Pith. sign in

REVIEW 3 major objections 5 minor 46 references

Communication-Efficient Byzantine-Robust Federated Conformal Prediction via Partial Model Sharing

T0 review · 3 major / 5 minor · reviewed 2026-08-02 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Randomly sharing only M of D model parameters per round attenuates Byzantine poisoning energy by exactly M/D, letting federated conformal prediction keep nominal coverage with tighter intervals.

desk verdict The empirical claim holds up for the stochastic attack they study, but the headline Byzantine-robustness theory leans on an M/D attenuation that a mask-aware adversary can sidestep, so the paper needs revisions before it can stand as a general defense. read the letter →

arxiv 2602.18396 v2 pith:U75PL77U submitted 2026-02-20 cs.LG eess.SPmath.PRstat.APstat.ML

Ehsan Lari , Reza Arablouei , Stefan Werner This is my paper · ORCID
classification cs.LGeess.SPmath.PRstat.APstat.ML
keywords federatedlearningconformalpredictionByzantinerobustnesspartialmodelsharingpoisoningintervalsuncertaintyquantificationhistogramfiltering
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

PRISM-FCP argues that the same mechanism used to cut communication cost—each client transmitting only a random subset of model parameters each round—acts as a built-in defense against Byzantine model poisoning. Because a Byzantine client's injected perturbation is masked before it enters the server aggregation, its expected energy drops by the factor M/D, which propagates through the steady-state mean-square error into the residual distribution and finally into the width of conformal prediction intervals. The paper derives this chain formally: exact per-iteration attenuation, a fourth-root quantile-deviation bound, and an exact-filtering guarantee for the calibration stage, provided benign score histograms separate from adversarial ones. Empirically, the method holds 90% coverage under efficiency, coverage, and random attacks while producing intervals about 1.8 times narrower than the calibration-only baseline on synthetic data and about 13 percent narrower on the UCI Superconductivity dataset. The central insight is that adversarial influence shrinks simply because a random mask hides a fraction of the poisoned coordinates from the aggregate, at no extra computational cost to clients.

What carries the argument

The random selection matrix Sk,n, a diagonal matrix with exactly M ones, is the central object: it masks which coordinates clients upload and receive. When a Byzantine client adds noise of variance σ²_B to its update, the masked perturbation has expected squared norm Mσ²_B, exactly M/D times the full-sharing value. This stochastic filter reduces the Byzantine-induced component of steady-state MSE, which in turn tightens residual distributions. The calibration stage uses histogram characterization vectors in the probability simplex, pairwise ℓ₂ distances, and a maliciousness score summing distances to the K_b−1 farthest clients; the paper proves these filters exactly identify Byzantine client

What would settle it

Construct a calibration scenario where all benign clients produce identical residuals that concentrate exactly at the target quantile, so the benign density near q* is zero; then compute the quantile under a small training perturbation. If the observed quantile shift exceeds the fourth-root bound by a wide margin, the density assumption fails. Alternatively, run an adaptive Byzantine client that observes which M parameters are shared and injects all its perturbation energy into those coordinates; under the paper's stochastic attack model the measured interval width should remain near the M/D-a

Watch

Extended reading notes

Core claim

The paper establishes that partial model sharing—exchanging only a randomly chosen M of D parameters per client per round—reduces the expected energy of a Byzantine perturbation entering the federated aggregation by the exact factor M/D (Theorem 2, Eq. 23–24). Combined with the steady-state MSE decomposition (Lemma 3) and a quantile-stability bound that depends on the benign residual density near the target quantile (Theorem 1), this yields a bound on the shift of the conformal quantile that scales as the fourth root of the steady-state parameter error (Corollary 1–2). The mechanism also improves calibration-phase Byzantine detection: lower training error concentrates benign client score his

Load-bearing premise

The entire quantile and coverage argument collapses if the benign residual distribution has negligible density near the target quantile, because the constants involve 1/f_min and the bounds become vacuous; likewise, the exact-filtering guarantee requires that benign and Byzantine score histograms are actually separable in the sense of the score-separation condition.

