Pith. sign in

REVIEW 4 major objections 8 minor 50 references

Fed-AugMix: Balancing Privacy and Utility via Data Augmentation

T0 review · 4 major / 8 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Fed-AugMix embeds AugMix-generated distortion and a Jensen-Shannon consistency term into client gradients, claiming to block gradient-inversion reconstruction while preserving or improving federated model accuracy.

desk verdict A straightforward application of AugMix to FL clients with a plausible utility story, but the privacy defense is not established: no adaptive attacker, no baselines, and the noise is admittedly minimal at the stage where deployed updates arrive. read the letter →

arxiv 2412.13818 v1 pith:CRVA24BH submitted 2024-12-18 cs.CR

Haoyang Li , Wei Chen , Xiaojin Zhang This is my paper · ORCID
classification cs.CR
keywords federatedlearninggradientleakageattackdataaugmentationAugMixJensen-Shannondivergenceprivacy-utilitytrade-offInvGradlossscaling
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes Fed-AugMix, a client-side data augmentation framework for federated learning that aims to prevent gradient leakage attacks while keeping or improving model accuracy. The method replaces plain training data with AugMix-transformed images and adds a Jensen-Shannon divergence consistency loss so the model's predictions agree across the original and two stochastic augmented versions. The authors argue that the resulting gradient carries complex, augmentation-dependent noise that is difficult for inversion attacks to reverse. In their experiments, gradient-inversion reconstructions become unrecognizable on MNIST, CIFAR-10, and CIFAR-100, while test accuracy is maintained or improved, with reported gains up to 5.86 percentage points on CIFAR-10.

What carries the argument

The load-bearing object is the augmented client loss $L = L_c(p_{\text{orig}}, y) + \lambda D_{JS}(p_{\text{orig}}; p_{\text{augmix1}}; p_{\text{augmix2}})$, where each $p$ is the model's class-prediction distribution for the original or an AugMix-transformed image. AugMix itself samples $n$ stochastic operation chains from the AutoAugment set, mixes their outputs with Dirichlet weights, and blends the result with the original image via a Beta-weighted skip connection. The Jensen-Shannon divergence, defined as the average KL divergence of each prediction distribution to their mean, is bounded by the log of the number of classes and enforces prediction consistency across augmentations. A phased loss-scaling rule raises $\lambda$ when the classification loss is large, so early-training gradients carry enough JS noise to resist inversion.

What would settle it

Run the InvGrad attack on Fed-AugMix gradients while letting the attacker optimize over augmentation seeds or use a differentiable approximation of AugMix, and compare reconstruction SSIM with and without the JS term. If a knowledgeable attacker recovers recognizable images (SSIM comparable to the no-defense baseline), the central privacy claim collapses.

Watch

Extended reading notes

Core claim

The central claim is that embedding augmentation-induced distortion into the model update, rather than only augmenting the data, is what makes the defense work. Fed-AugMix has each client build two AugMix images from one original, compute predictions for all three, and train with a loss that is the classification loss plus a weighted Jensen-Shannon divergence among the three prediction distributions. Because AugMix layers random operation chains and random convex mixing, the JS term behaves like complex noise that back-propagates into every gradient. The paper reports that under the vanilla InvGrad attack with true labels, this noise pushes reconstruction similarity below 5% SSIM on the tested datasets, and the included accuracy tables show accuracy gains for FedAvg and FedProx backbones.

Load-bearing premise

The privacy claim rests on the assumption that the complicated noise baked into the shared model updates is hard for a gradient-inversion attacker to reverse or cancel, even one who knows exactly how the noise was generated.

