Pith. sign in

REVIEW 5 major objections 5 minor 1 cited by

Hidden Data Privacy Breaches in Federated Learning

T0 review · 5 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A federated-learning server can steal nearly all of a client's private images by training a hidden memory model inside the shared weights.

desk verdict A genuinely new attack variant with a serious evidence gap: the stealth claim rests on main-task accuracy that is never reported. read the letter →

arxiv 2411.18269 v1 pith:FM4TTWT3 submitted 2024-11-27 cs.CL cs.CR

Xueluan Gong , Yuji Wang , Shuaike Li , Mengyuan Sun , Songze Li , Qian Wang , Kwok-Yan Lam , Chen Chen This is my paper · ORCID
classification cs.CLcs.CR
keywords federatedlearningdatareconstructionattackmaliciouscodeinjectionparametersharingFibonaccicodingprivacybreachsecureaggregationgradientinversiondefense
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that a malicious federated-learning server can steal a client's private training images at scale without changing the model's architecture or making handcrafted parameter modifications. The attack works by injecting a few lines of code into the client's training loop, which trains a hidden memory network whose parameters are a subset of the shared model's parameters, so the model looks normal to an outside observer. With a Fibonacci-based index encoding and a block-partitioning scheme, the hidden network memorizes images and the server later reconstructs them from the received updates. In experiments on CIFAR-10, CIFAR-100, MINI-ImageNet, and CelebA, the paper reports nearly perfect extraction (512/512 on CIFAR-10 and CIFAR-100, 64/64 on the high-resolution sets) and says the attack evades five defenses: D-SNR detection, noise perturbation, gradient pruning, gradient clipping, and loss monitoring. If true, this undermines the default privacy promise of federated learning and shifts the burden onto code integrity and client-side verification.

What carries the argument

The load-bearing object is the shared-parameter secret model $M' = \{p_i \mid i \equiv r \pmod{k}\}$ with $r=1$, $k=2$: every other parameter of the local model is reinterpreted, layer by layer, as a fully connected memory network. The supporting mechanism is a Fibonacci-coding indexer (based on Zeckendorf representation, sequence starting $[1,2,3,5,8,\ldots]$) that produces sparse, well-separated, label-independent input codes, so the hidden network can memorize and later retrieve many images without confusion. Block partitioning extends the scheme to high-resolution images by splitting each image into blocks, indexing blocks with appended Fibonacci codes, and using a total-variation loss $L_{\mathrm{var}}$ to keep block boundaries smooth. Together these pieces let the server train the memory task in parallel with the classification task, then read out the memorized data after aggregation.

What would settle it

Run the paper's CIFAR-10 protocol exactly as described, measuring the victim model's held-out test accuracy across all rounds; if the accuracy trajectory is statistically distinguishable from clean training, the attack's stealth claim fails even though image recovery may still work.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central claim is that data reconstruction in federated learning can be turned into a covert memorization problem rather than a gradient-inversion problem. The server injects malicious code that trains a secret model $M'$ sharing parameters with the victim's local model; the secret model maps a sparse index code $I$ to a training image $x_i$, minimizing $L_{\mathrm{dist}}(M'(I), x_i) = L_1 + L_2 + L_{\mathrm{var}}$. Parameters are chosen by systematic sampling with offset $r=1$ and interval $k=2$, so the server reconstructs $M'$ from every other parameter of the received model. A Fibonacci-code indexer assigns each sample a sparse, label-independent binary code, and a block-partitioning scheme splits high-resolution images into smaller blocks to fit the hidden network's capacity. The paper reports that this recovers 512 of 512 images on CIFAR-10 and CIFAR-100 and up to 64 of 64 on MINI-ImageNet and CelebA, under both FedAvg and FedSGD, while not being flagged by D-SNR, noise perturbation, gradient pruning, gradient clipping, or a loss-change monitor.

Load-bearing premise

For the attack to be truly undetectable, the malicious code must run inside the client's training loop and the side job of memorizing images must not noticeably hurt the model's normal performance, which the paper never directly measures.