Editorial extensions

If this is right

  • If partial sharing attenuates Byzantine energy by M/D, then communication efficiency and poisoning robustness become aligned goals: transmitting fewer parameters per round simultaneously saves bandwidth and dilutes adversarial influence.
  • The quantile-deviation bound implies that any training-phase defense that reduces steady-state parameter error will translate into narrower conformal intervals at the same nominal coverage, giving a concrete link between optimization robustness and uncertainty calibration.
  • The exact-filtering guarantee means that, under the stated separation condition, the server can reliably remove all Byzantine calibration submissions without removing benign ones, so post-filtering coverage deviates from nominal only by the training-phase residue.
  • Because the attenuation factor is exact per iteration, the theory suggests that the benefit persists even with a small number of participating clients per round, a regime where many robust aggregation rules degrade.
  • The empirical saturation around M/D≈0.5 indicates that most of the robustness benefit is obtainable with only a modest reduction in communication, and the diminishing returns define a practical operating range for the sharing ratio.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The M/D attenuation argument is purely statistical and does not rely on the linear model: any federated system that randomly masks a fraction of the shared update before aggregation should dilute additive poisoning energy proportionally, so the mechanism plausibly extends to neural networks even though the paper only proves it for linear regression.
  • An adaptive adversary that observes the selection masks could concentrate its perturbation on the shared coordinates, defeating the attenuation; the paper explicitly leaves this case open. A testable extension is to keep masks secret or refresh them rapidly, which would preserve the statistical dilution against even adaptive poisoning.
  • The coverage bounds could be sharpened by replacing the worst-case benign error erms with a distributional assumption on training trajectory errors, which would tighten the separation margin and possibly prove exact filtering in regimes where the current condition fails.
  • Since the M/D attenuation also reduces the observation-noise-driven error component E_φ in the MSE decomposition, the benefits of partial sharing may extend beyond Byzantine attacks to ordinary noisy clients, suggesting a broader regime where communication reduction helps accuracy as well as robustness.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes PRISM-FCP, a federated conformal prediction framework that combines partial model sharing (PSO-Fed) with Rob-FCP-style histogram-based Byzantine filtering. The claimed contribution is end-to-end Byzantine robustness: during training, random partial sharing attenuates the expected energy of a Byzantine perturbation by a factor M/D, reducing steady-state MSE and thereby tightening conformal intervals; during calibration, distance-based maliciousness scores filter Byzantine score submissions. The paper provides a theoretical analysis (Theorems 1–3, Lemmas 1–7, Corollaries 1–5) and experiments on synthetic data and the UCI Superconductivity dataset, reporting near-nominal 90% coverage with narrower intervals than Rob-FCP and reduced communication.

Significance. If fully established, the paper's core idea—that a communication-compression mechanism can double as a Byzantine-defense mechanism—would be a useful and non-obvious contribution to federated conformal prediction. The empirical study is substantial: 100 Monte Carlo trials, three calibration attack types, a real benchmark, an M/D ablation, and a comparison against Rob-FCP and FCP. The paper also makes a concrete, falsifiable prediction (Fig. 5: quantile deviation decreases with smaller M/D) and is honest in Remark 2 about the limited adversary model. However, the central theoretical claim currently rests on the M/D attenuation of instantaneous stochastic perturbations, and the paper does not show that this attenuation propagates to the steady-state quantities used by the downstream theorems. The significance will depend on whether that gap can be closed or the claims appropriately restricted.