Editorial extensions

If this is right

  • Under the paper's settings, gradient-inversion attacks on Fed-AugMix updates produce reconstructions with SSIM below 5%, i.e., visually unrecognizable, across MNIST, CIFAR-10, and CIFAR-100.
  • Augmentation severity acts as a privacy-utility dial: raising $s$ increases reconstruction error and lowers accuracy, while low severities can raise accuracy relative to no protection.
  • Fed-AugMix can be layered on top of standard federated optimizers; the reported FedAvg and FedProx runs all show accuracy improvements when Fed-AugMix is added.
  • The loss-scaling phase closes the early-training window where the classification loss dominates and the JS noise would otherwise be too weak to protect gradients.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The privacy evaluation uses a vanilla InvGrad attacker that does not know the augmentation chain; an adaptive attacker that fits the AugMix distribution or cancels the JS term could plausibly erode the reported margin, so the defense's strength against knowledgeable adversaries is an open question.
  • Treating the JS gradient noise as a learned, data-dependent randomizer suggests a testable connection to differential privacy: one could measure how severity $s$ maps to an empirical privacy budget and compare Fed-AugMix's Pareto frontier with DP-SGD at equal utility loss.
  • The consistency loss is a form of stochastic smoothing of the loss landscape; a natural extension is to check whether the same mechanism yields certified robustness or better calibration on corrupted inputs, not just inversion resistance.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 8 minor

Summary. The paper proposes Fed-AugMix, a client-side data augmentation framework for federated learning that combines AugMix with Jensen-Shannon (JS) divergence consistency loss, with the goal of protecting against gradient leakage attacks (e.g., InvGrad) while preserving or even improving model accuracy. The method augments each input twice, computes the JS divergence among the predictions for the original and two augmented views, adds this divergence to the classification loss, and introduces a Loss Scaling mechanism that enlarges the JS coefficient in early training when the classification loss is relatively large. Experiments on MNIST, CIFAR-10, and CIFAR-100 with FedAvg and FedProx report that reconstruction error (MSE) increases with augmentation severity and that test accuracy is maintained or improved, with one claimed gain of 5.86 percentage points on CIFAR-10.

Significance. If the central privacy claim were established, Fed-AugMix would be a practically attractive defense: it is simple, compatible with existing FL algorithms, and avoids the utility degradation typically associated with noise-based defenses. The utility results, however, are reported without statistical rigor, and the privacy evaluation is limited to a single vanilla attack with no adaptive adversary. The paper is transparent about its limitations, conceding that the gradient noise is minimal at convergence and that only limited distortions are introduced. Overall, the idea is plausible but the evidence as presented does not yet substantiate the headline privacy guarantee; the contribution would be strengthened considerably by an adaptive-attack evaluation and a clearer statement of the threat model.

major comments (4)
  1. [Sec. IV-D, Q2] The central privacy claim—that JS-divergence noise is 'difficult to approximate during GLA'—is not supported by the experiments. All attack results use the vanilla InvGrad attack (Sec. V-A) with true labels and no knowledge of the augmentation procedure. No adaptive attacker is considered that knows the AugMix algorithm, estimates the JS term, or optimizes jointly over dummy inputs and augmentation latents. Because the paper's own Limitations section (Sec. VI) states that the augmentation introduces only relatively minimal noise to the gradients, the privacy guarantee rests entirely on this unvalidated assertion. Please provide an adaptive-attack evaluation or a formal argument (e.g., a lower bound on reconstruction error that holds against any attacker with access to the algorithm).
  2. [Sec. IV-E and Table II] Loss Scaling is deliberately active only when the classification loss is large relative to the scaled JS divergence; at convergence, the defense reduces to plain AugMix with minimal added noise. The CONVERGENT rows of Table II show only modest MSE increases over no protection (e.g., MNIST 2.092 to 2.414; CIFAR-10 3.629 to 4.323) and SSIM values close to the unprotected baseline. Since a deployed FL server would typically receive updates from converged models, the practical privacy benefit at the deployed stage is unclear. Please discuss this operational regime explicitly and, ideally, evaluate privacy on converged models with an attacker that is aware of the defense.
  3. [Sec. V-A and Appendix] The architecture used for the CIFAR privacy experiments is ambiguous. The main text (Sec. V-A) states that ResNet-50 is used for CIFAR-10 and CIFAR-100, but the Appendix states: 'We evaluated InvGrad attacks on CIFAR-10 and CIFAR-100 datasets using ConvNet, an 8-layer CNN.' Since gradient inversion success is strongly architecture-dependent, please clarify which architecture produced the privacy numbers in Table II and Figures 3–6, and report privacy results for the same architecture that is used for the accuracy results in Table III, or justify the difference.
  4. [Sec. V-B, Table III] The accuracy improvements, including the claimed 5.86-point gain for FedProx on CIFAR-10, are reported without error bars, number of independent runs, or significance tests. Given that AugMix is known to improve robustness and that the improvements are sometimes small, it is important to report mean±std over multiple seeds and to state all hyperparameters (learning rate, communication rounds, local epochs) for both the vanilla baselines and Fed-AugMix. This would rule out the possibility that the gains arise from a single favorable run or from different hyperparameter settings.
minor comments (8)
  1. [Sec. I] The Introduction contains two nearly identical paragraphs, 'Early attempts aiming to thwart privacy attacks...' and 'Early approaches to mitigating privacy attacks...', which should be merged or removed.
  2. [Sec. IV-D] There is a typo: 'aprrroximate' should be 'approximate'.
  3. [Author affiliation] The affiliation line for Wei Chen contains 'the the School of Software Engineering'; please correct.
  4. [Sec. V-A] The Model Architectures paragraph mentions FMNIST, but FMNIST is not listed among the datasets used in the experiments; please either add FMNIST results or remove the mention.
  5. [Table III reference] The text refers to 'Table 7' when the accuracy table is numbered Table III; please fix the cross-reference.
  6. [Fig. 1 caption] The caption contains 'Client Updata' which should be 'Client Update'.
  7. [Table I] The table entry 'Dateset' should be 'Dataset'.
  8. [References [21] and [40]] References [21] and [40] both cite the mixup paper; please consolidate to avoid duplicate entries.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: the privacy and utility claims are self-contained empirical evaluations against an external attack, with only non-load-bearing self-citations.

