The reviewed record of science sign in
Pith

arxiv: 2606.08027 · v1 · pith:A5SGFKP3 · submitted 2026-06-06 · cs.LG · cs.AI

CausShield: Sample Reconstruction-Resilient Vertical FL via Causal Representation Learning

Yongqi Jiang , Yansong Gao , Siguang Chen , Anmin Fu This is my paper

Reviewed by Pith T0 review T1 audit T2 compute T3 formal T4 kernel 2026-06-27 20:11 UTCgrok-4.3pith:A5SGFKP3record.jsonopen to challenge →

classification cs.LG cs.AI
keywords vertical federated learningcausal representation learningsample reconstruction attacksprivacy protectionunsupervised learningstructural causal modelconvergence preservation
0
0 comments X

The pith

CausShield splits shared VFL representations into causal task-relevant features and non-causal task-irrelevant ones via unsupervised learning to block sample reconstruction while preserving utility and convergence.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper shows that in vertical federated learning, raw samples contain causal features that drive the learning task and non-causal features that are irrelevant to the task yet often carry sample-specific details usable for reconstruction attacks. By adopting a structural causal model, CausShield decomposes the representations exchanged between client and server into these two components through an optimization problem solved by unsupervised representation learning. This yields full-cycle privacy protection without the early-epoch exposure of supervised defense training. The authors provide theoretical proofs that the decomposition insight holds and that the method retains the convergence rate of ordinary VFL.

Core claim

From a task-learning standpoint, causal features within a raw sample are those that are directly relevant and contributory to the learning objective, whereas non-causal features are task-irrelevant but often encode sample-specific private information, thereby facilitating reconstruction. CausShield decomposes the shared representations between the client and the coordinating server in VFL into task-relevant and task-irrelevant components to ensure full-cycle privacy protection. The decomposition is solved through unsupervised representation learning, and theoretical analysis proves both the insight and preservation of standard VFL convergence behavior.

What carries the argument

Structural causal model decomposition of shared representations into task-relevant causal features and task-irrelevant non-causal features, realized by solving an optimization problem with unsupervised representation learning.

If this is right

  • CausShield achieves a superior privacy-utility trade-off against seven prior defenses including InvL.
  • The method remains robust under advanced reconstruction attacks such as URVFL.
  • No supervised end-to-end training of the defense is required, eliminating early-epoch leakage windows.
  • Convergence behavior of standard vertical federated learning is theoretically unchanged.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same causal split could be tested in horizontal federated learning or other partitioned-data settings where reconstruction risks exist.
  • If the unsupervised decomposition proves stable across datasets, it may reduce reliance on differential privacy noise in federated pipelines.
  • The approach suggests that privacy mechanisms grounded in causal structure may generalize beyond VFL to other representation-sharing protocols.

Load-bearing premise

Non-causal features reliably encode the private sample-specific information that enables reconstruction attacks, and the causal/non-causal split can be recovered unsupervised without any post-training adjustment that reduces model utility.

What would settle it

A controlled test in which an advanced reconstruction attack such as URVFL recovers identifiable samples from the representations after CausShield decomposition at a success rate comparable to undefended VFL.

Figures

Figures reproduced from arXiv: 2606.08027 by Anmin Fu, Siguang Chen, Yansong Gao, Yongqi Jiang.

