Pith. sign in

REVIEW 3 major objections 6 minor 39 references

Exploit Gradient Skewness to Circumvent Byzantine Defenses for Federated Learning

T0 review · 3 major / 6 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that under non-IID data the dense cluster of honest gradients skews away from the average honest gradient, and that Byzantine gradients placed inside that cluster defeat density-based robust aggregation.

desk verdict A genuinely new skew-aware attack with a credible core phenomenon; needs fixes on the search heuristic's evidence, ν selection, and an algorithm/text mismatch, but worth refereeing. read the letter →

arxiv 2502.04890 v2 pith:XWMM4QYP submitted 2025-02-07 cs.LG

Yuchen Liu , Chen Chen , Lingjuan Lyu , Yaochu Jin , Gang Chen This is my paper · ORCID
classification cs.LG
keywords federatedlearningByzantineattacksrobustnessgradientskewnon-IIDdatamodelpoisoningrobustaggregationSTRIKEattack
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Federated learning aggregates gradients from many clients, and Byzantine defenses commonly trust the gradient cluster that is densest, reasoning that honest clients must agree. This paper tries to establish that under non-IID data this assumption inverts: the honest gradients themselves form a dense cluster that is skewed away from the average honest gradient, so an attacker can put malicious gradients inside that dense cluster and be treated as honest. It names this phenomenon gradient skew and proposes STRIKE, a two-stage attack that finds the skewed cluster and then solves a constrained optimization to place Byzantine gradients within the cluster's diameter while pulling the aggregated gradient away from the true average. The paper reports that STRIKE outperforms six existing attacks against seven robust aggregation rules on three benchmark datasets, with the largest gains on the most heterogeneous data. If the claim is right, the practical lesson is that robustness to Byzantine clients is not achieved merely by trusting dense gradients; the shape of the honest gradient distribution matters.

What carries the argument

The machinery is the mean-to-median search direction $u_{\mathrm{search}} = g_{\mathrm{med}} - \bar{g}$, justified by the classical statistics relation that for a skewed distribution the median lies between the mean and the mode, so moving from the mean toward the median points toward the dense skewed cluster. The first stage projects every honest gradient onto this direction and keeps the largest projections as the presumed skewed set. The second stage solves a one-dimensional optimization for $\alpha$ using the bisection method, under the constraint that Byzantine gradients stay within the diameter of the skewed honest gradients, then emits $g_b = \bar{g}_S + \nu\alpha \, \mathrm{sign}(\bar{g}_S - \bar{g}) \odot \sigma_S$. This construction is what lets the attack hide: coordinate-wise, Byzantine gradients are indistinguishable in scale from the skewed honest gradients, while the sign term pushes the aggregated result away from the honest average.

What would settle it

Record honest gradients from a non-IID federated learning run and test the search direction directly: compute the coordinate-wise median and the average of the honest gradients, project every honest gradient onto their difference, and examine whether the high-projection subset is in fact the dense cluster and whether its average lies far from the overall average. If the dense cluster is not recovered in this way, or if replacing the median by a different robust center changes the selected subset, the mechanism underlying STRIKE is not present in that setting.

Watch

Extended reading notes

Core claim

The central discovery is a statistical fact about federated learning rather than a new defense: when client data are non-IID, the honest local gradients form a dense mass that is shifted away from their own average, and this shift persists across training rounds. Because robust aggregators formalize safety by bounding the distance from the aggregated gradient to the average of some candidate honest set, they are structurally biased toward the dense cluster; under gradient skew that cluster is the wrong target. STRIKE operationalizes this by selecting the honest gradients with the largest scalar projection onto $u_{\mathrm{search}} = g_{\mathrm{med}} - \bar{g}$, i.e., the direction from the average toward the coordinate-wise median, which locates the skewed cluster. It then constructs each Byzantine gradient as $g_b = \bar{g}_S + \nu\alpha \, \mathrm{sign}(\bar{g}_S - \bar{g}) \odot \sigma_S$, with $\alpha$ chosen so that the Byzantine gradients stay within the diameter of the skewed cluster, and $\nu$ an adjustable strength parameter. The paper's experiments show that this construction reliably lowers final model accuracy on CIFAR-10, ImageNet-12, and FEMNIST across Multi-Krum, Median, RFA, Aksel, CClip, DnC, and RBTM, and that the advantage over baselines grows with the degree of data heterogeneity.