full rationale

The paper's derivation chain is self-contained rather than circular. The central loss modification, L = Lc + lambda * DJS, is defined directly from model predictions on original and AugMix-processed images, and the resulting gradient perturbation follows by ordinary back-propagation; it is not defined in terms of the InvGrad reconstruction metric. Privacy is then measured by running an external, fixed attack (InvGrad) with stated hyperparameters, so the reported MSE/SSIM/PSNR values are empirical outcomes rather than quantities forced by the construction. The Loss Scaling mechanism in Sec. IV-E was admittedly motivated by an observed early-training vulnerability and by the measured ratio Lc ~ DJS * 10^5, but the paper states this transparently, and the final defense is still evaluated against the same external attack rather than against a fitted prediction function. The severity sweep in Table II is a direct measurement, not a claim that a held-out quantity was predicted from fitted constants. The only self-citations ([36], [39]) appear in related-work summaries and are not load-bearing for the paper's core claims. The limitations section's concession that data augmentation introduces only minimal gradient noise, together with the absence of an adaptive-attacker evaluation, is a real support gap for the privacy claim, but it is a correctness and threat-model concern rather than a circularity. No equation is shown to reduce to its own input, and no fitted parameter is renamed as an independent prediction.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

The central claim rests on standard FL optimization plus AugMix, with the main cost in two fitted parameter sets (severity s and Loss Scaling constants) and an untested assumption about attacker adaptation. No new entities are introduced.

free parameters (3)
  • Augmentation severity s = s in {2,4,6,8,10}
    Controls distortion magnitude and the privacy-utility trade-off; results are reported per value, not derived.
  • Loss Scaling constants (Scale, LargeVal, initial lambda) = Scale=5e4, LargeVal=5e3, lambda=50
    Chosen after observing Lc approximately equals DJS scaled by 1e5 on untrained models (Sec. IV-E); fitted so the early-training attack fails.
  • AugMix internal hyperparameters (chain count n, chain length l, mixing alpha) = n=3, l in [1,3], alpha not reported
    Inherited from AugMix [25]; alpha is not specified in the paper, which affects reproducibility.
assumptions (3)
  • domain assumption The gradient of the JS-divergence loss behaves as complex noise that gradient inversion cannot approximate.
    Stated as intuition in Sec. IV-D (Q2) without proof or adaptive-attack testing.
  • domain assumption Attacker knowledge is limited to shared weight updates and true labels, using vanilla InvGrad with fixed hyperparameters.
    Defined in Sec. V-A; the defense is only shown against this non-adaptive attack.
  • standard math Standard FedAvg/FedProx convergence and non-IID Dirichlet(0.1) data partitioning.
    Background assumptions from FL literature used without modification.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Fed-AugMix: Balancing Privacy and Utility via Data Augmentation." pith.science (2026). https://pith.science/paper/CRVA24BH

