Pith. sign in

REVIEW 4 major objections 5 minor 16 references

SenseCrypt: Sensitivity-guided Selective Homomorphic Encryption for Joint Federated Learning in Cross-Device Scenarios

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read SenseCrypt lets each federated-learning client encrypt its own sensitivity-selected parameters, reporting normal accuracy, blocked inversion attacks, and 58.4–88.7% lower training time than established HE schemes.

desk verdict A timely selective-HE framework with a real straggler insight, but the MI constraint at the heart of the security claim is unsatisfiable as written—so the paper needs major revision, not a quick fix. read the letter →

arxiv 2508.04100 v1 pith:RDJWU4DK submitted 2025-08-06 cs.CR cs.AIcs.DC

Borui Li , Li Yan , Junhao Han , Jianmin Liu , Lei Yu This is my paper
classification cs.CRcs.AIcs.DC
keywords federatedlearninghomomorphicencryptionselectiveparametersensitivityclientclusteringdataheterogeneitystragglerproblemprivacyleakage
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

SenseCrypt's claim is that selective homomorphic encryption—encrypting only part of the model before upload—can be made practical in cross-device federated learning, where clients differ in both data and hardware. The key move is to let each client choose its own encryption mask rather than sharing one global mask. The choice is driven by a first-order sensitivity vector $\Gamma_i \approx |w_i^\top \nabla_W L(W_i)|$, which the paper uses both to rank parameters by privacy risk and to cluster clients whose local data are effectively IID (same distribution). Each client then gets a straggler-free encryption budget from the slower of its bandwidth and CPU speed, and solves a binary mask optimization that minimizes encrypted-parameter count, maximizes protected sensitivity, and caps mutual-information leakage. The paper reports that this preserves normal model accuracy on non-IID data, resists gradient-inversion attacks, and cuts training time by 58.4–88.7% relative to plain and selective-HE baselines.

What carries the argument

The load-bearing object is the first-order parameter-sensitivity vector $\Gamma_i = |w_i^\top \nabla_W L(W_i)|$, computable in $O(N_w)$ multiplications per client. It does three jobs: it ranks parameters by contribution to the loss (hence by exposure to inversion attacks), it serves as a data-distribution fingerprint for Euclidean-distance clustering via Affinity Propagation, and its weighted sum is the maximized objective in the per-client mask selection. The other central mechanism is the per-client encryption budget $\alpha_i=\min\{r_i,v_i\}$ normalized to $[0,1]$ within a cluster, which turns device capability into a hard constraint $\sum_k x^i_k \le \lfloor \alpha_i N_w\rfloor$ that pre

What would settle it

On a set of clients with known label distributions, compute the Euclidean distances between their first-round sensitivity vectors and compare them with the Earth Mover's distances between their label distributions: if any two clients with markedly different label distributions are closer in sensitivity distance than two clients known to share the same distribution, the clustering premise is falsified. For the security claim, run the paper's iLRG attack on a client whose mask encrypts only 3.1% of MNIST parameters: if label-number accuracy approaches the no-encryption client's level, the claime

Watch

Extended reading notes

Core claim

The central discovery, on the paper's own terms, is that one vector—the element-wise product of model parameters and their gradients—can carry the entire selective-encryption design. Because $|w^\top\nabla_W L(W)|$ approximates the loss change when a parameter is zeroed, it measures how much privacy that parameter exposes; because gradients are known to leak data-distribution information, the same vector is taken to encode which clients have similar data. Clients upload this vector once; the server clusters them with Affinity Propagation, which needs no preset number of clusters; within each cluster, a normalized $\min(\text{bandwidth}, \text{CPU speed})$ score fixes each client's encryption

Load-bearing premise

The load-bearing premise is that the sensitivity vector computed in the first training round reliably reflects which clients have similar data distributions; if that link weakens after round one or fails for other architectures, the clustering-based accuracy and security benefits disappear.

