{"id":"a227873a-a82d-4325-85ef-45f750ba6caa","arxiv_id":"2506.17292","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"Active membership inference attacks on federated vision models keep high success rates under LDP when the privacy budget is large, and the noise that would stop them destroys model utility.","lead":"This paper derives theoretical bounds showing that a dishonest server can still run membership inference attacks against federated learning clients even when client data is protected by local differential privacy, with success depending on the privacy budget. The experiments show that the noise needed to block these attacks severely degrades model accuracy on vision tasks.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 3's separation condition is neither verified nor met by the reported experiments: with β=0.01 and 49 ViT patches, Eq. (5) requires Δ^ε of order hundreds, so the attention lower bound is not certified for the paper's main vision results.","rationale":"The reader's weakest_assumption identified the unproven Δ^ε ≥ Δ minimum-separation step, which is the core of this concern. I add a second, experimentally checkable symptom: the β values used in the main paper violate Eq. (5) for realistic ViT embedding norms and NX=49, so the theorem's condition is not merely unproven but contradicted by the paper's own reported hyperparameters. The FC-based result (Theorem 1) is much more robust, since its main preconditions are a discrete alphabet and a known statistic ΔX, and it is corroborated by the GRR analysis and by experiments. Therefore the overall message that LDP-protected data remain vulnerable may still be true, and the empirical attack results are suggestive; but the attention contribution as stated overreaches because the theoretical lower bound is not certified for the settings in which it is claimed. The appropriate remedy is a conditional acceptance that requires the concrete check above, explicit reporting of Δ^ε_min and M^ε, a β choice that satisfies Eq. (5) or a stated non-applicability, and a revised claim restricting the attention theorem to data where the separation condition is verified. No rejection is warranted because the concern is about scope and condition discharge, not an internal contradiction of the theorem under its stated hypotheses.","tokens_in":34738,"tokens_out":9744,"duration_ms":114506,"concrete_test":"Run the authors' attack pipeline on CIFAR10 and ImageNet with ViT-B-32-224/384 and each reported LDP mechanism (BitRand, GRR, RAPPOR, dBitFlipPM). After adding LDP noise to patch embeddings, compute the protected dataset D^ε, the per-pattern separation Δ^ε_i = (x_i^ε)⊤x_i^ε − max_{j≠i} (x_i^ε)⊤x_j^ε, the minimum Δ^ε_min, and the observed maximum norm M^ε = max_i ||x_i^ε||. Then evaluate whether Δ^ε_min ≥ 2/(βNX) + (1/β) log(2(NX−1)NX β (M^ε)^2) holds for β=0.01 and for the tuned β values in Appx. G.3. If the inequality fails, Eq. (6) is not applicable to those experiments; report instead the empirical P_proj and P_box values and the resulting numerical right-hand side of Eq. (6) to show whether the claimed advantage is even positive. Also run the same check on the synthetic one-hot and spherical data used in Figs.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The most load-bearing weakness is that Theorem 3's applicability condition is not discharged for the setting where the paper claims attention-based privacy risk. Theorem 3 requires (i) the LDP-protected data DMε to be Δ^ε-separated and (ii) β to satisfy Eq. (5). The paper defends (i) only by an expectation calculation in Appx. D.3: E[x_i^ε⊤x_i^ε − x_i^ε⊤x_j^ε] = E[x_i^⊤x_i − x_i^⊤x_j] + Var(r_i). This says the average separation increases; it does not imply the minimum separation Δ^ε ≥ Δ, which is what condition (5) uses. Moreover, the experiments use β=0.01 (Appx. G.3, Fig. 10) without reporting whether Eq. (5) holds. For ViT-B-32-224, NX=49; with β=0.01 the right-hand side of Eq. (5) is at least 2/(0.01·49) = 4.08 plus 100·log(2·48·49·0.01·(M^ε)^2). Even for a modest M^ε≈5 this exceeds 4.08 + 100·log(1176) ≈ 711, while inner-product separations of normalized patch embeddings are typically O(1)–O(10). Thus the lower bound Eq. (6) is almost certainly not certified for Figures 9–10. The central attention claim therefore rests on Monte-Carlo simulations and empirical success rates, not on the stated theorem. This is a scope gap rather than a contradiction of the theorem under its own hypotheses, but it is load-bearing because the paper's headline contribution includes a theoretical lower bound for attention-based AMI.