Load-bearing premise

The attack's first stage assumes that the dense cluster of honest gradients sits near the mode of the gradient distribution and that moving from the average toward the coordinate-wise median points to that mode in the high-dimensional space; if real honest-gradient distributions are multimodal or the mode is not on that line, STRIKE selects the wrong gradients and the hiding step fails.

Editorial extensions

If this is right

  • Density-based Byzantine defenses such as Multi-Krum, Median, RFA, Aksel, CClip, DnC, and RBTM are all vulnerable to the same skew-aware hiding strategy in non-IID federated learning.
  • The attack needs no knowledge of the defense and only the honest gradients, so it applies to partial-knowledge threat models that previous omniscient attacks could not cover.
  • Effectiveness tracks heterogeneity: the paper reports larger accuracy drops on more skewed datasets and smaller gaps with lower non-IID levels, implying that skew-aware attacks matter most where federated learning is hardest.
  • Defenses that correct for skew rather than trust density, for example by recentering gradients or by weighting tail gradients, become necessary to restore robustness.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural test of the core claim is to measure the actual skew direction in deployed FL systems: if the dense cluster is multimodal or does not sit on the mean-to-median line, Stage 1 of STRIKE picks the wrong gradients and the attack loses its hiding property.
  • Because STRIKE uses the coordinate-wise median of honest gradients, defenses that add noise to the median, subsample clients per round, or use a robust center other than the mean could blunt the search without changing the honest gradient distribution.
  • The paper measures attack success by final model accuracy; an inference worth checking is whether skew-aware attacks also corrupt downstream tasks like fairness or calibration, where the shift toward the dense cluster may have different harms.
  • STRIKE assumes the attacker knows which gradients are honest; a harder open question is whether the same hiding effect can be achieved when Byzantine clients must estimate the skew direction from their own local updates only.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper claims a new vulnerability of Byzantine-robust federated learning under non-IID data: honest local gradients can form a dense, skewed cluster that lies away from the mean honest gradient. It argues that robust aggregators that trust dense gradients will mistake this cluster for the honest majority and can be fooled. The proposed STRIKE attack has two stages: first, it identifies the skewed cluster by projecting honest gradients onto the direction from the mean to the coordinate-wise median; second, it crafts Byzantine gradients as a scaled, sign-aligned perturbation of the cluster mean, constrained to remain inside the cluster's diameter. Experiments compare STRIKE with six baselines against seven defenses on CIFAR-10, ImageNet-12, and FEMNIST, with additional experiments on bucketing and NNM variants.

Significance. If the phenomenon and attack work as described, this is a useful and timely contribution: it challenges the density-based inductive bias of popular Byzantine defenses, provides a concrete attack that exploits data heterogeneity, and releases code. The paper's strengths are the breadth of the evaluation (three datasets, seven defenses, two defense variants) and the clear two-stage attack formulation. However, the reported superiority of STRIKE is currently supported mainly by test-set selection of the attack-strength hyperparameter ν, and the stage-1 cluster search is validated only through nonlinear visualizations. These issues must be resolved before the central empirical claim can be taken at face value.