Figure 1
Figure 1. Figure 1: Evidence of reconstruction risk and task relevance. [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: CausShield overview. two core designs: (i) Altering Non-Causal Components: A1 generates chrominance output xˆab with substantially different appearance from the original xab, by adopting CE loss over quantized color distributions and window-based variance reg￾ularization to disrupt both global and local color patterns. (ii) Preserving Causal Components: A2 reconstructs luminance output xˆL that faithfully … view at source ↗
Figure 3
Figure 3. Figure 3: Surrogate data generation paradigm. Altering Non-Causal Components. Conventional coloriza￾tion methods [43], [44] minimize pixel-level distance loss (e.g., Euclidean or L1 norm), driving the subnetwork to faithfully reproduce exact pixel values and producing xˆab that remains chromatically close to xab, thus failing to alter non￾causal components sufficiently. To address this, we introduce the following tw… view at source ↗
Figure 4
Figure 4. Figure 4: Causal representation learning process. As shown in [PITH_FULL_IMAGE:figures/full_fig_p008_4.png] view at source ↗
Figure 6
Figure 6. Figure 6: Defense effects against Unsplit on CIFAR10. [PITH_FULL_IMAGE:figures/full_fig_p011_6.png] view at source ↗
Figure 9
Figure 9. Figure 9: Comparison of the batch attack-defense against Unsplit. [PITH_FULL_IMAGE:figures/full_fig_p012_9.png] view at source ↗
Figure 7
Figure 7. Figure 7: Defense effects against Unsplit on CIFAR-100. [PITH_FULL_IMAGE:figures/full_fig_p012_7.png] view at source ↗
Figure 10
Figure 10. Figure 10: Defense effect on different cut-layers on CIFAR-10. [PITH_FULL_IMAGE:figures/full_fig_p012_10.png] view at source ↗
Figure 14
Figure 14. Figure 14: Illustration of extra processing time. TABLE III COMPARISON OF DEFENSE METHODS IN ACC(%) ON EMNIST AND CIFAR-100. (a) EMNIST Method ACC No defense 89.21 ± 0.85 DP-L(ε=1.0) 82.13 ± 1.10 Prune(k=99%) 84.72 ± 0.92 Soteria(s=95%) 86.58 ± 0.88 CausShield 88.32 ± 0.75 (b) CIFAR-100 Method ACC No defense 62.20 ± 0.65 DP-L(ε=1.5) 38.80 ± 1.20 Soteria(s=95%) 53.40 ± 2.00 ResSFL(δ=0.3) 55.60 ± 1.40 CausShield 56.90… view at source ↗
Figure 12
Figure 12. Figure 12: Comparison of ACC and Loss on CIFAR-10. mechanism results in a significant decrease in model accuracy, approximately 15%. This decrease is attributed to the irre￾versible disruption of intermediate representations caused by indiscriminate noise addition. (3) CausShield significantly outperforms SOTAs, with the utility degradation being almost negligible. This phenomenon demonstrates that CausShield reduce… view at source ↗
Figure 13
Figure 13. Figure 13: Comparison of the ACC at varying ID overlap ratio. [PITH_FULL_IMAGE:figures/full_fig_p013_13.png] view at source ↗
read the original abstract

Vertical federated learning (VFL) is a distributed learning paradigm that leverages vertically partitioned features across isolated parties without sharing raw samples; however, it remains vulnerable to active sample reconstruction attacks. Existing defenses fail to achieve a satisfactory trade-off between model utility and privacy protection, due to either suppressing task-relevant information alongside privacy-sensitive features or relying on end-to-end supervised training to converge the defense module, which exposes the model to early-epoch vulnerability. To address this challenge, we adopt a structural causal model (SCM) insight and construct CausShield. From a task-learning standpoint, causal features within a raw sample are those that are directly relevant and contributory to the learning objective, whereas non-causal features are task-irrelevant but often encode sample-specific private information, thereby facilitating reconstruction. Importantly, we lay a theoretical foundation to prove this insight. CausShield thus decomposes the shared representations between the client and the coordinating server in VFL into task-relevant and task-irrelevant components to ensure full-cycle privacy protection. Nonetheless, the decomposition is inherently challenging due to the dual objectives of preserving model utility while mitigating privacy leakage. We address this via a carefully formulated optimization problem, which is solved through unsupervised representation learning. We further theoretically prove that CausShield preserves the convergence behavior of standard VFL. Extensive experiments compare CausShield against seven SOTAs, including InvL (USENIX Security'25), and evaluate robustness against advanced reconstruction attacks such as URVFL (NDSS'25). Results demonstrate that CausShield consistently outperforms in privacy protection, model utility, and computational efficiency.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

