Pith. sign in

REVIEW 4 major objections 6 minor 80 references

Towards Communication-Efficient Adversarial Federated Learning for Robust Edge Intelligence

T0 review · 4 major / 6 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A pre-trained teacher can make federated models both accurate and adversarially robust while sending far fewer parameters per round.

desk verdict A coherent, incremental distillation-based AFL method whose headline gains are conditional on an untested teacher-availability assumption; it deserves a serious referee but needs a teacher-degradation experiment before acceptance. read the letter →

arxiv 2501.15257 v2 pith:CBP53IIV submitted 2025-01-25 cs.CV

Yu Qiao , Apurba Adhikary , Huy Q. Le , Eui-Nam Huh , Zhu Han , Choong Seon Hong This is my paper · ORCID
classification cs.CV
keywords adversarialfederatedlearningknowledgedistillationpre-trainedmodelrobustnessnon-IIDdatacommunicationefficiencyedgeintelligencemixup
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that a small, locally trained federated model can inherit both clean accuracy and adversarial robustness from a robust pre-trained teacher, and that doing so is cheaper in communication than training a robust federated model from scratch. Its framework, PM-AFL++, distills two kinds of knowledge—clean and adversarial—through mixup-augmented pairs, and adds a local-global alignment term to counter non-IID drift. The headline result is that on CIFAR-10, PM-AFL++ reaches 47.88% clean accuracy and 20.22% AutoAttack robustness in 150 rounds with 320K parameters per round, whereas the FedPGD baseline needs 200 rounds and 11.69M parameters to reach 28.82% clean and 17.22% AutoAttack. If this holds, a pre-trained model can act as a free robustness teacher in federated edge settings, decoupling robustness from heavy communication.

What carries the argument

The load-bearing machinery is the three-term local objective $\mathcal{L} = \alpha \mathcal{L}_{VKD} + (1-\alpha) \mathcal{L}_{AKD} + \mathcal{L}_{ALG}$. $\mathcal{L}_{VKD}$ aligns interpolated and mixed clean class probabilities between teacher and student; $\mathcal{L}_{AKD}$ aligns the student's adversarial and mixed-adversarial outputs with the teacher's clean outputs; and $\mathcal{L}_{ALG}$ enforces consistency between local adversarial features and global clean features. The teacher is a pre-trained WideResNet used only locally for forward passes, so its predictions can be cached and add no communication cost, while the student is a small CNN that sends only its own parameters to the aggregation server.

What would settle it

Run PM-AFL++ with the teacher removed from the objective, or with a teacher that is not robust on the clients' data domain; if clean and robust accuracy do not drop materially, then the teacher-guided distillation is not what carries the reported result. Alternatively, recompute the communication savings after including the cost of training and distributing the teacher; if those costs dominate, the 73x, 36x, and 23x figures apply only to the federated phase rather than the whole pipeline.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that neither vanilla knowledge distillation nor adversarial distillation alone can transfer both accuracy and robustness from a teacher to federated students: VKD preserves clean accuracy but transfers little robustness, while AKD transfers robustness at the cost of clean accuracy. The paper claims that combining them in a unified mixture-KD objective—aligning clean and mixed-clean pairs for accuracy, and adversarial and mixed-adversarial pairs against the teacher's clean outputs for robustness—plus a consistency term that pulls local adversarial predictions toward global clean ones, yields a student that beats from-scratch adversarial FL methods on both metrics while sending far fewer parameters each round.

Load-bearing premise

Each client must already have access to a well-generalized, robust pre-trained teacher model whose soft labels are available locally without extra communication, since the whole local objective is defined against that teacher's outputs.

Editorial extensions

If this is right

  • Communication per round drops drastically: roughly 73x on MNIST, 36x on CIFAR-10, and 23x on CIFAR-100 compared with MobileNet or ResNet baselines, and the number of rounds needed also shrinks.
  • Clean and robust accuracy need not trade off as sharply in federated learning: PM-AFL++ reaches 47.88% clean and 20.22% AutoAttack accuracy on CIFAR-10, outperforming all from-scratch adversarial FL baselines on both axes.
  • The method degrades more gracefully under data heterogeneity: on MNIST, its robustness drop when the Dirichlet parameter moves from 1.0 to 0.1 is 12.76 points, versus 26.75 points for FedPGD.
  • Ablations show each loss term is necessary: removing $\mathcal{L}_{ALG}$ drops CIFAR-100 average robust accuracy from 28.98% to 23.87%, and removing $\mathcal{L}_{AKD}$ drops robustness nearly to zero while raising clean accuracy.
  • Larger student models help only up to a point, since performance plateaus between ResNet-12 and WideResNet-34-10, suggesting a small CNN suffices for distillation in this setting.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The efficiency ledger excludes the cost of obtaining the teacher; if the teacher must be trained and distributed before federated training begins, the advertised 73x, 36x, and 23x savings describe only the federated phase, not the full pipeline.
  • If a robust teacher is available centrally, the same distillation recipe could be tested in other decentralized regimes such as cross-silo or personalized federated learning, where the teacher's fixed parameters are shared rather than aggregated.
  • The student's robustness is presumably capped by the quality of the teacher's clean outputs used as distillation targets; a teacher that is not robust on the clients' data domain should bound both clean and robust gains, which is a direct testable hypothesis.
  • The reported 20.22% AutoAttack accuracy on CIFAR-10 is far below centralized robust models, so the real claim is robustness-per-communication-bit rather than state-of-the-art robustness; comparisons should be normalized by total bits transmitted.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes PM-AFL++, an adversarial federated learning framework in which each client distills knowledge from a locally available pre-trained teacher model. The local objective in Eq. (16) combines vanilla mixture knowledge distillation (Eq. 11), adversarial mixture knowledge distillation (Eq. 14), and a local-to-global alignment term (Eq. 15). The authors claim that this setup transfers both clean accuracy and adversarial robustness to a small student model, while drastically reducing per-round communication compared with from-scratch adversarial federated training. Experiments on MNIST, CIFAR-10, and CIFAR-100 compare PM-AFL/PM-AFL++ with FedAvg and several adversarial federated baselines, and ablations isolate the roles of the three loss terms. The paper also studies sensitivity to data heterogeneity, distillation temperature, weighting factor, and student model size.

