Pith. sign in

REVIEW 4 major objections 5 minor 1 cited by

Hear No Evil: Detecting Gradient Leakage by Malicious Servers in Federated Learning

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Malicious gradient-leakage attacks in federated learning cannot be both highly effective and stealthy, and a simple warm-up detector can flag them in realistic settings.

desk verdict A plausible, well-written de-escalation of the malicious-server FL threat model, but the load-bearing claim that SEER dies without batch norm is argued, not tested. read the letter →

arxiv 2506.20651 v1 pith:GYJEDHHZ submitted 2025-06-25 cs.LG cs.CRcs.DC

Fei Wang , Baochun Li This is my paper · ORCID
classification cs.LGcs.CRcs.DC
keywords federatedlearningmaliciousgradientleakageattackinversionbatchnormalizationaveragingclient-sidedetectionanomalyprivacy
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that gradient-leakage attacks by malicious servers in federated learning are far less dangerous than prior work suggests. It analyzes known attacks and finds a core trade-off: the more aggressively a manipulated model extracts private data, the more detectable it becomes, while the stealthiest learning-based attacks depend on outdated model components and unrealistic training assumptions. In realistic federated learning, with sample-wise normalization such as layer or group normalization and with federated averaging over multiple local steps, these attacks lose effectiveness or leave statistical traces. The authors also propose a lightweight client-side detector that runs a short warm-up phase before local training and flags anomalous parameter statistics using Z-scores. If the paper is right, privacy-conscious federated learning systems do not need heavy defenses against malicious servers, only basic monitoring plus this simple check.

What carries the argument

The argument turns on two mechanisms. The first is the probability calculation for isolating a single target sample: without batch normalization, the probability that exactly one sample falls into an attacker's 'bin' is bounded by about $1/e \approx 0.3679$, whereas batch normalization couples samples through shared statistics so the attacker can define local in-batch properties (e.g., the darkest image) and push the isolation probability toward 1. The second is the client's warm-up detector, which performs a few gradient-descent steps on a small random subset, records the mean, standard deviation, and maximum absolute value of weights, biases, and batch-normalization activations in targeted layers, and compares new statistics to the historical baseline using Z-scores.

What would settle it

Run SEER against a modern model with layer or group normalization and standard FedAvg with several local epochs, and measure whether it still reconstructs images from batches of size 512 with success probability above 0.9 and D-SNR scores indistinguishable from benign models; if it does, the paper's central trade-off collapses. A simpler check is to deploy the proposed warm-up detector on a BN-free network and see whether the maximum Z-score threshold cleanly separates benign models from SEER-manipulated ones.

Watch

Extended reading notes

Core claim

The central claim is that no known malicious gradient-leakage attack can be both highly effective at reconstructing clients' private data and sufficiently stealthy to avoid detection in realistic federated learning deployments. Manually crafted manipulations that insert or rewrite layers to funnel data into a fully connected layer are either blocked by standard model-loading APIs or easy to spot by inspecting parameter patterns; learning-based attacks such as SEER, which hide their tampering in optimized weights, rely on batch normalization to create inter-sample dependencies that let the attacker isolate a single target sample from a large batch. Because modern vision models use layer or group normalization, which normalize each sample independently, and because FedAvg's multiple local update steps overwrite the server's crafted parameters, the paper argues that SEER's mechanism breaks in practice. As a complementary safeguard, the paper contributes a warm-up phase detector that profiles weight, bias, and activation statistics of the most attack-prone layers over a few gradient steps and flags the model as malicious if any Z-score exceeds a threshold.

Load-bearing premise

The load-bearing premise is that SEER and similar learning-based attacks depend critically on batch normalization and single-step local updates, a claim the paper argues from mechanism but does not back with experiments under SEER or LOKI in the modified settings.

