 2 in Section VII-C assumes the key approximation error is bounded without proof; this is close to assuming the result.
  • domain assumption All malicious clients have been identified and removed.
    Assumed in Theorem 1 and in the experiments; the stated design goal of independence from detection is not tested with undetected attackers.
  • ad hoc to paper L-BFGS is linear in the secret-shared gradient histories, so Lagrange interpolation of local HVPs yields the global HVP.
    Invoked in Section VII-A Extension; false because L-BFGS uses nonlinear operations such as products and matrix inversion.
  • domain assumption Gradients can be quantized to finite-field integers without meaningful loss of fidelity.
    Stated in the Remarks on Quantization in Section VII-A; no precision analysis is provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of PDLRecover: Privacy-preserving Decentralized Model Recovery with Machine Unlearning." pith.science (2026). https://pith.science/paper/7TNJWVVE

@misc{pith2026250615112,
  author       = {Pith},
  title        = {Pith review of: PDLRecover: Privacy-preserving Decentralized Model Recovery with Machine Unlearning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/7TNJWVVE}},
  note         = {Machine review of arXiv:2506.15112}
}
read the original abstract

Decentralized learning is vulnerable to poison attacks, where malicious clients manipulate local updates to degrade global model performance. Existing defenses mainly detect and filter malicious models, aiming to prevent a limited number of attackers from corrupting the global model. However, restoring an already compromised global model remains a challenge. A direct approach is to remove malicious clients and retrain the model using only the benign clients. Yet, retraining is time-consuming, computationally expensive, and may compromise model consistency and privacy. We propose PDLRecover, a novel method to recover a poisoned global model efficiently by leveraging historical model information while preserving privacy. The main challenge lies in protecting shared historical models while enabling parameter estimation for model recovery. By exploiting the linearity of approximate Hessian matrix computation, we apply secret sharing to protect historical updates, ensuring local models are not leaked during transmission or reconstruction. PDLRecover introduces client-side preparation, periodic recovery updates, and a final exact update to ensure robustness and convergence of the recovered model. Periodic updates maintain accurate curvature information, and the final step ensures high-quality convergence. Experiments show that the recovered global model achieves performance comparable to a fully retrained model but with significantly reduced computation and time cost. Moreover, PDLRecover effectively prevents leakage of local model parameters, ensuring both accuracy and privacy in recovery.

Figures

Figures reproduced from arXiv: 2506.15112 by the authors.

Figure 1
Figure 1. An overview of PDLRecover B. PDLRecover Background In decentralized learning, suppose each client has a local dataset 𝐷𝑖 with 𝑛 samples to train a global machine learning model. The loss function for a client 𝑖 is defined as 𝐿𝑖(w) = 1 𝑛 ∑︁𝑛 𝑗=1 𝐿𝑖 𝑗(w), (4) where w is the local model parameter, and 𝐿𝑖 𝑗(w) is the 𝑗-th sample’s loss function for the client 𝑖. The gradient of 𝐿(w) for the client 𝑖 is ∇𝐿𝑖(w) = 1 𝑛 ∑︁𝑛 … view at source ↗
Figure 2
Figure 2. Accuracy of the recovery strategy under attack on MNIST, FashionMNIST, HAR datasets [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗
Figure 3
Figure 3. Accuracy of the recovery strategy under client drop on MNIST, FashionMNIST, HAR datasets [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Model accuracy under different recovery strategy with different mumber of malicious clients [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: Model accuracy under different recovery strategy with different drop client number [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 6
Figure 6. Figure 6: Effect of preparation Step and final training step in [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

40 extracted references · 27 canonical work pages

  1. [1]

    Decentralized federated learning: Fundamentals, state of the art, frameworks, trends, and challenges,

    E. T. M. Beltrán and M. Q. e. Pérez, “Decentralized federated learning: Fundamentals, state of the art, frameworks, trends, and challenges,” IEEE Communications Surveys & Tutorials , 2023

    work page 2023

  2. [2]

