Pith. sign in

REVIEW 5 major objections 7 minor 1 cited by

From Models to Network Topologies: A Topology Inference Attack in Decentralized Federated Learning

T0 review · 5 major / 7 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper attempts to establish that the peer-to-peer topology of a decentralized federated learning network can be inferred from the trained models alone, without raw data or network logs.

desk verdict A worthwhile empirical attack paper whose convergence proof is wrong; the supervised results are strong, the unsupervised ones are moderate, and the theory must be fixed before publication. read the letter →

arxiv 2501.03119 v3 pith:MVJEPA55 submitted 2025-01-06 cs.LG cs.AI

Chao Feng , Yuanzhe Gao , Alberto Huertas Celdran , Gerome Bovet , Burkhard Stiller This is my paper · ORCID
classification cs.LGcs.AI
keywords decentralizedfederatedlearningtopologyinferenceattackmodelsimilaritycosinegraphneuralnetworksprivacyleakageedgeclassificationnetwork
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Decentralized federated learning (DFL) distributes model training over a peer-to-peer network, and this paper tries to establish that the network's overlay topology—which nodes exchange model updates with which—can be read off the trained models themselves. The point matters because topology is a sensitive asset: an adversary who knows it can target the central or best-connected nodes for poisoning or denial-of-service. The paper defines five attacker scenarios by how much model, dataset, and edge knowledge the adversary holds, selects pairwise similarity metrics that separate connected from unconnected nodes (cosine similarity between parameter vectors is the strongest), and builds two inference methods: a supervised edge classifier and an unsupervised graph reconstruction. Across six datasets, synthetic topologies, and 27 real-world communication topologies, the models recover the adjacency matrix with F1 around 0.79–0.89 when some edge labels are available, and with AUC around 0.76–0.81 when no labels or datasets are available.

What carries the argument

The engine of the attack is the DFL aggregation identity $\tilde{M}_t = P M_{t-1}$, with $P = D^{-1}(A+I)$ encoding the graph; expanding to $M_T = P^T M_0 + \sum_{t=1}^T P^{T-t}\delta_t$ shows that the adjacency structure enters every round through powers of $P$, so neighboring models converge toward each other while the initialization term decays. The observable that carries the inference is cosine similarity between model parameter vectors, chosen after distribution analysis showed it separates edge from non-edge pairs more cleanly than Euclidean similarity or curvature divergence. Two algorithms consume that signal: EDGEPRE, a supervised MLP edge classifier trained on partially labeled pairs, and INFERGAT, an unsupervised graph-attention encoder-decoder trained to reconstruct the pairwise similarity matrix.

What would settle it

Fix a topology and a training setup, then give two non-adjacent nodes nearly identical local datasets while making adjacent nodes' data dissimilar. If pairwise cosine similarity for those non-edge pairs exceeds that of true edges, and EDGEPRE/INFERGAT F1 drops toward 0.5, the core signal is data similarity rather than communication topology; a sweep over data-overlap between non-adjacent pairs, with the graph held fixed, would settle the question.

Watch

Extended reading notes

Core claim

The central claim is that direct communication leaves an imprint in model parameters: each aggregation step multiplies the model matrix by the row-stochastic matrix $P = D^{-1}(A+I)$, so connected nodes repeatedly average each other's parameters and end up with models that point in similar directions. The paper shows experimentally that pairwise cosine similarity of final models separates the edge group from the non-edge group with little overlap, and that this signal suffices for topology reconstruction. Equipped with a few labeled edges, EDGEPRE—an MLP that classifies each node pair from concatenated features—recovers the full adjacency matrix at F1 $\approx 0.79$–$0.89$ on six datasets. With no edge labels and no data access, INFERGAT—a graph-attention encoder trained to reconstruct the similarity structure—still reaches AUC $\approx 0.76$–$0.81$ and F1 $\approx 0.60$–$0.67$ in the weakest scenario. The paper also establishes that leakage increases with local overfitting and decreases with data heterogeneity and differential privacy, and that topology density helps unsupervised inference while network size hurts it.