Editorial extensions

If this is right

  • Federated learning platforms can cluster clients for IID training using sensitivity vectors alone, removing the need for raw data, gradient exchange, or extra scheduling components.
  • Homomorphic-encryption overhead can be aligned with device capability, so slower clients encrypt fewer parameters instead of blocking the round—a direct fix for the straggler problem in cross-device FL.
  • The mutual-information threshold $\eta_{\mathrm{MI}}$ gives operators a single tunable knob to trade encryption cost against the worst-case leakage from unencrypted parameters.
  • Because per-cluster aggregation is just FedAvg on Paillier ciphertexts, the scheme can be bolted onto existing FL stacks without changing core aggregation logic.
  • Moving decryption to a trusted key-management server (the paper's dual-server extension) removes the client-side decryption bottleneck while preserving the same masks and aggregation.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper, the same first-round sensitivity fingerprint could plausibly drive client selection, personalized local epochs, or adaptive aggregation—uses the paper does not evaluate.
  • The honest-but-curious threat model leaves open the possibility that a malicious client uploads a crafted sensitivity vector to steer clustering or inflate its encryption budget; testing robustness to adversarial sensitivity vectors would be a natural next step.
  • Since the paper's low encryption ratios (3–6%) still blunt iLRG attacks, the redundancy of deep models may permit even smaller or layer-targeted masks; quantifying that floor across datasets and architectures would sharpen the security–overhead trade-off.
  • The paper's choice of Paillier over batched schemes such as CKKS means the per-client masks rule out SIMD packing; developing a packing-compatible variant of per-client selective HE is the clearest open path to closing the remaining overhead gap.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. SenseCrypt is a selective homomorphic encryption framework for cross-device federated learning. It uses model-parameter sensitivity vectors, computed from the first training iteration via |w^T grad_W L|, to cluster clients with similar data distributions using Affinity Propagation. It then derives per-client encryption budgets from normalized bandwidth and CPU speed, and formulates a multi-objective binary integer program that minimizes the number of encrypted parameters while maximizing the sum of sensitivities of encrypted parameters, subject to a straggler-free budget, an exponential security-level constraint, and a mutual-information privacy constraint. Experiments on CIFAR10/100, MNIST, and FMNIST compare SenseCrypt against MaskCrypt, full Paillier HE, and plaintext FedAvg, reporting training-time reductions of 58.4%–88.7%, accuracy comparable to IID training, and resistance to iLRG inversion attacks. The paper includes extensive appendices on DP-based clustering, dual-server key management, collusion resistance, and component-wise timing.

Significance. If the claims hold, the paper would address a real practical bottleneck in applying homomorphic encryption to cross-device federated learning by making selective encryption adaptive to both data and system heterogeneity. The work is clearly presented and contains useful engineering components: a DP-noised clustering variant, a dual-server extension, a collusion-resistance proof, and a detailed component timing analysis. The iLRG attack evaluation is a positive addition. However, the central optimization constraint used to justify the security/overhead balance is formally problematic, the accuracy comparison is confounded by clustered training, and the calibration of the security constants is circular. These issues are load-bearing for the paper’s main claims and require substantive revision.