major comments (3)
  1. [Appendix D.1 ('Other Setups'); Table 1] Appendix D.1 ('Other Setups') states that STRIKE is tested with ν ∈ {0.25,...,2.0} and that 'we report the lowest test accuracy (highest attack effectiveness).' Since the test accuracy is the evaluation metric, selecting ν per defense/dataset on that same metric makes Table 1 an oracle comparison: baseline attacks (e.g., LIE with z=1.5, IPM with ε=0.1) use fixed hyperparameters, while STRIKE receives the best test-set ν for each cell. The statement in §6.2 that 'simply setting ν=1 can beat almost all attacks' does not repair this, because Table 1 does not report which ν generated each number and the appendix only shows ν=1 results graphically for ImageNet-12. Please report main results with a fixed ν=1 (or with a defensible selection rule that does not use test accuracy) and/or clearly separate oracle-selection results from default-parameter results.
  2. [Algorithm 1 vs. §5, Eq. (8)] Algorithm 1 in Appendix B sets S to the n−f honest gradients with the highest scalar projection, whereas §5 (Eq. (8)) defines S as the n−2f gradients with the highest projection. With |H|=n−f, the former choice selects all honest gradients, making stage 2 trivial and inconsistent with the denominator n−2f used in the same algorithm to compute ¯gS. If the experiments followed Eq. (8), the algorithm as written does not describe the evaluated attack; if they followed Algorithm 1, the 'exclude f outlier honest gradients' mechanism is absent. Please correct the algorithm and state precisely which cardinality was used in the experiments.
  3. [§5, Eq. (6)] The stage-1 search relies on the unproven assumption that the coordinate-wise mean-to-median direction points toward the dense skewed cluster. Karl Pearson's formula is a univariate empirical rule; no high-dimensional analogue is established for neural-network gradients. The only support is LLE visualization (Figures 1, 2, 5, 6), but LLE is a nonlinear embedding and does not preserve the relevant geometry in a way that certifies the mean-to-median direction, and no quantitative skewness metric or ablation of alternative search directions is provided. If honest gradients are multimodal or the mode is not on that direction, S will be mis-selected and the stage-2 hiding (Eq. (12)) will not place Byzantine gradients in a dense region. Please add a quantitative validation of the search (e.g., in the original gradient space, how often does the selected S contain the densest cluster?) or provide a theoretical justification.
minor comments (6)
  1. [Definition 1, Eq. (5)] The summation in Eq. (5) is over S, which is not defined in the definition; it should presumably be G. Please fix and clarify the role of κ.
  2. [Eq. (13)] Eq. (13) uses sign(¯gS), while Eq. (12) and Algorithm 1 use sign(¯gS − ¯g); the notation should be made consistent.
  3. [Table 2] The header of Table 2 contains 'STRKE' instead of 'STRIKE'.
  4. [§6.1 and Appendix D.1] The hardware descriptions are inconsistent: §6 says an NVIDIA Tesla V100 with 64GB RAM, Appendix C says 'a single A100 GPU', and Appendix D.1 says four GeForce GTX 1080Ti with a different CPU/RAM configuration. Please align the compute description.
  5. [Appendix D.1, baseline attacks] Appendix D.1 lists 'LabelFlip' as a baseline attack, but Table 1 reports 'BitFlip'; please clarify whether LabelFlip was actually evaluated or whether this is a typo.
  6. [Appendix C] Appendix C claims that f(α) has a unique zero point, but the listed facts (f(0)≤0, f→∞, continuity) do not by themselves imply uniqueness. Please provide a proof or weaken the claim to existence of a zero found by bisection.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the attack is an explicit construction and its evaluation is against external defenses.