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies active membership inference (AMI) against federated vision models when client data are protected by local differential privacy (LDP). Building on the FC-based and attention-based attacks of Vu et al. (2024), the authors state a security game ExpAMI_LDP and prove: a lower bound for an FC adversary in terms of the probability P_{M_ε} that LDP noise moves a point out of its radius-Δ_X ball (Theorem 1); an information-theoretic upper bound (e^ε−1)/(e^ε+1) for any adversary (Theorem 2); a lower bound for an attention adversary on Δ^ε-separated LDP-protected data (Theorem 3, Eq. (6)); and a closed-form GRR specialization (Theorem 4). Experiments on CIFAR10, CIFAR100, and ImageNet with BitRand, GRR, RAPPOR, and dBitFlipPM report high attack success rates and show that the noise needed to reduce risk degrades utility. The paper's headline claim is that LDP does not eliminate privacy risk and that the residual risk is governed by the privacy budget ε.","tokens_in":35121,"tokens_out":3784,"duration_ms":42104,"significance":"If the central results hold, the paper makes a useful contribution: it moves AMI analysis from purely empirical demonstrations to provable lower bounds under LDP, and it provides an explicit GRR lower bound that is clean and checkable. The FC half of the paper is solid: Theorem 1's proof is elementary and correct, Theorem 2 is a standard LDP argument, and Theorem 4 gives a concrete closed form. The attention result is potentially interesting but currently not certified for the experiments in which it is claimed, because the hypothesis of Theorem 3, condition (5), is not verified for the ViT settings. The empirical study is broad (two vision datasets, four LDP mechanisms, NLP extension) and the privacy-utility tension is convincingly demonstrated. However, the paper does not ship machine-checked proofs or code, and the 'theoretical' curves in Figures 7 and 8 rely on empirically estimated P_{M_ε}; these caveats should be stated transparently.","major_comments":[{"comment":"The applicability condition for the attention lower bound is not discharged for the paper's main vision experiments. The manuscript defends Δ^ε ≥ Δ only through an expectation calculation in Appx. D.3: E[x_i^{ε⊤}x_i^{ε} − x_i^{ε⊤}x_j^{ε}] = E[x_i^{⊤}x_i − x_i^{⊤}x_j] + Var(r_i). This concerns the average separation, whereas condition (5) uses the minimum separation Δ^ε. In the ViT experiments NX = 49 (Table 2) and β = 0.01 is reported as a good default (Appx. G.3, Fig. 10). For these values the right-hand side of (5) is at least 2/(0.01·49) = 4.08 plus 100·log(2·48·49·0.01·(M^ε)^2); even for a modest M^ε ≈ 5 this exceeds 700, while inner-product separations of patch embeddings are typically O(1)–O(10). Therefore Eq. (6) is not certified for Figures 9–10. The attention-based privacy risk in the vision setting rests on the empirical curves, not on Theorem 3. The theorem may be correct under its own hypotheses, but the paper must either verify the minimum-separation condition for the deployed β and data, or explicitly restrict the theoretical claim to settings where (5) is known to hold.","section":"§4.2, Theorem 3, Eq. (5)"},{"comment":"Theorem 3 assumes that LDP noise is bounded by a norm budget R_ε, so that M^ε = sqrt(M^2 + R_ε^2) exists. This excludes common LDP mechanisms with unbounded support, such as continuous Laplace noise. The abstract and introduction state that privacy risks persist 'even when data are protected by LDP' and refer to 'any ideal LDP mechanism'; the theorem as stated does not support that unrestricted reading. Please add an explicit bounded-support hypothesis to Theorem 3 and adjust the scope claims accordingly, or restrict the statement to the finite-alphabet mechanisms used in the experiments (GRR, RAPPOR, dBitFlipPM, BitRand).","section":"§4.2, bounded-noise assumption before Theorem 3"},{"comment":"The theoretical lower-bound curves in Figures 7 and 8 are plotted using an estimate of P_{M_ε} obtained from the same data on which the empirical attack success rates are measured. Theorem 1 is a valid bound for any fixed M_ε, but substituting an empirical P̂_{M_ε} makes the 'theoretical' curve a data-dependent plug-in rather than a parameter-free prediction. This weakens the claimed corroboration in Section 5 ('The theoretical lower bound... corroborates the empirical success rate'). The paper should either derive P_{M_ε} analytically for each mechanism (as is done for GRR in Theorem 4) or explicitly label these curves as simulations/empirical plug-in estimates.","section":"§4.1, Remark 1; Figures 7–8"}],"minor_comments":[{"comment":"The bound is written as 1 − n+|X |−1 / |X |−1 P_{M_ε}, which is ambiguous; the proof uses (n+|X|−1)/(|X|−1). Please add parentheses in the theorem statement.","section":"Theorem 1 statement"},{"comment":"The theorem says 'for all AMI adversary A' but then writes AdvAMI_LDP(AD^FC); the advantage should be for A, not for the specific FC adversary, or the quantifier should be rephrased.","section":"Theorem 2 statement"},{"comment":"The sentence 'we can generally expect Δ^ε ≥ Δ' is presented as an intuition; since condition (5) uses the minimum separation, this expectation should be labeled as a heuristic rather than a proved statement.","section":"§4.2, paragraph before Theorem 3"},{"comment":"There is a typo in the table note ('β is is set'), and the columns Min β/Max β are not explained; please clarify how these values were selected and whether they were tuned on held-out data.","section":"Appx. G.3, Table 3"},{"comment":"The caption does not state which dataset, LDP mechanism, and ε values are used; please specify these in the caption or in the text referencing the figure.","section":"Figure 10"}],"recommendation":"major_revision","confidential_remarks":"The FC results are sound and publishable in principle, but the advertised theoretical contribution for attention-based AMI is currently not connected to the ViT experiments because condition (5) is unverified and very likely violated at β = 0.01. The revision should either prove the minimum-separation condition for the relevant data or substantially narrow the theoretical claim. No concerns about attribution or novelty beyond what is stated in the report."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know before you read it. The FC half of the paper is in good shape: Theorem 1's lower bound and Theorem 4's explicit GRR bound are correct, and the upper bound is the standard e^epsilon argument applied properly. The attention half is not certified for the paper's own experiments. With beta=0.01 and NX=49, Theorem 3's condition (5) requires Delta^epsilon in the hundreds, while ViT patch embeddings have inner-product separations on the order of 1-10. So the attention lower bound (Eq. 6) does not apply to the vision results in Figures 9-10; those curves are simulations, not certified bounds.\n\nWhat is genuinely new: this is the first LDP-aware theoretical treatment of active membership inference in federated vision. The attacks themselves are from Vu et al. 2024 (same group), but the LDP analysis is new, and the GRR bound (advantage >= (e^epsilon - n)/(e^epsilon + |X| - 1)) is a real, explicit result. The paper is also honest that its attention analysis needs bounded noise and doesn't transfer to discrete NLP data.\n\nSoft spots, in order. (1) Theorem 3's separation premise is defended only by an expectation calculation (Appx. D.3) showing E[separation] increases with noise variance; that doesn't control the minimum Delta^epsilon, which is what the theorem uses. The stress-test math checks out, and the paper never reports whether (5) holds in its experiments. This is a scope gap, not an internal contradiction - the theorem is fine under its conditions - but it's load-bearing because the attention bound is a headline contribution. (2) The 'theoretical' curves plot P_M_epsilon, P_proj, and P_box estimated from data, so theory and experiment are partly entangled. (3) No code or data release, and the hyperparameters are tuned by fitting biases with linear regression rather than the tau_D = Delta_X and gamma = 2*Deltabar^epsilon prescriptions. Minor: the proof's large-NX sampled-mean approximation is a heuristic, and unbounded mechanisms like continuous Laplace are excluded.