Pith. sign in

REVIEW 4 major objections 5 minor 30 references

Sybil-based Virtual Data Poisoning Attacks in Federated Learning

T0 review · 4 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A malicious client can spawn sybil nodes with synthetic virtual data to steer a federated global model toward a target model.

desk verdict A plausible sybil-attack idea whose central 'outperforms' claim is undercut by the paper's own TTA numbers and an unvalidated linearization. read the letter →

arxiv 2505.09983 v1 pith:A3XTRI4O submitted 2025-05-15 cs.CR cs.LG

Changxun Zhu , Qilong Wu , Lingjuan Lyu , Shibei Xue This is my paper · ORCID
classification cs.CRcs.LG
keywords federatedlearningsybilattackdatapoisoninggradientmatchingvirtualgenerationnon-IIDlabelflippingtargetmodel
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that an attacker in federated learning does not need to share real data among conspiring clients: one malicious client can generate synthetic 'virtual' images, hand them to fake sybil clients it controls, and use the amplified voting weight to steer the global model toward a target behavior. The specific claim is that synthetic images made by gradient matching, combined with a target model obtained online-locally, online-globally, or offline, outperform the Feature Collision and Local Method baselines in keeping the main task intact while forcing the target misclassification, even under strongly non-IID data (Dirichlet $\alpha=0.1$). On the paper's three benchmarks the attack reaches target-task accuracies of 92.42%, 80.43%, and 63.74%, while preserving main-task accuracy better than the second-best baseline by 7.6%, 9.03%, and 17.3%. If correct, this means federated learning's data-locality protection is not enough to stop a modest fraction of malicious clients from reshaping the shared model.

What carries the argument

The load-bearing object is the negative-cosine-similarity gradient-matching objective of Eq. (14), which replaces the nested bilevel optimization of Eqs. (2)--(4) with a cheap inner loop. For each of 32 baseline images from the attacker's local dataset, a perturbation $\Delta$ is updated by SGD until the gradient of the poisoned batch aligns with $w_r - w_{\mathrm{tar}}$. Three target-model acquisition schemes feed this objective: online local, which flips labels on one malicious client's data; online global, which averages the flipped models of all malicious clients; and offline, which pre-trains the flipped model before federated learning starts. The sybil nodes simply train on the generated virtual data and upload their models, amplifying the malicious update's weight in server aggregation.

What would settle it

Run the same attack on CIFAR-10/ResNet18 while replacing $w_r - w_{\mathrm{tar}}$ in Eq. (14) with the true gradient of the adversarial loss at $w_r$; if target-task accuracy does not drop when the true gradient replaces the approximation, the linearization in Eq. (13) is not the mechanism that makes the attack work.

Watch

Extended reading notes

Core claim

The paper's central claim is that a single malicious federated-learning client can create several fake sybil clients, generate synthetic training images locally, and use those images to move the global model toward a target model it has computed in advance. The synthetic images are produced by gradient matching: the attacker minimizes the negative cosine similarity between the gradient of the poisoned batch and the fixed direction $w_r - w_{\mathrm{tar}}$, where $w_r$ is the current global model and $w_{\mathrm{tar}}$ is the target model obtained by one of three schemes (online local, online global, and offline). The reported attack reaches target-task accuracies of 92.42%, 80.43%, and 63.74% on MNIST, FMNIST, and CIFAR-10 while keeping main-task accuracy closer to the no-attack baseline than the compared Feature Collision and Local methods, including when client data follows a Dirichlet distribution with $\alpha = 0.1$. Where the target-task accuracy is below the Local Method baseline, the authors argue the attack is still more effective because the main task does not collapse, and they claim the global target model is obtainable under non-IID data, which earlier baselines cannot achieve as cleanly.

Load-bearing premise

The virtual-data generator assumes the gradient of the adversarial loss at the current global model is well approximated by the fixed vector $w_r - w_{\mathrm{tar}}$ across all 50 attack rounds, so the loss landscape is nearly linear between the two models; if that approximation fails, the generated data will not steer the global model toward the target.