Load-bearing premise

The approach stands or falls on the assumption that similarity between two models is caused mainly by a direct communication link, rather than by the two nodes happening to hold similar local data.

Editorial extensions

If this is right

  • A DFL participant with partial knowledge of the graph can reconstruct the full overlay, so topology should be treated as confidential in any deployment where participants are not fully trusted.
  • Even in the weakest scenario considered—models only, no labels, no datasets—the graph is recoverable at AUC around 0.76–0.81, so hiding network metadata is not enough.
  • Denser topologies make unsupervised reconstruction easier and larger networks make it harder, giving operators a quantitative trade-off between connectivity and topology privacy.
  • Reducing local epochs, encouraging non-IID data splits, and applying differential privacy each lower attack performance, and these effects are large enough to serve as defense levers.
  • The inference signal persists across ring, star, random, and 27 real-world communication topologies, suggesting the result is structural rather than an artifact of one graph family.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A defense aimed specifically at the cosine-similarity gap—such as adding a small amount of calibrated noise to shared parameters or randomizing the aggregation weights—might break edge–non-edge separation more cheaply than global differential privacy; this follows from the mechanism but is not tested in the paper.
  • Under the aggregation dynamics in equation (5), changing the gossip schedule (asynchronous updates, randomized neighbor selection, or periodic topology rewiring) should change which parameter pairs resemble each other and likely weakens inference; this is an untested corollary of the paper's model.
  • The open Scenario 5, where the attacker sees only a subset of models, might be solvable with spectral or graph-prior techniques that estimate the missing parts of $P$ from observed rows; the paper acknowledges the scenario as future work.
  • The same pairwise similarity features could be used defensively as a topology-exposure audit: a federation operator can monitor cosine similarities between shared models to detect when its own topology has become inferable.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 7 minor

Summary. The paper studies privacy leakage of the overlay topology in Decentralized Federated Learning (DFL). It introduces a taxonomy of topology inference attacks based on attacker knowledge, proposes two attack mechanisms—EDGEPRE, an MLP-based edge classifier trained with partial edge labels (SC1/SC2), and INFERGAT, an unsupervised GAT-based adjacency reconstructor (SC3/SC4)—and evaluates them across six datasets and a range of synthetic and real-world topologies. The central claim is that the DFL overlay topology can be accurately inferred from node models alone, with Table 1 reported as quantitative support (EDGEPRE F1 around 0.79–0.89 in SC1/SC2; INFERGAT AUC around 0.76–0.81 in SC4).

Significance. If the central claim holds, the paper identifies a novel and practically relevant privacy risk in DFL systems and provides a useful taxonomy plus a publicly available codebase. The evaluation is broad in terms of datasets and topologies, and the supervised results are consistent and fairly strong. However, the theoretical motivation in Section 3 contains a mathematical error, the reported superiority of INFERGAT is contradicted by Table 1 in SC3, and several experimental parameters (label budget, training length, threshold baselines) are not reported. These issues currently prevent the paper from being accepted as is.