@misc{pith2026241213818,
  author       = {Pith},
  title        = {Pith review of: Fed-AugMix: Balancing Privacy and Utility via Data Augmentation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/CRVA24BH}},
  note         = {Machine review of arXiv:2412.13818}
}
read the original abstract

Gradient leakage attacks pose a significant threat to the privacy guarantees of federated learning. While distortion-based protection mechanisms are commonly employed to mitigate this issue, they often lead to notable performance degradation. Existing methods struggle to preserve model performance while ensuring privacy. To address this challenge, we propose a novel data augmentation-based framework designed to achieve a favorable privacy-utility trade-off, with the potential to enhance model performance in certain cases. Our framework incorporates the AugMix algorithm at the client level, enabling data augmentation with controllable severity. By integrating the Jensen-Shannon divergence into the loss function, we embed the distortion introduced by AugMix into the model gradients, effectively safeguarding privacy against deep leakage attacks. Moreover, the JS divergence promotes model consistency across different augmentations of the same image, enhancing both robustness and performance. Extensive experiments on benchmark datasets demonstrate the effectiveness and stability of our method in protecting privacy. Furthermore, our approach maintains, and in some cases improves, model performance, showcasing its ability to achieve a robust privacy-utility trade-off.

Figures

Figures reproduced from arXiv: 2412.13818 by the authors.

Figure 1
Figure 1. An illustration of training process of Fed-AugMix. Client Updata consists of two parts: (1) In data augmentation part, [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. An example of AugMix. First generate x aug using three stochastic augmentation chains. Then employ ”skip connection” to MixUp the augmented image and the original image. Next, we compute the KL divergence between q and each of the three distributions: porig, paugmix1 and paugmix2. Finally, we take the average of these KL divergences to obtain the JS divergence: DJS(porig; paugmix1; paugmix2) = 1 3  DKL(porig ∥ q) +… view at source ↗
Figure 3
Figure 3. Visualization of InvGrad attack results under varying privacy protection severity levels (s=0, 2, 6, 10). The second [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: Relationship between test accuracy and MSE of [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: An illustration of the relationship between accuracy, SSIM, and PSNR for untrained and converged models across [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: An example demonstrating the effectiveness of Loss [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: These charts illustrate the test accuracy of two federated learning methods, FedAvg and FedProx, during the training [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]
Figure 8
Figure 8. Figure 8: CIFAR10 [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]
Figure 9
Figure 9. Figure 9: CIFAR100 As [PITH_FULL_IMAGE:figures/full_fig_p012_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

50 extracted references · 34 canonical work pages

  1. [1]

    Federated learning of deep networks using model averaging,

    H. B. McMahan, E. Moore, D. Ramage, and B. A. y Arcas, “Federated learning of deep networks using model averaging,” CoRR, vol. abs/1602.05629, 2016

    arXiv 2016

  2. [2]

    Communication-efficient learning of deep networks from decentralized data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Artificial Intelligence and Statistics. PMLR, 2017, pp. 1273–1282

    2017

  3. [3]

    Federated optimization: Distributed machine learning for on-device intelligence,

    J. Koneˇcn`y, H. B. McMahan, D. Ramage, and P. Richt´arik, “Federated optimization: Distributed machine learning for on-device intelligence,” arXiv preprint arXiv:1610.02527 , 2016

    arXiv 2016

  4. [4]

    Federated learning: Strategies for improving communication efficiency,

    J. Koneˇcn`y, H. B. McMahan, F. X. Yu, P. Richt ´arik, A. T. Suresh, and D. Bacon, “Federated learning: Strategies for improving communication efficiency,” arXiv preprint arXiv:1610.05492, 2016

    arXiv 2016

  5. [5]

    Deep leakage from gradients,

    L. Zhu, Z. Liu, and S. Han, “Deep leakage from gradients,” 2019. [Online]. Available: https://arxiv.org/ abs/1906.08935

    arXiv 2019

  6. [6]

    Inverting gradients – how easy is it to break privacy in federated learning?