Significance. If the results are reliable, the paper makes a useful empirical contribution: it shows that a strong pre-trained teacher can allow small federated student models to obtain both higher clean accuracy and higher adversarial robustness than from-scratch adversarial federated training, while using fewer communication rounds. The ablations in Table III are internally consistent (L_VKD improves clean accuracy, L_AKD improves robustness, L_ALG helps both), and Table V is a genuine attempt to control for the architecture confound by giving all baselines the same small model. The scalability experiments in Figs. 2–3 also support the claim of better robustness to non-IID heterogeneity. However, the significance is tempered by an untested and potentially strong assumption about teacher availability, by the statistical uncertainty from missing error bars, and by communication-efficiency claims that are partly attributable to architecture choice.

major comments (4)
  1. [Section III-A; Eq. (16)] The framework assumes that every client has access to a "well-generalized, robust teacher model," and all three terms of the local objective in Eq. (16) are defined with respect to that teacher. Yet no experiment varies teacher quality, teacher robustness, or teacher domain mismatch. Table II and Table V use a single strong, in-distribution teacher per dataset. This is load-bearing: if the teacher is weak on a client's non-IID local distribution, both clean and robust knowledge transfer degrade, and the method's reported gains may be an upper bound. Please add ablations with (a) a standard (non-robust) teacher, (b) a randomly initialized or low-accuracy teacher, and (c) a teacher trained on a shifted domain, and report clean and robust accuracy in each case.
  2. [Table II; Section V-B] The headline communication-efficiency numbers (73x, 36x, 23x fewer parameters per round) compare PM-AFL's small CNN student against baselines that use MobileNet or ResNet-18. This conflates the method with the student architecture. Table V partially addresses the confound by giving baselines the same architecture, but it then omits per-round parameter counts and only reports a modest reduction in communication rounds. Please make Table V the primary communication comparison, explicitly state that per-round parameter counts are identical by construction in that table, and revise the abstract/conclusion claims so that the "73x/36x/23x" reductions are presented as consequences of the chosen student architecture rather than of the proposed algorithm.
  3. [Table III; Section V-C] All results are said to be averaged over three independent runs, but no standard deviations or confidence intervals are reported. Several load-bearing comparisons involve small gaps: in Table III on CIFAR-10, adding L_ALG changes clean accuracy from 47.12% to 47.88% and robust accuracy from 23.88% to 24.03%, and in Table IV the differences between neighboring temperatures are of similar magnitude. Without variance information, the claim that L_ALG is indispensable and that a particular temperature is optimal is not statistically supported. Please report standard deviations (or per-run values) for the main tables and at least for the ablation and temperature studies.
  4. [Eq. (16); Section V-C; Figure 4] There is an internal inconsistency in the definition of the weighting factor. Eq. (16) defines α as the weight on L_VKD (clean distillation), so ρ = α/(1−α) is an accuracy-to-robustness ratio. However, Section V-C and the caption of Figure 4 state that ρ is the "ratio of robustness to accuracy," and the text says that increasing ρ improves robustness. Under Eq. (16), increasing ρ increases the weight of clean distillation and decreases the weight of adversarial distillation, which makes the reported trend counterintuitive. Please correct either the definition of α in Eq. (16) or the interpretation of ρ, and re-state the hyperparameter-selection conclusions accordingly.
minor comments (6)
  1. [Section V-C] There is a typo in "we future analyze" and the heading "Comparision" should be "Comparison."
  2. [Section V-B] The sentence beginning "For example, in the MNIST results..." appears twice in the communication-efficiency paragraph with the same numbers; please delete the duplicate.
  3. [Table II] In the CIFAR-100 block, the DBFAT row lists the communication parameter count as "11.690" instead of "11,690"; please fix the formatting.
  4. [Eq. (15)] Equation (15) contains an unmatched parenthesis: it reads "∥ z_s^adv − z_g)\|_2^2" rather than "∥ z_s^adv − z_g \|_2^2."
  5. [Algorithm 1; Section IV] The paper does not give a formal separate definition of PM-AFL versus PM-AFL++: Algorithm 1 describes only PM-AFL++. Please state explicitly which component (mixture distillation, L_ALG, or both) distinguishes PM-AFL++ from PM-AFL, so that Table I and Table II are reproducible.
  6. [Figure 4] The x-axis labels such as "1.0/10.0" are ambiguous; state explicitly whether the leftmost point corresponds to ρ=0.1 or to ρ=10, and align the axis direction with the definition of ρ.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the teacher-guided objective is a stated premise rather than a fitted output, and the reported gains are benchmarked externally with same-architecture controls.