major comments (3)
  1. [Sec. II-C, Remark 2; Theorem 2, Eq. (23)–(24)] The exact M/D attenuation is derived under the assumption that δ_{k,n} ~ N(0, σ_B^2 I_D) is independent of the selection mask S_{k,n} and is injected before masking. A Byzantine client knows the mask—it must know which M coordinates to transmit—and, under the standard bounded-norm Byzantine model, it can place its entire perturbation budget on the transmitted coordinates. The masked perturbation energy is then Dσ_B^2, not Mσ_B^2, so partial sharing provides no attenuation. Remark 2 describes such an adversary as 'more powerful,' but this is the canonical Byzantine adversary. Since Corollary 2, Proposition 2, Theorem 3, and Corollaries 4–5 all inherit the claimed E_ω(M) reduction, the paper's headline Byzantine-resilience claim is currently established only for the narrow stochastic non-adaptive attack in Sec. II-C. The authors should either prove a bound for bounded-norm adaptive adversa
  2. [Sec. IV-C, Theorem 2, Eq. (25); Lemma 4] Eq. (23)–(24) computes the instantaneous expected energy E||S_{k,n} δ_{k,n}||_2^2 = M σ_B^2 for a single masked attack vector. The central downstream result, Eq. (25), requires that this attenuation propagates into the steady-state Byzantine MSE term E_ω(M) in the decomposition E = E_φ(M) + E_ω(M) + E_Θ (Lemma 3, Eq. (13)). The paper does not derive an expression for E_ω(M) or prove any monotonicity with respect to M; Lemma 4 is cited to [16] and its statement repeats only the instantaneous expectation. Eq. (25) is therefore not established: the 'if' clause is essentially the desired conclusion, and the sentence about 'matrices whose spectral properties also depend on M' is not a derivation. Corollary 2 and the explanation of the empirical MSE gain (−26.4 dB vs. −21.4 dB) depend on this missing step. The authors should supply the steady-state E_ω(M) analysis or clearly mark the MSE reduc
  3. [Sec. IV-C, Theorem 1 and Corollary 1] The quantile-deviation bound requires inf_{t∈N} f^⋆(t) ≥ f_min > 0 in a neighborhood of the benign quantile q^⋆, and the final bound scales as 1/f_min. If benign nonconformity scores concentrate around a point mass—e.g., many near-zero residuals, or after the normalization/binning used in the calibration stage—f_min can be very small or zero, making the bound vacuous. The manuscript does not discuss how f_min behaves for the synthetic or UCI score distributions, nor does it provide any empirical estimate of f_min. Since the tight-interval claim is justified partly by this theorem, the authors should state this limitation explicitly and, if possible, validate the density condition in the experimental settings.
minor comments (5)
  1. [Sec. II-C] The Byzantine update is written as w_{k,n+1} + β_k τ_{k,n} δ_{k,n} in one place and w_{k,n} + τ_{k,n} δ_{k,n} in the next; align the index and clarify whether δ is added before or after masking (the derivation assumes the former).
  2. [Fig. 5] The quantile deviation is plotted versus M/D, but no error bars or confidence intervals are shown. Since the paper emphasizes Monte Carlo averaging, adding error bars would strengthen the monotonicity claim.
  3. [Lemma 7, proof] The step 'Taking probabilities over (x,y)' is informal: F^⋆(t − Δ(x)) depends on the random quantity Δ(x). Please write the argument with conditional expectations so the bound in Eq. (29) is justified.
  4. [Sec. III-B and Theorem 3] The score-separation condition (34) is plausible but is not validated in the experiments. Reporting the empirical values of Δ, r_a, and r_b (or at least the margin γ) for the three attacks would make the exact-filtering guarantee more convincing.
  5. [Abstract and Title] The phrase 'Byzantine-resilient' overstates the proven scope: the training-phase proof covers stochastic additive Gaussian perturbations, not arbitrary Byzantine behavior. Consider using 'stochastic model-poisoning attacks' in the title/abstract or substantially extending the analysis.

Circularity Check

2 steps flagged · score 4.0 of 10

Load-bearing steady-state attenuation result is imported from the authors' own prior PSO-Fed paper; direct per-iteration calculation and external Rob-FCP framework keep the rest self-contained.

  1. self citation load bearing [Section IV-B, Lemma 4; used in Corollary 2 (Section IV-C)]
    "Lemma 4 (Partial sharing attenuates Byzantine contribution): Partial sharing and client scheduling reduce the Byzantine-induced term Eω, thereby enhancing resilience to model-poisoning attacks [16, Sec. IV]. In particular, when Sk,n selects M parameters uniformly at random, the expected energy (squared ℓ2-norm) of the injected perturbation in the aggregated update is attenuated by a factor M/D."

    The paper's own Corollary 2 concludes 'by Lemma 4, partial sharing reduces the Byzantine-induced term Eω' and thereby tightens the quantile deviation bound. But Lemma 4 is not proved here; it is asserted as a summary of the authors' prior paper [16]. Theorem 2 in this paper computes only the instantaneous masked energy E||Sδ||² = Mσ²_B; it does not derive the steady-state dependence Eω(M) that Corollary 2 needs. Hence the central training-robustness claim rests on a self-citation rather than on a derivation contained in this paper.

  2. self citation load bearing [Section IV-D, Corollary 5 (and Proposition 2/Theorem 3)]
    "Mechanism. By Theorem 3, filtering succeeds with probability at least 1−(δ+δa) whenever the score-separation condition holds, with benign radius rb and error level erms as defined therein. Partial sharing attenuates Byzantine influence during training (Lemma 4), reducing erms (in attack-dominated regimes) and hence shrinking rb, which enlarges the separation margin γ = ∆−ra−rb."