Editorial extensions

If this is right

  • An attacker controlling 40% of clients, each spawning five sybil nodes, can flip a chosen class (digit '1' to '7' in the reported setup) with target-task accuracy 92.42% on MNIST, 80.43% on FMNIST, and 63.74% on CIFAR-10.
  • The attack remains effective when client data is strongly non-IID (Dirichlet $\alpha = 0.1$), the regime where sharing real data among sybil nodes is most costly.
  • Because the offline target-model scheme builds the target before federated learning starts, the attack can be prepared without real-time communication during training.
  • No raw client data is shared with the sybil nodes; the generated virtual data is sufficient, lowering the privacy cost usually associated with sybil collusion.
  • Compared with the Local Method baseline, main-task accuracy improves by 7.6%, 9.03%, and 17.3% on the three datasets.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural next test, not run in the paper, is whether the attack survives robust aggregation rules such as coordinate-wise median or trimmed mean; with 40% of clients malicious, the attack is a strong candidate for such defenses to blunt.
  • Equation (13) is exact only for a quadratic loss, so on deeper or wider networks the fixed-difference gradient surrogate may degrade; an extension would replace it with a curvature-corrected descent direction and measure the change in target-task accuracy.
  • The attack presumes the attacker knows when the final 50 rounds begin; an adaptive variant that detects convergence from the public global model would make the threat realistic outside controlled experiments.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes a sybil-based virtual data poisoning attack for federated learning. A malicious client generates sybil nodes to amplify its influence, and poison images are synthesized by a gradient-matching procedure that aligns the gradient of poisoned local training with a target model direction. The authors introduce three target-model acquisition schemes (online local, online global, and offline) and evaluate the attack on MNIST, FMNIST, and CIFAR-10 under IID and Dirichlet non-IID data, comparing with Feature Collision and Local Method baselines. The headline claim is that the proposed method outperforms the baselines in both main task accuracy (MTA) and target task accuracy (TTA), especially under non-IID data.

Significance. The problem addressed—reducing the cost and data-sharing burden of sybil-based poisoning in federated learning—is relevant and timely. The paper has two genuine strengths: it offers a concrete mechanism for generating poison data without transferring raw client data to sybil nodes, and it explicitly studies target-model acquisition under three deployment scenarios, which is a useful practical decomposition. The evaluation spans multiple datasets and data heterogeneity levels. However, the central claim is not supported by the paper's own reported numbers, and the key gradient approximation in Eq. (13) is unvalidated. If the method were properly validated and the claim reformulated with an explicit stealth/effectiveness trade-off criterion, the contribution would be a useful incremental advance. No code or reproducibility package is provided, and all quantitative conclusions lack error bars or significance tests.