    J. Geiping, H. Bauermeister, H. Dr ¨oge, and M. Moeller, “Inverting gradients – how easy is it to break privacy in federated learning?” 2020. [Online]. Available: https://arxiv.org/abs/2003.14053

    arXiv 2020

  7. [7]

    idlg: Improved deep leakage from gradients,

    B. Zhao, K. R. Mopuri, and H. Bilen, “idlg: Improved deep leakage from gradients,” ArXiv, vol. abs/2001.02610,

    arXiv 2001

  8. [8]

    See through Gradients: Image Batch Recovery via GradInversion

    H. Yin, A. Mallya, A. Vahdat, J. M. Alvarez, J. Kautz, and P. Molchanov, “See through gradients: Image batch recovery via gradinversion,” 2021. [Online]. Available: https://arxiv.org/abs/2104.07586

    work page Pith review arXiv 2021

Show all 50 references
  1. [9]

    Private federated learn- ing on vertically partitioned data via entity resolution and additively homomorphic encryption,

    S. Hardy, W. Henecka, H. Ivey-Law, R. Nock, G. Patrini, G. Smith, and B. Thorne, “Private federated learn- ing on vertically partitioned data via entity resolution and additively homomorphic encryption,” arXiv preprint arXiv:1711.10677, 2017. 10

    2017 arXiv

  2. [10]

    How to share a secret,

    A. Shamir, “How to share a secret,” Commun. ACM , vol. 22, no. 11, p. 612–613, nov 1979. [Online]. Available: https://doi.org/10.1145/359168.359176

    1979

  3. [11]

    Safeguarding cryptographic keys,

    G. Blakley, “Safeguarding cryptographic keys,” in Pro- ceedings of the 1979 AFIPS National Computer Con- ference. Monval, NJ, USA: AFIPS Press, 1979, pp. 313–317

    1979

  4. [12]

    Practical secure aggregation for privacy-preserving ma- chine learning,

    K. Bonawitz, V . Ivanov, B. Kreuter, A. Marcedone, H. B. McMahan, S. Patel, D. Ramage, A. Segal, and K. Seth, “Practical secure aggregation for privacy-preserving ma- chine learning,” in proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security , 20...

    2017

  5. [13]

    Deep learning with differential privacy,

    M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” in Proceedings of the 2016 ACM SIGSAC conference on computer and communications security. New York, NY , USA: ACM, 2016, pp. 308– 318

    2016

  6. [14]

    Deep gradient compression: Reducing the communication band- width for distributed training,

    Y . Lin, S. Han, H. Mao, Y . Wang, and B. Dally, “Deep gradient compression: Reducing the communication band- width for distributed training,” in International Conference on Learning Representations , 2018

    2018

  7. [15]

    Gradient disaggregation: Breaking privacy in federated learning by reconstructing the user participant matrix,

    M. Lam, G.-Y . Wei, D. Brooks, V . J. Reddi, and M. Mitzenmacher, “Gradient disaggregation: Breaking privacy in federated learning by reconstructing the user participant matrix,” in Proceedings of the 38th Interna- tional Conference on Machine Learning , ser. Proceedings of Ma...

    2021

  8. [16]

    Gradient- leakage resilient federated learning,

    W. Wei, L. Liu, Y . Wut, G. Su, and A. Iyengar, “Gradient- leakage resilient federated learning,” in 2021 IEEE 41st International Conference on Distributed Computing Systems (ICDCS). IEEE, 2021, pp. 797–807

    2021

  9. [17]

    Differentially private federated learning on heterogeneous data,

    M. Noble, A. Bellet, and A. Dieuleveut, “Differentially private federated learning on heterogeneous data,” in Proceedings of The 25th International Conference on Artificial Intelligence and Statistics , ser. Proceedings of Machine Learning Research, G. Camps-Valls, F. J. R. Ru...

    2022

  10. [18]

    A fine-grained differentially private federated learning against leakage from gradients,

    L. Zhu, X. Liu, Y . Li, X. Yang, S.-T. Xia, and R. Lu, “A fine-grained differentially private federated learning against leakage from gradients,” IEEE Internet of Things Journal, vol. 9, no. 13, pp. 11 500–11 512, 2021

    2021

  11. [19]

    Performance-enhanced federated learning with differential privacy for internet of things,

    X. Shen, Y . Liu, and Z. Zhang, “Performance-enhanced federated learning with differential privacy for internet of things,” IEEE Internet of Things Journal , vol. 9, no. 23, pp. 24 079–24 094, 2022