    The advertised end-to-end calibration benefit — narrower coverage bounds under partial sharing — is inherited from the same Lemma 4 citation to [16]. Theorem 3 itself only states a conditional filtering guarantee given the separation margin; the claimed improvement of that margin under partial sharing is exactly the self-cited Eω reduction. Thus the end-to-end advantage is not derived in this paper but imported from the authors' prior work.

full rationale

The paper contains many genuinely self-contained derivations: Theorem 2's expectation E||S_{k,n}δ||² = Mσ²_B follows from the stated Gaussian masking model; Lemmas 5-7 and Theorem 1 are proved from triangle/Cauchy-Schwarz/Bernstein inequalities; Theorem 3's proof is carried out in Appendix A; and the Rob-FCP calibration machinery is cited to an external work [37]. No experiment uses a fitted parameter renamed as a prediction. The main circularity-related weakness is that the bridge from per-iteration energy attenuation to steady-state MSE (Lemmas 3-4) is taken from the authors' earlier PSO-Fed paper [16], and Corollaries 2 and 5 repeatedly invoke that lemma to reach their headline conclusions. This is a load-bearing self-citation, but it is a published prior result and the local calculations around it are independently derived, so the paper is only partially dependent on the self-citation. The adaptive-adversary caveat in Remark 2 is a threat-model scope limitation, not a circularity, and the same-architecture comparison with Rob-FCP is an experimental design choice rather than a definitional identity. Overall circularity score: 4.

Assumptions & free parameters 5 free parameters · 5 assumptions · 1 invented entities

The central parametric assumptions are the linear model, stochastic Gaussian poisoning, and histogram separation. None of these are validated against an independent benchmark in the theory; they are standard modeling assumptions in this literature. The real arbitrariness is concentrated in f_min/f_max density constants and the attack-severity parameters (pa, sigma_B), which the experiments set by hand.

free parameters (5)
  • M/D operating range (0.3-0.5) = recommended 0.3<=M/D<=0.5
    Chosen empirically in Section V-B as the point where interval-width reduction saturates; the theory does not predict an optimal operating ratio for real data.
  • MAD threshold (2.5) and scale (1.4826) = threshold 2.5
    Used in the unknown-|SB| outlier rule (Remark 3); standard robust-statistics defaults, but the effectiveness of the exact-filtering corollaries depends on them.
  • Attack epoch/severity parameters (pa, sigma_B^2, sigma_C^2) = pa=0.25, sigma_B^2=0.1, sigma_C^2=0.5
    Chosen by the authors for simulation; the theoretical guarantees are parameterized in these terms, so the absolute coverage numbers shown are for this attack regime only.
  • Histogram bin count H and bin boundaries = H=100 (or 30 in Fig 2); boundaries 'fixed a priori or estimated from a benign pilot round'
    Binning choice directly affects histogram separation (Lemma 6 constants grow with H, Lemma 7 drift depends on bin positions through f_max at boundaries); the paper does not give a concrete rule.
  • f_min / f_max density constants = abstract
    Theorem 1 and Lemma 7 depend on the benign residual CDF density being bounded away from zero at the quantile and bounded at bin edges; these are assumed, not verified, and make the stated bounds vacuous when density is small.
assumptions (5)
  • domain assumption Linear regression observation model y = w*^T x + noise (Eq. 1); all theory derived only for this model.
    Stated explicitly in Remark 1 as adopted 'for analytical tractability'; the authors say the conceptual mechanism extends beyond linear regression but provide no proof.
  • domain assumption Federated conformal calibration relies on exchangeability/partial exchangeability of calibration data (Eq. 7 and [24,41]).
    Standard CP assumption; the paper's Section II-D invokes it without proof.
  • domain assumption Byzantine training attacks are stochastic additive Gaussian perturbations with probability p_a (Section II-C).
    Explicitly acknowledged in Remark 2 as not covering adaptive adversaries; all attenuation guarantees are in expectation over masks and the attack randomness.
  • domain assumption Byzantine calibration histograms are concentrated around a common adversarial center q with radius r_a (Proposition 2, Theorem 3).
    Needed for the separation margin Delta = ||q-p*||; adversarial clients can in principle spread histograms arbitrarily, which would defeat the distance-based filter. Remark 7 also assumes benign histograms are small perturbations of a common CDF.
  • domain assumption PSO-Fed convergence Lemmas 1-4 from [16] are correct and apply under Byzantine noise.
    The paper does not reproduce the proofs; Section IV-B summarizes results from prior work, which is legitimate but means the soundness of the MSE-decomposition backbone rests on an unverified citation.
invented entities (1)
  • PRISM-FCP framework (partial sharing + histogram distance filtering + maliciousness scores)
    purpose: End-to-end Byzantine-robust federated conformal prediction
    This is a method, not an unexplained physical or mathematical entity; its evidence is the experiments in the paper itself. The characterization-vector filtering is directly borrowed from Rob-FCP.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Communication-Efficient Byzantine-Robust Federated Conformal Prediction via Partial Model Sharing." pith.science (2026). https://pith.science/paper/U75PL77U