full rationale

The paper's derivation chain is self-contained rather than circular. The gradient-skew phenomenon is an empirical observation supported by LLE visualizations (Figures 2 and 5) and is not defined in terms of the attack's success. The attack principle 'hide Byzantine gradients within the skewed honest gradients' follows directly from the externally cited (f, κ)-robustness characterization of density-based defenses (Allouah et al. 2023), which is used as a premise, not as the conclusion. Stage 1 selects S via a heuristic search: Eq. (6) defines u_search = gmed − gbar and Eq. (8) selects the top n−2f projections along this direction; this is an explicit selection rule, not a quantity fitted to the reported accuracy. Stage 2 constructs Byzantine gradients by the explicit form in Eq. (12), gb = gbarS + να·sign(gbarS − gbar)⊙σS, and solves Eq. (13) by bisection; the attack vector is built from the skewed gradients by construction, which is the intended attack mechanism rather than a disguised input. No load-bearing self-citation is present: the cited robustness definitions and diameter sensitivity come from external works by Allouah et al., Farhadkhani et al., and Karimireddy et al., not from the present authors. The only caveat is that ν is tuned over a grid and the lowest test accuracy is reported (Appendix D.1: 'We test STRIKE with ν ∈ {0.25·i | i = 1,...,8} and report the lowest test accuracy'), which is a reporting/fairness concern relative to fixed baselines, but it is not circular because the attack effectiveness is not claimed as an a priori prediction and ν is an attack-strength hyperparameter rather than a fitted parameter that defines the measured quantity. The unproven high-dimensional extension of Karl Pearson's formula is a correctness risk, not a circularity. Overall, no equation or fitted parameter reduces to the claimed result by definition.

Assumptions & free parameters 1 free parameters · 4 assumptions · 0 invented entities

The central attack depends on a free hyperparameter nu, four domain assumptions about gradient distributions and attacker knowledge, and an unproved uniqueness claim. No new physical or algorithmic entities are introduced beyond the named phenomenon.

free parameters (1)
  • attack strength nu = 0.25, 0.5, 0.75, 1.0, 1.25, 1.5, 1.75, 2.0 (best per defense/dataset selected)
    Controls how far Byzantine gradients are pushed from the skewed cluster average; the paper reports the lowest test accuracy over this grid, fitting it to the evaluation metric.
assumptions (4)
  • domain assumption The skewed honest gradients coincide with the population mode, and the mode lies on the same side of the mean as the median (Karl Pearson's formula).
    Used in Section 5 (Eq. 6) to justify searching along u_search = g_med - g_bar; not verified for high-dimensional gradients.
  • domain assumption A robust AGR satisfying (f,kappa)-robustness outputs a gradient close to the average of the n-f most densely distributed submitted gradients.
    This formalization (Def. 1, from Allouah et al. 2023) is used to argue that hiding within the dense cluster evades defense; real defenses may not satisfy the precise bound.
  • ad hoc to paper The bisection method's f(alpha) has a unique zero point.
    Stated in Appendix C without proof; f(alpha) is convex but not necessarily monotone, so uniqueness is not guaranteed.
  • domain assumption The attacker knows all honest gradients {g_i | i in H}.
    The algorithm requires honest gradients to compute median, mean, and projection; a standard but strong assumption shared with prior attacks.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Exploit Gradient Skewness to Circumvent Byzantine Defenses for Federated Learning." pith.science (2026). https://pith.science/paper/XWMM4QYP

@misc{pith2026250204890,
  author       = {Pith},
  title        = {Pith review of: Exploit Gradient Skewness to Circumvent Byzantine Defenses for Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XWMM4QYP}},
  note         = {Machine review of arXiv:2502.04890}
}
read the original abstract

Federated Learning (FL) is notorious for its vulnerability to Byzantine attacks. Most current Byzantine defenses share a common inductive bias: among all the gradients, the densely distributed ones are more likely to be honest. However, such a bias is a poison to Byzantine robustness due to a newly discovered phenomenon in this paper - gradient skew. We discover that a group of densely distributed honest gradients skew away from the optimal gradient (the average of honest gradients) due to heterogeneous data. This gradient skew phenomenon allows Byzantine gradients to hide within the densely distributed skewed gradients. As a result, Byzantine defenses are confused into believing that Byzantine gradients are honest. Motivated by this observation, we propose a novel skew-aware attack called STRIKE: first, we search for the skewed gradients; then, we construct Byzantine gradients within the skewed gradients. Experiments on three benchmark datasets validate the effectiveness of our attack

Figures

Figures reproduced from arXiv: 2502.04890 by the authors.