major comments (5)
  1. [Section 3] Equation (6) is incorrect: the aggregation matrix P = D^{-1}(A+I) defined in Eq. (2) is row-stochastic, so its spectral radius is exactly 1, not less than 1, and ||P^T M0|| does not tend to 0 as T grows; P^T converges to a rank-one consensus/projection operator. Consequently the statement that "the impact of individual updates diminishes" and the convergence argument based on ||P^{T-t}|| -> 0 are unsupported. Because this is the stated theoretical basis for why topology leaves traces in models, the paper must either derive the correct asymptotics (e.g., how the local-update terms P^{T-t}δ_t encode topology through the mixing dynamics) or explicitly restrict the attack claim to finite training horizons. As written, this is a load-bearing error in the motivation.
  2. [Section 6.1C] All experiments fix the number of communication rounds at "rounds = number of nodes", with no variation of T. Given that the topology signal may be a finite-transient effect (as the corrected analysis of Section 3 would show, and as the current invalid proof was trying to argue), the paper needs to report attack F1/AUC as a function of T, e.g., from a few rounds to several times the number of nodes, along with a measure of mixing. Without this, the central claim is only established for one arbitrary stopping rule and cannot be separated from the convergence phase of DFL training.
  3. [Section 6.3, Table 1] The text states that "INFERGAT ranks best in SC3–SC4 across all datasets", but Table 1 contradicts this for SC3. In SC3, KMeans achieves higher F1 than INFERGAT on ImageNet10 (0.792 vs 0.765), Malware (0.779 vs 0.664), MNIST (0.754 vs 0.657), and SVHN (0.907 vs 0.769), and GMM exceeds INFERGAT on MNIST (0.864 vs 0.657). The claim should be corrected to specify where INFERGAT is actually best, and the comparisons should be accompanied by significance or consistency tests.
  4. [Section 5.2.1 and Table 1] The supervised attack is trained on "a small set of labeled node pairs", but the paper never reports the number or fraction of labeled edges used for EDGEPRE in SC1/SC2, nor how performance varies with the label budget. Since the threat model assumes partial edge knowledge, the feasibility of the attack depends directly on this quantity. In addition, no threshold-based baseline on the chosen metric matrix is reported: in SC2/SC4, a simple threshold on cosine similarity (and in SC1/SC3 on relative loss) would quantify how much EDGEPRE/INFERGAT add beyond direct metric thresholding. This baseline is especially needed because INFERGAT's objective in Eq. (14) reconstructs the input metric matrix X, so the comparison separates the learned representation from the raw metric signal.
  5. [Section 6.2 and 7.2] The selection of cosine similarity as the attack feature relies on the separation between edge and non-edge distributions, but this separation may be driven by similarity of local data distributions rather than by direct communication. The non-IID experiment in Fig. 4 shows a performance drop, but it does not control for data similarity independent of topology. The paper should include a null-model experiment (e.g., the same data partition with a randomly reshuffled topology, or a data-only similarity predictor) to isolate the marginal signal contributed by the DFL aggregation process, and to characterize when the attack is really exploiting topology rather than data similarity.
minor comments (7)
  1. [Abstract and Section 4] The phrase "solely from model behavior" is stronger than what SC1 and SC3 assume, since those scenarios use local datasets to compute relative loss; please qualify the claim.
  2. [Section 3, Eq. (5)] The notation alternates between M_t and \tilde M_t without a clear derivation of Eq. (5) from Eqs. (3)–(4); please clarify the recursion.
  3. [Section 5.1, Eq. (9)] The metric called "Relative Entropy" is actually cross-entropy, as it uses true labels y_k(x); rename or redefine it.
  4. [Section 6.1C] The choice of "rounds = number of nodes" is given no justification; a sentence explaining the rationale, or an ablation over training length, would help.
  5. [Figure 1] The caption contains a typo in the axis label ("VLAUE"), and the term "normalized value" should specify which normalization is applied.
  6. [Section 5.2 and 6.1] The experimental section does not report hyperparameters (e.g., number of GAT layers/heads, hidden sizes, training epochs, learning rates) for EDGEPRE and INFERGAT; please include them for reproducibility.
  7. [Table 1] Many entries have AUC exactly 0.500 and near-constant F1 (e.g., Logistic and BGRL), suggesting degenerate predictions; a brief discussion of these baselines would improve interpretation.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: topology inference is an empirical attack whose output is validated against ground-truth adjacency; the Section 3 spectral-radius error is a correctness risk, not a circular step.