Editorial extensions

If this is right

  • If the central claim is correct, the threat model of a malicious server does not justify abandoning federated learning for privacy reasons in settings that use modern normalization and federated averaging.
  • Clients can adopt the proposed warm-up detector with negligible overhead (about 0.7 to 0.9 seconds per round) and abstain from rounds in which the received model looks manipulated.
  • Attack designers who want both effectiveness and stealth must either reintroduce batch normalization and single-step local updates, which conflict with standard practice, or find a new mechanism that does not depend on inter-sample coupling.
  • The $1/e$ bound becomes a practical benchmark: any attack claiming to isolate a single sample from a large batch without batch normalization must beat it, and the paper argues that none does.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • We infer that the same trade-off should apply to any future learning-based attack that preserves sample independence: without inter-sample coupling, the $1/e$ isolation bound is a hard ceiling, so the attack must either lose power or reveal itself.
  • We infer that secure aggregation may be less important than the field assumes for defending against malicious servers, since the malicious model itself is detectable before the client sends anything.
  • We infer a testable corollary: on clients with very little local data, the warm-up detector's statistical baseline will be noisier, so the detection threshold may need to be client-adaptive.
  • We infer that the $1/e$ bound could be formalized as a lower-bound theorem for sample-independent reconstruction, turning the paper's empirical trade-off into a provable statement.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. This paper studies malicious gradient leakage attacks in federated learning (FL), where a server manipulates the global model to extract clients' private data. The authors survey existing attack families, categorize them by detectability, and argue for a fundamental trade-off: attacks that are highly effective at reconstruction either leave detectable traces in model parameters/gradients or rely on outdated architectural components and single-step FedSGD assumptions. They identify batch normalization as a key enabler for learning-based attacks such as SEER, and claim that modern normalization methods (layer/group normalization) and federated averaging with multiple local steps neutralize these attacks. As a defense, they propose a lightweight client-side detector that performs a short warm-up phase, monitors statistical properties of selected layers, and flags anomalies via Z-scores. The paper concludes that malicious gradient leakage attacks are not a serious practical threat when such monitoring is deployed.

Significance. If the central trade-off claim is correct, this paper would significantly reframe the threat model for malicious-server gradient leakage in FL, moving from 'attacks are stealthy and severe' to 'attacks are either detectable or ineffective in realistic settings.' The systematic categorization of attacks and the emphasis on architectural assumptions are useful contributions. The paper also provides a concrete, low-overhead detection mechanism with a clean conceptual design, and the probability derivation for the Robbing lower bound in Section 4.1 is mathematically transparent. However, the most load-bearing claims are not empirically validated: the paper argues, rather than demonstrates, that SEER fails under layer/group normalization and FedAvg, and the detector is evaluated against only one attack with no specified threshold. These gaps currently prevent the paper from supporting its headline conclusions, though they appear addressable with additional experiments.

