A New Federated Learning Framework Against Gradient Inversion Attacks

Liangqiong Qu; Pengxin Guo; Shuang Zeng; Weihong Ren; Wenhao Chen; Xiaodan Zhang; Yuyin Zhou

REVIEW 3 major objections 5 minor 1 cited by

A New Federated Learning Framework Against Gradient Inversion Attacks

T0 review · 3 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Sharing only hypernetwork weights, HyperFL aims to make gradient-inversion attacks unattainable while preserving federated learning accuracy and avoiding the privacy-utility trade-offs of noise-based defenses.

desk verdict A genuinely new client-side hypernetwork FL architecture with strong utility, but the privacy guarantee is argued rather than proven and the simulation-based attack surface is not addressed. read the letter →

arxiv 2412.07187 v1 pith:OJO43YOI submitted 2024-12-10 cs.LG cs.CR

Pengxin Guo , Shuang Zeng , Wenhao Chen , Xiaodan Zhang , Weihong Ren , Yuyin Zhou , Liangqiong Qu This is my paper · ORCID

classification cs.LGcs.CR

keywords federatedlearninggradientinversionattackshypernetworkprivacy-utilitytrade-offpersonalizedparameter-efficientfine-tuningdifferentialprivacyconvergenceanalysis

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Federated learning clients transmit model updates, and recent work has shown those updates can be inverted to reconstruct private training images. HyperFL is a proposed framework that avoids the inversion problem structurally: each client's feature extractor is generated by a hypernetwork from a private per-client embedding, and only the hypernetwork parameters are uploaded to the server for aggregation. The paper argues that this severs the direct connection between shared parameters and private data, because an attacker would need the private classifier and embedding to compute the hypernetwork gradient and invert it, and the required joint optimization over image, embedding, and generated weights is intractable. The reported result is accuracy matching FedAvg while reconstruction metrics (PSNR, SSIM, LPIPS) are comparable to differential-privacy baselines, with convergence rate $O(1/\sqrt{T})$ in the non-convex setting. The paper's claim is that a favorable privacy-utility trade-off against gradient inversion is achievable without noise, encryption, or secure aggregation.

What carries the argument

The load-bearing object is the hypernetwork $h(\cdot;\varphi_i)$ acting as a private parameter generator: it maps a client embedding $v_i$ to the feature extractor weights $\theta_i = h(v_i;\varphi_i)$. The classifier $\phi_i$ and the embedding $v_i$ are never uploaded, so the server sees only the aggregated hypernetwork parameters $\bar{\varphi}$. This decoupling is what breaks the gradient-to-data link: the shared parameters do not directly expose $x$, and any attempt to recover $x$ must first undo the hypernetwork map, which requires the private classifier and a joint optimization over $x$, $v$, and $\theta$.

What would settle it

Run a gradient-inversion attack on HyperFL in which the attacker knows the public architecture and a small set of labels, and instead of optimizing $x$ alone, jointly optimizes $x$, an estimated classifier, and the embedding $v$; if reconstructed images reach near-original quality (PSNR above roughly 25 dB), the central privacy claim is falsified.

Watch

Extended reading notes

Core claim

The central claim is that the combination of a hypernetwork, a locally kept classifier, and a private client embedding makes recovering client data $x$ using gradient inversion attacks unattainable. Each client decomposes its model into a feature extractor $f(\cdot;\theta_i)$ and classifier $g(\cdot;\phi_i)$, with $\theta_i = h(v_i;\varphi_i)$ produced by a hypernetwork from the private embedding $v_i$. Only the hypernetwork parameters $\varphi_i$ are transmitted; the classifier and embedding are trained locally and never shared. Since the gradient of the hypernetwork loss passes through the private classifier, the honest-but-curious server cannot form the gradient needed to invert, and attempting to optimize $x$ and the embedding simultaneously faces a high-dimensional search space that prior GIA work already found hard.

Load-bearing premise

The defense assumes the server cannot recover the private client embedding $v_i$ (and hence $\theta_i$) from the sequence of shared hypernetwork updates, on the grounds that computing the hypernetwork gradient requires the private classifier and that joint optimization is intractable; this is argued through Eqs. (9)-(10) rather than proved.