@misc{pith2026260218396,
  author       = {Pith},
  title        = {Pith review of: Communication-Efficient Byzantine-Robust Federated Conformal Prediction via Partial Model Sharing},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/U75PL77U}},
  note         = {Machine review of arXiv:2602.18396}
}
abstract

We propose PRISM-FCP (Partial shaRing and robust calIbration with Statistical Margins for Federated Conformal Prediction), a communication-efficient Byzantine-robust federated conformal prediction framework that uses partial model sharing to mitigate stochastic model-poisoning attacks during training and histogram-based filtering to mitigate adversarial calibration submissions. Existing approaches address adversarial behavior only in the calibration stage, leaving the learned model susceptible to poisoned updates. In contrast, PRISM-FCP mitigates attacks end-to-end. During training, clients partially share updates by transmitting only $M$ of $D$ parameters per round. This attenuates the expected energy of an adversary's perturbation in the aggregated update by a factor of $M/D$, yielding lower mean-square error (MSE) and tighter prediction intervals. During calibration, clients convert nonconformity scores into characterization vectors, compute distance-based maliciousness scores, and downweight or filter suspected Byzantine contributions before estimating the conformal quantile. Extensive experiments on both synthetic data and the UCI Superconductivity dataset demonstrate that PRISM-FCP maintains near-nominal empirical coverage in the studied Byzantine settings while avoiding the interval inflation observed in standard FCP, with reduced communication. These results support PRISM-FCP as a robust and communication-efficient approach to federated uncertainty quantification.

Figures

Figures reproduced from arXiv: 2602.18396 by the authors.

Figure 1
Figure 1. Illustration of how partial sharing attenuates Byzantine [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Histograms illustrating the effect of different Byzantine attacks during the calibration phase: (a) efficiency attack (adversaries [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Distribution of maliciousness scores mk (cf. (12)) under different calibration-phase Byzantine attacks. Byzantine clients (red) attain markedly larger scores than benign clients, enabling reliable outlier filtering. 10× the benign mean), and (iii) random attack (adding zero￾mean Gaussian noise with variance σ 2 C = 0.5 to original scores while keeping them nonnegative). We set the size of the characterization vector… view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Illustrative prediction intervals under (a) efficiency, (b) coverage, and (c) random attacks. The true target values are shown [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]
Figure 5
Figure 5. Figure 5: Quantile deviation |qˆ1−α − q ⋆ 1−α| of PRISM-FCP versus sharing ratio M/D under different types of Byzantine attacks. 21,263 samples with D = 81 features describing material properties, with the target being the critical temperature, in Kelvin (K), at which supercondu…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

46 extracted references · 1 linked inside Pith

  1. [16]

    Resilience in online federated learning: Mitigating model-poisoning attacks via partial sharing,

    E. Lari, R. Arablouei, V . C. Gogineni, and S. Werner, “Resilience in online federated learning: Mitigating model-poisoning attacks via partial sharing,”IEEE Trans. Signal Inf. Process. Netw., vol. 11, pp. 388–400, 2025

    2025

  2. [1]

    Communication-efficient learning of deep networks from decentralized data,

    H. B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. Y . Arcas, “Communication-efficient learning of deep networks from decentralized data,” inProc. Int. Conf. Artif. Intell. Stat., 2017, pp. 1273–1282

    2017

  3. [2]

    Federated machine learning: Concept and applications,

    Q. Yang, Y . Liu, T. Chen, and Y . Tong, “Federated machine learning: Concept and applications,”ACM Trans. Intell. Syst. Technol., vol. 10, no. 2, pp. 1–19, 2019

    2019

  4. [3]

    Federated learning: Challenges, methods, and future directions,

    T. Li, A. K. Sahu, A. Talwalkar, and V . Smith, “Federated learning: Challenges, methods, and future directions,”IEEE Signal Process. Mag., vol. 37, no. 3, pp. 50–60, 2020