major comments (4)
  1. [Section 4.1 (Eqs. 5–12)] The central claim that SEER and similar learning-based attacks are neutralized by modern normalization is argued entirely from mechanism, not from experiments. The paper does not run SEER (or any learning-based attack) under layer normalization, group normalization, or a modern architecture without batch normalization. It also does not run SEER under FedAvg with multiple local update steps. Since Sections 1 and 6 state this as the core trade-off and the main practical conclusion, this missing empirical validation is load-bearing. Please add direct experiments or substantially soften the claim to a hypothesis.
  2. [Section 5.3, Table 1 and Section 5.2] The proposed detector is evaluated against only the Fishing attack [41], with no specified Z-score threshold despite Section 5.2 referring to a 'predefined threshold.' Without a threshold, the detection results in Table 1 are not falsifiable, and no false-positive or false-negative rates, ROC curves, or error bars are reported. The detector is the paper's main constructive contribution and the basis for the 'detectable' half of the trade-off; it must be evaluated with a concrete threshold and across multiple attack types, including SEER and LOKI, against a benign FL baseline.
  3. [Section 4.1, Eqs. (10)–(11)] The derivation of p(X' = 1) = ∏_{j≠i}(1-p_j) is not generally correct. The event that x_i is the minimum requires integrating over the distribution of the target's feature value, and the product form ignores the dependence of the events {m(x_j) > m(x_i)} on the random value m(x_i). For example, with i.i.d. uniform features, P(min) = 1/B, whereas ∏_{j≠i}(1-p_j) = 2^{-(B-1)}. This mathematical issue affects the 'enhanced lower bound' argument that is used to explain why BN matters. Please correct the derivation or clarify the conditioning under which the product form holds.
  4. [Section 4.1, final paragraph] The claim that FedAvg 'exponentially more severe[ly]' degrades SEER is extrapolated from [14]'s observation about FedSGD rounds, not from any experiment in this paper. Moreover, LOKI [49] is cited as working under FedAvg, but the paper dismisses it as detectable via parameter inspection without evaluating that detection. Since LOKI directly contradicts the claim that FedAvg neutralizes learning-based attacks, this point requires either an experimental test of LOKI's detectability or a more nuanced statement.
minor comments (5)
  1. [Section 5.3, Fig. 3] The benign baseline in Fig. 3 is from a 'natural centralized training process,' but the detector is intended for FL; a benign FL baseline with non-IID client data would be more appropriate and could change the Z-score distribution.
  2. [Section 4.1] The statement that batch normalization is 'outdated in modern models' is too broad; BN is still common in many contemporary CNN backbones. The argument about practical FL deployments would benefit from nuanced statistics or explicit scope conditions.
  3. [Section 5.2] The Z-score computation Z = (x-μ)/σ needs a safeguard for near-zero standard deviations, which can occur during early warm-up iterations. The paper does not discuss numerical stability or how such cases are handled.
  4. [Section 5.3] The reported warm-up duration of 0.72–0.88 seconds is useful, but no comparison is provided against the time cost of a single local training epoch, which would better contextualize the overhead.
  5. [Section 3.2] The D-SNR definition in Eq. (1) is clear, but the discussion of Figs. 2c and 2d would be easier to follow if the layer indices were labeled explicitly in the text.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the core trade-off argument and detector are not fitted to their own conclusions, though the central claim rests on untested empirical premises.

full rationale

The paper's derivation chain is not circular in the sense defined by the review. The central trade-off claim—that malicious gradient leakage attacks cannot be both effective and stealthy—is argued from mechanism and from external attack literature, not from a fitted parameter or a self-referential definition. The Section 4.1 probability derivation is an independent mathematical bound: it assumes sample independence, then shows that batch normalization introduces inter-sample dependencies, and uses that to explain SEER's reported success. This is an explanation of an external result, not a prediction that reduces to its inputs. The proposed detector is evaluated against the external Fishing attack [41] with benign-model baselines; its Z-score statistics are reported for attacked versus benign layers, so the detection result is not calibrated to reproduce a known outcome. The main weaknesses are evidentiary rather than circular: (1) SEER is never empirically rerun under layer normalization, group normalization, or FedAvg with multiple local steps, so the claim that modern normalization 'nullifies' SEER is asserted from mechanism rather than demonstrated; (2) the Z-score threshold is never specified, making the detection claim partially unfalsifiable as reported; (3) the FedAvg argument extrapolates 'exponentially more severe' degradation from a remark in [14] without experiments. The only self-citation, [38], supports the general statement that multiple local gradient steps increase gradient confusion; this is not load-bearing because the text also provides an independent argument that client optimization diverges from the server's manipulation objective. For these reasons, the paper's derivation is self-contained and no step reduces to its own inputs by construction. The concerns noted are about missing empirical support and underspecified detection parameters, which belong to correctness risk, not circularity.