full rationale

The paper's central claim—that node-level model behaviors leak the DFL overlay topology—is supported by an empirical pipeline, not by a definitional reduction. The features (Eqs. 8–13) are computed from models and datasets; the targets are ground-truth edges A; and the reported F1/AUC compare predicted adjacency A′ against A under held-out evaluation (Algorithm 1 uses a partial labeled edge set Ptrain, and Table 1 reports generalization, with near-chance AUC for weak baselines). INFERGAT's training objective (Eq. 14) minimizes reconstruction error between A′ and the input feature matrix X, but the evaluation then measures A′ against ground-truth A, so success is not forced by the objective; it is an empirical test of whether X correlates with topology. The metric choice (cosine similarity, relative loss) is informed by Figure 1's edge/non-edge distributions, which is feature selection on the same benchmark and may be optimistic, but it does not make any predicted edge equal to a fitted input by construction. Self-citations [1,2,7,8] appear only as background on DFL platforms, robustness, and datasets; no load-bearing argument reduces to them. Section 3's assertion that ρ(P)<1 for row-stochastic P is mathematically false (ρ(P)=1 for a connected graph with self-loops), and the bound ∥P^T M0∥→0 should be a convergence-to-consensus statement; this is a correctness risk in the motivation, not a circularity, because the empirical evaluation does not rely on that bound being true.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The central claim does not depend on a fitted numeric parameter beyond standard ML hyperparameters, but it depends on domain assumptions about the DFL aggregation rule, attacker model access, and the relationship between data similarity and model similarity. No new physical or conceptual entities are introduced.

assumptions (4)
  • domain assumption G is connected and local updates are bounded
    Used in Section 3 to argue that P^T M0 tends to zero and the series of local updates converges, which motivates why topology mixing shapes the final models.
  • domain assumption DFL aggregation follows P = D^{-1}(A+I), i.e., equal-weight averaging with self-loops
    Equation (2) defines the aggregation rule; the attack metrics assume this averaging makes neighbors' models similar. Other gossip or weighted aggregation rules may weaken or distort the signal.
  • domain assumption The attacker can observe the final model of every node without noise or differential privacy
    Scenarios SC1 through SC4 all assume M' = M. Section 7.3 shows that differential privacy reduces attack F1 by roughly 23 percent, so the unperturbed model-access assumption is load-bearing.
  • domain assumption Pairwise cosine similarity between node models is primarily driven by graph adjacency rather than by data distribution similarity
    Sections 5.1 and 6.2 choose cosine similarity as the attack feature because it separates edge pairs from non-edge pairs. If unconnected nodes have highly similar data, this metric would create false edges, and the paper does not control for this confound.

how reviews work

0 comments
Cite this review

Pith. "Pith review of From Models to Network Topologies: A Topology Inference Attack in Decentralized Federated Learning." pith.science (2026). https://pith.science/paper/MVJEPA55

@misc{pith2026250103119,
  author       = {Pith},
  title        = {Pith review of: From Models to Network Topologies: A Topology Inference Attack in Decentralized Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MVJEPA55}},
  note         = {Machine review of arXiv:2501.03119}
}
read the original abstract

Federated Learning (FL) is widely recognized as a privacy-preserving Machine Learning paradigm due to its model-sharing mechanism that avoids direct data exchange. Nevertheless, model training leaves exploitable traces that can be used to infer sensitive information. In Decentralized FL (DFL), the topology, defining how participants are connected, plays a crucial role in shaping the model's privacy, robustness, and convergence. However, the topology introduces an unexplored vulnerability: attackers can exploit it to infer participant relationships and launch targeted attacks. This work uncovers the hidden risks of DFL topologies by proposing a novel Topology Inference Attack that infers the topology solely from model behavior. A taxonomy of topology inference attacks is introduced, categorizing them by the attacker's capabilities and knowledge. Practical attack strategies are designed for various scenarios, and experiments are conducted to identify key factors influencing attack success. The results demonstrate that analyzing only the model of each node can accurately infer the DFL topology, highlighting a critical privacy risk in DFL systems. These findings offer insights for improving privacy preservation in DFL environments.

Figures

Figures reproduced from arXiv: 2501.03119 by the authors.