    2020

  5. [4]

    Advances and open problems in federated learning,

    P. Kairouz, H. B. McMahan, B. Avent, A. Bellet, M. Bennis, A. N. Bhagoji, K. Bonawitz, Z. Charles, G. Cormode, R. Cummingset al., “Advances and open problems in federated learning,”Found. Trends Mach. Learn., vol. 14, no. 1–2, pp. 1–210, 2021

    2021

  6. [5]

    Noise-robust and resource-efficient ADMM-based federated learning,

    E. Lari, V . C. Gogineni, R. Arablouei, and S. Werner, “Noise-robust and resource-efficient ADMM-based federated learning,”Signal Process., vol. 233, p. 109988, 2025

    2025

  7. [6]

    Federated multi- task learning,

    V . Smith, C. Chiang, M. Sanjabi, and A. S. Talwalkar, “Federated multi- task learning,” inProc. Adv. Neural Inf. Process. Syst., 2017

    2017

  8. [7]

    Tackling the objective inconsistency problem in heterogeneous federated optimization,

    J. Wang, Q. Liu, H. Liang, G. Joshi, and H. V . Poor, “Tackling the objective inconsistency problem in heterogeneous federated optimization,” inProc. Adv. Neural Inf. Process. Syst., vol. 33, 2020, pp. 7611–7623

    2020

Show all 46 references
  1. [8]

    Adaptive federated optimization,

    S. Reddi, Z. Charles, M. Zaheer, Z. Garrett, K. Rush, J. Koneˇcn`y, S. Kumar, and H. B. McMahan, “Adaptive federated optimization,” inProc. Int. Conf. Learn. Represent., 2021

    2021

  2. [9]

    Towards federated learning at scale: System design,

    K. Bonawitz, H. Eichner, W. Grieskamp, D. Huba, A. Ingerman, V . Ivanov, C. Kiddon, J. Kone ˇcn`y, S. Mazzocchi, B. McMahanet al., “Towards federated learning at scale: System design,” inProc. MLSys, 2019, pp. 374–388

    2019

  3. [10]

    A field guide to federated optimization,

    J. Wang, Z. Charles, Z. Xu, G. Joshi, H. B. McMahan, M. Al-Shedivat, G. Andrew, S. Avestimehr, K. Deng, J. Duchiet al., “A field guide to federated optimization,” inProc. Int. Conf. Learn. Represent., 2024

    2024

  4. [11]

    Towards federated foundation models: Scalable dataset pipelines for group-structured learning,

    Z. Charles, N. Garrett, Z. Xu, and G. Joshi, “Towards federated foundation models: Scalable dataset pipelines for group-structured learning,” inProc. Adv. Neural Inf. Process. Syst., 2024

    2024

  5. [12]

    Federated learning,

    Q. Yang, Y . Liu, Y . Cheng, Y . Kang, T. Chen, and H. Yu, “Federated learning,”IEEE Trans. Big Data, vol. 6, no. 4, pp. 673–688, 2020

    2020

  6. [13]

    Federated learning in mobile edge networks: A comprehensive survey,

    W. Y . B. Lim, N. C. Luong, D. T. Hoang, Y . Jiao, Y .-C. Liang, Q. Yang, D. Niyato, and C. Miao, “Federated learning in mobile edge networks: A comprehensive survey,”IEEE Commun. Surv. Tutor., vol. 22, no. 3, pp. 2031–2063, 2020

  7. [14]

    Federated learning: A signal processing perspective,

    T. Gafni, N. Shlezinger, K. Cohen, Y . C. Eldar, and H. V . Poor, “Federated learning: A signal processing perspective,”IEEE Signal Process. Mag., vol. 39, no. 3, pp. 14–41, 2022

    2022

  8. [15]

    On the resilience of online federated learning to model poisoning attacks through partial sharing,

    E. Lari, V . C. Gogineni, R. Arablouei, and S. Werner, “On the resilience of online federated learning to model poisoning attacks through partial sharing,” inProc. IEEE Int. Conf. Acoust. Speech Signal Process., 2024, pp. 9201–9205

    2024

  9. [17]

    V ovk, A

    V . V ovk, A. Gammerman, and G. Shafer,Algorithmic learning in a random world. Springer, 2005

    2005

  10. [18]