Assumptions & free parameters 4 free parameters · 6 assumptions · 0 invented entities

The central argument rests on assumptions about attack mechanisms and FL practice rather than on fitted numerical parameters. The main unquantified design choices are the detector's threshold and warm-up settings.

free parameters (4)
  • Z-score detection threshold = unspecified
    The detector flags models when a Z-score exceeds a predefined threshold (Section 5.2), but no threshold value or selection procedure is given.
  • Warm-up steps = 5
    Number of gradient descent iterations in the warm-up phase, chosen by the authors, Section 5.3.
  • Warm-up subset size = 128
    Random subset of local training samples used for warm-up, Section 5.3.
  • Number of monitored layers = unspecified
    The detector monitors first and last FC, first conv, up to three BN layers, first and last attention; no sensitivity analysis is provided.
assumptions (6)
  • domain assumption Samples' bin membership is independent and uniformly distributed.
    Used in the 1/e probability lower bound for non-BN attacks (Section 4.1, Eq. 5).
  • domain assumption Batch normalization creates inter-sample dependencies; layer and group normalization do not.
    The central mechanism attributed to SEER, Eq. (7) in Section 4.1.
  • domain assumption Clients in FedAvg perform multiple local update steps, overwriting server-side manipulations.
    Section 4.1, 'Federated averaging inherently neutralizes learning-based model manipulations'.
  • domain assumption Modern CNN architectures predominantly replace batch normalization with layer/group normalization.
    Section 4.1, 'Batch normalization is outdated in modern models'.
  • domain assumption PyTorch and TensorFlow load_state_dict enforce strict architectural consistency, preventing inserted layers.
    Section 3.1, used to argue architectural tampering is ineffective in practice.
  • domain assumption The malicious server's objective and the client's task objective diverge, so client optimization removes manipulations.
    Section 4.1, discussion of L_SEER versus the client's classification loss.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Hear No Evil: Detecting Gradient Leakage by Malicious Servers in Federated Learning." pith.science (2026). https://pith.science/paper/GYJEDHHZ

@misc{pith2026250620651,
  author       = {Pith},
  title        = {Pith review of: Hear No Evil: Detecting Gradient Leakage by Malicious Servers in Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GYJEDHHZ}},
  note         = {Machine review of arXiv:2506.20651}
}
read the original abstract

Recent work has shown that gradient updates in federated learning (FL) can unintentionally reveal sensitive information about a client's local data. This risk becomes significantly greater when a malicious server manipulates the global model to provoke information-rich updates from clients. In this paper, we adopt a defender's perspective to provide the first comprehensive analysis of malicious gradient leakage attacks and the model manipulation techniques that enable them. Our investigation reveals a core trade-off: these attacks cannot be both highly effective in reconstructing private data and sufficiently stealthy to evade detection -- especially in realistic FL settings that incorporate common normalization techniques and federated averaging. Building on this insight, we argue that malicious gradient leakage attacks, while theoretically concerning, are inherently limited in practice and often detectable through basic monitoring. As a complementary contribution, we propose a simple, lightweight, and broadly applicable client-side detection mechanism that flags suspicious model updates before local training begins, despite the fact that such detection may not be strictly necessary in realistic FL settings. This mechanism further underscores the feasibility of defending against these attacks with minimal overhead, offering a deployable safeguard for privacy-conscious federated learning systems.

Figures

Figures reproduced from arXiv: 2506.20651 by the authors.

Figure 1
Figure 1. Honest and malicious federated learning servers executing gradient leakage [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. The weights and bias of the imprint layer in ResNet-18 under the attack [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. A benign ResNet18 model in a natural training process. [PITH_FULL_IMAGE:figures/full_fig_p015_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: An example of a 3 × 3 convolutional layer with an identity kernel, which preserves the input image without any changes. Using a positive constant (e.g., 2) at the center instead of 1 scales the image features. layer to isolate gradient updates associated with a single …

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. On the Detectability of Active Gradient Inversion Attacks in Federated Learning

    cs.CR 2025-11 conditional novelty 6.0 of 10

    Four modern active gradient-inversion attacks in federated learning are detectable by simple client-side statistical checks on model weights, losses, and gradient norms, despite their stealth claims.