    2022

  12. [20]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” 2015. [Online]. Available: https://arxiv.org/abs/1512.03385

    2015 arXiv

  13. [21]

    mixup: Beyond empirical risk minimization,

    H. Zhang, M. Ciss ´e, Y . Dauphin, and D. Lopez-Paz, “mixup: Beyond empirical risk minimization,” ICLR, 2017

    2017

  14. [22]

    Between-class learning for image classification,

    Y . Tokozume, Y . Ushiku, and T. Harada, “Between-class learning for image classification,” CVPR, 2018

    2018

  15. [23]

    Mixup as locally linear out-of-manifold regularization,

    H. Guo, Y . Mao, and R. Zhang, “Mixup as locally linear out-of-manifold regularization,” in AAAI, 2019

    2019

  16. [24]

    Autoaugment: Learning augmentation policies from data,

    E. D. Cubuk, B. Zoph, D. Mane, V . Vasudevan, and Q. V . Le, “Autoaugment: Learning augmentation policies from data,” 2018

    2018

  17. [25]

    Augmix: A simple data processing method to improve robustness and uncertainty,

    D. Hendrycks, N. Mu, E. D. Cubuk, B. Zoph, J. Gilmer, and B. Lakshminarayanan, “Augmix: A simple data processing method to improve robustness and uncertainty,” 2020. [Online]. Available: https: //arxiv.org/abs/1912.02781

    2020 arXiv

  18. [26]

    Mitigating data heterogeneity in federated learning with data augmentation,

    A. B. de Luca, G. Zhang, X. Chen, and Y . Yu, “Mitigating data heterogeneity in federated learning with data augmentation,” 2022. [Online]. Available: https://arxiv.org/abs/2206.09979

    2022 arXiv

  19. [27]

    Data- augmentation-based federated learning,

    H. Zhang, Q. Hou, T. Wu, S. Cheng, and J. Liu, “Data- augmentation-based federated learning,” IEEE Internet of Things Journal, vol. 10, no. 24, pp. 22 530–22 541, 2023

    2023

  20. [28]

    Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning,

    M. Nasr, R. Shokri, and A. Houmansadr, “Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning,” in 2019 IEEE Symposium on Security and Privacy (SP). IEEE, May 2019, p. 739–753. [Online]. Avail...

    2019

  21. [29]

    Exploiting unintended feature leakage in collaborative learning,

    L. Melis, C. Song, E. De Cristofaro, and V . Shmatikov, “Exploiting unintended feature leakage in collaborative learning,” in 2019 IEEE Symposium on Security and Privacy (SP), 2019, pp. 691–706

    2019

  22. [30]

    Model inversion attacks that exploit confidence information and basic countermeasures,

    M. Fredrikson, S. Jha, and T. Ristenpart, “Model inversion attacks that exploit confidence information and basic countermeasures,” Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security ,

  23. [31]

    Information theory and privacy in data banks,

    I. S. Reed, “Information theory and privacy in data banks,” in Proceedings of the June 4-8, 1973, national computer conference and exposition , 1973, pp. 581–587

    1973

  24. [32]

    A source coding problem for sources with additional outputs to keep secret from the receiver or wiretappers (corresp.),

    H. Yamamoto, “A source coding problem for sources with additional outputs to keep secret from the receiver or wiretappers (corresp.),” IEEE Transactions on Information Theory, vol. 29, no. 6, pp. 918–923, 1983

    1983

  25. [33]

    Utility- privacy tradeoffs in databases: An information-theoretic approach,

    L. Sankar, S. R. Rajagopalan, and H. V . Poor, “Utility- privacy tradeoffs in databases: An information-theoretic approach,” IEEE Transactions on Information Forensics and Security, vol. 8, no. 6, pp. 838–852, 2013

    2013

  26. [34]

    On the relation between identifiability, differential privacy, and mutual- information privacy,

    W. Wang, L. Ying, and J. Zhang, “On the relation between identifiability, differential privacy, and mutual- information privacy,” IEEE Transactions on Information Theory, vol. 62, no. 9, pp. 5018–5029, 2016

    2016

  27. [35]

    An estimation-theoretic view of privacy,

    H. Wang and F. P. Calmon, “An estimation-theoretic view of privacy,” in 2017 55th Annual Allerton Conference on Communication, Control, and Computing (Allerton) . IEEE, 2017, pp. 886–893