major comments (4)
  1. [Abstract and Section IV-C] The abstract claims the method "outperforms other attack algorithms," and Section IV-C states that it outperforms others "in both main task accuracy (MTA) and target task accuracy (TTA)." The same paragraph reports TTA values of 92.42%, 80.43%, and 63.74%, and admits that these are 12.27% and 33.96% lower than the LM method on FMNIST and CIFAR-10, respectively. Thus the paper's own numbers directly contradict the headline outperformance claim on two of three datasets. The only stated justification is that "the MTA of LM has significantly decreased," but no attack-effectiveness metric, acceptable MTA-loss threshold, or combined objective is defined. Unless the authors specify a formal trade-off criterion that weighs TTA against MTA preservation, the superiority claim is unsupported.
  2. [Section III-C, Eq. (13)] Eq. (13) replaces the sum of adversarial-loss gradients with the fixed model difference w_r - w_tar, asserting that this is "a more representative descent direction." This is a strong linearity assumption about the loss landscape over the entire 50-round attack window and across networks of very different depths (FC, CNN, ResNet18). It is never validated against the true adversarial gradient, and no experiment reports the cosine similarity between w_r - w_tar and the actual gradient, or compares attack success when the true gradient is used. Because the poison-generation objective Eq. (14) is built entirely on this approximation, the mechanism by which the attack works is unverified.
  3. [Section IV-A and Section IV-B] The evaluation has no error bars, no multiple seeds, and no significance tests, while the configuration depends on several ad-hoc choices: the attack window of the final 50 rounds is justified only by "experience," T = 300, perturbation learning rate 1, 32 baseline images, m% = 40%, and v = 5 are fixed without sensitivity analysis for the comparisons. Since the central comparison in Section IV-C is quantitative and the reported advantages in MTA are on the order of 7-17 percentage points, the absence of variance information makes it impossible to tell whether the reported differences are real or within run-to-run noise. The authors should report mean and standard deviation over at least five seeds, and should vary the attack window and T to show that the qualitative conclusions are robust.
  4. [Section II, Eq. (4) and Section IV-A] The formal attack model in Eq. (4) constrains perturbations with ||Δ||∞ ≤ ε, but the experimental setup states that "the disturbance vector Δ is unconstrained in size." This is a direct inconsistency between the problem formulation and the implementation. If the experiments use unconstrained perturbations, the method has not been tested under the constraint stated in the paper, and the reported attack performance may depend on unbounded perturbations that would be easily detectable or violate the threat model. The formulation and experiments must be reconciled, and the constrained case should be evaluated.
minor comments (5)
  1. [Abstract and Section V] The phrase "non-independent uniformly distributed data" is unclear; it should read "non-IID data" or be rephrased to match standard terminology.
  2. [Section IV-A] CIFAR-10 is reported as "70K images," but the standard dataset contains 60,000 images; this appears to be a typo.
  3. [Table II] The third layer entry contains a typo: "[6.12,12]" should presumably be "[6,12,12]", and the output "16,8,8]" is missing an opening bracket.
  4. [Algorithm 1] The indexing in lines 7-14 is confusing: the conditions "M ≤ i ≤ N", "1 ≤ i ≤ M", and "1 + N ≤ i ≤ N + v*M" use i as if it were a global client ID, but the loop iterates over the selected set S_r in parallel. Please clarify how client indices are mapped to malicious, benign, and sybil clients.
  5. [Section III-B, Eqs. (9)-(14)] The notation is inconsistent: the same symbol ∇J is used for both the inner and outer gradient sums, and the index ranges N1+N2 and P are used without explaining how the two sums align. This makes the relaxation from the bilevel objective to Eq. (14) difficult to follow and should be rewritten with distinct symbols.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the attack optimizes its stated objective and the central claims rest on empirical comparisons, not on a definitional identity.

full rationale

The paper's derivation chain is an attack construction, not a first-principles prediction. The target model w_tar is intentionally trained on label-flipped data (Eq. 7), and the poison data is generated by minimizing the negative cosine similarity in Eq. 14 so that the sybil update direction aligns with w_r − w_tar. TTA then measures whether the global model moves toward w_tar, which is exactly the attack's explicit objective. This is the intended mechanism of a poisoning attack, not a hidden equivalence: whether the poisoned updates actually move the federated global model, and at what cost to the main task, remains an empirical question that the paper tests against Feature Collision and Local Method baselines under IID and Dirichlet α=0.5 and α=0.1 splits. The reported tension that TTA is lower than LM on FMNIST and CIFAR-10 is a support/evidence concern about the undefined MTA-versus-TTA trade-off, not a circularity. The approximation in Eq. 13 (using w_r − w_tar as the adversarial gradient) is explicitly heuristic and is a correctness/robustness risk, not a circular step. The only self-citations, Refs. [11] and [15], are bibliographic background for privacy preservation and defense algorithms and are not load-bearing for the attack's construction or evaluation. No uniqueness theorem is imported from the authors' prior work, and no fitted parameter is renamed as a prediction. The central claim is therefore self-contained against external benchmarks, with no step that reduces by definition to its inputs.