Reference graph

Works this paper leans on

51 extracted references · 45 canonical work pages · cited by 1 Pith paper

  1. [41]

    In: Proc

    Wen, Y., Geiping, J., Fowl, L., Goldblum, M., Goldstein, T.: Fishing for User Data in Large-Batch Federated Learning via Gradient Magnification. In: Proc. Interna- tional Conference on Machine Learning (ICML) (2022)

    work page 2022

  2. [14]

    In: Proc

    Garov, K., Dimitrov, D.I., Jovanović, N., Vechev, M.: Hiding in Plain Sight: Dis- guising Data Stealing Attacks in Federated Learning. In: Proc. International Con- ference on Learning Representations (ICLR) (2024) 18 Fei Wang and Baochun Li

    work page 2024

  3. [49]

    In: Proc

    Zhao, J.C., Sharma, A., Elkordy, A.R., Ezzeldin, Y.H., Avestimehr, S., Bagchi, S.: LOKI: Large-Scale Data Reconstruction Attack against Federated Learning through Model Manipulation. In: Proc. 45th IEEE Symposium on Security and Privacy (S&P). pp. 30–30 (2024)

    work page 2024

  4. [1]

    arXiv preprint arXiv:1607.06450 (2016)

    Ba, J.L., Kiros, J.R., Hinton, G.E.: Layer Normalization. arXiv preprint arXiv:1607.06450 (2016)

    arXiv 2016

  5. [2]

    In: Advances in Neural Information Processing Sys- tems (NeurIPS) (2019)

    Bagdasaryan, E., Poursaeed, O., Shmatikov, V.: Differential Privacy Has Disparate Impact on Model Accuracy. In: Advances in Neural Information Processing Sys- tems (NeurIPS) (2019)

    work page 2019

  6. [3]

    Advances in Neural Information Pro- cessing Systems (NeurIPS)35, 7641–7654 (2022)

    Balunović, M., Dimitrov, D., Jovanović, N., Vechev, M.: LAMP: Extracting Text from Gradients with Language Model Priors. Advances in Neural Information Pro- cessing Systems (NeurIPS)35, 7641–7654 (2022)

    work page 2022

  7. [4]

    In: Proc

    Boenisch, F., Dziedzic, A., Schuster, R., Shamsabadi, A.S., Shumailov, I., Paper- not, N.: When the Curious Abandon Honesty: Federated Learning Is Not Private. In: Proc. IEEE 8th European Symposium on Security and Privacy (EuroS&P). pp. 175–199 (2023)

    work page 2023

  8. [5]

    In: Proc

    Boenisch, F., Dziedzic, A., Schuster, R., Shamsabadi, A.S., Shumailov, I., Paper- not, N.: Reconstructing individual data points in federated learning hardened with differential privacy and secure aggregation. In: Proc. IEEE 8th European Sympo- sium on Security and Privacy (EuroS&P). pp. 241–257 (2023)

    work page 2023

Show all 51 references
  1. [6]

    International Journal of Computer Applications182(45), 1–5 (2018)

    Chikodili, A., Abisoye, B.: Detecting Outliers in High Dimensional Data Sets Using Z-Score Methodology. International Journal of Computer Applications182(45), 1–5 (2018)

    2018

  2. [7]

    In: Proc

    Chu, H.M., Geiping, J., Fowl, L.H., Goldblum, M., Goldstein, T.: Panning for Gold in Federated Learning: Targeted Text Extraction under Arbitrarily Large- Scale Aggregation. In: Proc. International Conference on Learning Representations (ICLR) (2023)

    2023

  3. [8]

    In: Proc

    Deng, J., Wang, Y., Li, J., Wang, C., Shang, C., Liu, H., Rajasekaran, S., Ding, C.: TAG: Gradient Attack on Transformer-based Language Models. In: Proc. Con- ference on Empirical Methods in Natural Language Processing (EMNLP) (2021)

    2021

  4. [9]

    In: Proc

    Devlin, J., Chang, M., Lee, K., Toutanova, K.: BERT: Pre-training of Deep Bidi- rectional Transformers for Language Understanding. In: Proc. Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies. pp. 4171–4186 (2019)

    2019

  5. [10]

    In: Proc

    Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., Gelly, S., Uszkoreit, J., Houlsby, N.: An image is worth 16x16 words: Transformers for image recognition at scale. In: Proc. International Conferenc...