full rationale

The paper's central claim is empirical: PM-AFL++ outperforms AFL baselines on MNIST, CIFAR-10, and CIFAR-100 under FGSM, BIM, PGD, Square, and AutoAttack (Table II), with communication cost measured by rounds and parameter counts. Nothing in the derivation chain reduces the reported results to the method's own inputs by construction. The teacher assumption in Section III-A ('Each client also has access to a well-generalized, robust teacher model') is a stated deployment premise, not a fitted parameter or a renamed prediction; the paper never tunes the teacher to match the reported accuracies, and the teacher is an externally pretrained WideResNet. Equation (16) defines the local objective, but the paper does not present the table entries as algebraic consequences of Eq. (16); they are measured outcomes on public benchmarks. Hyperparameters alpha and temperature T are selected from Figure 4 and Table IV, which is standard hyperparameter tuning rather than concealed fitting of the headline numbers. The self-citations that appear ([17], [19], [20], [50], [51], [54], [58]) are used as related-work background or implementation context; none is invoked as a uniqueness theorem, and none is the sole justification of a load-bearing premise. The external citations carry the design rationale: Mixup [66], KD [21], AKD [23], and adversarial logit alignment [68]-[70]. The same-architecture comparison in Table V and the model-size studies in Tables VI-VII also address the fairness of the communication-efficiency comparison, so the advantage is not an artifact of comparing different student sizes. The teacher-quality dependence flagged by the skeptic is an applicability limitation or upper-bound concern, but it is not circular: the paper could fail gracefully in domains where the teacher is weak without the derivation becoming equivalent to its own inputs.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

The method introduces no new entity; it depends on the availability and transfer power of a pre-trained teacher, and on per-dataset choices of alpha and temperature. The mixup coefficient is stated inconsistently.

free parameters (3)
  • alpha (accuracy-robustness weighting) = ≈0.909 for MNIST and CIFAR-100 (rho=10/1), ≈0.833 for CIFAR-10 (rho=5/1)
    Controls balance between L_VKD and L_AKD in Eq. (16); chosen per dataset from robustness curves in Fig. 4, not derived.
  • distillation temperature T = 3 for MNIST, 2 for CIFAR-10 and CIFAR-100
    Selected from Table IV to maximize the clean/robust trade-off; affects all distillation losses.
  • mixup coefficient lambda = 0.2
    Fixed following [66], but contradicted by Eq. (8) where lambda is drawn from Beta(beta,beta); the value used in experiments is 0.2.
assumptions (3)
  • domain assumption Clients have access to a well-generalized, robust pre-trained teacher model.
    Stated in Section III-A; the entire distillation framework requires this teacher and its fixed outputs, and no fallback is provided if no such teacher exists.
  • domain assumption Knowledge from a robust teacher transfers both clean and robust accuracy to a small student under non-IID federated training.
    Relies on prior adversarial distillation results [21]-[24] and the toy experiment in Table I; the paper does not prove this transfer under client drift.
  • domain assumption Robustness can be measured and optimized using PGD and AutoAttack threat models.
    Eqs. (4)-(6) generate adversarial examples with PGD, and robustness is evaluated with AutoAttack; standard in the field, but it assumes these attacks define the relevant threat model.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Towards Communication-Efficient Adversarial Federated Learning for Robust Edge Intelligence." pith.science (2026). https://pith.science/paper/CBP53IIV

@misc{pith2026250115257,
  author       = {Pith},
  title        = {Pith review of: Towards Communication-Efficient Adversarial Federated Learning for Robust Edge Intelligence},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/CBP53IIV}},
  note         = {Machine review of arXiv:2501.15257}
}
read the original abstract

Federated learning (FL) has gained significant attention for enabling decentralized training on edge networks without exposing raw data. However, FL models remain susceptible to adversarial attacks and performance degradation in non-IID data settings, thus posing challenges to both robustness and accuracy. This paper aims to achieve communication-efficient adversarial federated learning (AFL) by leveraging a pre-trained model to enhance both robustness and accuracy under adversarial attacks and non-IID challenges in AFL. By leveraging the knowledge from a pre-trained model for both clean and adversarial images, we propose a pre-trained model-guided adversarial federated learning (PM-AFL) framework. This framework integrates vanilla and adversarial mixture knowledge distillation to effectively balance accuracy and robustness while promoting local models to learn from diverse data. Specifically, for clean accuracy, we adopt a dual distillation strategy where the class probabilities of randomly paired images, and their blended versions are aligned between the teacher model and the local models. For adversarial robustness, we employ a similar distillation approach but replace clean samples on the local side with adversarial examples. Moreover, by considering the bias between local and global models, we also incorporate a consistency regularization term to ensure that local adversarial predictions stay aligned with their corresponding global clean ones. These strategies collectively enable local models to absorb diverse knowledge from the teacher model while maintaining close alignment with the global model, thereby mitigating overfitting to local optima and enhancing the generalization of the global model. Experiments demonstrate that the PM-AFL-based framework not only significantly outperforms other methods but also maintains communication efficiency.