major comments (4)
  1. [Section 3.3, Eq. (8)] The mutual-information constraint is formally unsatisfiable as stated. W−w=(1−Xi)⊙W is a deterministic function of W, so I(W;W−w) equals the entropy of the unencrypted parameters (or is undefined for continuous weights under the discrete-sum formula of Eq. (3)). With N_w in the tens of thousands and η_MI=2.0, no mask with any unencrypted parameter can satisfy the constraint. No estimator or implementation is provided, and Appendix H measures MI only for hand-crafted strategies, not for the masks produced by the proposed MOBIP. The optimization therefore effectively reduces to constraints (6)–(7), and the advertised 'adaptive balance' is not established. Please either redefine MI (e.g., per-parameter or conditional on the mask), provide the estimator actually used, or remove constraint (8) and justify the security/overhead trade-off directly.
  2. [Section 4.2, Figs. 2–4] The accuracy comparison is confounded by clustered training. SenseCrypt trains a separate FedAvg model per IID cluster, whereas MaskCrypt and Baseline train a single global model over the union of non-IID clients. The text attributes the accuracy gain to client clustering ('This is majorly due to the client clustering'), so the result is an expected property of clustered FL, not evidence for the sensitivity-guided selective encryption. To support the central claim, include a clustered baseline in which MaskCrypt-style selective HE is applied after the same clustering (or a standard clustered-FL method), and compare against it with matched mask sizes.
  3. [Appendix F vs. Section 4.1] The security constants B and C are inconsistent and circular. Main text reports {C=0.5, B=2} for CIFAR10, while Appendix F states the optimal combination is (B=1.5, C=0.30) for CIFAR-10. The appendix selects B and C by minimizing the same MI quantity used to evaluate privacy, so constraint (7) is calibrated against the evaluation metric rather than an independent measure. Report the exact values used in each experiment, provide the selection criterion, and evaluate how results change when B and C are varied independently of MI.
  4. [Section 3.1 and Appendix E] The claim that a single first-iteration sensitivity vector reliably measures data-distribution similarity is supported only by one qualitative heatmap on AlexNet/CIFAR10 (Fig. 12), with no comparison to other similarity measures and no validation across architectures/datasets. Since clustering is load-bearing for the accuracy and overhead results, this assumption needs stronger empirical support (e.g., ablation against gradient-based or EMD-based clustering) and a statement about failures or sensitivity to training stage.
minor comments (5)
  1. [Abstract and Section 4.2] The training-time reduction is reported as '58.4%–88.7%' in the abstract but the text states 58.4%–62.7% vs. MaskCrypt and 81.4%–88.7% vs. Baseline. Clarify the comparison basis.
  2. [Section 3.2] The Max Absolute Scaling equation 'ui = ui / max{|ui|}N_c' is notationally sloppy; the subscript N_c and the division should be defined clearly.
  3. [Section 2.2, Eq. (3)] Equation (3) uses discrete sums over W and W−w although model parameters are continuous; clarify whether weights are quantized and how the joint distribution is estimated.
  4. [Figures 6–8] 'HE ratio' is used without an explicit definition; define it as the fraction of encrypted model parameters at first use.
  5. [References] The citation '(Pyt 2013)' should refer to the python-paillier repository with proper author and access date, rather than as a standalone author-year entry.

Circularity Check

1 steps flagged · score 2.0 of 10

Minor self-referential B/C calibration against the MI metric; central security claim is externally grounded by iLRG attacks.

  1. other [Appendix F; Eq. (7) in Sec. 3.3; MI definition Eq. (3) in Sec. 2.2; constraint Eq. (8)]
    "To guide their selection, we propose an empirical methodology based on the following objectives: ... (2) Reduce Mutual Information (MI) between the original model parameters W and the ones after selective encryption W−w, thereby limiting privacy leakage. ... Based on the empirical analysis results, we know that (B = 1.5, C = 0.3) is the best combination that can achieve the maximum encryption ratio with the minimum MI."

    B and C are the constants in the security protection level constraint (7). They are chosen by minimizing the same I(W;W−w) that Section 2.2 defines as the privacy-leakage metric and that constraint (8) imposes as a privacy limit. Thus any MI-level privacy validation of the optimization output partly reflects the fitting objective used to set the security constraint, rather than an independent prediction. This is not a full reduction: the paper's main security claims are validated with external iLRG attacks (LeAcc/LnAcc, Figures 6-8), and the B,C values actually used in Section 4.1 ({C=0.7,B=1.3} for FMNIST; {C=0.5,B=2} for CIFAR10) differ from the Appendix F optimum (B=1.5,C=0.3), so the calibration overlap is minor.