Editorial extensions

If this is right

  • A malicious server can exfiltrate the full local dataset of a victim client (512/512 on CIFAR-10 and CIFAR-100) in a single FedAvg round, without adding unusual layers or corrupting weights in a detectable way.
  • Five state-of-the-art defenses—D-SNR, noise perturbation, gradient pruning, gradient clipping, and loss monitoring—do not stop the attack, because the hidden-memory gradients are low-magnitude and spread across rounds.
  • The attack transfers to FedSGD and to high-resolution 224x224 datasets (ImageNet, CelebA) via block partitioning, where gradient-inversion baselines fail.
  • Secure aggregation alone is not a reliable defense: the paper argues that communication-acceleration inconsistencies between clients can be exploited to expose a target user's update, so systems using such strategies remain vulnerable.
  • Developers need new defenses, such as verifying training-code integrity and checking for hidden reuse of parameters, rather than relying on gradient statistics.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial extension: The paper never reports the victim model's main-task accuracy after the memory task runs, so the attack's stealth claim hinges on an unmeasured premise: the hidden training must not visibly degrade classification performance.
  • Editorial extension: A defender could look for the hidden parameter-subset network by testing whether every other parameter (fixed offset $r=1$, interval $k=2$) carries an unusual correlation with reconstruction quality; if such a signature exists, detection could be cheap.
  • Editorial extension: The same parameter-sharing and index-memorization scheme could be adapted to language data, as the paper sketches, meaning the privacy risk may extend beyond image datasets to token sequences or prompts.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes a new active data-reconstruction attack against federated learning. The malicious server injects a few lines of training code into the client's local training loop; this code alternately optimizes the classification task and a hidden 'memory task' on a secret model M' that shares parameters with the victim model through systematic sampling (every k-th parameter, r=1, k=2). A Fibonacci-based encoding assigns sparse, label-agnostic indices to training samples, and a block-partitioning scheme with a variation loss is used for high-resolution images. The authors report that the attack extracts 512/512 images on CIFAR-10 and CIFAR-100, 61–64/64 on MINI-ImageNet and CelebA, under both FedAvg and FedSGD, while evading D-SNR, noise perturbation, gradient pruning, and gradient clipping, and that it can operate under secure aggregation when combined with communication acceleration. The evaluation compares against Transpose, RtF, LOKI, SEER, and Inverting across four datasets.

Significance. If the claims are substantiated, the paper would make a meaningful contribution to the active-attack literature: it demonstrates a way to scale data theft to 512 images per round and to high-resolution inputs, and it does so without inserting a conspicuous malicious module into the model architecture, which is the main novelty relative to RtF and LOKI. The parameter-sharing secret model and the Fibonacci index are conceptually interesting and the defense-evasion results, if properly measured, would be valuable for the community. The paper also deserves credit for evaluating both FedAvg and FedSGD and for explicitly attempting to address secure aggregation. However, the current manuscript does not provide enough evidence for the central 'undetected' claim (no main-task accuracy is reported), the secret model architecture is underspecified, the Transpose baseline is conceded to be under-trained, and the defense evaluation omits the actual detection metrics. These issues leave the headline claims conditional rather than established.

major comments (5)
  1. [Sec. 3.3, Fig. 1; Abstract] The stealth claim is unverified because no main-task accuracy is reported anywhere. The attack alternately trains the classification task and the memory task on the same parameters (Eq. 2, Fig. 1), so the memory task can degrade the victim model's utility. Without showing that classification accuracy after the attack stays within the normal range of training fluctuation, a client can detect the attack by simply validating the model, breaking the 'without being detected' claim in the Abstract and Section 7. Please report the victim model's training/test accuracy before, during, and after the attack rounds, for all datasets and for the largest N used.
  2. [Sec. 3.3, Eq. (3); Sec. 3.4, Eq. (7)] The secret model M' is never fully specified. Eq. (3) defines which parameters are selected (every second parameter), but the paper does not state the number of layers, the input and output dimensions, the activation function, or how the sampled parameters are arranged into a fully-connected network. Without this information the reported 512/512 leakage cannot be reproduced or audited. In addition, the Fibonacci sequence in Eq. (7) sums to 142, which bounds the index space at 142 distinct codes, yet experiments use N up to 512 (Tables 2 and 10). The extension of the encoding beyond 142 is not explained.
  3. [Sec. 4.2, Fig. 3] The comparison with the Transpose baseline is compromised. The text states: 'For Transpose, due to the limited number of training epochs, the transpose fails to converge, resulting in poor performance.' This admits that the baseline was not given enough training to converge, so the very low leakage and quality values for Transpose in Tables 2 and 10 do not reflect the method's capability. Please either run Transpose to convergence (and report the number of epochs needed) or remove the comparison and soften the claim of superiority over all five baselines.
  4. [Sec. 5.1, Table 6; Sec. 5.5] The defense-evasion evaluation does not report the actual detection outputs. For D-SNR (Sec. 5.1), Table 6 lists leakage and image-quality metrics under a column labeled 'D-SNR Detection', but it does not give the D-SNR values of the submitted gradients, the detection threshold used, or the number of rounds in which D-SNR would have flagged the update. Similarly, Section 5.5 shows a qualitative loss plot (Fig. 4) without a quantitative anomaly-detection threshold. Showing that the attack still leaks after a defense is applied is not the same as showing that the defense is evaded; please report the defense's detection metric and threshold.
  5. [Sec. 3.3, Eq. (1)-(2); Sec. 4.2] The headline leakage result is partly built into the training objective. Eq. (1) directly minimizes the distance between M'(I) and the private sample xi, so a leakage of 512/512 with near-perfect SSIM is an expected outcome of solving this optimization, not an empirical discovery. The paper should explicitly separate this by-construction component from the non-trivial contributions (parameter-sharing stealth, defense evasion, high-resolution block partitioning) and should not present the raw leakage counts as evidence of superiority over methods that solve a harder inverse problem. The comparison against LOKI and RtF is more meaningful, and the paper should frame its contribution accordingly.
minor comments (5)
  1. [Abstract; Sec. 1] There are repeated typos in 'FedA VG' and 'FedSGD' (e.g., in the Abstract and Section 1).
  2. [Eq. (11)] The indexing notation in the variation loss, e.g., Ii,j,s-1:-1:s,: and Ii,j,:,s-1:-1:s, is not defined and is hard to parse; please clarify the slice notation.
  3. [Fig. 1] The pseudocode mentions mem_net.fill_model(model) and mem_net.fill_back_paramter(), but the latter function is never described; it is unclear how parameters are copied back after the memory step.
  4. [Table 2, CIFAR-100 row for LOKI at N=512] The PSNR value 5.810 ± 0.888 for LOKI at N=512 looks anomalous and inconsistent with the other LOKI rows; please verify the reported number and its units.
  5. [References] Reference [14] is cited as 'MINI-ImageNet' but the entry points to fast.ai's Imagenette; this is likely the wrong source. Please provide the correct reference for MINI-ImageNet.