    Federated learning for mobile keyboard prediction,

    A. Hard, K. Rao, R. Mathews, S. Ramaswamy, F. Beaufays, S. Augen- stein, H. Eichner, C. Kiddon, and D. Ramage, “Federated learning for mobile keyboard prediction,” arXiv preprint arXiv:1811.03604 , 2018

    arXiv 2018

  3. [3]

    Privacy in pharmacogenetics: An end-to-end case study of personalized warfarin dosing,

    M. Fredrikson, E. Lantz, S. Jha, S. Lin, D. Page, and T. Ristenpart, “Privacy in pharmacogenetics: An end-to-end case study of personalized warfarin dosing,” in Proc. of USENIX Security 14 , 2014, pp. 17–32

    work page 2014

  4. [4]

    Membership inference attacks against machine learning models,

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Membership inference attacks against machine learning models,” in Proc. of 2017 S&P, 2017, pp. 3–18

    work page 2017

  5. [5]

    Dataset security for machine learn- ing: Data poisoning, backdoor attacks, and defenses,

    M. Goldblum, D. Tsipras, C. Xie, X. Chen, A. Schwarzschild, D. Song, A. M ˛ adry, B. Li, and T. Goldstein, “Dataset security for machine learn- ing: Data poisoning, backdoor attacks, and defenses,” IEEE Transactions on Pattern Analysis and Machine Intelligence , vol. 45, no. 2, pp. 1563– 1580, 2022

    work page 2022

  6. [6]

    Machine unlearning: Solutions and challenges,

    J. Xu, Z. Wu, C. Wang, and X. Jia, “Machine unlearning: Solutions and challenges,” IEEE Transactions on Emerging Topics in Computational Intelligence, 2024

    2024

  7. [7]

    Hessian eigenvectors and principal component analysis of neural network weight matrices,

    D. Haink, “Hessian eigenvectors and principal component analysis of neural network weight matrices,” arXiv preprint arXiv:2311.00452 , 2023

    arXiv 2023

  8. [8]

    How to share a secret,

    A. Shamir, “How to share a secret,” Communications of the ACM , vol. 22, no. 11, pp. 612–613, 1979

    1979

Show all 40 references
  1. [9]

    A multi-batch l-bfgs method for machine learning,

    A. S. Berahas, J. Nocedal, and M. Takác, “A multi-batch l-bfgs method for machine learning,” Advances in Neural Information Processing Systems, vol. 29, 2016

    2016

  2. [10]

    Machine unlearning,

    L. Bourtoule, V . Chandrasekaran, C. A. Choquette-Choo, H. Jia, A. Travers, B. Zhang, D. Lie, and N. Papernot, “Machine unlearning,” in Proc. of 2021 S&P , 2021, pp. 141–159

    2021

  3. [11]

    The effect of the gdpr on privacy policies: Recent progress and future promise,

    R. N. Zaeem and K. S. Barber, “The effect of the gdpr on privacy policies: Recent progress and future promise,” ACM Transactions on Management Information Systems (TMIS), vol. 12, no. 1, pp. 1–20, 2020

    2020

  4. [12]

    On the necessity of auditable algorithmic definitions for machine unlearning,

    A. Thudi, H. Jia, I. Shumailov, and N. Papernot, “On the necessity of auditable algorithmic definitions for machine unlearning,” in Proc. of USENIX Security 22 , 2022, pp. 4007–4022

    2022

  5. [13]

    When machine unlearning jeopardizes privacy,

    M. Chen, Z. Zhang, T. Wang, M. Backes, M. Humbert, and Y . Zhang, “When machine unlearning jeopardizes privacy,” in Proc. of CCS ’21 , 2021, pp. 896–911

    2021

  6. [14]

    Cer- tified data removal from machine learning models,

    C. Guo, T. Goldstein, A. Hannun, and L. Van Der Maaten, “Cer- tified data removal from machine learning models,” arXiv preprint arXiv:1911.03030, 2019

    1911 arXiv

  7. [15]

    Deltagrad: Rapid retraining of machine learning models,

    Y . Wu, E. Dobriban, and S. Davidson, “Deltagrad: Rapid retraining of machine learning models,” in Proc. of ICML 2020 , 2020, pp. 10 355– 10 366