3 major / 2 minor

Summary. The paper proposes CausShield, a defense mechanism for vertical federated learning (VFL) against active sample reconstruction attacks. Drawing on structural causal model (SCM) insights, it decomposes shared client-server representations into task-relevant (causal) components that preserve utility and task-irrelevant (non-causal) components that encode sample-specific private information enabling reconstruction. The decomposition is achieved via an unsupervised representation learning optimization problem; the manuscript claims theoretical proofs establishing the SCM insight and showing that CausShield preserves the convergence rate of standard VFL. Experiments compare against seven baselines (including InvL and URVFL) and report improved privacy-utility trade-offs and efficiency.

Significance. If the theoretical separation guarantee and convergence preservation hold under the stated unsupervised setting, CausShield would address a recognized limitation in VFL defenses by avoiding both utility-destroying suppression and early-epoch supervised tuning. The SCM framing and explicit convergence analysis would constitute a substantive contribution to privacy-preserving distributed learning.

major comments (3)
  1. [theoretical foundation / optimization formulation] The central claim rests on an unsupervised learner reliably isolating task-irrelevant private features without utility loss or hidden supervision. The SCM justification (abstract and theoretical foundation section) asserts that non-causal features are both task-irrelevant and reconstruction-enabling, yet no identifiability conditions, auxiliary losses, or intervention-based guarantees are provided to ensure the partition occurs; if the separation fails, either reconstruction succeeds on the retained component or accuracy degrades, undermining both the privacy and convergence claims.
  2. [convergence analysis] Convergence preservation proof: the argument that the dual-objective unsupervised optimization does not alter the convergence behavior of standard VFL must be examined for any implicit assumptions on gradient flow or representation stability; without explicit bounds showing the task-relevant component remains equivalent in distribution to the original shared representation, the preservation result is not load-bearing.
  3. [experiments section] Experimental validation of the decomposition: the reported superiority over InvL (USENIX Security'25) and robustness to URVFL (NDSS'25) requires ablation studies isolating the effect of the unsupervised decomposition (e.g., utility with vs. without the task-irrelevant removal, reconstruction success rates on each component separately); current results do not yet confirm that the claimed separation, rather than other implementation choices, drives the gains.
minor comments (2)
  1. [method section] Notation for the decomposed representations (task-relevant vs. task-irrelevant) should be introduced with explicit symbols and distinguished from standard VFL notation to avoid reader confusion.
  2. [experiments section] Dataset details, attack hyper-parameters, and exact reconstruction metrics (e.g., MSE or success rate thresholds) are needed for reproducibility of the seven-baseline comparison.

Simulated Author's Rebuttal

3 responses · 0 unresolved

We thank the referee for the constructive and detailed comments. We address each major comment point by point below, with clear indications of planned revisions to strengthen the manuscript.

read point-by-point responses

  1. Referee: The central claim rests on an unsupervised learner reliably isolating task-irrelevant private features without utility loss or hidden supervision. The SCM justification asserts that non-causal features are both task-irrelevant and reconstruction-enabling, yet no identifiability conditions, auxiliary losses, or intervention-based guarantees are provided to ensure the partition occurs.

    Authors: We appreciate the referee drawing attention to this aspect of the theoretical foundation. The manuscript's theoretical foundation section establishes via SCM that non-causal features are task-irrelevant yet encode sample-specific information. To directly address the identifiability concern, we will add a dedicated paragraph in the revised theoretical section referencing standard identifiability results from causal representation learning (e.g., under linear SCMs with independent noise) and stating the precise assumptions under which the unsupervised objective isolates the components. This clarifies the conditions without introducing supervision or auxiliary losses. revision: partial

  2. Referee: Convergence preservation proof: the argument that the dual-objective unsupervised optimization does not alter the convergence behavior of standard VFL must be examined for any implicit assumptions on gradient flow or representation stability; without explicit bounds showing the task-relevant component remains equivalent in distribution to the original shared representation, the preservation result is not load-bearing.