Figure 2
Figure 2. Impact of topology density on the F1-scores achieved by each attack scenario on the CIFAR10 dataset. yields only a modest drop (typically a few points), indicating that model parameters alone already encode most of the topology signal. The larger degradation appears when supervision is removed: in SC3, INFERGAT remains strongest but F1 becomes dataset-dependent (e.g., ≈0.89 on CIFAR10 vs. ≈0.66–0.77 on MNIST and Mal… view at source ↗
Figure 3
Figure 3. Impact of network size on the F1-scores achieved by each attack scenario on the CIFAR10 dataset. 7 Mitigation The effectiveness of the proposed topology inference attacks indi￾cates that topology in DFL systems can be discerned solely by an￾alyzing model behaviors. This observation highlights the security and privacy concerns of DFL systems. This section proposes defense strategies to mitigate these vulnerabilities … view at source ↗
Figure 4
Figure 4. Impact of local training epochs and data heterogeneity on the F1-Score of topology inference attacks in the CIFAR10 dataset. Consistent with findings in prior inference attack literature, the success of topology inference attacks is closely tied to the degree of overfitting in the target model. To validate this, experiments were conducted on the CIFAR10 dataset under four attack scenarios. By increasing the number o… view at source ↗
Figures from the paper (6 more)
Figure 5
Figure 5. Figure 5: Normalized distributions of attack metrics in various topology DFL systems trained on the CIFAR10 dataset. The “edge group” corresponds to metrics calculated between directly connected nodes, while the “non-edge group” corresponds to metrics calculated between nodes wi…
Figure 6
Figure 6. Figure 6: Normalized distributions of attack metrics in various topology DFL systems trained on the MNIST dataset. The “edge group” corresponds to metrics calculated between directly connected nodes, while the “non-edge group” corresponds to metrics calculated between nodes with…
Figure 7
Figure 7. Figure 7: Normalized distributions of attack metrics in various topology DFL systems trained on the FMNIST dataset. The “edge group” corresponds to metrics calculated between directly connected nodes, while the “non-edge group” corresponds to metrics calculated between nodes wit…
Figure 8
Figure 8. Figure 8: Normalized distributions of attack metrics in various topology DFL systems trained on the SVHN dataset. The “edge group” corresponds to metrics calculated between directly connected nodes, while the “non-edge group” corresponds to metrics calculated between nodes with …
Figure 9
Figure 9. Figure 9: Normalized distributions of attack metrics in various topology DFL systems trained on the ImageNet10 dataset. The “edge group” corresponds to metrics calculated between directly connected nodes, while the “non-edge group” corresponds to metrics calculated between nodes…
Figure 10
Figure 10. Figure 10: Normalized distributions of attack metrics in various topology DFL systems trained on the Malware dataset. The “edge group” corresponds to metrics calculated between directly connected nodes, while the “non-edge group” corresponds to metrics calculated between nodes w…

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Topology-Aware Differential Privacy in Federated Learning

    cs.CR 2025-06 conditional novelty 6.0 of 10

    The paper derives a per-client mutual-information bound for topology-aware leakage in differentially private federated learning and a min-max noise allocation that improves the bound over uniform noise when leverage s...

Reference graph

Works this paper leans on

35 extracted references · 24 canonical work pages · cited by 1 Pith paper

  1. [1]

    E. T. M. Beltrán, Á. L. P. Gómez, C. Feng, P. M. S. Sánchez, S. L. Bernal, G. Bovet, M. G. Pérez, G. M. Pérez, and A. H. Celdrán. Fed- stellar: A platform for decentralized federated learning. Expert Systems with Applications, 242:122861, 2024

    work page 2024

  2. [2]

    E. T. Beltrán, M. Q. Pérez, P. M. S. Sánchez, S. L. Bernal, G. Bovet, M. G. Pérez, G. M. Pérez, and A. H. Celdrán. Decentralized feder- ated learning: Fundamentals, state of the art, frameworks, trends, and challenges. IEEE Communications Surveys and Tutorials, 25(4):2983– 3013, 2023. doi: 10.1109/COMST.2023.3315746

    arXiv 2023

  3. [3]

    Castro, M

    R. Castro, M. Coates, G. Liang, R. Nowak, and B. Yu. Network tomog- raphy: Recent developments, 2004

    work page 2004

  4. [4]