Circularity Check

1 steps flagged · score 4.0 of 10

Central leakage metric is the memorization training objective; defense evasion results have independent support.

  1. fitted input called prediction [Sec. 3.3, Eqs. (1)-(2); Sec. 4.2; Appendix B, Eq. (14)]
    "Given the predefined structure, the secret model M ′ is optimized as: min Ldist(M ′(I), xi) (1) ... During training, the distance between the stolen data M ′(I) and xi is minimized. ... Ldist(M ′(I), xi) = L1(M ′(I), xi) + L2(M ′(I), xi) (2) ... Leakage: The leakage quantifies the number of images that can be extracted from the total dataset in the given attack rounds."

    The headline extraction result, e.g., 512/512 leaked images in Table 2, counts how many secret-model outputs M'(I) match the victim images x_i. But Eqs. (1)-(2) define the secret model's training objective as minimizing exactly this mismatch. The 'stolen' images are the same images used as supervised targets while fitting M', so the leakage number is a report of how well the memorization network fit its training set, not an independent reconstruction or prediction. The claim that the attack extracts 512 images therefore reduces by construction to the fitting procedure.

full rationale

This is an attack-evaluation paper, not a formal derivation, so most claimed capabilities rest on experimental measurement rather than a derivation chain. The one genuine circular element is the attack's central success metric: the secret model is trained to output the private image from its index, and 'leakage' simply counts how often it reproduces that trained image. Table 2's near-perfect leakage at small N is therefore the training objective itself, not an independent extraction result. However, the paper also evaluates robustness against five externally specified defenses, and those comparisons do not reduce to the training loss. There is no load-bearing self-citation chain: the only relevant self-citation ([10], APF) appears in a discussion of secure-aggregation bypass and is not used to ground the main results. The missing main-task accuracy is a correctness/completeness concern, not circularity. Overall score 4 reflects the partial circularity of the headline metric while acknowledging the independent defense-evaluation content.

Assumptions & free parameters 3 free parameters · 4 assumptions · 1 invented entities

The central claim rests on one strong assumption (server can inject code) and one unverified technical assumption (parameter subset acts as a trainable FCNN without degrading the main model). The block size and sampling parameters are hand-chosen, and the variation loss weight is unspecified.