Editorial extensions

If this is right

If HyperFL works as claimed, federated learning can obtain gradient-inversion protection without the accuracy loss or communication overhead of DP, SMC, or HE.
The defense is structural rather than noise-based, so the server sees clean aggregated parameters and the framework runs faster than DP-based baselines.
HyperFL-LPM extends the same defense to large pre-trained models by generating adapter weights, making the approach compatible with modern fine-tuning pipelines.
The convergence proof matches FedAvg's non-convex rate and gives a linear rate under a PL condition, so privacy protection does not slow optimization.
Learned client embeddings cluster according to data distribution, so the hypernetwork acts as a personalized model generator with privacy preserved.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The privacy claim rests on the hardness of joint optimization; a stronger attacker who estimates the classifier from the public architecture and alternates between recovering $v$ and $x$ could test this assumption directly.
Because the server never sees feature extractors, the framework may also blunt attacks that exploit feature-space statistics, not only gradient inversion.
The appendix's generalization analysis suggests the privacy benefit may scale with heterogeneity: more distinct client embeddings make the inversion problem harder, and the framework's personalization helps in non-IID settings.
A natural extension is to measure how reconstruction quality degrades as embedding dimension or hypernetwork capacity grows; the paper's experiments fix the embedding dimension at 64.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The main idea here is worth taking seriously. HyperFL moves the hypernetwork from the server (where pFedHN and FedTP put it) to the client, and uses a private client embedding to generate the feature extractor. Only the hypernetwork weights are shared. That breaks the direct link between shared parameters and raw data in a way I haven't seen in the cited prior work, and the utility results back it up: HyperFL beats FedAvg and the DP baselines on four benchmarks, and the LPM variant with adapters is a sensible extension. The convergence proof is standard—L-smoothness, bounded variance, bounded gradients—and I did not spot a hole in it. The generalization bound in the appendix is a nice extra, though it reads like a side remark.

The soft spot is the privacy analysis in Section 4.1, and it's load-bearing. The paper claims recovery of x via GIA is 'unattainable' because the attacker would need the classifier's gradient to get the hypernetwork gradient, and joint optimization of x, v, and the classifier is hard. That is an empirical difficulty, not a lower bound. Worse, the attack model in Eq. (8) gives the attacker the hypernetwork gradient, but in the actual protocol the server only sees the final phi_i. The natural attack is simulation-based: choose candidate x, y, v, run the client's local update steps (Eqs. 4-5) from the public global phi_bar using an approximate classifier, and minimize the distance between the simulated phi and the observed phi. That requires only a differentiable simulator, not the true classifier gradient. The paper does not consider this attack at all. Their own cited reference, ROG, shows exactly this failure mode for gradient-obfuscation defenses. The tailored attack in the appendix is designed around the same assumed difficulty, so it doesn't fill the gap.

I want to be clear: the empirical privacy results are decent—IG, ROG, and the tailored attack all fail to reconstruct meaningful images, with metrics close to the DP baselines. That shows the defense resists those specific attacks. But the headline claim is 'unattainable,' and that is not supported. The authors should either formalize a hardness assumption or, more practically, evaluate against the simulation-based attack and multi-round variants. Until then, the paper should be read as 'a promising architectural defense with strong utility and preliminary privacy evidence,' not as a proven guarantee.

This is a solid submission for the FL privacy subfield. I'd send it to reviewers, with the expectation that the privacy analysis gets substantial revision. The convergence and utility parts are publishable as is. The privacy part needs either a formal adversary model or a much wider attack evaluation.

Referee Report

3 major / 5 minor

Summary. The paper proposes HyperFL, a federated learning framework in which each client's feature extractor is generated by a per-client hypernetwork from a private client embedding, and only the hypernetwork parameters are shared with the server. The claimed contribution is a favorable privacy-utility trade-off: the framework allegedly "breaks the direct connection" between shared parameters and local data, making gradient inversion attacks (GIA) unattainable without relying on DP, SMC, or HE. The paper provides a convergence analysis (Theorem 1 and Corollary 1) under standard smoothness, bounded variance, and bounded gradient assumptions, a generalization bound (Theorem 2), and utility experiments on four datasets showing HyperFL matches or exceeds FedAvg and outperforms several DP-based FL methods. Privacy is evaluated via inversion attacks (IG, ROG, and a tailored attack), with reported reconstruction metrics (PSNR, SSIM, LPIPS) indicating that HyperFL obfuscates images as strongly as DP methods while retaining higher accuracy.