    Coates, A

    A. Coates, A. O. Hero III, R. Nowak, and B. Yu. Internet tomography. IEEE Signal processing magazine, 19(3):47–65, 2002

    work page 2002

  5. [5]

    Dayal, D

    S. Dayal, D. Alhadidi, A. Abbasi Tadi, and N. Mohammed. Compara- tive analysis of membership inference attacks in federated learning. In Proceedings of the 27th International Database Engineered Applica- tions Symposium, pages 185–192, 2023

    work page 2023

  6. [6]

    J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248–255. Ieee, 2009

    2009

  7. [7]

    C. Feng, A. H. Celdrán, J. V on der Assen, E. T. M. Beltrán, G. Bovet, and B. Stiller. Dart: A solution for decentralized federated learning model robustness analysis. Array, page 100360, 2024

    work page 2024

  8. [8]

    C. Feng, A. H. Celdran, J. Han, H. Ren, X. Cheng, Z. Zeng, L. Krauter, G. Bovet, and B. Stiller. A crowdsensing intrusion detec- tion dataset for decentralized federated learning models. arXiv preprint arXiv:2507.13313, 2025

    work page arXiv 2025

Show all 35 references
  1. [9]

    Fredrikson, S

    M. Fredrikson, S. Jha, and T. Ristenpart. Model inversion attacks that exploit confidence information and basic countermeasures. In Proceed- ings of the 22nd ACM SIGSAC conference on computer and communi- cations security, pages 1322–1333, 2015

    2015

  2. [10]

    Ganju, Q

    K. Ganju, Q. Wang, W. Yang, C. A. Gunter, and N. Borisov. Property inference attacks on fully connected neural networks using permutation invariant representations. In Proceedings of the 2018 ACM SIGSAC conference on computer and communications security, pages 619–633, 2018

    2018

  3. [11]

    Gomez-Rodriguez, J

    M. Gomez-Rodriguez, J. Leskovec, and A. Krause. Inferring networks of diffusion and influence. ACM Transactions on Knowledge Discovery from Data (TKDD), 5(4):1–37, 2012

    2012

  4. [12]

    N. Z. Gong and B. Liu. Attribute inference attacks in online social networks. ACM Transactions on Privacy and Security (TOPS) , 21(1): 1–30, 2018

    2018

  5. [13]

    N. Z. Gong, W. Xu, L. Huang, P. Mittal, E. Stefanov, V . Sekar, and D. Song. Evolution of social-attribute networks: measurements, model- ing, and implications using google+. InProceedings of the 2012 internet measurement conference, pages 131–144, 2012

    2012

  6. [14]

    Hamilton, Z

    W. Hamilton, Z. Ying, and J. Leskovec. Inductive representation learn- ing on large graphs.Advances in neural information processing systems, 30, 2017

    2017

  7. [15]

    Hartert, S

    R. Hartert, S. Vissicchio, P. Schaus, O. Bonaventure, C. Filsfils, T. Telkamp, and P. Francois. A declarative and expressive approach to control forwarding paths in carrier-grade networks. ACM SIGCOMM computer communication review, 45(4):15–28, 2015

    2015

  8. [16]

    K. He, X. Zhang, S. Ren, and J. Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016

    2016

  9. [17]

    T. Hou, Z. Qu, T. Wang, Z. Lu, and Y . Liu. Proto: Proactive topology ob- fuscation against adversarial network topology inference. In IEEE IN- FOCOM 2020-IEEE Conference on Computer Communications, pages 1598–1607. IEEE, 2020

    2020

  10. [18]

    H. Hu, Z. Salcic, L. Sun, G. Dobbie, P. S. Yu, and X. Zhang. Member- ship inference attacks on machine learning: A survey. ACM Computing Surveys (CSUR), 54(11s):1–37, 2022

    2022

  11. [19]

    Jin, W.-P

    X. Jin, W.-P. K. Yiu, S.-H. G. Chan, and Y . Wang. Network topology inference based on end-to-end measurements.IEEE Journal on Selected areas in Communications, 24(12):2182–2195, 2006