Figures

Figures reproduced from arXiv: 2501.15257 by the authors.

Figure 1
Figure 1. Illustration of the proposed PM-AFL++ framework. We propose vanilla mixture knowledge distillation ( [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Robustness comparison of PM-AFL++ and FedPGD on MNIST under [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Accuracy comparison of PM-AFL++ and FedPGD on CIFAR-10 under [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Robustness of PM-AFL++ on MNIST, CIFAR-10, and CIFAR-100 under different values of [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 2
Figure 2. Figure 2: This figure illustrates the robustness comparison [PITH_FULL_IMAGE:figures/full_fig_p009_2.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

80 extracted references · 66 canonical work pages

  1. [1]

    Gpt-4 technical report,

    J. Achiam, S. Adler, S. Agarwal, L. Ahmad, I. Akkaya, F. L. Aleman, D. Almeida, J. Altenschmidt, S. Altman, S. Anadkat, et al. , “Gpt-4 technical report,” arXiv preprint arXiv:2303.08774 , 2023

    arXiv 2023

  2. [2]

    Gemini: a family of highly capable multimodal models,

    G. Team, R. Anil, S. Borgeaud, J.-B. Alayrac, J. Yu, R. Soricut, J. Schalkwyk, A. M. Dai, A. Hauth, K. Millican,et al., “Gemini: a family of highly capable multimodal models,”arXiv preprint arXiv:2312.11805, 2023

    arXiv 2023

  3. [3]

    Deepseek-inspired exploration of rl-based llms and synergy with wire- less networks: A survey,

    Y . Qiao, P.-N. Tran, J. S. Yoon, L. X. Nguyen, and C. S. Hong, “Deepseek-inspired exploration of rl-based llms and synergy with wire- less networks: A survey,” Authorea Preprints, 2025

    work page 2025

  4. [4]

    Chatgpt: Enabling human-like conversations and shaping the future of language processing,

    S. Torne and P. K. Pullela, “Chatgpt: Enabling human-like conversations and shaping the future of language processing,” in Sustainability in Digital Transformation Era: Driving Innovative & Growth , CRC Press, 2024

    work page 2024

  5. [5]

    Evaluating text-to-visual generation with image-to-text generation,

    Z. Lin, D. Pathak, B. Li, J. Li, X. Xia, G. Neubig, P. Zhang, and D. Ramanan, “Evaluating text-to-visual generation with image-to-text generation,” in European Conference on Computer Vision (ECCV) , MiCo, Milano, September 2024

    work page 2024

  6. [6]

    Empirical evaluation of chatgpt on requirements information retrieval under zero-shot setting,

    J. Zhang, Y . Chen, C. Liu, N. Niu, and Y . Wang, “Empirical evaluation of chatgpt on requirements information retrieval under zero-shot setting,” in IEEE International Conference on Intelligent Computing and Next Generation Networks (ICNGN) , Hangzhou, China, November 2023

    work page 2023

  7. [7]

    Mp-fedcl: Multiprototype federated contrastive learning for edge intelligence,

    Y . Qiao, M. S. Munir, A. Adhikary, H. Q. Le, A. D. Raha, C. Zhang, and C. S. Hong, “Mp-fedcl: Multiprototype federated contrastive learning for edge intelligence,” IEEE Internet of Things Journal , vol. 11, no. 5, pp. 8604–8623, September 2023

    work page 2023

  8. [8]

    Communication-efficient learning of deep networks from decentralized data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Artificial Intelligence and Statistics (AISTATS), Lauderdale, FL, April 2017

    work page 2017

Show all 80 references
  1. [9]

    Federated learning for healthcare: Systematic review and architecture proposal,

    R. S. Antunes, C. André da Costa, A. Küderle, I. A. Yari, and B. Eskofier, “Federated learning for healthcare: Systematic review and architecture proposal,” ACM Transactions on Intelligent Systems and Technology, vol. 13, no. 4, pp. 1–23, May 2022

    2022

  2. [10]

    Federated learning for open banking,

    G. Long, Y . Tan, J. Jiang, and C. Zhang, “Federated learning for open banking,” in Federated Learning: Privacy and Incentive , pp. 240–254, Springer, 2020

    2020

  3. [11]

    Perturbation-enabled deep federated learning for preserving internet of things-based social net- works,