    2020

  8. [16]

    Eternal sunshine of the spotless net: Selective forgetting in deep networks,

    A. Golatkar, A. Achille, and S. Soatto, “Eternal sunshine of the spotless net: Selective forgetting in deep networks,” in Proc. of CVPR 2020 , 2020, pp. 9304–9312

    2020

  9. [17]

    Asynchronous federated unlearning,

    N. Su and B. Li, “Asynchronous federated unlearning,” in Proc. of INFOCOM 2023, 2023, pp. 1–10

    2023

  10. [18]

    The right to be forgotten in federated learning: An efficient realization with rapid retraining,

    Y . Liu, L. Xu, X. Yuan, C. Wang, and B. Li, “The right to be forgotten in federated learning: An efficient realization with rapid retraining,” in Proc. of INFOCOM 2022 , 2022, pp. 1749–1758

    2022

  11. [19]

    New insights and perspectives on the natural gradient method,

    J. Martens, “New insights and perspectives on the natural gradient method,” Journal of Machine Learning Research , vol. 21, no. 146, pp. 1–76, 2020

    2020

  12. [20]

    Federated unlearning with knowledge distillation,

    C. Wu, S. Zhu, and P. Mitra, “Federated unlearning with knowledge distillation,” arXiv preprint arXiv:2201.09441 , 2022

    2022 arXiv

  13. [21]

    Federaser: Enabling efficient client-level data removal from federated learning models,

    G. Liu, X. Ma, Y . Yang, C. Wang, and J. Liu, “Federaser: Enabling efficient client-level data removal from federated learning models,” in Proc. of 2021 IWQOS , 2021, pp. 1–10

    2021

  14. [22]

    Data poisoning attacks on eeg signal-based risk assessment systems,

    Z. Zhang, S. Umar, A. Y . A. Hammadi, S. Yoon, E. Damiani, and C. Y . Yeun, “Data poisoning attacks on eeg signal-based risk assessment systems,” arXiv preprint arXiv:2302.04224 , 2023

    2023 arXiv

  15. [23]

    Confident federated learning to tackle label flipped data poisoning attacks,

    P. R. Ovi, A. Gangopadhyay, R. F. Erbacher, and C. Busart, “Confident federated learning to tackle label flipped data poisoning attacks,” in Ar- tificial Intelligence and Machine Learning for Multi-Domain Operations Applications V, vol. 12538, 2023, pp. 263–272

    2023

  16. [24]

    Poison attack and defense on deep source code processing models,

    J. Li, Z. Li, H. Zhang, G. Li, Z. Jin, X. Hu, and X. Xia, “Poison attack and defense on deep source code processing models,” arXiv preprint arXiv:2210.17029, 2022

    2022 arXiv

  17. [25]

    Poisoning attack in federated learning using generative adversarial nets,

    J. Zhang, J. Chen, D. Wu, B. Chen, and S. Yu, “Poisoning attack in federated learning using generative adversarial nets,” in Proc. of TrustCom/BigDataSE 2019, 2019, pp. 374–380

    2019

  18. [26]

    Nightshade: Prompt-specific poisoning attacks on text-to-image gener- ative models,

    S. Shan, W. Ding, J. Passananti, S. Wu, H. Zheng, and B. Y . Zhao, “Nightshade: Prompt-specific poisoning attacks on text-to-image gener- ative models,” in Proc. of 2024 S& P , 2024, pp. 212–212

    2024

  19. [27]

    Spectre: Defending against backdoor attacks using robust statistics,

    J. Hayase, W. Kong, R. Somani, and S. Oh, “Spectre: Defending against backdoor attacks using robust statistics,” in Proc. of ICML 2021 , 2021, pp. 4129–4139

    2021

  20. [28]

    Demon in the variant: Statistical analysis of dnns for robust backdoor contamination detection,

    D. Tang, X. Wang, H. Tang, and K. Zhang, “Demon in the variant: Statistical analysis of dnns for robust backdoor contamination detection,” in Proc. of USENIX Security 21 , 2021, pp. 1541–1558