free parameters (3)
  • Block size s = 16 or 28 (chosen after sweep in Table 8)
    Controls the trade-off between reconstruction quality and time; authors state block sizes 16 or 28 strike a good balance.
  • Systematic sampling interval k and offset r = k=2, r=1
    Selected by design in Sec 3.3 to construct the secret model; no ablation is shown for varying k.
  • Variation loss weight lambda = Not specified
    Appears in Eq. 11 for block smoothness; the value is not reported, so the exact loss is not reproducible.
assumptions (4)
  • domain assumption Malicious server can distribute training code to clients
    Threat model in Sec 3.1; this power is what makes the attack possible.
  • domain assumption Clients run server-provided code without integrity verification
    Sec 2.1 argues package managers and ML libraries are vulnerable; the attack relies on this.
  • standard math Zeckendorf representation: every natural number is a unique sum of non-consecutive Fibonacci numbers
    Used in Sec 3.4 for the Fibonacci encoding (Eq. 8-9).
  • domain assumption A subset of ResNet parameters can be trained as a functioning fully-connected network via parameter sharing
    Sec 3.3 assumes every-other-parameter selection yields a usable FCNN; no architectural details or utility checks are provided.
invented entities (1)
  • Secret model M'
    purpose: A fully-connected network whose weights are a subset of the client model's parameters, trained to map index codes to private training images
    The secret model is a software construct introduced by the paper; its existence is only demonstrated by the paper's own experiments, not by any external or falsifiable handle.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Hidden Data Privacy Breaches in Federated Learning." pith.science (2026). https://pith.science/paper/FM4TTWT3

@misc{pith2026241118269,
  author       = {Pith},
  title        = {Pith review of: Hidden Data Privacy Breaches in Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FM4TTWT3}},
  note         = {Machine review of arXiv:2411.18269}
}
read the original abstract

Federated Learning (FL) emerged as a paradigm for conducting machine learning across broad and decentralized datasets, promising enhanced privacy by obviating the need for direct data sharing. However, recent studies show that attackers can steal private data through model manipulation or gradient analysis. Existing attacks are constrained by low theft quantity or low-resolution data, and they are often detected through anomaly monitoring in gradients or weights. In this paper, we propose a novel data-reconstruction attack leveraging malicious code injection, supported by two key techniques, i.e., distinctive and sparse encoding design and block partitioning. Unlike conventional methods that require detectable changes to the model, our method stealthily embeds a hidden model using parameter sharing to systematically extract sensitive data. The Fibonacci-based index design ensures efficient, structured retrieval of memorized data, while the block partitioning method enhances our method's capability to handle high-resolution images by dividing them into smaller, manageable units. Extensive experiments on 4 datasets confirmed that our method is superior to the five state-of-the-art data-reconstruction attacks under the five respective detection methods. Our method can handle large-scale and high-resolution data without being detected or mitigated by state-of-the-art data reconstruction defense methods. In contrast to baselines, our method can be directly applied to both FedAVG and FedSGD scenarios, underscoring the need for developers to devise new defenses against such vulnerabilities. We will open-source our code upon acceptance.

Figures

Figures reproduced from arXiv: 2411.18269 by the authors.

Figure 1
Figure 1. Examples of injected malicious code in our method. The green boxes highlight the sections where the malicious code needs to be injected. batches [6], [7], [17], [40], [49], [56], [57], [58]. Moreover, it is shown that only a few attacks [15], [58] can also be applied to the FedAvg training scenario. In this paper, we introduce a novel data reconstruction attack based on malicious code poisoning in FL. As shown in [… view at source ↗
Figure 2
Figure 2. Overview of our method. our method features an active server attack designed to extract the training samples of victim clients. It is composed of three key modules: secret model training, distinctive and sparse encoding design, and block partitioning. Note that bi represents the Fibonacci coding bits of n. gradients in linear layers. Specifically, they estimate the cumulative distribution function for a basic datase… view at source ↗
Figure 3
Figure 3. Comparison of our method with baselines in terms of the reconstruction sample quality. [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Impact of the loss change. where A(x, x′ ), B(x, x′ ), and C(x, x′ ) quantify the lumi￾nance similarity, contrast similarity, and structure similarity between the original image x and the distorted image x ′ . α, β, and γ are parameters in the range [0, 1]. PSNR. PSNR …

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Mitigating Data Exfiltration Attacks through Layer-Wise Learning Rate Decay Fine-Tuning

    cs.LG 2025-08 conditional novelty 6.0 of 10

    A layer-wise learning rate decay fine-tuning protocol corrupts steganographically embedded training data in exported medical models while preserving classification utility.