    S. Salim, N. Moustafa, B. Turnbull, and I. Razzak, “Perturbation-enabled deep federated learning for preserving internet of things-based social net- works,” ACM Transactions on Multimedia Computing, Communications, and Applications, vol. 18, no. 2, pp. 1–19, October 2022

    2022

  4. [12]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” arXiv preprint arXiv:1312.6199, 2013

    2013 arXiv

  5. [13]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” in International Conference on Learning Repre- sentations (ICLR), CA, USA, May 2015

    2015

  6. [14]

    Fat: Federated adversarial training,

    G. Zizzo, A. Rawat, M. Sinn, and B. Buesser, “Fat: Federated adversarial training,” in Annual Conference on Neural Information Processing Systems (NeurIPS), Virtual, December 2020

    2020

  7. [15]

    Federated robustness propagation: sharing adversarial robustness in heterogeneous federated learning,

    J. Hong, H. Wang, Z. Wang, and J. Zhou, “Federated robustness propagation: sharing adversarial robustness in heterogeneous federated learning,” in AAAI Conference on Artificial Intelligence (AAAI) , W A., USA, February 2023

    2023

  8. [16]

    Delving into the adversarial robustness of federated learning,

    J. Zhang, B. Li, C. Chen, L. Lyu, S. Wu, S. Ding, and C. Wu, “Delving into the adversarial robustness of federated learning,” in AAAI Conference on Artificial Intelligence (AAAI) , Washington DC, February 2023

    2023

  9. [17]

    Logit calibration and feature contrast for robust federated learning on non-iid data,

    Y . Qiao, C. Zhang, A. Adhikary, and C. S. Hong, “Logit calibration and feature contrast for robust federated learning on non-iid data,” IEEE Transactions on Network Science and Engineering , vol. 12, no. 2, pp. 636–652, March 2025

    2025

  10. [18]

    Calfat: Calibrated federated ad- versarial training with label skewness,

    C. Chen, Y . Liu, X. Ma, and L. Lyu, “Calfat: Calibrated federated ad- versarial training with label skewness,” Advances in Neural Information Processing Systems (NeurIPS) , LA, USA, November 2022

    2022

  11. [19]

    Towards robust federated learning via logits calibration on non-iid data,

    Y . Qiao, A. Adhikary, C. Zhang, and C. S. Hong, “Towards robust federated learning via logits calibration on non-iid data,” in IEEE/IFIP Network Operations and Management Symposium (NOMS) , Seoul, South Korea, May 2024

    2024

  12. [20]

    Fedccl: Federated dual-clustered feature contrast under domain heterogeneity,

    Y . Qiao, H. Q. Le, M. Zhang, A. Adhikary, C. Zhang, and C. S. Hong, “Fedccl: Federated dual-clustered feature contrast under domain heterogeneity,” Information Fusion, vol. 113, p. 102645, January 2025

    2025

  13. [21]

    Distilling the knowledge in a neural network,

    G. Hinton, O. Vinyals, and J. Dean, “Distilling the knowledge in a neural network,” arXiv preprint arXiv:1503.02531 , 2015

    2015 arXiv

  14. [22]

    Knowledge distillation: A good teacher is patient and consistent,

    L. Beyer, X. Zhai, A. Royer, L. Markeeva, R. Anil, and A. Kolesnikov, “Knowledge distillation: A good teacher is patient and consistent,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 10925–10934, New Orleans, LA, June 2022

    2022

  15. [23]

    Adversarially robust distillation,

    M. Goldblum, L. Fowl, S. Feizi, and T. Goldstein, “Adversarially robust distillation,” in AAAI Conference on Artificial Intelligence (AAAI) , NY , USA, April 2020

    2020

  16. [24]

    Revisiting adversarial robust- ness distillation: Robust soft labels make student better,

    B. Zi, S. Zhao, X. Ma, and Y .-G. Jiang, “Revisiting adversarial robust- ness distillation: Robust soft labels make student better,” in IEEE/CVF International Conference on Computer Vision (CVPR) , Nashville, TN, June 2021

    2021

  17. [25]

    Boosting accuracy and robustness of student models via adaptive adversarial distillation,

    B. Huang, M. Chen, Y . Wang, J. Lu, M. Cheng, and W. Wang, “Boosting accuracy and robustness of student models via adaptive adversarial distillation,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Vancouver, Canada, June 2023

    2023

  18. [26]

    Adversarial training for free!,

    A. Shafahi, M. Najibi, M. A. Ghiasi, Z. Xu, J. Dickerson, C. Studer, L. S. Davis, G. Taylor, and T. Goldstein, “Adversarial training for free!,” Advances in Neural Information Processing Systems (NeurIPS) , Vancouver, Canada, December 2019

    2019

  19. [27]

    Recent advances in adversarial training for adversarial robustness,

    T. Bai, J. Luo, J. Zhao, B. Wen, and Q. Wang, “Recent advances in adversarial training for adversarial robustness,” in International Joint Conference on Artificial Intelligence (IJCAI), Montreal, Canada, August 2021

    2021

  20. [28]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” in International Conference on Learning Representations (ICLR) , BC, Canada, April 2018

    2018

  21. [29]