Figure 1
Figure 1. The LLE visualization of honest gradients in the [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Visualization of gradient skew on CIFAR-10 dataset. As shown in the figures, the optimal gradients (green stars) [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Illustration of the proposed two-stage attack STRIKE: in the first stage, STRIKE searches for the skewed honest [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: Accuracy under different attacks against seven robust AGRs with bucketing on ImageNet-12. The [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Visualization of gradient skew on ImageNet-12 and FEMNIST [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]
Figure 6
Figure 6. Figure 6: Visualization of STRIKE attack on CIFAR-10 datasets. The visualization shows that Byzantine gradients can hide [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]
Figure 7
Figure 7. Figure 7: Accuracy under STRIKE attack with ν in {0.25 ∗ i | i = 1, . . . , 8} against seven different defenses on ImageNet-12. The gray dashed line in each figure represents the lowest test accuracy (best performance) of six baseline attacks introduced in Section 6.1. We includ…
Figure 8
Figure 8. Figure 8: Accuracy under different attacks against DnC under different non-IID levels on ImageNet12. Lower [PITH_FULL_IMAGE:figures/full_fig_p016_8.png]
Figure 9
Figure 9. Figure 9: Accuracy under different attacks against DnC under different Byzantine client ratio on ImageNet12. The [PITH_FULL_IMAGE:figures/full_fig_p016_9.png]
Figure 10
Figure 10. Figure 10: Accuracy under different attacks against DnC under different client number on ImageNet12. The [PITH_FULL_IMAGE:figures/full_fig_p017_10.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

39 extracted references · 26 canonical work pages

  1. [1]

    , " * write output.state after.block = add.period write newline

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    Allen-Zhu, Z.; Ebrahimianghazani, F.; Li, J.; and Alistarh, D. 2020. Byzantine-Resilient Non-Convex Stochastic Gradient Descent. In International Conference on Learning Representations

    work page 2020

  4. [4]

    Allouah, Y.; Farhadkhani, S.; Guerraoui, R.; Gupta, N.; Pinot, R.; Rizk, G.; and Voitovych, S. 2024. Byzantine-Robust Federated Learning: Impact of Client Subsampling and Local Updates. In Forty-first International Conference on Machine Learning

    work page 2024

  5. [5]

    Allouah, Y.; Farhadkhani, S.; Guerraoui, R.; Gupta, N.; Pinot, R.; and Stephan, J. 2023. Fixing by Mixing: A Recipe for Optimal Byzantine ML under Heterogeneity. arXiv preprint arXiv:2302.01772

    work page Pith review arXiv 2023

  6. [6]

    Baruch, G.; Baruch, M.; and Goldberg, Y. 2019. A little is enough: Circumventing defenses for distributed learning. Advances in Neural Information Processing Systems, 32

    work page 2019

  7. [7]

    M.; Guerraoui, R.; and Stainer, J

    Blanchard, P.; El Mhamdi, E. M.; Guerraoui, R.; and Stainer, J. 2017. Machine learning with adversaries: Byzantine tolerant gradient descent. Advances in Neural Information Processing Systems, 30

    work page 2017

  8. [8]

    M.; Guerraoui, R.; Maurer, A

    Boussetta, A.; El Mhamdi, E. M.; Guerraoui, R.; Maurer, A. D. O.; and Rouault, S. L. A. 2021. Aksel: Fast byzantine sgd. In Proceedings of the 24th International Conference on Principles of Distributed Systems (OPODIS 2020), CONF. Schloss Dagstuhl--Leibniz-Zentrum f \"u r Informatik

    work page 2021

Show all 39 references
  1. [9]

    Caldas, S.; Duddu, S. M. K.; Wu, P.; Li, T.; Kone c n \`y , J.; McMahan, H. B.; Smith, V.; and Talwalkar, A. 2018. Leaf: A benchmark for federated settings. arXiv preprint arXiv:1812.01097