Assumptions & free parameters 7 free parameters · 5 assumptions · 0 invented entities

The central method depends on a set of hand-chosen experimental parameters (T=300, lr=1, 32 images, m=40%, v=5, last 50 rounds), a heuristic linearization of the gradient (Eq. 13), and the assumption that the server applies no defense and cannot distinguish sybils. No new physical or conceptual entity is introduced.

free parameters (7)
  • T (poisoning iterations) = 300
    Fixed number of gradient-matching updates for each poison image; chosen based on experience, no sensitivity analysis.
  • Perturbation learning rate = 1
    Step size for updating Δ in Eq. (15); no tuning study reported.
  • Number of baseline images per malicious client = 32
    Only 32 images from Dbase are used to compute each disturbance vector; effect of this number is not studied.
  • Proportion of malicious clients m% = 40%
    Selected after the ablation in Section IV-B; higher m gives higher TTA but hurts MTA.
  • Sybil nodes per malicious client v = 5
    Selected after the ablation in Section IV-B; the combination yields 80% attacker-controlled participants.
  • Attack window = final 50 rounds
    Attacks are executed only in the last 50 of 200 or 300 rounds, based on experience, not derived from the problem.
  • Dirichlet parameter α = 0.5 (default)
    Used for non-IID data generation; experiments also test α=0.1.
assumptions (5)
  • standard math Gradient descent on cross-entropy loss is the correct model of client and server updates.
    Used throughout the problem formulation and Algorithm 1.
  • domain assumption The server runs federated averaging with no defense and cannot distinguish sybil nodes from benign clients.
    Algorithm 1 line 17 aggregates all clients equally; no anomaly detection, clipping, or client verification is modeled.
  • ad hoc to paper The adversarial gradient can be approximated by w_r - w_tar over the attack window (Eq. 13).
    This linearization is stated heuristically in Section III-C and is never checked against true gradients.
  • ad hoc to paper The bilevel poisoning problem can be relaxed to negative cosine similarity between two gradient terms (Eqs. 9-12).
    The relaxation is heuristic and no bound on the error introduced by the relaxation is provided.
  • ad hoc to paper Attacks in the last 50 rounds capture the relevant regime for the comparison.
    The paper states this is based on experience, not on a formal criterion.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Sybil-based Virtual Data Poisoning Attacks in Federated Learning." pith.science (2026). https://pith.science/paper/A3XTRI4O

@misc{pith2026250509983,
  author       = {Pith},
  title        = {Pith review of: Sybil-based Virtual Data Poisoning Attacks in Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/A3XTRI4O}},
  note         = {Machine review of arXiv:2505.09983}
}
read the original abstract

Federated learning is vulnerable to poisoning attacks by malicious adversaries. Existing methods often involve high costs to achieve effective attacks. To address this challenge, we propose a sybil-based virtual data poisoning attack, where a malicious client generates sybil nodes to amplify the poisoning model's impact. To reduce neural network computational complexity, we develop a virtual data generation method based on gradient matching. We also design three schemes for target model acquisition, applicable to online local, online global, and offline scenarios. In simulation, our method outperforms other attack algorithms since our method can obtain a global target model under non-independent uniformly distributed data.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

30 extracted references · 23 canonical work pages

  1. [1]

    Bert: Pre-training of deep bidirectional transformers for language understanding,

    J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, “Bert: Pre-training of deep bidirectional transformers for language understanding,” in Proceedings of the 2019 conference of the North American chapter of the association for computational linguistics: human language technologies, volume 1 (long and short papers) , 2019, pp. 4171–4186

    work page 2019

  2. [2]

    Deepfm: a factorization- machine based neural network for ctr prediction,

    H. Guo, R. Tang, Y . Ye, Z. Li, and X. He, “Deepfm: a factorization- machine based neural network for ctr prediction,” arXiv preprint arXiv:1703.04247, 2017

    arXiv 2017

  3. [3]

    Deep & cross network for ad click predictions,

    R. Wang, B. Fu, G. Fu, and M. Wang, “Deep & cross network for ad click predictions,” in Proceedings of the ADKDD’17 . New York, NY , USA: Association for Computing Machinery, 2017, pp. 1–7

    work page 2017

  4. [4]

    High-resolution representation object pose estimation from monocular images,

    Q. Guan, W. Li, S. Xue, and D. Li, “High-resolution representation object pose estimation from monocular images,” in 2021 China Automation Congress (CAC). IEEE, 2021, pp. 980–984

    work page 2021

  5. [5]