    Authors: We agree that the convergence analysis would benefit from greater explicitness. The current proof shows that the optimization leaves the task-relevant component unchanged in expectation, thereby preserving the original VFL convergence rate. In revision we will insert two additional lemmas providing explicit bounds on the distributional distance (via Wasserstein metric) between the task-relevant component and the original representation, confirming equivalence under the stated unsupervised objective and removing any implicit assumptions on gradient flow. revision: yes

  3. Referee: Experimental validation of the decomposition: the reported superiority over InvL and robustness to URVFL requires ablation studies isolating the effect of the unsupervised decomposition (e.g., utility with vs. without the task-irrelevant removal, reconstruction success rates on each component separately); current results do not yet confirm that the claimed separation, rather than other implementation choices, drives the gains.

    Authors: We concur that targeted ablations are required to isolate the decomposition's contribution. We will add two new figures and accompanying text in the experiments section: (i) utility curves comparing the full CausShield against a variant that retains both components, and (ii) reconstruction attack success rates measured separately on the causal versus non-causal components. These ablations will be run on the same datasets and attack models (including URVFL) to demonstrate that the separation, rather than other design choices, accounts for the reported gains. revision: yes

Circularity Check

0 steps flagged

No circularity: theoretical claims presented as independent contributions

full rationale

The paper adopts an SCM insight, states that it lays a theoretical foundation to prove the causal/non-causal decomposition, formulates an optimization solved via unsupervised representation learning, and claims a separate proof that convergence matches standard VFL. No equations, fitted parameters renamed as predictions, or self-citation chains are exhibited that reduce any load-bearing step to its own inputs by construction. The derivation is therefore self-contained.

Axiom & Free-Parameter Ledger

0 free parameters · 1 axioms · 0 invented entities

The central approach rests on the domain assumption that task-irrelevant features primarily encode reconstructible private information; no free parameters or invented entities are named in the abstract.

axioms (1)
  • domain assumption Structural causal model insight that causal features are directly relevant to the learning objective while non-causal features encode sample-specific private information
    Stated explicitly in the abstract as the foundation for the decomposition.

pith-pipeline@v0.9.1-grok · 5822 in / 1265 out tokens · 22977 ms · 2026-06-27T20:11:45.091382+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

50 extracted references · 3 canonical work pages · 1 internal anchor

  1. [1]

    X. Zhu, X. Luo, Y . Wu, et al. Passive inference attacks on split learning via adversarial regularization. InProc. Netw. Distrib. Syst. Secur. Symp. (NDSS), 2025

    2025

  2. [2]

    M. Ye, W. Shen, B. Du, et al. Vertical federated learning for effective- ness, security, applicability: A survey.ACM Comput. Surv., 57(9):1–32, 2025

    2025

  3. [3]

    Federated ai technology enabler (fate)

    WeBank. Federated ai technology enabler (fate). https://fate.fedai.org. Accessed: Oct. 31, 2019

    2019

  4. [4]

    Erdogan, A

    E. Erdogan, A. Kupcu, and A. E. Cicek. Unsplit: Data-oblivious model inversion, model stealing, and label inference attacks against split learning. InProc. Workshop Priv. Electron. Soc. (WPES), pages 115– 124, 2022

    2022

  5. [5]

    D. Yao, S. Li, X. Gong, S. Hou, et al. Urvfl: Undetectable data reconstruction attack on vertical federated learning. InProc. Netw. Distrib. Syst. Secur. Symp. (NDSS), pages 1–18, 2025

    2025

  6. [6]