    2018 arXiv

  2. [10]

    M.; Farhadkhani, S.; Guerraoui, R.; Guirguis, A.; Hoang, L.-N.; and Rouault, S

    El-Mhamdi, E. M.; Farhadkhani, S.; Guerraoui, R.; Guirguis, A.; Hoang, L.-N.; and Rouault, S. 2021. Collaborative learning in the jungle (decentralized, byzantine, heterogeneous, asynchronous and nonconvex learning). Advances in Neural Information Processing Systems, 34: 25044--25057

    2021

  3. [11]

    Fang, M.; Cao, X.; Jia, J.; and Gong, N. 2020. Local model poisoning attacks to \ Byzantine-Robust \ federated learning. In 29th USENIX Security Symposium (USENIX Security 20), 1605--1622

    2020

  4. [12]

    Farhadkhani, S.; Guerraoui, R.; Gupta, N.; Pinot, R.; and Stephan, J. 2022. B yzantine Machine Learning Made Easy By Resilient Averaging of Momentums. In Proceedings of the 39th International Conference on Machine Learning, volume 162 of Proceedings of Machine Learning Researc...

    2022

  5. [13]

    Guerraoui, R.; Rouault, S.; et al. 2018. The hidden vulnerability of distributed learning in byzantium. In International Conference on Machine Learning, 3521--3530. PMLR

    2018

  6. [14]

    He, K.; Zhang, X.; Ren, S.; and Sun, J. 2016. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, 770--778

    2016

  7. [15]

    P.; He, L.; and Jaggi, M

    Karimireddy, S. P.; He, L.; and Jaggi, M. 2021. Learning from history for byzantine robust optimization. In International Conference on Machine Learning, 5311--5319. PMLR

    2021

  8. [16]

    P.; He, L.; and Jaggi, M

    Karimireddy, S. P.; He, L.; and Jaggi, M. 2022. Byzantine-Robust Learning on Heterogeneous Datasets via Bucketing. In International Conference on Learning Representations

    2022

  9. [17]

    P.; Kale, S.; Mohri, M.; Reddi, S.; Stich, S.; and Suresh, A

    Karimireddy, S. P.; Kale, S.; Mohri, M.; Reddi, S.; Stich, S.; and Suresh, A. T. 2020. Scaffold: Stochastic controlled averaging for federated learning. In International Conference on Machine Learning, 5132--5143. PMLR

    2020

  10. [18]

    Knoke, D.; Bohrnstedt, G.; and Mee, A. 2002. Statistics for Social Data Analysis. F.E. Peacock Publishers. ISBN 9780875814483

    2002

  11. [19]

    Krizhevsky, A.; and Hinton, G. 2009. Learning multiple layers of features from tiny images. Technical Report 0, University of Toronto, Toronto, Ontario

    2009

  12. [20]

    Krizhevsky, A.; Sutskever, I.; and Hinton, G. E. 2017. Imagenet classification with deep convolutional neural networks. Communications of the ACM, 60(6): 84--90

    2017

  13. [21]

    Li, Q.; Diao, Y.; Chen, Q.; and He, B. 2021 a . Federated Learning on Non-IID Data Silos: An Experimental Study. arXiv preprint arXiv:2102.02079

    2021 arXiv

  14. [22]

    K.; Zaheer, M.; Sanjabi, M.; Talwalkar, A.; and Smith, V

    Li, T.; Sahu, A. K.; Zaheer, M.; Sanjabi, M.; Talwalkar, A.; and Smith, V. 2020. Federated optimization in heterogeneous networks. Proceedings of Machine Learning and Systems, 2: 429--450

    2020

  15. [23]

    Li, X.; Huang, K.; Yang, W.; Wang, S.; and Zhang, Z. 2019. On the convergence of fedavg on non-iid data. arXiv preprint arXiv:1907.02189

    2019 arXiv

  16. [24]