    2006

  12. [20]

    Krizhevsky, G

    A. Krizhevsky, G. Hinton, et al. Learning multiple layers of features from tiny images, 2009

    2009

  13. [21]

    LeCun and C

    Y . LeCun and C. Cortes. MNIST handwritten digit database. http: //yann.lecun.com/exdb/mnist/, 2010. Accessed: 2016-01-14

    2010

  14. [22]

    McMahan, E

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas. Communication-efficient learning of deep networks from decentralized data. In Artificial intelligence and statistics, pages 1273–1282. PMLR, 2017

    2017

  15. [23]

    Netzer, T

    Y . Netzer, T. Wang, A. Coates, A. Bissacco, B. Wu, A. Y . Ng, et al. Reading digits in natural images with unsupervised feature learning. In NIPS workshop on deep learning and unsupervised feature learning , volume 2011, page 4. Granada, 2011

    2011

  16. [24]

    Orlowski, R

    S. Orlowski, R. Wessäly, M. Pióro, and A. Tomaszewski. Sndlib 1.0—survivable network design library. Networks: An International Journal, 55(3):276–286, 2010

    2010

  17. [25]

    Salem, Y

    A. Salem, Y . Zhang, M. Humbert, P. Berrang, M. Fritz, and M. Backes. Ml-leaks: Model and data independent membership inference at- tacks and defenses on machine learning models. arXiv preprint arXiv:1806.01246, 2018

    2018 arXiv

  18. [26]

    Sandler, A

    M. Sandler, A. Howard, M. Zhu, A. Zhmoginov, and L.-C. Chen. Mobilenetv2: Inverted residuals and linear bottlenecks, 2019. URL https://arxiv.org/abs/1801.04381

    2019 arXiv

  19. [27]

    L. Sha. Imagenet10 (kaggle version). https://www.kaggle.com/datasets/ liusha249/imagenet10, 2022

    2022

  20. [28]

    Shokri, M

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE Symposium on Security and Privacy (SP) , pages 3–18, 2017. doi: 10.1109/SP.2017.41

    2017 doi

  21. [29]

    Thakoor, C

    S. Thakoor, C. Tallec, M. G. Azar, R. Munos, P. Veli ˇckovi´c, and M. Valko. Bootstrapped representation learning on graphs. In ICLR 2021 workshop on geometrical and topological representation learn- ing, 2021

    2021

  22. [30]

    Wang, Y .-X

    Y . Wang, Y .-X. Wang, and A. Singh. Graph connectivity in noisy sparse subspace clustering. In Artificial Intelligence and Statistics, pages 538–

  23. [31]

    H. Xiao, K. Rasul, and R. V ollgraf. Fashion-mnist: A novel image dataset for benchmarking machine learning algorithms. arXiv:1708.07747 [cs, stat] , Sept. 2017. doi: 10.48550/arXiv.1708. 07747. Accessed: 2023-07-11

    2017 doi arXiv

  24. [32]

    X. Yin, Y . Zhu, and J. Hu. A comprehensive survey of privacy- preserving federated learning: A taxonomy, review, and future direc- tions. ACM Computing Surveys (CSUR), 54(6):1–36, 2021

    2021

  25. [33]

    W. Yu, M. Luo, P. Zhou, C. Si, Y . Zhou, X. Wang, J. Feng, and S. Yan. Metaformer is actually what you need for vision. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10819–10829, 2022

    2022

  26. [34]

    Zhang and Y

    M. Zhang and Y . Chen. Link prediction based on graph neural networks. Advances in neural information processing systems, 31, 2018

    2018

  27. [35]

    edge group

    Y . Zhu, Y . Xu, F. Yu, Q. Liu, S. Wu, and L. Wang. Deep graph contrastive representation learning. arXiv preprint arXiv:2006.04131, 2020. A appendix A.1 Topology Information This work utilizes two categories of topologies: synthetic and real-world. The synthetic topologies in...

    2006 arXiv

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.