Reference graph

Works this paper leans on

60 extracted references · 38 canonical work pages · cited by 1 Pith paper

  1. [1]

    Deep learning with differential privacy

    Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In SIGSAC Conference on Computer and Communications Security, pages 308–318, 2016

    work page 2016

  2. [2]

    Transpose attack: Stealing datasets with bidirectional training

    Guy Amit, Mosh Levy, and Yisroel Mirsky. Transpose attack: Stealing datasets with bidirectional training. arXiv preprint arXiv:2311.07389, 2023

    arXiv 2023

  3. [3]

    Privacy-preserving deep learning via additively homomorphic en- cryption

    Yoshinori Aono, Takuya Hayashi, Lihua Wang, Shiho Moriai, et al. Privacy-preserving deep learning via additively homomorphic en- cryption. IEEE transactions on information forensics and security , 13(5):1333–1345, 2017

    work page 2017

  4. [4]

    Robust transmission of un- bounded strings using fibonacci representations

    Alberto Apostolico and A Fraenkel. Robust transmission of un- bounded strings using fibonacci representations. IEEE Transactions on Information Theory , 33(2):238–245, 1987

    work page 1987

  5. [5]

    Blind backdoors in deep learning models

    Eugene Bagdasaryan and Vitaly Shmatikov. Blind backdoors in deep learning models. In USENIX Security Symposium , pages 1505–1521, 2021

    work page 2021

  6. [6]

    Reconstructing individual data points in federated learning hardened with differential privacy and secure aggregation

    Franziska Boenisch, Adam Dziedzic, Roei Schuster, Ali Shahin Shamsabadi, Ilia Shumailov, and Nicolas Papernot. Reconstructing individual data points in federated learning hardened with differential privacy and secure aggregation. In European Symposium on Security and Privacy, pages 241–257. IEEE, 2023

    work page 2023

  7. [7]

    When the curious abandon honesty: Federated learning is not private

    Franziska Boenisch, Adam Dziedzic, Roei Schuster, Ali Shahin Shamsabadi, Ilia Shumailov, and Nicolas Papernot. When the curious abandon honesty: Federated learning is not private. In IEEE European Symposium on Security and Privacy , pages 175–199, 2023

    work page 2023

  8. [8]

    Practical secure aggregation for privacy-preserving machine learning

    Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth. Practical secure aggregation for privacy-preserving machine learning. In SIGSAC Conference on Computer and Commu- nications Security, pages 1175–1191. ACM, 2017

    work page 2017

Show all 60 references
  1. [9]

    Understanding training-data leakage from gradients in neural networks for image classification

    Cangxiong Chen and Neill DF Campbell. Understanding training-data leakage from gradients in neural networks for image classification. arXiv preprint arXiv:2111.10178 , 2021

    2021 arXiv

  2. [10]

    Communication-efficient federated learning with adaptive parameter freezing

    Chen Chen, Hong Xu, Wei Wang, Baochun Li, Bo Li, Li Chen, and Gong Zhang. Communication-efficient federated learning with adaptive parameter freezing. In IEEE International Conference on Distributed Computing Systems , pages 1–11, 2021

    2021

  3. [11]

    From QoS to QoE: A tutorial on video quality assessment

    Yanjiao Chen, Kaishun Wu, and Qian Zhang. From QoS to QoE: A tutorial on video quality assessment. IEEE Communications Surveys & Tutorials, 17(2):1126–1165, 2014

    2014

  4. [12]

    Fe- dobd: Opportunistic block dropout for efficiently training large- scale neural networks through federated learning

    Yuanyuan Chen, Zichen Chen, Pengcheng Wu, and Han Yu. Fe- dobd: Opportunistic block dropout for efficiently training large- scale neural networks through federated learning. arXiv preprint arXiv:2208.05174, 2022

    2022 arXiv

  5. [13]

    Towards measuring supply chain attacks on package managers for interpreted languages

    Ruian Duan, Omar Alrawi, Ranjita Pai Kasturi, Ryan Elder, Brendan Saltaformaggio, and Wenke Lee. Towards measuring supply chain attacks on package managers for interpreted languages. arXiv preprint arXiv:2002.01139, 2020

    2002 arXiv

  6. [14]

    Imagenette: A smaller subset of 10 easily classified classes from imagenet

    fast.ai. Imagenette: A smaller subset of 10 easily classified classes from imagenet. Available: https://github.com/fastai/imagenette

  7. [15]

    Robbing the fed: Directly obtaining private data in feder- ated learning with modified models

    Liam Fowl, Jonas Geiping, Wojtek Czaja, Micah Goldblum, and Tom Goldstein. Robbing the fed: Directly obtaining private data in feder- ated learning with modified models. arXiv preprint arXiv:2110.13057, 2021

    2021 arXiv

  8. [16]

    Decepticons: Corrupted trans- formers breach privacy in federated learning for language models

    Liam Fowl, Jonas Geiping, Steven Reich, Yuxin Wen, Wojtek Czaja, Micah Goldblum, and Tom Goldstein. Decepticons: Corrupted trans- formers breach privacy in federated learning for language models. arXiv preprint arXiv:2201.12675 , 2022

    2022 arXiv

  9. [17]