    Efficient conformal prediction under data heterogeneity,

    V . Plassier, N. Kotelevskii, A. Rubashevskii, F. Noskov, M. Velikanov, A. Fishkov, S. Horvath, M. Takac, E. Moulines, and M. Panov, “Efficient conformal prediction under data heterogeneity,” inProc. Int. Conf. Artif. Intell. Stat.PMLR, 2024, pp. 4879–4887

    2024

  11. [19]

    Federated inference with reliable uncertainty quantification over wireless channels via conformal prediction,

    M. Zhu, M. Zecchin, S. Parket al., “Federated inference with reliable uncertainty quantification over wireless channels via conformal prediction,” IEEE Trans. Signal Process., vol. 72, pp. 1235–1250, 2024

    2024

  12. [20]

    Benchmarking LLMs via uncertainty quantification,

    F. Ye, M. Yang, J. Pang, L. Wang, D. Wong, E. Yilmaz, S. Shi, and Z. Tu, “Benchmarking LLMs via uncertainty quantification,”Proc. Adv. Neural Inf. Process. Syst., vol. 37, pp. 15 356–15 385, 2024

    2024

  13. [21]

    Conformal prediction: A data perspective,

    X. Zhou, B. Chen, Y . Gui, and L. Cheng, “Conformal prediction: A data perspective,”ACM Comput. Surv., vol. 58, no. 2, pp. 1–37, 2025

    2025

  14. [22]

    Distribution-free predictive inference for regression,

    J. Lei, M. G’Sell, A. Rinaldo, R. J. Tibshirani, and L. Wasserman, “Distribution-free predictive inference for regression,”J. Am. Stat. Assoc., vol. 113, no. 523, pp. 1094–1111, 2018

    2018

  15. [23]

    Not all distributional shifts are equal: Fine-grained robust conformal inference,

    J. Ai and Z. Ren, “Not all distributional shifts are equal: Fine-grained robust conformal inference,” inProc. Int. Conf. Mach. Learn., 2024, pp. 641–665

    2024

  16. [24]

    Federated conformal predictors for distributed uncertainty quantification,

    C. Lu, Y . Yu, S. P. Karimireddy, M. Jordan, and R. Raskar, “Federated conformal predictors for distributed uncertainty quantification,” inProc. Int. Conf. Mach. Learn.PMLR, 2023, pp. 22 942–22 964

    2023

  17. [25]

    One-shot federated conformal prediction,

    P. Humbert, B. Le Bars, A. Bellet, and S. Arlot, “One-shot federated conformal prediction,” inProc. Int. Conf. Mach. Learn.PMLR, 2023, pp. 14 153–14 177

    2023

  18. [26]

    Conformal prediction for federated uncertainty quantification under label shift,

    V . Plassier, M. Makni, A. Rubashevskii, E. Moulines, and M. Panov, “Conformal prediction for federated uncertainty quantification under label shift,” inProc. Int. Conf. Mach. Learn., 2023, pp. 28 101–28 139

    2023

  19. [27]

    Personalized federated conformal prediction with localization,

    Y . Min, C. Zhang, L. Peng, and C. Zou, “Personalized federated conformal prediction with localization,” inProc. Adv. Neural Inf. Process. Syst., 2025

    2025

  20. [28]

    Privacy-preserving federated learning and uncertainty quantification in medical imaging,

    N. Koutsoubis, A. Waqas, Y . Yilmazet al., “Privacy-preserving federated learning and uncertainty quantification in medical imaging,”Radiol.: Artif. Intell., vol. 7, no. 4, 2025

    2025

  21. [29]

    Machine learning with adversaries: Byzantine tolerant gradient descent,

    P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: Byzantine tolerant gradient descent,”Proc. Adv. Neural Inf. Process. Syst., vol. 30, 2017

    2017

  22. [30]

    The hidden vulnerability of distributed learning in byzantium,

    E. M. E. Mhamdi, R. Guerraoui, and S. Rouault, “The hidden vulnerability of distributed learning in byzantium,” inProc. Int. Conf. Mach. Learn., 2018, pp. 3521–3530

    2018

  23. [31]

    Local model poisoning attacks to Byzantine-Robust federated learning,

    M. Fang, X. Cao, J. Jia, and N. Gong, “Local model poisoning attacks to Byzantine-Robust federated learning,” inUSENIX Security Symp., Aug. 2020, pp. 1605–1622

    2020

  24. [32]

    Self-driven entropy aggregation for Byzantine-robust heterogeneous federated learning,