    2021

  6. [11]

    In: Proc

    Du, Z., Sun, J., Li, A., Chen, P.Y., Zhang, J., Li, H.H., Chen, Y.: Rethinking Normalization Methods in Federated Learning. In: Proc. the 3rd International Workshop on Distributed Machine Learning (DistributedML). pp. 16–22 (2022)

    2022

  7. [12]

    In: Proc

    Fowl, L.H., Geiping, J., Czaja, W., Goldblum, M., Goldstein, T.: Robbing the Fed: Directly Obtaining Private Data in Federated Learning with Modified Models. In: Proc. International Conference on Learning Representations (ICLR) (2022)

    2022

  8. [13]

    In: Proc

    Fowl, L.H., Geiping, J., Reich, S., Wen, Y., Czaja, W., Goldblum, M., Goldstein, T.: Decepticons: Corrupted Transformers Breach Privacy in Federated Learning for Language Models. In: Proc. International Conference on Learning Representations (ICLR) (2023)

    2023

  9. [15]

    Geiping, J., Bauermeister, H., Dröge, H., Moeller, M.: Inverting Gradients — How Easy Is It to Break Privacy in Federated Learning? Advances in Neural Information Processing Systems (NeurIPS)33, 16937–16947 (2020)

    2020

  10. [16]

    Advances in Neural Information Processing Systems (NeurIPS)35, 8130–8143 (2022)

    Gupta, S., Huang, Y., Zhong, Z., Gao, T., Li, K., Chen, D.: Recovering private text in federated learning of language models. Advances in Neural Information Processing Systems (NeurIPS)35, 8130–8143 (2022)

    2022

  11. [17]

    In: Proc

    He, K., Zhang, X., Ren, S., Sun, J.: Deep Residual Learning for Image Recognition. In: Proc. IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 770–778 (2016)

    2016

  12. [18]

    In: Proc

    Huang, G., Liu, Z., Weinberger, K.Q.: Densely Connected Convolutional Networks. In: Proc. IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 2261–2269 (2016)

    2016

  13. [19]

    Advances in Neural Information Pro- cessing Systems (NeurIPS)34(2021)

    Huang, Y., Gupta, S., Song, Z., Li, K., Arora, S.: Evaluating Gradient Inversion Attacks and Defenses in Federated Learning. Advances in Neural Information Pro- cessing Systems (NeurIPS)34(2021)

    2021

  14. [20]

    In: Proc

    Ioffe, S.: Batch Renormalization: Towards Reducing Minibatch Dependence in Batch-Normalized Models. In: Proc. the 31st International Conference on Neural Information Processing Systems. pp. 1942–1950 (2017)

    2017

  15. [21]

    In: Proc

    Ioffe, S., Szegedy, C.: Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift. In: Proc. International Conference on Machine Learning (ICML). pp. 448–456 (2015)

    2015

  16. [22]

    Advances in Neural Information Processing Systems (NeurIPS)34, 29898– 29908 (2021)

    Jeon, J., Lee, K., Oh, S., Ok, J., et al.: Gradient Inversion with Generative Image Prior. Advances in Neural Information Processing Systems (NeurIPS)34, 29898– 29908 (2021)

    2021

  17. [23]

    In: Proc

    Karimireddy, S.P., Kale, S., Mohri, M., Reddi, S., Stich, S., Suresh, A.T.: SCAF- FOLD: Stochastic Controlled Averaging for Federated Learning. In: Proc. Interna- tional Conference on Machine Learning (ICML). vol. 119, pp. 5132–5143. PMLR (2020)