    Li, Y.; Lyu, X.; Koren, N.; Lyu, L.; Li, B.; and Ma, X. 2021 b . Anti-backdoor learning: Training clean models on poisoned data. Advances in Neural Information Processing Systems, 34

    2021

  17. [25]

    Luo, M.; Chen, F.; Hu, D.; Zhang, Y.; Liang, J.; and Feng, J. 2021. No fear of heterogeneity: Classifier calibration for federated learning with non-iid data. Advances in Neural Information Processing Systems, 34: 5972--5984

    2021

  18. [26]

    McMahan, B.; Moore, E.; Ramage, D.; Hampson, S.; and y Arcas, B. A. 2017. Communication-efficient learning of deep networks from decentralized data. In Artificial intelligence and statistics, 1273--1282. PMLR

    2017

  19. [27]

    S.; Mccabe, G

    Moore, D. S.; Mccabe, G. P.; and Craig, B. A. 2009. Introduction to the practice of statistics

    2009

  20. [28]

    Peng, H.; Yu, H.; Tang, X.; and Li, X. 2024. FedCal: Achieving Local and Global Calibration in Federated Learning via Aggregated Parameterized Scaler. arXiv preprint arXiv:2405.15458

    2024 arXiv

  21. [29]

    M.; and Harchaoui, Z

    Pillutla, K.; Kakade, S. M.; and Harchaoui, Z. 2019. Robust aggregation for federated learning. arXiv preprint arXiv:1912.13445

    2019 arXiv

  22. [30]

    T.; and Saul, L

    Roweis, S. T.; and Saul, L. K. 2000. Nonlinear dimensionality reduction by locally linear embedding. science, 290(5500): 2323--2326

    2000

  23. [31]

    Russakovsky, O.; Deng, J.; Su, H.; Krause, J.; Satheesh, S.; Ma, S.; Huang, Z.; Karpathy, A.; Khosla, A.; Bernstein, M.; et al. 2015. Imagenet large scale visual recognition challenge. International journal of computer vision, 115(3): 211--252

    2015

  24. [32]

    Shejwalkar, V.; and Houmansadr, A. 2021. Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning. In NDSS

    2021

  25. [33]

    Van der Maaten, L.; and Hinton, G. 2008. Visualizing data using t-SNE. Journal of machine learning research, 9(11)

    2008

  26. [34]

    E.; Patel, K

    Woodworth, B. E.; Patel, K. K.; and Srebro, N. 2020. Minibatch vs local sgd for heterogeneous distributed learning. Advances in Neural Information Processing Systems, 33: 6281--6292

    2020

  27. [35]

    Xie, C.; Koyejo, O.; and Gupta, I. 2020. Fall of empires: Breaking byzantine-tolerant sgd by inner product manipulation. In Uncertainty in Artificial Intelligence, 261--270. PMLR

    2020

  28. [36]

    Yan, H.; Zhang, W.; Chen, Q.; Li, X.; Sun, W.; Li, H.; and Lin, X. 2024. Recess vaccine for federated learning: Proactive defense against model poisoning attacks. Advances in Neural Information Processing Systems, 36

    2024

  29. [37]

    Yin, D.; Chen, Y.; Kannan, R.; and Bartlett, P. 2018. Byzantine-robust distributed learning: Towards optimal statistical rates. In International Conference on Machine Learning, 5650--5659. PMLR

    2018

  30. [38]

    Yu, H.; Yang, S.; and Zhu, S. 2018. Parallel restarted SGD for non-convex optimization with faster convergence and less communication. arXiv preprint arXiv:1807.06629, 2(4): 7

    2018 arXiv

  31. [39]

    Yurochkin, M.; Agarwal, M.; Ghosh, S.; Greenewald, K.; Hoang, N.; and Khazaeni, Y. 2019. Bayesian nonparametric federated learning of neural networks. In International Conference on Machine Learning, 7252--7261

    2019

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.