Significance. If the privacy claim were rigorously established, HyperFL would be a significant contribution, offering a way to reduce GIA leakage without DP's utility cost. The paper has several strengths: it supplies a conventional but internally coherent convergence proof (Theorem 1, Appendix A.1), a generalization bound (Appendix B), and reproducible code. The utility experiments are extensive and show that HyperFL is competitive with FedAvg and clearly better than the DP baselines used in Table 1. However, the paper's central claim—that recovering x is 'unattainable' (Section 4.1)—rests on an informal difficulty argument rather than a formal hardness assumption or a lower bound, and the attack evaluation does not include the strongest known attack class (simulation-based inversion). Consequently, the significance of the privacy contribution is not yet established; the current evidence supports only an empirical obfuscation claim, not a privacy guarantee.

major comments (3)

[Section 4.1, Eqs. (8)-(10)] The central privacy claim is not proven. The analysis argues that the attacker cannot compute the hypernetwork gradient ∇φL because it requires the private classifier, and that joint optimization over (x, v, θ) is 'challenging'. This addresses only an attacker who is restricted to exact gradient computation from the objective in Eq. (8). In the actual protocol, the server receives the updated hypernetwork parameters φ_i (and knows the global φ_bar), so a natural adversary is simulation-based: choose candidate x, v, and an approximate classifier ϕ, run the local update in Eqs. (4)-(5), and minimize ||φ_simulated - φ_observed||^2. The paper's counterargument—that the output θ is high-dimensional and the search space is large—is an empirical difficulty, not a lower bound. The paper should either evaluate against such a simulation-based attack or state an explicit hardness assumption; without that, the word 'unattainable' in the final paragraph of Section 4.1 is unsupported.
[Appendix D.1, DP baseline setting] The configuration of the DP baselines appears internally inconsistent. The text states 'the DP budget ϵ is set to 4 and the Gaussian noise σ is 1e−5', yet Table 1 reports DP-FedAvg at 35.12% accuracy on EMNIST, far below FedAvg's 72.77%. A Gaussian noise scale of 1e-5 is negligible and should not cause such a large drop unless paired with an extreme clipping threshold or an erroneous adaptation. Since the utility comparison is used to argue that HyperFL achieves a favorable privacy-utility trade-off relative to DP methods, this setup must be clarified and the experiments repeated with standard DP accounting (e.g., a normal noise multiplier and a meaningful budget), or the reported numbers should be corrected.
[Section 5.2, Table 3 and Table 5] The privacy evaluation compares reconstruction metrics (PSNR, SSIM, LPIPS) between HyperFL and DP-based methods, but the comparison is not apples-to-apples. DP methods provide a formal (ε, δ) privacy guarantee, whereas HyperFL provides none; the reported metrics only show that under specific attacks (IG, ROG) HyperFL images are as distorted as DP-noised images. To substantiate the 'similar level of privacy protection' claim, the paper should either provide a formal quantification of the attacker's error (e.g., a lower bound on the reconstruction distortion under a defined threat model) or explicitly frame HyperFL as an empirical defense without a formal privacy guarantee. The current wording overstates the privacy assurance.

minor comments (5)

[Section 3.2, Eq. (3)] The notation in Eq. (3) is ambiguous: the loss is written as Li(h(vi; φi), ϕi), but earlier Li is defined as an expectation over data. Clarify that the same Li is used for both the empirical and expected loss, consistent with the problem formulation in Section 3.1.
[Section 4.2, Theorem 1] The bound in Eq. (11) can be simplified: 2 sqrt(LMG^2D/(2T)) = sqrt(2LMG^2D/T). Also, the proof sets η_min = sqrt(2D/(LMG^2T)) at the end, but the theorem statement defines η_min as a minimum over the three learning rates; state explicitly that the stated choice of learning rates yields the displayed rate.
[Appendix A, proof of Theorem 1] In the proof, the notation in Eq. (20) uses ¯g_t_{i,φ} without squaring in one place (the term (1/2)η_h(¯g_t_{i,φ})^2 appears in the proof text, but the display in inequality (20) shows the square; correct this inconsistency for clarity.
[Section 4.1, citation of ∆θ] The statement that ∆θ = θ_t - θ_{t-1} 'serves as an approximation for the gradient of the feature extractor' is attributed to Zhang et al. 2019, which is the Lookahead optimizer paper. A more standard reference for using parameter differences in gradient-matching attacks would be the GIA literature; the current citation may confuse readers.
[General] The phrase 'unattainable' in Section 4.1 is much stronger than the evidence supports. Unless a formal hardness result is added, recommend softening this to 'resistant' or 'empirically difficult to recover' to match the level of the analysis.