    Hrpose: Real-time high-resolution 6d pose estimation network using knowledge distillation,

    Q. Guan, Z. Sheng, and S. Xue, “Hrpose: Real-time high-resolution 6d pose estimation network using knowledge distillation,” Chinese Journal of Electronics , vol. 32, no. 1, pp. 189–198, 2023

    work page 2023

  6. [6]

    Graph-based spatial-temporal convolutional network for vehicle trajectory prediction in autonomous driving,

    Z. Sheng, Y . Xu, S. Xue, and D. Li, “Graph-based spatial-temporal convolutional network for vehicle trajectory prediction in autonomous driving,” IEEE Transactions on Intelligent Transportation Systems , vol. 23, no. 10, pp. 17 654–17 665, 2022

    2022

  7. [7]

    A cooperation-aware lane change method for automated vehicles,

    Z. Sheng, L. Liu, S. Xue, D. Zhao, M. Jiang, and D. Li, “A cooperation-aware lane change method for automated vehicles,” IEEE Transactions on Intelligent Transportation Systems, vol. 24, no. 3, pp. 3236–3251, 2022

    work page 2022

  8. [8]

    Feature-fusion-kernel-based gaussian process model for probabilistic long-term load forecasting,

    Y . Guan, D. Li, S. Xue, and Y . Xi, “Feature-fusion-kernel-based gaussian process model for probabilistic long-term load forecasting,” Neurocomputing, vol. 426, pp. 174–184, 2020

    work page 2020

Show all 30 references
  1. [9]

    A deep rein- forcement learning bidding algorithm on electricity market,

    S. Jia, Z. Gan, Y . Xi, D. Li, S. Xue, and L. Wang, “A deep rein- forcement learning bidding algorithm on electricity market,” Journal of Thermal Science , vol. 29, no. 5, pp. 1125–1134, 2020

    2020

  2. [10]

    Photovoltaic power forecasting: Using wavelet threshold denoising combined with vmd,

    L. Liu, J. Zhang, and S. Xue, “Photovoltaic power forecasting: Using wavelet threshold denoising combined with vmd,” Renewable Energy, vol. 249, p. 123152, 2025

    2025

  3. [11]

    Towards distributed privacy-preserving prediction,

    L. Lyu, Y . W. Law, K. S. Ng, S. Xue, J. Zhao, M. Yang, and L. Liu, “Towards distributed privacy-preserving prediction,” in 2020 IEEE International Conference on Systems, Man, and Cybernetics (SMC) . IEEE, 2020, pp. 4179–4184

    2020

  4. [12]

    Communication-efficient learning of deep networks from decentral- ized data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentral- ized data,” in Proceedings of the 20th International Conference on Artificial Intelligence and Statistics , 2017, pp. 1273–1282

    2017

  5. [13]

    Advances and open problems in federated learning,

    P. Kairouz, H. B. McMahan, B. Avent, A. Bellet, M. Bennis, A. N. Bhagoji, K. Bonawitz, Z. Charles, G. Cormode, R. Cummings et al., “Advances and open problems in federated learning,” Foundations and trends® in machine learning , vol. 14, no. 1–2, pp. 1–210, 2021

    2021

  6. [14]

    Federated learning on non-iid data: A survey,

    H. Zhu, J. Xu, S. Liu, and Y . Jin, “Federated learning on non-iid data: A survey,” Neurocomputing, vol. 465, pp. 371–390, 2021

    2021

  7. [15]

    Global update guided federated learning,

    Q. Wu, L. Liu, and S. Xue, “Global update guided federated learning,” in 2022 41st Chinese Control Conference (CCC) . IEEE, 2022, pp. 2434–2439

    2022

  8. [16]

    Poisoning attacks against support vector machines,

    B. Biggio, B. Nelson, and P. Laskov, “Poisoning attacks against support vector machines,” arXiv:1206.6389, 2012

    2012 arXiv

  9. [17]