    2017

  28. [36]

    Trading off privacy, utility and efficiency in federated learning,

    X. Zhang, Y . Kang, K. Chen, L. Fan, and Q. Yang, “Trading off privacy, utility and efficiency in federated learning,” arXiv preprint arXiv:2209.00230 , 2022

    2022 arXiv

  29. [37]

    Learning privacy preserving encodings through adversarial training,

    F. Pittaluga, S. Koppal, and A. Chakrabarti, “Learning privacy preserving encodings through adversarial training,” in 2019 IEEE Winter Conference on Applications of Computer Vision (WACV), 2019, pp. 791–799

    2019

  30. [38]

    Fl- 11 apb: Balancing privacy protection and performance optimization for adversarial training in federated learning,

    T. Liu, H. Wu, X. Sun, C. Niu, and H. Yin, “Fl- 11 apb: Balancing privacy protection and performance optimization for adversarial training in federated learning,” Electronics, 2024. [Online]. Available: https: //api.semanticscholar.org/CorpusID:273635882

    2024

  31. [39]

    Theoretically principled federated learning for balancing privacy and utility,

    X. Zhang, W. Li, K. Chen, S. Xia, and Q. Yang, “Theoretically principled federated learning for balancing privacy and utility,” 2023. [Online]. Available: https: //arxiv.org/abs/2305.15148

    2023 arXiv

  32. [40]

    mixup: Beyond empirical risk minimization,

    H. Zhang, M. Ciss ´e, Y . N. Dauphin, and D. Lopez-Paz, “mixup: Beyond empirical risk minimization,” CoRR, vol. abs/1710.09412, 2017

    2017 arXiv

  33. [41]

    Data augmentation: A comprehensive survey of modern approaches,

    A. Mumuni and F. Mumuni, “Data augmentation: A comprehensive survey of modern approaches,” Array, vol. 16, p. 100258, 2022. [Online]. Available: https://www.sciencedirect.com/science/article/ pii/S2590005622000911

    2022

  34. [42]

    Learning with pseudo-ensembles,

    P. Bachman, O. Alsharif, and D. Precup, “Learning with pseudo-ensembles,” in Advances in Neural Information Processing Systems 27 , Z. Ghahramani, M. Welling, C. Cortes, N. D. Lawrence, and K. Q. Weinberger, Eds. Curran Associates, Inc., 2014, pp. 3365–

    2014

  35. [43]

    Improv- ing the robustness of deep neural networks via stability training,

    S. Zheng, Y . Song, T. Leung, and I. Goodfellow, “Improv- ing the robustness of deep neural networks via stability training,” CVPR, 2016

    2016

  36. [44]

    Adversarial logit pairing,

    H. Kannan, A. Kurakin, and I. Goodfellow, “Adversarial logit pairing,” NeurIPS, 2018

    2018

  37. [45]

    Mnist hand- written digit database,

    Y . LeCun, C. Cortes, and C. Burges, “Mnist hand- written digit database,” ATT Labs [Online]. Available: http://yann.lecun.com/exdb/mnist, vol. 2, 2010

    2010

  38. [46]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky, “Learning multiple layers of features from tiny images,” Tech. Rep., 2009

    2009

  39. [47]

    Gradient- based learning applied to document recognition,

    Y . Lecun, L. Bottou, Y . Bengio, and P. Haffner, “Gradient- based learning applied to document recognition,” Proceed- ings of the IEEE , vol. 86, no. 11, pp. 2278–2324, 1998. 12 APPENDIX We evaluated InvGrad attacks on CIFAR-10 and CIFAR-100 datasets using ConvNet, an 8-layer...

    1998

  40. [2015]

    Available: https://api.semanticscholar.org/ CorpusID:207229839

    [Online]. Available: https://api.semanticscholar.org/ CorpusID:207229839

  41. [2020]

    Available: https://api.semanticscholar.org/ CorpusID:210064455

    [Online]. Available: https://api.semanticscholar.org/ CorpusID:210064455

  42. [3373]

    Available: http://papers.nips.cc/paper/ 5487-learning-with-pseudo-ensembles.pdf

    [Online]. Available: http://papers.nips.cc/paper/ 5487-learning-with-pseudo-ensembles.pdf

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.