Circularity Check

0 steps flagged · score 1.0 of 10

No load-bearing circularity: the convergence and privacy analyses are self-contained; the central privacy claim rests on an unproven hardness assumption, which is a correctness risk rather than a circular derivation.

full rationale

I walked the claimed derivation chain. Theorem 1 and Corollary 1 are derived from Assumptions 1-4 via standard smoothness and PL arguments; no constant is fitted to the reported accuracies and no proof step assumes the conclusion. The generalization bound (Theorem 2) is an application of Baxter 2000 under stated Lipschitz assumptions, not a circular reuse of the paper's own result. The privacy analysis in Section 4.1 does not derive the security claim from a fitted parameter or from a self-citation; it argues that an attacker cannot compute the hypernetwork gradient because the classifier is private (Eq. 9) and that joint optimization of input and embedding is challenging (Eq. 10). That is an unproven hardness assumption about the attack surface, and the server's actual view (only uploaded hypernetwork parameters, not the hypernetwork gradient) may admit simulation-based attacks not captured by Eq. (8), but this is an evidential gap rather than a self-definitional reduction. The self-citations in Sections 1 and 2 (e.g., Guo et al. 2024, Zeng et al. 2024, Zhang et al. 2024) are contextual and not load-bearing for the main claims. Privacy evaluation uses external attack baselines IG and ROG and does not fit constants to the reported PSNR/SSIM/LPIPS values. No equation reduces to another equation by construction, and no fitted parameter is renamed as a prediction.

Assumptions & free parameters 1 free parameters · 7 assumptions · 1 invented entities

The framework introduces no new physical entities; the private client embedding is a learned latent. The central convergence proof relies on standard smoothness/boundedness assumptions, while the privacy claim rests on two unproven difficulty assumptions about the adversary's optimization problem.

free parameters (1)

client embedding dimension = 64
Hand-chosen; no sensitivity analysis, and it controls the size of the private latent the server would need to recover.

assumptions (7)

standard math Li is L-smooth jointly in (phi, phi, v) (Assumption 1).
Used in the descent inequalities of Theorem 1; standard but not checked numerically.
standard math Stochastic gradient variance bounded by sigma^2 (Assumption 2).
Standard for SGD convergence; no empirical verification.
standard math Expected squared stochastic gradient norm bounded by G^2 (Assumption 3).
Used to bound noise accumulation over local steps; standard.
standard math Each client loss satisfies the Polyak-Lojasiewicz condition (Assumption 4).
Needed for linear convergence corollary; strong for deep networks.
standard math Lipschitz conditions on h and losses (Assumption 5).
Used for generalization bound via Baxter 2000.
domain assumption Server is honest-but-curious and never sees classifier phi_i or embedding v_i.
Defines the threat model; if server gets auxiliary information, privacy argument changes.
ad hoc to paper Recovering the high-dimensional hypernetwork output theta from shared gradients is difficult without knowing v, and joint optimization over x and v is intractable.
This unproven difficulty is the load-bearing justification for privacy; no lower bound or complexity argument is given.

invented entities (1)

Private client embedding v_i
purpose: A trainable per-client latent vector that conditions the hypernetwork to generate personalized feature extractor weights; kept on the client and never shared.
It is a learned model component without external falsifiable handle; its main function is to make generated feature extractors client-specific.

how reviews work

0 comments

Cite this review

Pith. "Pith review of A New Federated Learning Framework Against Gradient Inversion Attacks." pith.science (2026). https://pith.science/paper/OJO43YOI