full rationale

The derivation chain is largely self-contained. Sensitivity is defined from a standard first-order Taylor expansion (Eq. 2) and used both to cluster clients and to select encryption masks, with the sensitivity-distribution link supported by an independent heatmap experiment (Appendix E). The adaptive budget is computed from measured bandwidth/CPU norms (Sec. 3.2), not from the target security outcome. The mask optimization (Eqs. 4-7) is a sensitivity-weighted knapsack whose output is then tested against the external iLRG attack, so the security claim does not reduce to a fitted parameter. Two non-circular weaknesses should be noted: (i) the MI constraint (8) is formally vacuous, since W−w=(1−Xi)⊙W is a deterministic function of W, making I(W;W−w) the entropy of the unencrypted parameters and far above ηMI=2.0 for any non-trivial mask; the paper provides no estimator or measurement for the actual masks, which is a feasibility/correctness flaw rather than a circularity; (ii) B and C are calibrated against the same MI metric used as a privacy indicator, a mild self-reference that would deserve more weight if the external attack results were absent. The self-citations (Han & Yan 2023; Hu & Li 2024) serve as baselines/background and are not used to justify the central claim, so they do not raise the score.

Assumptions & free parameters 5 free parameters · 6 assumptions · 0 invented entities

The framework introduces several hand-chosen constants (B, C, eta_MI, beta) and relies on unproven domain assumptions about sensitivity as a proxy for data distribution and about resource normalization as a proxy for encryption capacity. The central contribution is therefore heuristic and empirically tuned rather than derived.

free parameters (5)
  • B (security scaling constant) = B=1.3 (FMNIST), B=2 (CIFAR10), B=1.5 (Appendix F optimal)
    Controls step size of exponential security protection level in Eq. (7); selected empirically in Appendix F to minimize MI and maximize encryption ratio on CIFAR10.
  • C (security lower bound constant) = C=0.7 (FMNIST), C=0.5 (CIFAR10), C=0.3 (Appendix F optimal)
    Controls lower bound of security protection level in Eq. (7); tuned together with B.
  • eta_MI (MI threshold) = 2.0
    Privacy leakage threshold in constraint (8); set by hand based on dataset complexity and privacy requirements.
  • beta_1, beta_2 (objective weights) = 1, 1
    Weights for scalarizing the multi-objective optimization; assumed equal importance by hand, can be customized.
  • DP noise scale sigma and norm bound G (optional) = varies with epsilon; delta=1e-5
    Used only in the optional DP-clustering variant to calibrate Gaussian noise; not used in main experiments.
assumptions (6)
  • standard math First-order Taylor expansion approximates parameter sensitivity (Eq. 2)
    Assumes quadratic and higher terms in the loss expansion are negligible when zeroing parameters; standard in pruning literature but not always accurate for deep networks.
  • domain assumption Model parameter sensitivity reflects client data distribution
    Stated in Section 2.1 and Appendix E; supported only by a heatmap comparison between pairwise EMD and sensitivity distance for one AlexNet/CIFAR10 setup, no theoretical justification.
  • ad hoc to paper The min of normalized bandwidth and CPU speed, after max-abs scaling, equals the fraction of parameters a client can encrypt without straggling
    Section 3.2; assumes encrypting x% of parameters takes x% of the round time and that the bottleneck resource is limiting, which is not validated.
  • ad hoc to paper Exponential security protection function 1 - C e^{-B alpha_i}
    Chosen to prevent fast clients from over-encrypting; no derivation, fitted via Appendix F.
  • domain assumption Mutual information I(W; (1-X)⊙W) can be computed and bounded in practice
    Constraint (8) depends on MI, but the paper provides no estimator or algorithm for computing it in large models.
  • domain assumption Honest-but-curious server and honest clients, with clients sharing a private key
    Section 2.3; Appendix I acknowledges the private-key sharing issue and proposes a dual-server variant for collusion resistance.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SenseCrypt: Sensitivity-guided Selective Homomorphic Encryption for Joint Federated Learning in Cross-Device Scenarios." pith.science (2026). https://pith.science/paper/RDJWU4DK