    Hiding in plain sight: Disguising data stealing attacks in federated learning

    Kostadin Garov, Dimitar I Dimitrov, Nikola Jovanovi ´c, and Martin Vechev. Hiding in plain sight: Disguising data stealing attacks in federated learning. arXiv preprint arXiv:2306.03013 , 2023

    2023 arXiv

  10. [18]

    Inverting gradients-how easy is it to break privacy in feder- ated learning? Advances in Neural Information Processing Systems , 33:16937–16947, 2020

    Jonas Geiping, Hartmut Bauermeister, Hannah Dr ¨oge, and Michael Moeller. Inverting gradients-how easy is it to break privacy in feder- ated learning? Advances in Neural Information Processing Systems , 33:16937–16947, 2020

    2020

  11. [19]

    Differentially pri- vate federated learning: A client level perspective

    Robin C Geyer, Tassilo Klein, and Moin Nabi. Differentially pri- vate federated learning: A client level perspective. arXiv preprint arXiv:1712.07557, 2017

    2017 arXiv

  12. [20]

    Recovering private text in federated learning of language models

    Samyak Gupta, Yangsibo Huang, Zexuan Zhong, Tianyu Gao, Kai Li, and Danqi Chen. Recovering private text in federated learning of language models. Advances in Neural Information Processing Systems, 35:8130–8143, 2022

    2022

  13. [21]

    Fastai: A layered api for deep learning

    Jeremy Howard and Sylvain Gugger. Fastai: A layered api for deep learning. Information, 11(2):108, 2020

    2020

  14. [22]

    Gaia: {Geo- Distributed} machine learning approaching {LAN} speeds

    Kevin Hsieh, Aaron Harlap, Nandita Vijaykumar, Dimitris Konomis, Gregory R Ganger, Phillip B Gibbons, and Onur Mutlu. Gaia: {Geo- Distributed} machine learning approaching {LAN} speeds. In USENIX Symposium on Networked Systems Design and Implemen- tation, pages 629–647, 2017

    2017

  15. [23]

    Gradient inversion with generative image prior

    Jinwoo Jeon, Kangwook Lee, Sewoong Oh, Jungseul Ok, et al. Gradient inversion with generative image prior. Advances in Neural Information Processing Systems , 34:29898–29908, 2021

    2021

  16. [24]

    Advances and open problems in federated learning

    Peter Kairouz, H Brendan McMahan, Brendan Avent, Aur ´elien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, et al. Advances and open problems in federated learning. Foundations and trends® in machine learning, 14(...

    2021

  17. [25]

    Federated learning: Strategies for improving communication efficiency

    Jakub Konecn `y, H Brendan McMahan, Felix X Yu, Peter Richt ´arik, Ananda Theertha Suresh, and Dave Bacon. Federated learning: Strategies for improving communication efficiency. arXiv preprint arXiv:1610.05492, 8, 2016

    2016 arXiv

  18. [26]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky and Geoffrey Hinton. Learning multiple layers of features from tiny images. 2009

    2009

  19. [27]

    Gradient disaggregation: Breaking pri- vacy in federated learning by reconstructing the user participant matrix

    Maximilian Lam, Gu-Yeon Wei, David Brooks, Vijay Janapa Reddi, and Michael Mitzenmacher. Gradient disaggregation: Breaking pri- vacy in federated learning by reconstructing the user participant matrix. In International Conference on Machine Learning , pages 5959–5968. PMLR, 2021

    2021

  20. [28]

    Auditing pri- vacy defenses in federated learning via generative gradient leakage

    Zhuohang Li, Jiaxin Zhang, Luyang Liu, and Jian Liu. Auditing pri- vacy defenses in federated learning via generative gradient leakage. In IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 10132–10142, 2022

    2022

  21. [29]

    Channel pruning based on mean gradient for accelerating convolutional neural networks

    Congcong Liu and Huaming Wu. Channel pruning based on mean gradient for accelerating convolutional neural networks. Signal Pro- cessing, 156:84–91, 2019

    2019

  22. [30]

    How does noise help robustness? explanation and exploration under the neural sde framework

    Xuanqing Liu, Tesi Xiao, Si Si, Qin Cao, Sanjiv Kumar, and Cho-Jui Hsieh. How does noise help robustness? explanation and exploration under the neural sde framework. In IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 282–290, 2020

    2020

  23. [31]

    Deep learning face attributes in the wild

    Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In IEEE International Conference on Computer Vision , pages 3730–3738, 2015

    2015

  24. [32]

    Discriminator-free generative adversarial attack

    Shaohao Lu, Yuqiao Xian, Ke Yan, Yi Hu, Xing Sun, Xiaowei Guo, Feiyue Huang, and Wei-Shi Zheng. Discriminator-free generative adversarial attack. In ACM International Conference on Multimedia , pages 1544–1552, 2021