    Theoretically principled trade-off between robustness and accuracy,

    H. Zhang, Y . Yu, J. Jiao, E. Xing, L. El Ghaoui, and M. Jordan, “Theoretically principled trade-off between robustness and accuracy,” in International Conference on Machine Learning (ICML) , CA, USA, June 2019

    2019

  22. [30]

    Continuous multivariate distributions,

    N. Balakrishnan, “Continuous multivariate distributions,” Wiley StatsRef: Statistics Reference Online , August 2014

    2014

  23. [31]

    Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks,

    F. Croce and M. Hein, “Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks,” in International Conference on Machine Learning (ICML) , Virtual, July 2020

    2020

  24. [32]

    Federated optimization in heterogeneous networks,

    T. Li, A. K. Sahu, M. Zaheer, M. Sanjabi, A. Talwalkar, and V . Smith, “Federated optimization in heterogeneous networks,” Machine Learning and Systems (MLSys) , TX, USA, March 2020

    2020

  25. [33]

    Model-contrastive federated learning,

    Q. Li, B. He, and D. Song, “Model-contrastive federated learning,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), TN, USA, June 2021

    2021

  26. [34]

    Measuring the effects of non- identical data distribution for federated visual classification,

    T.-M. H. Hsu, H. Qi, and M. Brown, “Measuring the effects of non- identical data distribution for federated visual classification,” arXiv preprint arXiv:1909.06335, 2019

    1909 arXiv

  27. [35]

    Federated learning with personalization layers,

    M. G. Arivazhagan, V . Aggarwal, A. K. Singh, and S. Choud- hary, “Federated learning with personalization layers,” arXiv preprint arXiv:1912.00818, 2019

    1912 arXiv

  28. [36]

    Fedproto: Federated prototype learning across heterogeneous clients,

    Y . Tan, G. Long, L. Liu, T. Zhou, Q. Lu, J. Jiang, and C. Zhang, “Fedproto: Federated prototype learning across heterogeneous clients,” in AAAI Conference on Artificial Intelligence (AAAI) , New York, USA, February 2022

    2022

  29. [37]

    A framework for multi-prototype based federated learning: Towards the edge intelligence,

    Y . Qiao, M. S. Munir, A. Adhikary, A. D. Raha, S. H. Hong, and C. S. Hong, “A framework for multi-prototype based federated learning: Towards the edge intelligence,” in IEEE International Conference on Information Networking (ICOIN) , Bangkok, Thailand, January 2023

    2023

  30. [38]

    Efficient parameter-free clustering using first neighbor relations,

    S. Sarfraz, V . Sharma, and R. Stiefelhagen, “Efficient parameter-free clustering using first neighbor relations,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), CA, USA, June 2019

    2019

  31. [39]

    Federated learning with label distribution skew via logits calibration,

    J. Zhang, Z. Li, B. Li, J. Xu, S. Wu, S. Ding, and C. Wu, “Federated learning with label distribution skew via logits calibration,” in Interna- tional Conference on Machine Learning (ICML) , Virtual, July 2022

    2022

  32. [40]

    Rethinking client drift in federated learning: A logit perspective,

    Y . Yan, C.-M. Feng, M. Ye, W. Zuo, P. Li, R. S. M. Goh, L. Zhu, and C. Chen, “Rethinking client drift in federated learning: A logit perspective,” arXiv preprint arXiv:2308.10162 , 2023

    2023 arXiv

  33. [41]

    Data-free knowledge distillation for het- erogeneous federated learning,

    Z. Zhu, J. Hong, and J. Zhou, “Data-free knowledge distillation for het- erogeneous federated learning,” in International Conference on Machine Learning (ICML), Virtual, July 2021. 13

    2021

  34. [42]

    Dfrd: Data-free ro- bustness distillation for heterogeneous federated learning,

    S. Wang, Y . Fu, X. Li, Y . Lan, M. Gao, et al. , “Dfrd: Data-free ro- bustness distillation for heterogeneous federated learning,” Advances in Neural Information Processing Systems (NeurIPS) , Vancouver, Canada, December 2024

    2024

  35. [43]

    Logit standardization in knowledge distillation,

    S. Sun, W. Ren, J. Li, R. Wang, and X. Cao, “Logit standardization in knowledge distillation,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , W A, USA, June 2024

    2024

  36. [44]

    Differentiable feature aggregation search for knowledge distillation,

    Y . Guan, P. Zhao, B. Wang, Y . Zhang, C. Yao, K. Bian, and J. Tang, “Differentiable feature aggregation search for knowledge distillation,” in European Conference on Computer Vision (ECCV) , Glasgow, UK, August 2020

    2020

  37. [45]

    Data-free knowledge distillation via feature exchange and activation region constraint,

    S. Yu, J. Chen, H. Han, and S. Jiang, “Data-free knowledge distillation via feature exchange and activation region constraint,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , Van- couver, Canada, December 2023

    2023

  38. [46]

    Probabilistic knowledge transfer for lightweight deep representation learning,

    N. Passalis, M. Tzelepi, and A. Tefas, “Probabilistic knowledge transfer for lightweight deep representation learning,” IEEE Transactions on Neural Networks and Learning Systems , vol. 32, pp. 2030–2039, June 2020