@misc{pith2026241207187,
  author       = {Pith},
  title        = {Pith review of: A New Federated Learning Framework Against Gradient Inversion Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OJO43YOI}},
  note         = {Machine review of arXiv:2412.07187}
}

read the original abstract

Federated Learning (FL) aims to protect data privacy by enabling clients to collectively train machine learning models without sharing their raw data. However, recent studies demonstrate that information exchanged during FL is subject to Gradient Inversion Attacks (GIA) and, consequently, a variety of privacy-preserving methods have been integrated into FL to thwart such attacks, such as Secure Multi-party Computing (SMC), Homomorphic Encryption (HE), and Differential Privacy (DP). Despite their ability to protect data privacy, these approaches inherently involve substantial privacy-utility trade-offs. By revisiting the key to privacy exposure in FL under GIA, which lies in the frequent sharing of model gradients that contain private data, we take a new perspective by designing a novel privacy preserve FL framework that effectively ``breaks the direct connection'' between the shared parameters and the local private data to defend against GIA. Specifically, we propose a Hypernetwork Federated Learning (HyperFL) framework that utilizes hypernetworks to generate the parameters of the local model and only the hypernetwork parameters are uploaded to the server for aggregation. Theoretical analyses demonstrate the convergence rate of the proposed HyperFL, while extensive experimental results show the privacy-preserving capability and comparable performance of HyperFL. Code is available at https://github.com/Pengxin-Guo/HyperFL.

Figures

Figures reproduced from arXiv: 2412.07187 by the authors.

**Figure 1.** Left. Existing methods mainly explore defenses mechanisms on the shared gradients. Such mechanisms, including SMC, HE, and DP, inherently involve substantial privacy-utility trade-offs. Right. A novel FL framework that “breaks the direct connection” between the shared parameters and the local private data is proposed to achieve a favorable privacy-utility trade-off. et al. 2024; Guo et al. 2024; Zhang et al. 2024… view at source ↗

**Figure 2.** The proposed HyperFL framework. HyperFL decouples each client’s network into the former feature extractor [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 3.** The proposed HyperFL-LPM framework within [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

Figures from the paper (5 more)

**Figure 4.** Figure 4: (a) Average training loss of different methods on [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]

**Figure 5.** Figure 5: Reconstructed images of IG. is set to 600 for all datasets except EMNIST, where the size is 1000. For the DP-based FL methods, the DP budget ϵ is set to 4 and the Gaussian noise σ is 1e−5 to satisfy the (ϵ, σ) privacy guarantee. Average test accuracy of all local model…

**Figure 6.** Figure 6: Reconstructed images of ROG. cover any information from the proposed HyperFL framework, thereby showcasing the robust privacy preservation capability of HyperFL [PITH_FULL_IMAGE:figures/full_fig_p018_6.png]

**Figure 7.** Figure 7: Reconstructed images of the tailored attack [PITH_FULL_IMAGE:figures/full_fig_p018_7.png]

**Figure 8.** Figure 8: (a) Label distribution of the EMNIST dataset with [PITH_FULL_IMAGE:figures/full_fig_p018_8.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

Deep Learning Model Inversion Attacks and Defenses: A Comprehensive Survey
cs.CR 2025-01 accept novelty 4.0 of 10

A structured literature review that taxonomizes model inversion attacks and defenses and provides a public resource repository.

Reference graph

Works this paper leans on

12 extracted references · 5 canonical work pages · cited by 1 Pith paper

[5]

IEEE Transactions on Big Data

Privacy-preserving aggregation in federated learning: A survey. IEEE Transactions on Big Data. Liu, Z.; Lin, Y .; Cao, Y .; Hu, H.; Wei, Y .; Zhang, Z.; Lin, S.; and Guo, B. 2021. Swin transformer: Hierarchical vi- sion transformer using shifted windows. In Proceedings of the IEEE/CVF international conference on computer vision, 10012–10022. Lowy, A.; and...

work page 2021
[6]

International Journal of Intelligent Systems , 37(11): 9373– 9389

An effective and practical gradient inversion attack. International Journal of Intelligent Systems , 37(11): 9373– 9389. Ma, J.; Naas, S.-A.; Sigg, S.; and Lyu, X. 2022. Privacy- preserving federated learning based on multi-key homomor- phic encryption. International Journal of Intelligent Sys- tems, 37(9): 5880–5901. Ma, K.; Sun, Y .; Cui, J.; Li, D.; Gu...

work page 2022
[8]

Provable Defense against Privacy Leakage in Federated Learning from Representation Perspective

Provable defense against privacy leakage in federated learning from representation perspective. arXiv preprint arXiv:2012.06043. Tashakori, A.; Zhang, W.; Wang, Z. J.; and Servati, P. 2023. SemiPFL: personalized semi-supervised federated learning framework for edge intelligence. IEEE Internet of Things Journal. Van der Maaten, L.; and Hinton, G. 2008. Vis...