@misc{pith2026250804100,
  author       = {Pith},
  title        = {Pith review of: SenseCrypt: Sensitivity-guided Selective Homomorphic Encryption for Joint Federated Learning in Cross-Device Scenarios},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RDJWU4DK}},
  note         = {Machine review of arXiv:2508.04100}
}
read the original abstract

Homomorphic Encryption (HE) prevails in securing Federated Learning (FL), but suffers from high overhead and adaptation cost. Selective HE methods, which partially encrypt model parameters by a global mask, are expected to protect privacy with reduced overhead and easy adaptation. However, in cross-device scenarios with heterogeneous data and system capabilities, traditional Selective HE methods deteriorate client straggling, and suffer from degraded HE overhead reduction performance. Accordingly, we propose SenseCrypt, a Sensitivity-guided selective Homomorphic EnCryption framework, to adaptively balance security and HE overhead per cross-device FL client. Given the observation that model parameter sensitivity is effective for measuring clients' data distribution similarity, we first design a privacy-preserving method to respectively cluster the clients with similar data distributions. Then, we develop a scoring mechanism to deduce the straggler-free ratio of model parameters that can be encrypted by each client per cluster. Finally, for each client, we formulate and solve a multi-objective model parameter selection optimization problem, which minimizes HE overhead while maximizing model security without causing straggling. Experiments demonstrate that SenseCrypt ensures security against the state-of-the-art inversion attacks, while achieving normal model accuracy as on IID data, and reducing training time by 58.4%-88.7% as compared to traditional HE methods.

Figures

Figures reproduced from arXiv: 2508.04100 by the authors.

Figure 1
Figure 1. Framework of SenseCrypt. we let each client only upload its sensitivity vector once dur￾ing the first FL training iteration. Thus, clients’ sensitivity vectors cannot be observed (like gradients) for inversion at￾tack as in (Hitaj, Ateniese, and Perez-Cruz 2017; Zhu, Liu, ´ and Han 2019; Geiping et al. 2020). Specifically, during the first FL training iteration, we ap￾ply Equation (2) to obtain the sensitivity vecto… view at source ↗
Figure 2
Figure 2. Performance comparison in statistical heterogeneity scenario. [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Performance comparison in system heterogeneity scenario. [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (12 more)
Figure 4
Figure 4. Figure 4: Performance comparison in statistical & system heterogeneity scenario. [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Training time under system heterogeneity. 0 50 100 CIFAR100 1 2 3 4 5 6 7 8 9 0 50 100 MNIST LeAcc LnAcc 0 50 100 0 50 100 Percentage (%) HE ratio HE ratio (%) Client ID [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 9
Figure 9. Figure 9: Imbalanced client HE time costs of existing Selec [PITH_FULL_IMAGE:figures/full_fig_p010_9.png]
Figure 10
Figure 10. Figure 10: HE ratios of existing Selective HE methods under [PITH_FULL_IMAGE:figures/full_fig_p011_10.png]
Figure 12
Figure 12. Figure 12: Heat map matrix of pairwise model parameter [PITH_FULL_IMAGE:figures/full_fig_p011_12.png]
Figure 13
Figure 13. Figure 13: Encryption ratios under different B and C values. 1.5 2.0 B values 0.4 0.6 0.8 1.0 1.2 C values Optimal (B=1.50, C=0.30) 1.25 1.30 1.35 1.40 Mutual Information [PITH_FULL_IMAGE:figures/full_fig_p012_13.png]
Figure 14
Figure 14. Figure 14: Mutual information under different B and C val￾ues. methodology based on the following objectives: (1) Ensure the model parameter selection optimization problem has a valid solution under system heterogeneity. (2) Reduce Mutual Information (MI) between the origi￾nal m…
Figure 17
Figure 17. Figure 17: Impact of ϵ on Clustering Accuracy. cohesion and separation. It is computed as: S(i) = b(i) − a(i) max(a(i), b(i)), (10) where a(i) is the mean distance between sample i and all other data points in the same cluster, and b(i) is the mean distance between sample i and …
Figure 15
Figure 15. Figure 15: Heat map matrix of pairwise similarity between [PITH_FULL_IMAGE:figures/full_fig_p013_15.png]
Figure 16
Figure 16. Figure 16: Impact of ϵ on Silhouette Score. in Figure 15b, excessive noise injection over sensitivity val￾ues (ϵ = 0.01) significantly hinders the effective measure￾ment of data similarity. Driven by these observations, we vary ϵ from 0.01 to 1.0 and apply the AP method and the …
Figure 18
Figure 18. Figure 18: Impact of Encryption Ratio and Strategy on Mu [PITH_FULL_IMAGE:figures/full_fig_p014_18.png]
Figure 19
Figure 19. Figure 19: Comparison of data reconstruction results. [PITH_FULL_IMAGE:figures/full_fig_p017_19.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