    P. Ye, Z. Jiang, W. Wang, et al. Feature reconstruction attacks and countermeasures of dnn training in vertical federated learning.IEEE Trans. Dependable Secure Comput., 22(3):2659–2669, 2024

    2024

  7. [7]

    J. A. Khan and K. Ozbay. Secure floating-scalable federated learning framework for real-time trust in mobility data using secure multi-party computation and blockchain. InProc. USENIX Secur. Symp. (USENIX Security), pages 133–141, 2025

    2025

  8. [8]

    D. Zhu, J. Chen, X. Zhou, et al. Vulnerabilities of data protection in vertical federated learning training and countermeasures.IEEE Trans. Inf. Forensics Secur., 19:3674–3689, Feb. 2024

    2024

  9. [9]

    Y . Li, N. Yan, J. Chen, et al. Fedphe: A secure and efficient federated learning via packed homomorphic encryption.IEEE Trans. Dependable Secure Comput., 2025

    2025

  10. [10]

    Cui and X

    L. Cui and X. Wu. Aldp-fl for adaptive local differential privacy in federated learning.Scientific Reports, 15(1):26679, 2025

    2025

  11. [11]

    Y . Hu, F. Wu, Q. Li, et al. Sok: Privacy-preserving data synthesis. In Proc. IEEE Symp. Secur. Privacy (S&P), pages 4696–4713, 2024

    2024

  12. [12]

    H. Gu, J. Luo, Y . Kang, et al. Fedpass: privacy-preserving vertical federated deep learning with adaptive obfuscation. InProc. Int. Joint Conf. Artif. Intell. (IJCAI), pages 3759–3767, 2023

    2023

  13. [13]

    X. Xu, Z. Li, Y . Han, et al. From risk to resilience: Towards assessing and mitigating the risk of data reconstruction attacks in federated learning. InProc. USENIX Secur. Symp. (USENIX Secur.), pages 3141– 3160, 2025

    2025

  14. [14]

    P. Qiu, X. Zhang, S. Ji, et al. Hashvfl: Defending against data reconstruction attacks in vertical federated learning.IEEE Trans. Inf. Forensics Secur., 19:3345–3359, 2024

    2024

  15. [15]

    Singh, A

    A. Singh, A. Chopra, E. Garza, et al. Disco: Dynamic and invariant sensitive channel obfuscation for deep neural networks. InProc. IEEE Comput. Soc. Conf. Comput. Vision Pattern Recognit. (CVPR), pages 12125–12135, 2021

    2021

  16. [16]

    J. Li, A. Rakin, X. Chen, et al. Ressfl: A resistance transfer framework for defending model inversion attack in split federated learning. InProc. IEEE Comput. Soc. Conf. Comput. Vision Pattern Recognit. (CVPR), pages 10194–10202, 2022

    2022

  17. [17]

    S. L. Noorbakhsh, B. Zhang, Y . Hong, et al. Inf2guard: An information- theoretic framework for learning privacy-preserving representations against inference attacks. InProc. USENIX Secur. Symp. (USENIX Secur.), pages 2405–2422, 2024

    2024

  18. [18]

    Vepakomma, A

    P. Vepakomma, A. Singh, O. Gupta, et al. Nopeek: Information leakage reduction to share activations in distributed deep learning. InProc. IEEE Int. Conf. Data Mining Workshops (ICDMW), pages 933–942, 2020

    2020

  19. [19]

    T. Chen, J. Wang, J. Zhao, et al. Dual dependency disentangling for defending model inversion attacks in split federated learning.IEEE Trans. Inf. Forensics Security, 20:11048–11063, 2025

    2025

  20. [20]

    X. Bi, Y . Hu, B. Liu, et al. Prifu: Capturing task-relevant information without adversarial learning. InProc. ACM Int. Conf. Multimedia (ACM MM), pages 3104–3112, 2024

    2024

  21. [21]