    2020

  18. [24]

    arXiv preprint arXiv:1511.03575 (2015)

    Konečn` y, J., McMahan, B., Ramage, D.: Federated Optimization: Distributed Op- timization Beyond the Datacenter. arXiv preprint arXiv:1511.03575 (2015)

    2015 arXiv

  19. [25]

    arXiv preprint arXiv:1610.02527 (2016)

    Konečný, J., McMahan, H.B., Ramage, D., Richtárik, P.: Federated Optimiza- tion: Distributed Machine Learning for On-Device Intelligence. arXiv preprint arXiv:1610.02527 (2016)

    2016 arXiv

  20. [26]

    IEEE Transactions on Image Processing9(10), 1661–1666 (2000)

    Lam, E., Goodman, J.: A Mathematical Analysis of The DCT Coefficient Dis- tributions for Images. IEEE Transactions on Image Processing9(10), 1661–1666 (2000)

    2000

  21. [27]

    Li, T., Sahu, A.K., Zaheer, M., Sanjabi, M., Talwalkar, A., Smith, V.: Federated Optimization in Heterogeneous Networks. Proc. Machine Learning and Systems (MLSys)2, 429–450 (2020)

    2020

  22. [28]

    In: Proc

    Lu, J., Zhang, X.S., Zhao, T., He, X., Cheng, J.: APRIL: Finding the Achilles’ Heel on Privacy for Vision Transformers. In: Proc. IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 10051–10060 (2022)

    2022

  23. [29]

    In: Proc

    McMahan, B., Moore, E., Ramage, D., Hampson, S., y Arcas, B.A.: Communication-Efficient Learning of Deep Networks from Decentralized Data. In: Proc. International Conference on Artificial Intelligence and Statistics (AISTATS). pp. 1273–1282 (2017)

    2017

  24. [30]

    arXiv preprint arXiv:2303.08774 (2023), https: //arxiv.org/abs/2303.08774

    OpenAI: Gpt-4 technical report. arXiv preprint arXiv:2303.08774 (2023), https: //arxiv.org/abs/2303.08774

    2023 arXiv

  25. [31]

    In: Proc

    Pasquini, D., Francati, D., Ateniese, G.: Eluding Secure Aggregation in Federated Learning via Model Inconsistency. In: Proc. ACM SIGSAC Conference on Com- puter and Communications Security (CCS). pp. 2429–2443 (2022) Title Suppressed Due to Excessive Length 19

    2022

  26. [32]

    https://pytorch.org/docs/stable/nn.html, accessed: 2025-03-26

    PyTorch: Documentations on Torch.nn. https://pytorch.org/docs/stable/nn.html, accessed: 2025-03-26

    2025

  27. [33]

    OpenAI Blog1(8), 9 (2019)

    Radford, A., Wu, J., Child, R., Luan, D., Amodei, D., Sutskever, I.: Language Models are Unsupervised Multitask Learners. OpenAI Blog1(8), 9 (2019)

    2019

  28. [34]

    In: Proc

    Sun, J., Li, A., Wang, B., Yang, H., Li, H., Chen, Y.: Soteria: Provable Defense against Privacy Leakage in Federated Learning from Representation Perspective. In: Proc. IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 9311–9319 (2021)

    2021

  29. [35]

    https://www.tensorflow.org/guide, ac- cessed: 2025-03-26

    TensorFlow: TensorFlow Documentation. https://www.tensorflow.org/guide, ac- cessed: 2025-03-26

    2025

  30. [36]

    In: Proc

    Truex, S., Liu, L., Chow, K.H., Gursoy, M.E., Wei, W.: LDP-Fed: Federated Learn- ing with Local Differential Privacy. In: Proc. the Third ACM International Work- shop on Edge Systems, Analytics and Networking. pp. 61–66. Association for Com- puting Machinery, New York, NY, USA (2020)

    2020

  31. [37]

    arXiv preprint arXiv:1607.08022 (2016)