\n\nWho should read it: privacy researchers working on FL and LDP, and system builders who want concrete attack numbers and a steep privacy-utility tradeoff. I'd cite the GRR and FC results.\n\nIt deserves a serious referee. My recommendation: conditional acceptance, with three demands - explicit P_M_epsilon (or derivations) for the mechanisms actually evaluated, either a genuine proof of Delta^epsilon >= Delta for those mechanisms or a re-labeling of the attention results as empirical, and artifact release.","headline":"FC bounds under LDP are solid and citable; the attention bound isn't certified for the paper's own vision experiments because the beta values used fail Theorem 3's separation condition.","tokens_in":35672,"tokens_out":4440,"would_cite":true,"duration_ms":43975,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Even when clients protect their data with local differential privacy, a dishonest federated-learning server can still run provably successful membership inference attacks in low polynomial time, with residual risk set by the privacy budget.","keywords":["membership inference attack","federated learning","local differential privacy","active adversary","fully connected layers","self-attention","vision transformer","privacy-utility tradeoff"],"falsifier":"Measure, for a concrete mechanism such as BitRand or GRR applied to CIFAR10 embeddings, the empirical minimum pairwise separation $\\Delta^\\varepsilon$ of the protected patterns across privacy budgets and check whether $\\Delta^\\varepsilon \\geq \\Delta$ holds whenever condition (5) is satisfied; finding a budget where the minimum separation drops below the unperturbed value, or where the measured attention-attack advantage falls short of Eq. (6), would pinpoint the theorem's premise as the failing link.","tokens_in":34485,"feed_emoji":"🔓","tokens_out":20122,"duration_ms":172394,"temperature":0.7,"pith_summary":"This paper aims to prove that local differential privacy (LDP) does not, by itself, protect federated-learning clients from a dishonest server that wants to know whether a specific sample sat in their training data. It analyzes two low-polynomial-time active attackers — one that plants two fully connected layers into the model, one that exploits self-attention — inside a formal security game where the server chooses the model and sees only gradients computed on LDP-protected data, and it proves lower bounds on their success. The bounds say the attacker's advantage stays close to perfect unless the privacy budget $\\varepsilon$ is pushed small enough that the LDP noise becomes large, and the experiments show the noise that actually blunts the attacks also collapses model accuracy (over 20% accuracy lost on CIFAR10 before the fully connected attack falls below 80% success). If the proofs are right, the paper turns the intuition that 'LDP noise hides membership' into a quantified residual risk that depends on $\\varepsilon$ and on how the mechanism spreads protected points around its output alphabet.","feed_headline":"Even LDP-protected data leaks membership, proofs show","feed_subtitle":"Attack success stays high unless privacy noise grows large enough to wreck the model.","key_machinery":"The argument rides on two planted detectors inside a game that forces the client to compute gradients on protected data. The fully connected detector is a two-layer probe: the first layer computes $[M_\\varepsilon(X)-T;\\; T-M_\\varepsilon(X)]$ and the second computes $z_0 = \\max\\{\\Delta_X - \\|M_\\varepsilon(X)-T\\|_{\\ell^1}, 0\\}$, so the gradient of the bias $b_2[1]$ is nonzero exactly when the protected sample lands inside the $\\ell^1$-ball of radius $\\Delta_X$ around the target; the alphabet's balls are disjoint, so a nonzero gradient means membership up to the noise probability $P_{M_\\varepsilon}$. The attention detector uses the Hopfield interpretation of self-attention with