    Shi and Y

    S. Shi and Y . Wo. Defending against model inversion attack via feature purification.IEEE Trans. Inf. Forensics Security, 2025

    2025

  22. [22]

    C. Luo, D. K. Yau, and Q. Song. Svdefense: Effective defense against gradient inversion attacks via singular value decomposition. InProc. Netw. Distrib. Syst. Secur. Symp. (NDSS), 2026

    2026

  23. [23]

    Scholkopf, D

    B. Scholkopf, D. Janzing, J. Peters, et al. On causal and anticausal learning. InProc. Int. Conf. Learn. Represent. (ICLR), 2012

    2012

  24. [24]

    Tople, A

    S. Tople, A. Sharma, and A. Nori. Alleviating privacy attacks via causal learning. InProc. Int. Conf. Mach. Learn. (ICML), pages 9479–9489, 2020

    2020

  25. [25]

    Mahajan, S

    D. Mahajan, S. Tople, and A. Sharma. Domain generalization using causal matching. InProc. Int. Conf. Learn. Represent. (ICLR), pages 7313–7324, 2021

    2021

  26. [26]

    F. Lv, J. Liang, S. Li, et al. Causality inspired representation learning for domain generalization. InProc. IEEE Comput. Soc. Conf. Comput. Vision Pattern Recognit. (CVPR), pages 8046–8056, 2022

    2022

  27. [27]

    Vertical federated learning: taxonomies, threats, and prospects.arXiv preprint arXiv:2302.01550, 2023

    Qun Li, Chandra Thapa, Lawrence Ong, Yifeng Zheng, Hua Ma, Seyit A Camtepe, Anmin Fu, and Yansong Gao. Vertical federated learning: taxonomies, threats, and prospects.arXiv preprint arXiv:2302.01550, 2023

    work page arXiv 2023

  28. [28]

    X. Luo, Y . Wu, X. Xiao, et al. Feature inference attack on model predictions in vertical federated learning. InProc. Int. Conf. Data Eng. (ICDE), pages 181–192, 2021

    2021

  29. [29]

    R. Yang, J. Ma, J. Zhang, et al. Practical feature inference attack in vertical federated learning during prediction in artificial internet of things.IEEE Internet Things J., 11(1):5–16, 2023

    2023

  30. [30]

    Z. He, T. Zhang, and R. Lee. Model inversion attacks against collabo- rative inference. InProc. Annu. Comput. Secur. Appl. Conf. (ACSAC), pages 148–162, 2019

    2019

  31. [31]

    Pasquini, G

    D. Pasquini, G. Ateniese, and M. Bernaschi. Unleashing the tiger: Inference attacks on split learning. InProc. ACM Conf. Computer Commun. Secur. (CCS), pages 2113–2129, 2021

    2021

  32. [32]

    Gao and L

    X. Gao and L. Zhang. Pcat: functionality and data stealing from split learning by pseudo-client attack. InProc. USENIX Secur. Symp. (USENIX Security), pages 5271–5288, 2023

    2023

  33. [33]

    Mohassel and Y

    P. Mohassel and Y . Zhang. Secureml: A system for scalable privacy- preserving machine learning. InProc. IEEE Symp. Secur. Privacy (SP), pages 19–38, 2017

    2017

  34. [34]

    Lou and L

    Q. Lou and L. Jiang. Hemet: A homomorphic-encryption-friendly privacy-preserving mobile neural network architecture. InProc. Int. Conf. Mach. Learn. (ICML), pages 7102–7110, 2021

    2021

  35. [35]

    R. C. Geyer, T. Klein, M. Nabi, et al. Differentially private federated learning: a client level perspective.arXiv preprint arXiv:1712.07557, 2017. 15

    work page internal anchor Pith review Pith/arXiv arXiv 2017

  36. [36]

    X. Cao, G. Sun, H. Yu, et al. Perfed-gan: Personalized federated learning via generative adversarial networks.IEEE Internet Things J., 10:3749– 3762, Mar 2023