    Ulyanov, D., Vedaldi, A., Lempitsky, V.: Instance Normalization: The Missing Ingredient for Fast Stylization. arXiv preprint arXiv:1607.08022 (2016)

    2016 arXiv

  32. [38]

    In: Proc

    Wang, F., Hugh, E., Li, B.: More than Enough is Too Much: Adaptive Defenses against Gradient Leakage in Production Federated Learning. In: Proc. IEEE Con- ference on Computer Communications (INFOCOM) (2023)

    2023

  33. [39]

    In: Proc

    Wang, J., Guo, S., Xie, X., Qi, H.: Protect Privacy from Gradient Leakage Attack in Federated Learning. In: Proc. IEEE Conference on Computer Communications (INFOCOM) (2022)

    2022

  34. [40]

    IEEE Transactions on Information Forensics and Security15, 3454–3469 (2020)

    Wei,K.,Li,J.,Ding,M.,Ma,C.,Yang,H.H.,Farokhi,F.,Jin,S.,Quek,T.Q.,Poor, H.V.: Federated Learning with Differential Privacy: Algorithms and Performance Analysis. IEEE Transactions on Information Forensics and Security15, 3454–3469 (2020)

    2020

  35. [42]

    In: Proc

    Wolf, T., Debut, L., Sanh, V., Chaumond, J., Delangue, C., Moi, A., Cistac, P., Rault, T., Louf, R., Funtowicz, M., et al.: Transformers: State-of-the-Art Natu- ral Language Processing. In: Proc. Conference on Empirical Methods in Natural Language Processing: System Demonstrat...

    2020

  36. [43]

    In: Proc

    Wu, R., Chen, X., Guo, C., Weinberger, K.Q.: Learning to Invert: Simple Adaptive Attacks for Gradient Inversion in Federated Learning. In: Proc. Uncertainty in Artificial Intelligence (UAI). pp. 2293–2303 (2023)

    2023

  37. [44]

    In: Proc

    Wu, Y., He, K.: Group normalization. In: Proc. the European Conference on Com- puter Vision (ECCV). pp. 3–19 (2018)

    2018

  38. [45]

    In: The Second Tiny Papers Track at ICLR 2024 (2024)

    Xue, R., Pei, J., Wang, L.: Federated Learning on Small Batch Sizes via Batch Renormalization. In: The Second Tiny Papers Track at ICLR 2024 (2024)

    2024

  39. [46]

    In: Proc

    Yin, H., Mallya, A., Vahdat, A., Alvarez, J.M., Kautz, J., Molchanov, P.: See through Gradients: Image Batch Recovery via GradInversion. In: Proc. IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 16337– 16346 (2021)

    2021

  40. [47]

    In: Proc

    Zhang, S., Huang, J., Zhang, Z., Qi, C.: Compromise Privacy in Large-Batch Fed- erated Learning via Malicious Model Parameters. In: Proc. the 22nd International Conference on Algorithms and Architectures for Parallel Processing (ICA3PP). p. 63–80 (2022)

    2022

  41. [48]

    arXiv preprint arXiv:2001.02610 (2020) 20 Fei Wang and Baochun Li

    Zhao, B., Mopuri, K.R., Bilen, H.: iDLG: Improved Deep Leakage from Gradients. arXiv preprint arXiv:2001.02610 (2020) 20 Fei Wang and Baochun Li

    2020 arXiv

  42. [50]

    Zhu, L., Liu, Z., Han, S.: Deep Leakage from Gradients. In: Advances in Neural Information Processing Systems (NeurIPS) (2019) A Appendix A.1 Characterization of Malicious Model Manipulation The success of malicious gradient leakage attacks depends on specific neural network l...

    2019

  43. [51]

    layer to isolate gradient updates associated with a single class or feature

    at the center instead of1scales the image features. layer to isolate gradient updates associated with a single class or feature. This makes it easier to reverse-engineer and reconstruct the corresponding data. To achieve this, the Fishing attack modifies the weights and biases...

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.