    Data poisoning attacks against federated learning systems,

    V . Tolpegin, S. Truex, M. E. Gursoy, and L. Liu, “Data poisoning attacks against federated learning systems,” in 25th European sympo- sium on research in computer security , 2020, pp. 480–501

    2020

  10. [18]

    Back to the drawing board: A critical evaluation of poisoning attacks on production federated learning,

    V . Shejwalkar, A. Houmansadr, P. Kairouz, and D. Ramage, “Back to the drawing board: A critical evaluation of poisoning attacks on production federated learning,” in IEEE Journal on Emerging and Selected Topics in Circuits and Systems , 2022, pp. 1354–1371

    2022

  11. [19]

    Poison frogs! targeted clean-label poisoning attacks on neural networks,

    A. Shafahi, W. R. Huang, M. Najibi, O. Suciu, C. Studer, T. Dumitras, and T. Goldstein, “Poison frogs! targeted clean-label poisoning attacks on neural networks,” Advances in neural information processing systems, vol. 31, pp. 6106–6116, 2018

    2018

  12. [20]

    Witches’ brew: Industrial scale data poisoning via gradient matching,

    J. Geiping, L. Fowl, W. R. Huang, W. Czaja, G. Taylor, M. Moeller, and T. Goldstein, “Witches’ brew: Industrial scale data poisoning via gradient matching,” arXiv:2009.02276, 2020

    2009 arXiv

  13. [21]

    How to backdoor federated learning,

    E. Bagdasaryan, A. Veit, Y . Hua, D. Estrin, and V . Shmatikov, “How to backdoor federated learning,” in International conference on artificial intelligence and statistics , 2020, pp. 2938–2948

    2020

  14. [22]

    Analyzing federated learning through an adversarial lens,

    A. N. Bhagoji, S. Chakraborty, P. Mittal, and S. Calo, “Analyzing federated learning through an adversarial lens,” in International con- ference on machine learning , 2019, pp. 634–643

    2019

  15. [23]

    Deep model poisoning attack on federated learning,

    X. Zhou, M. Xu, Y . Wu, and N. Zheng, “Deep model poisoning attack on federated learning,” Future Internet, vol. 13, no. 3, pp. 73–88, 2021

    2021

  16. [24]

    The limitations of feder- ated learning in sybil settings,

    C. Fung, C. J. Yoon, and I. Beschastnikh, “The limitations of feder- ated learning in sybil settings,” in 23rd International Symposium on Research in Attacks, Intrusions and Defenses , 2020, pp. 301–316

    2020

  17. [25]

    Sca: Sybil-based collusion attacks of iiot data poisoning in federated learning,

    X. Xiao, Z. Tang, C. Li, B. Xiao, and K. Li, “Sca: Sybil-based collusion attacks of iiot data poisoning in federated learning,” IEEE Transactions on Industrial Informatics, vol. 19, no. 3, pp. 2608–2618, 2022

    2022

  18. [26]

    Sbpa: Sybil-based backdoor poisoning attacks for distributed big data in aiot-based federated learning system,

    X. Xiao, Z. Tang, C. Li, B. Jiang, and K. Li, “Sbpa: Sybil-based backdoor poisoning attacks for distributed big data in aiot-based federated learning system,” IEEE Transactions on Big Data , vol. 10, no. 6, pp. 827–838, 2024

    2024

  19. [27]

    Gradient-based learning applied to document recognition,

    Y . LeCun, L. Bottou, Y . Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,” Proceedings of the IEEE , vol. 86, no. 11, pp. 2278–2324, 1998

    1998

  20. [28]

    Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,

    H. Xiao, K. Rasul, and R. V ollgraf, “Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,” arXiv:1708.07747, 2017

    2017 arXiv

  21. [29]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky, G. Hinton et al., “Learning multiple layers of features from tiny images,” Technical report, University of Toronto, pp. 1–58, 2009

    2009

  22. [30]

    Deep sparse rectifier neural networks,

    X. Glorot, A. Bordes, and Y . Bengio, “Deep sparse rectifier neural networks,” in Proceedings of the fourteenth international conference on artificial intelligence and statistics , 2011, pp. 315–323

    2011

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.