    W. Huang, Z. Shi, M. Ye, H. Li, and B. Du, “Self-driven entropy aggregation for Byzantine-robust heterogeneous federated learning,” in Proc. Int. Conf. Mach. Learn., 2024, pp. 20 096–20 110

    2024

  25. [33]

    Byzantine-robust distributed learning: Towards optimal statistical rates,

    D. Yin, Y . Chen, R. Kannan, and P. Bartlett, “Byzantine-robust distributed learning: Towards optimal statistical rates,” inProc. Int. Conf. Mach. Learn., 2018, pp. 5650–5659

    2018

  26. [34]

    Robust aggregation for federated learning,

    K. Pillutla, S. M. Kakade, and Z. Harchaoui, “Robust aggregation for federated learning,”IEEE Trans. Signal Process., vol. 70, pp. 1142–1154, 2022

    2022

  27. [35]

    ByMI: Byzantine machine identification with false discovery rate control,

    C. Qian, M. Wang, H. Ren, and C. Zou, “ByMI: Byzantine machine identification with false discovery rate control,” inProc. Int. Conf. Mach. Learn., 2024, pp. 41 357–41 382

    2024

  28. [36]

    Practical framework for privacy-preserving and Byzantine-robust federated learning,

    B. Zhang, M. Fang, Z. Liu, B. Yi, P. Zhou, Y . Wang, T. Li, and Z. Liu, “Practical framework for privacy-preserving and Byzantine-robust federated learning,”IEEE Trans. Inf. Forensics Security, 2025

    2025

  29. [37]

    Certifiably byzantine-robust federated conformal prediction,

    M. Kang, Z. Lin, J. Sun, C. Xiao, and B. Li, “Certifiably byzantine-robust federated conformal prediction,” inProc. Int. Conf. Mach. Learn.PMLR, 2024, pp. 23 022–23 057

    2024

  30. [38]

    Communication- efficient online federated learning framework for nonlinear regression,

    V . C. Gogineni, S. Werner, Y .-F. Huang, and A. Kuh, “Communication- efficient online federated learning framework for nonlinear regression,” in Proc. IEEE Int. Conf. Acoust. Speech Signal Process., 2022, pp. 5228– 5232

    2022

  31. [39]

    Communication-efficient online federated learning strategies for kernel regression,

    ——, “Communication-efficient online federated learning strategies for kernel regression,”IEEE Internet Things J., vol. 10, pp. 4531–4544, 2023

    2023

  32. [40]

    Data falsification attacks on consensus-based detection systems,

    B. Kailkhura, S. Brahma, and P. K. Varshney, “Data falsification attacks on consensus-based detection systems,”IEEE Trans. Signal Inf. Process. Netw., vol. 3, no. 1, pp. 145–158, 2017

    2017

  33. [41]

    On the condition of partial exchangeability,

    B. De Finetti, “On the condition of partial exchangeability,”Stud. Inductive Logic Probab., vol. 2, pp. 193–205, 1980

    1980

  34. [42]

    The T-Digest: Efficient estimates of distributions,

    T. Dunning, “The T-Digest: Efficient estimates of distributions,”Software Impacts, vol. 7, p. 100049, 2021

    2021

  35. [43]

    Detecting outliers: Do not use standard deviation around the mean, use absolute deviation around the median,

    C. Leys, C. Ley, O. Klein, P. Bernard, and L. Licata, “Detecting outliers: Do not use standard deviation around the mean, use absolute deviation around the median,”J. Exp. Soc. Psychol., vol. 49, pp. 764–766, 2013

    2013

  36. [44]

    User-friendly tail bounds for sums of random matrices,

    J. A. Tropp, “User-friendly tail bounds for sums of random matrices,” Found. Comput. Math., vol. 12, no. 4, pp. 389–434, 2012

    2012

  37. [45]

    A data-driven statistical model for predicting the critical temperature of a superconductor,

    K. Hamidieh, “A data-driven statistical model for predicting the critical temperature of a superconductor,”Comput. Mater. Sci., vol. 154, pp. 346–354, 2018

    2018

  38. [46]

    Measuring the effects of non- identical data distribution in federated optimization,

    T.-M. H. Hsu, H. Qi, and M. Brown, “Measuring the effects of non- identical data distribution in federated optimization,”arXiv preprint arXiv:1909.06335, 2019

    1909 arXiv

Pith tools

Reviewed August 2, 2026 · model on record in the stance chip above.