work page Pith review arXiv 2012
[10]

Future Generation Computer Systems , 128: 365–380

Non-interactive verifiable privacy-preserving feder- ated learning. Future Generation Computer Systems , 128: 365–380. Yao, A. C. 1982. Protocols for secure computations. In23rd annual symposium on foundations of computer science (sfcs 1982), 160–164. IEEE. Yin, H.; Mallya, A.; Vahdat, A.; Alvarez, J. M.; Kautz, J.; and Molchanov, P. 2021. See through gra...

arXiv 1982
[12]

1 m mX i=1 Li xt+1 i # − L∗ ≤(1 − ηminµ)t+1D + ηmin LM G2 4µ . (32) If we set ηmin ≤ µϵ LM G2 , after O( 1 ϵ log( 1 ϵ )) steps, we have E

Tackling data heterogeneity in federated learning via loss decomposition. In International Conference on Medi- cal Image Computing and Computer-Assisted Intervention , 707–717. Springer. Zhang, C.; Li, S.; Xia, J.; Wang, W.; Yan, F.; and Liu, Y . 2020a. {BatchCrypt}: Efficient homomorphic encryption for {Cross-Silo} federated learning. In 2020 USENIX an- ...

arXiv 2020
[2004]

IEEE transactions on image process- ing, 13(4): 600–612

Image quality assessment: from error visibility to structural similarity. IEEE transactions on image process- ing, 13(4): 600–612. Wei, W.; Liu, L.; Loper, M.; Chow, K.-H.; Gursoy, M. E.; Truex, S.; and Wu, Y . 2020. A framework for evaluating gra- dient leakage attacks in federated learning. arXiv preprint arXiv:2004.10397. Xiao, H.; Rasul, K.; and V oll...

arXiv 2020
[2018]

In International Conference on Learning Repre- sentations

Learning Differentially Private Recurrent Language Models. In International Conference on Learning Repre- sentations. Mou, W.; Fu, C.; Lei, Y .; and Hu, C. 2021. A verifiable fed- erated learning scheme based on secure multi-party compu- tation. In International Conference on Wireless Algorithms, Systems, and Applications, 198–209. Springer. Mugunthan, V ...

arXiv 2021
[2020]

Geng, J.; Mou, Y .; Li, Q.; Li, F.; Beyan, O.; Decker, S.; and Rong, C

Inverting gradients-how easy is it to break privacy in federated learning? Advances in Neural Information Pro- cessing Systems, 33: 16937–16947. Geng, J.; Mou, Y .; Li, Q.; Li, F.; Beyan, O.; Decker, S.; and Rong, C. 2023. Improved Gradient Inversion Attacks and Defenses in Federated Learning. IEEE Transactions on Big Data. Gentry, C. 2009. A fully homomo...

arXiv 2023

Show all 12 references

[2021]

In International conference on machine learning, 2089–2099

Exploiting shared representations for personalized federated learning. In International conference on machine learning, 2089–2099. PMLR. Dang, T.; Thakkar, O.; Ramaswamy, S.; Mathews, R.; Chin, P.; and Beaufays, F. 2021. Revealing and protecting labels in distributed training....

2021 arXiv
[2022]

In International Conference on Ma- chine Learning, 1945–1962

Personalization improves privacy-accuracy tradeoffs in federated learning. In International Conference on Ma- chine Learning, 1945–1962. PMLR. Bonawitz, K.; Ivanov, V .; Kreuter, B.; Marcedone, A.; McMahan, H. B.; Patel, S.; Ramage, D.; Segal, A.; and Seth, K. 2017. Practical ...

1945
[2023]

In 32nd USENIX Security Symposium (USENIX Security 23), 6381–6398

Gradient obfuscation gives a false sense of security in federated learning. In 32nd USENIX Security Symposium (USENIX Security 23), 6381–6398. Zeng, S.; Guo, P.; Wang, S.; Wang, J.; Zhou, Y .; and Qu, L
[2024]

arXiv preprint arXiv:2410.01463

Selective Aggregation for Low-Rank Adaptation in Federated Learning. arXiv preprint arXiv:2410.01463. Ha, D.; Dai, A. M.; and Le, Q. V . 2017. HyperNetworks. In The 5th International Conference on Learning Representa- tions. Hatamizadeh, A.; Yin, H.; Molchanov, P.; Myronenko, ...