    2020

  39. [47]

    Pairwise difference relational distillation for object re-identification,

    Y . Xie, H. Wu, Y . Lin, J. Zhu, and H. Zeng, “Pairwise difference relational distillation for object re-identification,” Pattern Recognition, vol. 152, p. 110455, August 2024

    2024

  40. [48]

    Ensemble distillation for robust model fusion in federated learning,

    T. Lin, L. Kong, S. U. Stich, and M. Jaggi, “Ensemble distillation for robust model fusion in federated learning,” Advances in Neural Information Processing Systems (NeurIPS) , Virtual, December 2020

    2020

  41. [49]

    Data-free knowledge filtering and distillation in federated learning,

    Z. Lu, J. Wang, and C. Jiang, “Data-free knowledge filtering and distillation in federated learning,” IEEE Transactions on Big Data, 2024

    2024

  42. [50]

    Knowledge distillation in federated learning: Where and how to distill?,

    Y . Qiao, C. Zhang, H. Q. Le, A. D. Raha, A. Adhikary, and C. S. Hong, “Knowledge distillation in federated learning: Where and how to distill?,” in IEEE Asia-Pacific Network Operations and Management Symposium (APNOMS), Sejong, South Korea, September 2023

    2023

  43. [51]

    Prototype helps federated learning: Towards faster convergence,

    Y . Qiao, S.-B. Park, S. M. Kang, and C. S. Hong, “Prototype helps federated learning: Towards faster convergence,” arXiv preprint arXiv:2303.12296, 2023

    2023 arXiv

  44. [52]

    Federated learning from pre-trained models: A contrastive learning approach,

    Y . Tan, G. Long, J. Ma, L. Liu, T. Zhou, and J. Jiang, “Federated learning from pre-trained models: A contrastive learning approach,” Advances in Neural Information Processing Systems (NeurIPS) , New Orleans, Louisiana, November 2022

    2022

  45. [53]

    Data-free adversarial distillation,

    G. Fang, J. Song, C. Shen, X. Wang, D. Chen, and M. Song, “Data-free adversarial distillation,” arXiv preprint arXiv:1912.11006 , 2019

    1912 arXiv

  46. [54]

    Knowledge distillation assisted robust federated learning: Towards edge intelli- gence,

    Y . Qiao, A. Adhikary, K. T. Kim, C. Zhang, and C. S. Hong, “Knowledge distillation assisted robust federated learning: Towards edge intelli- gence,” in IEEE International Conference on Communications (ICC) , Denver, Colorado, June 2024

    2024

  47. [55]

    Does physical ad- versarial example really matter to autonomous driving? towards system- level effect of adversarial object evasion attack,

    N. Wang, Y . Luo, T. Sato, K. Xu, and Q. A. Chen, “Does physical ad- versarial example really matter to autonomous driving? towards system- level effect of adversarial object evasion attack,” in IEEE/CVF Inter- national Conference on Computer Vision (CVPR) , Vancouver, Canada,...

    2023

  48. [56]

    Adversarial examples are not easily detected: Bypassing ten detection methods,

    N. Carlini and D. Wagner, “Adversarial examples are not easily detected: Bypassing ten detection methods,” in ACM Workshop on Artificial Intelligence and Security (AISec) , Dallas, TX, November 2017

    2017

  49. [57]

    Robustness of sam: Segment anything under corruptions and beyond,

    Y . Qiao, C. Zhang, T. Kang, D. Kim, S. Tariq, C. Zhang, and C. S. Hong, “Robustness of sam: Segment anything under corruptions and beyond,” arXiv preprint arXiv:2306.07713 , 2023

    2023 arXiv

  50. [58]

    Federated hybrid training and self-adversarial distillation: Towards robust edge networks,

    Y . Qiao, A. Adhikary, K. Kim, E.-N. Huh, Z. Han, and C. S. Hong, “Federated hybrid training and self-adversarial distillation: Towards robust edge networks,” arXiv preprint arXiv:2412.19354 , 2024

    2024 arXiv

  51. [59]

    Adversarial examples in the physical world,

    A. Kurakin, I. J. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” in Artificial Intelligence Safety and Security , Chapman and Hall/CRC, July 2018

    2018

  52. [60]

    Square attack: a query-efficient black-box adversarial attack via random search,

    M. Andriushchenko, F. Croce, N. Flammarion, and M. Hein, “Square attack: a query-efficient black-box adversarial attack via random search,” in European Conference on Computer Vision (ECCV) , Glasgow, UK, August 2020

    2020

  53. [61]

    Towards evaluating the robustness of neural networks,

    N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in IEEE Symposium on Security and Privacy (SP) , San Jose, CA, May 2017

    2017

  54. [62]

    Univer- sal adversarial perturbations,

    S.-M. Moosavi-Dezfooli, A. Fawzi, O. Fawzi, and P. Frossard, “Univer- sal adversarial perturbations,” in IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , Honolulu, HI, July 2017

    2017

  55. [63]