16 extracted references · 13 canonical work pages

  1. [1]

    The aggregation server only per- forms homomorphic additions on ciphertexts, and clients only receive the final, decrypted global model from the DKMS

    Enhanced Security: By isolating the private key on a dedicated DKMS, we prevent the aggregation server and any potentially malicious clients from decrypting indi- vidual client updates. The aggregation server only per- forms homomorphic additions on ciphertexts, and clients only receive the final, decrypted global model from the DKMS

    work page

  2. [2]

    The final aggregated model is decrypted once by the DKMS and then distributed to all clients

    Improved Efficiency in Heterogeneous Environ- ments: In our system, clients only perform encryption. The final aggregated model is decrypted once by the DKMS and then distributed to all clients. This elimi- nates the need for each client to perform decryption lo- cally, which can be a significant bottleneck, especially for resource-constrained devices. Si...

    work page

  3. [3]

    another in the model’s structure

    I(W; (1− Xi) ⊙ W) ≤ ηMI (MI Constraint) Selectively encrypt model: We,∗ i ← Encrypt(We i , Xi, pk) Send We,∗ i and Xi to AggregationServer(); 10 AggregationServer(): Receive We,∗ i and Xi from all clients in GIID; Aggregate encrypted models: We+1,∗ ← X i∈GIID ni NG We,∗ i Create union mask for decryption: bX ← S i∈GIID Xi; Send We+1,∗ and bX to DKMS(); 11...

    work page arXiv 2022

  4. [5]

    of NeurIPS

    Inverting gradients-how easy is it to break privacy in federated learning? In Proc. of NeurIPS. Han, J.; and Yan, L. 2023. Adaptive Batch Homomorphic Encryption for Joint Federated Learning in Cross-Device Scenarios. IEEE IoT-J, 11(6). Hao, M.; Li, H.; Xu, G.; Liu, S.; and Yang, H. 2019. Towards Efficient and Privacy-Preserving Federated Deep Learning. In...

    arXiv 2023

  5. [7]

    Importance Estimation for Neural Network Pruning. In Proc. of CVPR. Molchanov, P.; Tyree, S.; Karras, T.; Aila, T.; and Kautz, J

    work page

  6. [9]

    BatchCrypt: Efficient Homomorphic Encryption for Cross-Silo Federated Learning. In Proc. of USENIX ATC. Zhang, S.; Li, Z.; Chen, Q.; Zheng, W.; Leng, J.; and Guo, M. 2021. Dubhe: Towards Data Unbiasedness With Homo- morphic Encryption in Federated Learning Client Selection. In Proc. of ICPP. Zhang, T.; Lam, K.-Y .; Zhao, J.; Li, F.; Han, H.; and Jamil, N....