2017 arXiv

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [5]

IEEE Transactions on Big Data

Privacy-preserving aggregation in federated learning: A survey. IEEE Transactions on Big Data. Liu, Z.; Lin, Y .; Cao, Y .; Hu, H.; Wei, Y .; Zhang, Z.; Lin, S.; and Guo, B. 2021. Swin transformer: Hierarchical vi- sion transformer using shifted windows. In Proceedings of the IEEE/CVF international conference on computer vision, 10012–10022. Lowy, A.; and...

work page 2021

[2] [6]

International Journal of Intelligent Systems , 37(11): 9373– 9389

An effective and practical gradient inversion attack. International Journal of Intelligent Systems , 37(11): 9373– 9389. Ma, J.; Naas, S.-A.; Sigg, S.; and Lyu, X. 2022. Privacy- preserving federated learning based on multi-key homomor- phic encryption. International Journal of Intelligent Sys- tems, 37(9): 5880–5901. Ma, K.; Sun, Y .; Cui, J.; Li, D.; Gu...

work page 2022

[3] [8]

Provable Defense against Privacy Leakage in Federated Learning from Representation Perspective

Provable defense against privacy leakage in federated learning from representation perspective. arXiv preprint arXiv:2012.06043. Tashakori, A.; Zhang, W.; Wang, Z. J.; and Servati, P. 2023. SemiPFL: personalized semi-supervised federated learning framework for edge intelligence. IEEE Internet of Things Journal. Van der Maaten, L.; and Hinton, G. 2008. Vis...

work page Pith review arXiv 2012

[4] [10]

Future Generation Computer Systems , 128: 365–380

Non-interactive verifiable privacy-preserving feder- ated learning. Future Generation Computer Systems , 128: 365–380. Yao, A. C. 1982. Protocols for secure computations. In23rd annual symposium on foundations of computer science (sfcs 1982), 160–164. IEEE. Yin, H.; Mallya, A.; Vahdat, A.; Alvarez, J. M.; Kautz, J.; and Molchanov, P. 2021. See through gra...

arXiv 1982

[5] [12]

1 m mX i=1 Li xt+1 i # − L∗ ≤(1 − ηminµ)t+1D + ηmin LM G2 4µ . (32) If we set ηmin ≤ µϵ LM G2 , after O( 1 ϵ log( 1 ϵ )) steps, we have E

Tackling data heterogeneity in federated learning via loss decomposition. In International Conference on Medi- cal Image Computing and Computer-Assisted Intervention , 707–717. Springer. Zhang, C.; Li, S.; Xia, J.; Wang, W.; Yan, F.; and Liu, Y . 2020a. {BatchCrypt}: Efficient homomorphic encryption for {Cross-Silo} federated learning. In 2020 USENIX an- ...

arXiv 2020

[6] [2004]

IEEE transactions on image process- ing, 13(4): 600–612

Image quality assessment: from error visibility to structural similarity. IEEE transactions on image process- ing, 13(4): 600–612. Wei, W.; Liu, L.; Loper, M.; Chow, K.-H.; Gursoy, M. E.; Truex, S.; and Wu, Y . 2020. A framework for evaluating gra- dient leakage attacks in federated learning. arXiv preprint arXiv:2004.10397. Xiao, H.; Rasul, K.; and V oll...

arXiv 2020

[7] [2018]

In International Conference on Learning Repre- sentations

Learning Differentially Private Recurrent Language Models. In International Conference on Learning Repre- sentations. Mou, W.; Fu, C.; Lei, Y .; and Hu, C. 2021. A verifiable fed- erated learning scheme based on secure multi-party compu- tation. In International Conference on Wireless Algorithms, Systems, and Applications, 198–209. Springer. Mugunthan, V ...

arXiv 2021

[8] [2020]

Geng, J.; Mou, Y .; Li, Q.; Li, F.; Beyan, O.; Decker, S.; and Rong, C

Inverting gradients-how easy is it to break privacy in federated learning? Advances in Neural Information Pro- cessing Systems, 33: 16937–16947. Geng, J.; Mou, Y .; Li, Q.; Li, F.; Beyan, O.; Decker, S.; and Rong, C. 2023. Improved Gradient Inversion Attacks and Defenses in Federated Learning. IEEE Transactions on Big Data. Gentry, C. 2009. A fully homomo...

arXiv 2023