    2021

  25. [33]

    Tackling system and statistical heterogeneity for federated learning with adaptive client sampling

    Bing Luo, Wenli Xiao, Shiqiang Wang, Jianwei Huang, and Leandros Tassiulas. Tackling system and statistical heterogeneity for federated learning with adaptive client sampling. In IEEE INFOCOM Confer- ence on Computer Communications , pages 1739–1748, 2022

    2022

  26. [34]

    Feature inference attack on model predictions in vertical federated learning

    Xinjian Luo, Yuncheng Wu, Xiaokui Xiao, and Beng Chin Ooi. Feature inference attack on model predictions in vertical federated learning. In International Conference on Data Engineering , pages 181–192. IEEE, 2021

    2021

  27. [35]

    Communication-efficient learning of deep networks from decentralized data

    Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication-efficient learning of deep networks from decentralized data. In Artificial Intelligence and Statistics, pages 1273–1282. PMLR, 2017

    2017

  28. [36]

    Exploiting unintended feature leakage in collaborative learning

    Luca Melis, Congzheng Song, Emiliano De Cristofaro, and Vitaly Shmatikov. Exploiting unintended feature leakage in collaborative learning. In IEEE Symposium on Security and Privacy (SP) , pages 691–706, 2019

    2019

  29. [37]

    Adaptive federated dropout: Improving communication efficiency and gener- alization for federated learning

    Bouacida Nader, Hou Jiahui, Zang Hui, and Liu Xin. Adaptive federated dropout: Improving communication efficiency and gener- alization for federated learning. In IEEE Conference on Computer Communications Workshops, Vancouver, BC, Canada , pages 10–13, 2021

    2021

  30. [38]

    Comprehensive privacy analysis of deep learning: Passive and active white-box in- ference attacks against centralized and federated learning

    Milad Nasr, Reza Shokri, and Amir Houmansadr. Comprehensive privacy analysis of deep learning: Passive and active white-box in- ference attacks against centralized and federated learning. In IEEE Symposium on Security and Privacy , pages 739–753, 2019

    2019

  31. [39]

    fairseq: A fast, extensible toolkit for sequence modeling

    M Ott. fairseq: A fast, extensible toolkit for sequence modeling. arXiv preprint arXiv:1904.01038, 2019

    1904 arXiv

  32. [40]

    Eluding secure aggregation in federated learning via model inconsistency

    Dario Pasquini, Danilo Francati, and Giuseppe Ateniese. Eluding secure aggregation in federated learning via model inconsistency. In ACM SIGSAC Conference on Computer and Communications Security, pages 2429–2443, 2022

    2022

  33. [41]

    Aggregating capacity in fl through successive layer training for computationally-constrained devices

    Kilian Pfeiffer, Ramin Khalili, and J ¨org Henkel. Aggregating capacity in fl through successive layer training for computationally-constrained devices. Advances in Neural Information Processing Systems , 36, 2024

    2024

  34. [42]

    Privacy-preserving deep learning: Revisited and enhanced

    Le Trieu Phong, Yoshinori Aono, Takuya Hayashi, Lihua Wang, and Shiho Moriai. Privacy-preserving deep learning: Revisited and enhanced. In Applications and Techniques in Information Security: 8th International Conference , pages 100–110. Springer, 2017

  35. [43]

    Soteria: Provable defense against privacy leakage in federated learning from representation perspective

    Jingwei Sun, Ang Li, Binghui Wang, Huanrui Yang, Hai Li, and Yiran Chen. Soteria: Provable defense against privacy leakage in federated learning from representation perspective. In IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 9311–9319, 2021

    2021

  36. [44]

    Sapag: A self-adaptive privacy attack from gradients

    Yijue Wang, Jieren Deng, Dan Guo, Chenghong Wang, Xianrui Meng, Hang Liu, Caiwen Ding, and Sanguthevar Rajasekaran. Sapag: A self-adaptive privacy attack from gradients. arXiv preprint arXiv:2009.06228, 2020

    2009 arXiv

  37. [45]

    Beyond inferring class representatives: User-level privacy leakage from federated learning

    Zhibo Wang, Mengkai Song, Zhifei Zhang, Yang Song, Qian Wang, and Hairong Qi. Beyond inferring class representatives: User-level privacy leakage from federated learning. In IEEE INFOCOM Con- ference on Computer Communications , pages 2512–2520, 2019

    2019

  38. [46]