    The limitations of adversarial training and the blind-spot attack,

    H. Zhang, H. Chen, Z. Song, D. Boning, I. Dhillon, and C. J. Hsieh, “The limitations of adversarial training and the blind-spot attack,” in International Conference on Learning Representations (ICLR) , New Orleans, LA, May 2019

    2019

  56. [64]

    Bayesian nonparametric federated learning of neural networks,

    M. Yurochkin, M. Agarwal, S. Ghosh, K. Greenewald, N. Hoang, and Y . Khazaeni, “Bayesian nonparametric federated learning of neural networks,” in International Conference on Machine Learning (ICML) , Long Beach, CA, June 2019

    2019

  57. [65]

    On the robustness of the cvpr 2018 white- box adversarial example defenses,

    A. Athalye and N. Carlini, “On the robustness of the cvpr 2018 white- box adversarial example defenses,” in The Bright and Dark Sides of Computer Vision: Challenges and Opportunities for Privacy and Security, 2018

    2018

  58. [66]

    mixup: Beyond empirical risk minimization,

    H. Zhang, M. Cisse, Y . N. Dauphin, and D. Lopez-Paz, “mixup: Beyond empirical risk minimization,” in International Conference on Learning Representations (ICLR), Vancouver, BC, April 2018

    2018

  59. [67]

    Kullback– leibler divergence metric learning,

    S. Ji, Z. Zhang, S. Ying, L. Wang, X. Zhao, and Y . Gao, “Kullback– leibler divergence metric learning,” IEEE Transactions on Cybernetics , vol. 52, no. 4, pp. 2047–2058, April 2020

    2020

  60. [68]

    Adversarial logit pairing,

    H. Kannan, A. Kurakin, and I. Goodfellow, “Adversarial logit pairing,” arXiv preprint arXiv:1803.06373 , 2018

    2018 arXiv

  61. [69]

    Evaluating and understanding the robustness of adversarial logit pairing,

    L. Engstrom, A. Ilyas, and A. Athalye, “Evaluating and understanding the robustness of adversarial logit pairing,” NeurIPS 2018 Workshop on Security in Machine Learning (NeurIPS SECML) , Montreal, Canada, December 2018

    2018

  62. [70]

    Adaptive adversarial logits pairing,

    S. Wu, J. Sang, K. Xu, G. Zheng, and C. Xu, “Adaptive adversarial logits pairing,” ACM Transactions on Multimedia Computing, Communications and Applications, vol. 20, no. 2, pp. 1–16, October 2023

    2023

  63. [71]

    Improving adversarial robustness requires revisiting misclassified examples,

    Y . Wang, D. Zou, J. Yi, J. Bailey, X. Ma, and Q. Gu, “Improving adversarial robustness requires revisiting misclassified examples,” in International Conference on Learning Representations (ICLR) , New Orleans, LA, May 2019

    2019

  64. [72]

    Gradient-based learning applied to document recognition,

    Y . LeCun, L. Bottou, Y . Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,” Proceedings of the IEEE , vol. 86, no. 11, pp. 2278–2324, November 1998

    1998

  65. [73]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky, G. Hinton, et al., “Learning multiple layers of features from tiny images,” Toronto, ON, Canada, 2009

    2009

  66. [74]

    Wide residual networks,

    S. Zagoruyko, “Wide residual networks,” in British Machine Vision Conference (BMVC), York, UK, September 2016

    2016

  67. [75]

    Fixing data augmentation to improve adversarial robustness,

    S.-A. Rebuffi, S. Gowal, D. A. Calian, F. Stimberg, O. Wiles, and T. Mann, “Fixing data augmentation to improve adversarial robustness,” arXiv preprint arXiv:2103.01946 , 2021

    2021 arXiv

  68. [76]

    Mobilenets: Efficient convo- lutional neural networks for mobile vision applications,

    A. G. Howard, M. Zhu, B. Chen, D. Kalenichenko, W. Wang, T. Weyand, M. Andreetto, and H. Adam, “Mobilenets: Efficient convo- lutional neural networks for mobile vision applications,” arXiv preprint arXiv:1704.04861, 2017

    2017 arXiv

  69. [77]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Las Vegas, NV , June 2016

    2016

  70. [78]

    Knowledge distillation: A survey,

    J. Gou, B. Yu, S. J. Maybank, and D. Tao, “Knowledge distillation: A survey,” International Journal of Computer Vision , vol. 129, no. 6, pp. 1789–1819, June 2021

    2021

  71. [79]

    Improving robustness using generated data,

    S. Gowal, S.-A. Rebuffi, O. Wiles, F. Stimberg, D. A. Calian, and T. A. Mann, “Improving robustness using generated data,” Advances in Neural Information Processing Systems (NeurIPS) , Virtual, December 2021

    2021

  72. [80]

    Revisiting residual networks for adversarial robustness,

    S. Huang, Z. Lu, K. Deb, and V . N. Boddeti, “Revisiting residual networks for adversarial robustness,” in IEEE/CVF Conference on Com- puter Vision and Pattern Recognition (CVPR), Vancouver, Canada, June 2023

    2023

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.