    2023

  37. [37]

    Huang, Z

    Y . Huang, Z. Song, K. Li, et al. Instahide: Instance-hiding schemes for private distributed learning. InProc. Int. Conf. Mach. Learn. (ICML), pages 4457–4468, 2020

    2020

  38. [38]

    T. Zou, Y . Liu, Y . Kang, et al. Defending batch-level label inference and replacement attacks in vertical federated learning.IEEE Trans. Big Data, pages 1–12, Jul 2022

    2022

  39. [39]

    J. Sun, A. Li, B. Wang, et al. Soteria: Provable defense against privacy leakage in federated learning from representation perspective. InProc. IEEE Comput. Soc. Conf. Comput. Vision Pattern Recognit. (CVPR), pages 9307–9315, 2021

    2021

  40. [40]

    Z. Li, J. Zhang, L. Liu, et al. Auditing privacy defenses in federated learning via generative gradient leakage. InProc. IEEE Comput. Soc. Conf. Comput. Vision Pattern Recognit. (CVPR), pages 10122–10132, 2022

    2022

  41. [41]

    Peters, D

    J. Peters, D. Janzing, and B. Scholkopf.Elements of causal inference- foundations and learning algorithms. MIT Press, Cambridge, MA, USA, 2017

    2017

  42. [42]

    Ahuja, D

    K. Ahuja, D. Mahajan, Y . Wang, et al. Interventional causal representa- tion learning. InProc. Int. Conf. Mach. Learn. (ICML), pages 372–507, 2023

    2023

  43. [43]

    Zhang, P

    R. Zhang, P. Isola, and A. Efros. Split-brain autoencoders: Unsupervised learning by cross-channel prediction. InProc. IEEE Comput. Soc. Conf. Comput. Vision Pattern Recognit. (CVPR), pages 1058–1067, 2017

    2017

  44. [44]

    X. Kang, T. Yang, W. Ouyang, et al. Ddcolor: Towards photo-realistic image colorization via dual decoders. InProc. IEEE/CVF Int. Conf. Comput. Vis. (ICCV), pages 328–338, 2023

    2023

  45. [45]

    Luo and X

    X. Luo and X. Zhang. Exploiting defenses against gan-based feature inference attacks in federated learning.ACM Trans. Knowl. Discov. Data, 19(3):1–20, 2025

    2025

  46. [46]

    E. Jang, S. Gu, B. Poole, et al. Categorical reparameterization with gumbel-softmax. InProc. Int. Conf. Learn. Represent. (ICLR), pages 1–13, 2017

    2017

  47. [47]

    X. Li, K. Huang, W. Yang, et al. On the convergence of fedavg on non-iid data. InProc. Int. Conf. Learn. Represent. (ICLR), pages 1–26, 2020

    2020

  48. [48]

    Castiglia, A

    T. Castiglia, A. Das, S. Wang, et al. Compressed-vfl: Communication- efficient learning with vertically partitioned data. InProc. Int. Conf. Mach. Learn. (ICML), pages 2738–2766, 2022

    2022

  49. [49]

    L. Zhu, Z. Liu, and S. Han. Deep leakage from gradients. InProc. Int. Conf. Neural Inf. Proces. Syst. (NeurIPS), pages 14774–14784, 2019

    2019

  50. [50]

    L. Yang, X. Zhang, and L. Wang. Asymmetrical vertical federated learning.arXiv preprint arXiv:2004.07427, 2020. APPENDIX A.CausShield’s Algorithm 1 The algorithm ofCausShieldis presented in Algorithm 1 B. Proof of Theorem 1 Proof.The Jacobians∂U/∂xand∂S/∂xsatisfy the following structural properties of the SCM: σk ∂U ∂x ≥µ >0, ∂S ∂x 2 ≤ϑ <∞,(33) whereµandϑ...

    work page arXiv 2004