    A framework for evalu- ating gradient leakage attacks in federated learning

    Wenqi Wei, Ling Liu, Margaret Loper, Ka-Ho Chow, Mehmet Emre Gursoy, Stacey Truex, and Yanzhao Wu. A framework for evalu- ating gradient leakage attacks in federated learning. arXiv preprint arXiv:2004.10397, 2020

    2004 arXiv

  39. [47]

    Gradient-leakage resilient federated learning

    Wenqi Wei, Ling Liu, Yanzhao Wu, Gong Su, and Arun Iyengar. Gradient-leakage resilient federated learning. In International Con- ference on Distributed Computing Systems , pages 797–807. IEEE, 2021

    2021

  40. [48]

    Federated dropout—a simple approach for enabling federated learning on resource con- strained devices

    Dingzhu Wen, Ki-Jun Jeon, and Kaibin Huang. Federated dropout—a simple approach for enabling federated learning on resource con- strained devices. IEEE Wireless Communications Letters, 11(5):923– 927, 2022

    2022

  41. [49]

    Fishing for user data in large-batch federated learning via gradient magnification

    Yuxin Wen, Jonas Geiping, Liam Fowl, Micah Goldblum, and Tom Goldstein. Fishing for user data in large-batch federated learning via gradient magnification. arXiv preprint arXiv:2202.00580 , 2022

    2022 arXiv

  42. [50]

    Huggingface’s transformers: State-of-the-art natural language processing

    T Wolf. Huggingface’s transformers: State-of-the-art natural language processing. arXiv preprint arXiv:1910.03771 , 2019

    1910 arXiv

  43. [51]

    Patchguard: A provably robust defense against adversarial patches via small receptive fields and masking

    Chong Xiang, Arjun Nitin Bhagoji, Vikash Sehwag, and Prateek Mittal. Patchguard: A provably robust defense against adversarial patches via small receptive fields and masking. In 30th USENIX Security Symposium, 2021

    2021

  44. [52]

    Using highly compressed gradients in federated learning for data recon- struction attacks

    Haomiao Yang, Mengyu Ge, Kunlan Xiang, and Jingwei Li. Using highly compressed gradients in federated learning for data recon- struction attacks. IEEE Transactions on Information Forensics and Security, 18:818–830, 2022

    2022

  45. [53]

    Representations des nombres naturels par une somme de nombres de fibonacci on de nombres de lucas

    ´Edouard Zeckendorf. Representations des nombres naturels par une somme de nombres de fibonacci on de nombres de lucas. Bulletin de La Society Royale des Sciences de Liege , pages 179–182, 1972

    1972

  46. [54]

    Why gradient clipping accelerates training: A theoretical justification for adaptivity

    Jingzhao Zhang, Tianxing He, Suvrit Sra, and Ali Jadbabaie. Why gradient clipping accelerates training: A theoretical justification for adaptivity. arXiv preprint arXiv:1905.11881 , 2019

    1905 arXiv

  47. [55]

    The unreasonable effectiveness of deep features as a perceptual metric

    Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In IEEE Conference on Computer Vision and Pattern Recognition, pages 586–595, 2018

    2018

  48. [56]

    Compromise privacy in large-batch federated learning via malicious model parameters

    Shuaishuai Zhang, Jie Huang, Zeping Zhang, and Chunyang Qi. Compromise privacy in large-batch federated learning via malicious model parameters. In International Conference on Algorithms and Architectures for Parallel Processing, pages 63–80. Springer, 2022

    2022

  49. [57]

    The resource problem of using linear layer leakage attack in federated learning

    Joshua C Zhao, Ahmed Roushdy Elkordy, Atul Sharma, Yahya H Ezzeldin, Salman Avestimehr, and Saurabh Bagchi. The resource problem of using linear layer leakage attack in federated learning. In IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 3974–3983, 2023

    2023

  50. [58]

    Loki: Large-scale data reconstruction attack against federated learning through model manipulation

    Joshua Christian Zhao, Atul Sharma, Ahmed Roushdy Elkordy, Yahya H Ezzeldin, Salman Avestimehr, and Saurabh Bagchi. Loki: Large-scale data reconstruction attack against federated learning through model manipulation. In IEEE Symposium on Security and Privacy, pages 30–30. IEEE ...

    2023

  51. [59]

    R-gap: Recursive gradient attack on privacy

    Junyi Zhu and Matthew Blaschko. R-gap: Recursive gradient attack on privacy. arXiv preprint arXiv:2010.07733 , 2020

    2010 arXiv

  52. [60]

    Deep leakage from gradients

    Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. Advances in Neural Information Processing Systems , 32, 2019. Appendix A. Datasets and Models CIFAR-10. CIFAR-10 [26] contains 60,000 images be- longing to 10 classes. Each sample has a dimension of 32 × 32. W...

    2019

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.