    work page 2021

  7. [10]

    IEEE TDSC, 20(2)

    Aggregation Service for Federated Learning: An Effi- cient, Secure, and More Resilient Realization. IEEE TDSC, 20(2). Zhou, R.; Yu, J.; Wang, R.; Li, B.; Jiang, J.; and Wu, L

    work page

  8. [11]

    A Reinforcement Learning Approach for Minimizing Job Completion Time in Clustered Federated Learning. In Proc. of INFOCOM. Zhu, L.; Liu, Z.; and Han, S. 2019. Deep Leakage from Gradients. In Proc. of NeurIPS. A Notations Notation Description W Model parameters of a neural network W−w Model parameters with w zeroed-out L(W) Model loss function ∇WL(W) Gradi...

    work page 2019

Show all 16 references
  1. [14]

    P xi kγi kP γi k ⩾ 1 − Ce −Bαi (Security Constraint)

    PN w k=1 xi k ⩽ ⌊αiN w⌋ (Budget Constraint) 2. P xi kγi kP γi k ⩾ 1 − Ce −Bαi (Security Constraint)

  2. [16]

    How- ever, these methods mostly rely on additional components to measure data similarity or coordinate FL training, which creates extra burden for FL framework adaptation

    proposed to utilize adaptive client selection and gradi- ent compression for addressing the straggler problem. How- ever, these methods mostly rely on additional components to measure data similarity or coordinate FL training, which creates extra burden for FL framework adapta...

    2021

  3. [2013]

    https://github.com/data61/ python-paillier

    Python Paillier Library. https://github.com/data61/ python-paillier. Accessed in June, 2024. Abadi, M.; Chu, A.; Goodfellow, I.; McMahan, H. B.; Mironov, I.; Talwar, K.; and Zhang, L. 2016. Deep Learning with Differential Privacy. In Proc. of CCS. Bonawitz, K.; Eichner, H.; Gr...

    2024

  4. [2017]

    Pruning Convolutional Neural Networks for Resource Efficient Inference. In Proc. of ICLR. Paillier, P. 1999. Public-Key Cryptosystems Based on Com- posite Degree Residuosity Classes. In Proc. of EURO- CRYPT. Queyrut, S.; Schiavoni, V .; and Felber, P. 2023. Mitigating Adversar...

    1999 arXiv

  5. [2019]

    Global Sparse Momentum SGD for Pruning Very Deep Neural Networks. In Proc. of NeurIPS. Fan, J.; Wu, K.; Tang, G.; Zhou, Y .; and Huang, S. 2024. Taking advantage of the mistakes: Rethinking clustered fed- erated learning for iot anomaly detection. IEEE TPDS , 35(6). Frey, B. J...

    2024

  6. [2020]

    TiFL: A Tier-Based Federated Learning System. In Proc. of HPDC. Chen, W.; Ma, G.; Fan, T.; Kang, Y .; Xu, Q.; and Yang, Q. 2021. Secureboost+: A High Performance Gradient Boosting Tree Framework for Large Scale Vertical Feder- ated Learning. arXiv preprint arXiv:2110.10927. Ch...

    2021 arXiv

  7. [2022]

    MIT press

    Introduction to Algorithms. MIT press. Danielsson, P.-E. 1980. Euclidean Distance Mapping. Com- puter Graphics and Image Processing, 14(3). Ding, X.; ding, g.; Zhou, X.; Guo, Y .; Han, J.; and Liu, J

    1980

  8. [2023]

    Instance-Wise Batch Label Restoration via Gradients in Federated Learning. In Proc. of ICLR. MacQueen, J. 1967. Some Methods for Classification and Analysis of Multivariate Observations. In Proc. of BSMSP. McMahan, B.; Moore, E.; Ramage, D.; Hampson, S.; and y Arcas, B. A. 201...

    1967

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.