    2021

  21. [29]

    Neural attention distillation: Erasing backdoor triggers from deep neural networks,

    Y . Li, X. Lyu, N. Koren, L. Lyu, B. Li, and X. Ma, “Neural attention distillation: Erasing backdoor triggers from deep neural networks,” arXiv preprint arXiv:2101.05930, 2021

    2021 arXiv

  22. [30]

    Fine-pruning: Defending against backdooring attacks on deep neural networks,

    K. Liu, B. Dolan-Gavitt, and S. Garg, “Fine-pruning: Defending against backdooring attacks on deep neural networks,” in Proc. of RAID 2018 , 2018, pp. 273–294

    2018

  23. [31]

    Bridging mode connectivity in loss landscapes and adversarial robustness,

    P. Zhao, P.-Y . Chen, P. Das, K. N. Ramamurthy, and X. Lin, “Bridging mode connectivity in loss landscapes and adversarial robustness,” arXiv preprint arXiv:2005.00060, 2020

    2005 arXiv

  24. [32]

    Strong data augmentation sanitizes poisoning and backdoor attacks without an accuracy tradeoff,

    E. Borgnia, V . Cherepanova, L. Fowl, A. Ghiasi, J. Geiping, M. Gold- blum, T. Goldstein, and A. Gupta, “Strong data augmentation sanitizes poisoning and backdoor attacks without an accuracy tradeoff,” in Proc. of ICASSP 2021-2021 , 2021, pp. 3855–3859

    2021

  25. [33]

    Local model poisoning attacks to byzantine-robust federated learning,

    M. Fang, X. Cao, J. Jia, and N. Gong, “Local model poisoning attacks to byzantine-robust federated learning,” in Proc. of USENIX Security 20, 2020, pp. 1605–1622

    2020

  26. [34]

    Byzantine resistant secure blockchained federated learning at the edge,

    Z. Li, H. Yu, T. Zhou, L. Luo, M. Fan, Z. Xu, and G. Sun, “Byzantine resistant secure blockchained federated learning at the edge,” IEEE Network, vol. 35, no. 4, pp. 295–301, 2021

    2021

  27. [35]

    Fedrecover: Recovering from poisoning attacks in federated learning using historical information,

    X. Cao, J. Jia, Z. Zhang, and N. Z. Gong, “Fedrecover: Recovering from poisoning attacks in federated learning using historical information,” in Proc. of 2023 S&P , 2023, pp. 1366–1383

    2023

  28. [36]

    Towards efficient and certified recovery from poisoning attacks in federated learning,

    Y . Jiang, J. Shen, Z. Liu, C. W. Tan, and K.-Y . Lam, “Towards efficient and certified recovery from poisoning attacks in federated learning,” arXiv preprint arXiv:2401.08216 , 2024

    2024 arXiv

  29. [37]

    Braintorrent: A peer-to-peer environment for decentralized federated learning,

    A. G. Roy, S. Siddiqui, S. Pölsterl, N. Navab, and C. Wachinger, “Braintorrent: A peer-to-peer environment for decentralized federated learning,” arXiv preprint arXiv:1905.06731 , 2019. 14

    1905 arXiv

  30. [38]

    Communication-efficient learning of deep networks from decentralized data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Proc. of 20th AISTATS , 2017, pp. 1273–1282

    2017

  31. [39]

    The solution of nonlinear finite element equations,

    H. Matthies and G. Strang, “The solution of nonlinear finite element equations,” International journal for numerical methods in engineering , vol. 14, no. 11, pp. 1613–1626, 1979

    1979

  32. [40]

    Fedrecov- ery: Differentially private machine unlearning for federated learning frameworks,

    L. Zhang, T. Zhu, H. Zhang, P. Xiong, and W. Zhou, “Fedrecov- ery: Differentially private machine unlearning for federated learning frameworks,” IEEE Transactions on Information Forensics and Security, vol. 18, pp. 4732–4746, 2023

    2023

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.