exponentially small retrieval error: one head projects the target pattern $v$ out of the keys so that, when $v$ is present, that head's output collapses toward the protected patterns' mean while the unfiltered head does not, and the gap between the two heads surfaces as nonzero gradients on the output weight matrix. The proof then bounds the false-positive rate by the projection probability $P_{\\mathrm{proj}}$ and the false-negative rate by the box probability $P_{\\mathrm{box}}$, and Theorem 2 closes the picture by capping every adversary in this game at advantage $(e^\\varepsilon-1)/(e^\\varepsilon+1)$.","core_discovery":"On its own terms, the paper's central discovery is that every $\\varepsilon$-LDP mechanism leaves a provable hole for active membership inference in federated vision models. In the security game ExpAMI_LDP, where the adversarial server picks the model, crafts parameters from a target sample $T$, and receives gradients computed on the protected dataset $D' = M_\\varepsilon(D)$, the fully connected adversary of Theorem 1 achieves advantage at least $1 - \\frac{n+|\\mathcal{X}|-1}{|\\mathcal{X}|-1} P_{M_\\varepsilon}$ in time $O(d_X^2)$: with threshold $\\tau_D = \\Delta_X$, the planted neuron fires exactly when the protected version of a sample lands inside the $\\ell^1$-ball of radius $\\Delta_X$ around $T$, and the disjointness of those balls makes a nonzero gradient a trustworthy signal that $T$ was present. Theorem 3 carries the same program to self-attention layers on $\\Delta^\\varepsilon$-separated protected patterns with time $O(d_X^3)$, giving the lower bound in Eq. (6) in terms of projection and box probabilities of the protected distribution; at small noise the bound is near one, and at large noise the box term $P^{\\mathcal{D}_{M_\\varepsilon}}_{\\mathrm{box}}$ approaches one, which is exactly the regime where protected embeddings fuse near the center and the model stops telling classes apart. The experiments confirm the theory with near-100% attack success at moderate budgets ($\\varepsilon \\approx 6$ for the ResNet-based fully connected attack, $\\varepsilon \\geq 3$ for the ViT attention attack), and the noise needed to suppress the attacks degrades utility substantially.","pith_inferences":["A design criterion the paper leaves implicit: an LDP mechanism is harder to probe through the fully connected detector the larger its $P_{M_\\varepsilon}$ is, so mechanisms that keep protected outputs tightly clumped near their originals are precisely the ones that preserve high attack success at a fixed budget.","The attention bound implies embedding geometry, not just $\\varepsilon$, governs the residual risk — one-hot embeddings are the most vulnerable because patterns are mutually orthogonal and nothing sits near the center — so a testable prediction is that feature extractors producing well-spread, weakly aligned embeddings suffer higher attention-attack success at the same noise level.","The analysis covers a single round of gradient exchange; in multi-round federated training a server could average its probes across iterations, which should only sharpen the membership signal, an extension the paper does not analyze.","Because Theorem 3 needs a bounded noise norm $R_\\varepsilon$, mechanisms with unbounded noise such as continuous Laplace outputs lie outside the attention bound, and whether the fully connected bounds survive for continuous alphabets is a question the paper leaves open."],"forward_implications":["For any LDP mechanism with output alphabet $\\mathcal{X}$, the fully connected attack's success rate is at least $1 - \\frac{n+|\\mathcal{X}|-1}{2(|\\mathcal{X}|-1)} P_{M_\\varepsilon}$; for bit-flipping mechanisms with large bit-length $b$ the prefactor is nearly 1, so the residual success is essentially $1 - P_{M_\\varepsilon}$.","Theorem 2 caps every adversary in the game at advantage $(e^\\varepsilon-1)/(e^\\varepsilon+1)$, so LDP still binds the damage — but at the budgets used in practice ($\\varepsilon = 6$–$8$) the cap is already near certainty.","Empirically the attacks hit near 100% success at $\\varepsilon \\approx 6$ for the fully connected attack on ResNet embeddings and at $\\varepsilon \\geq 3$ for the attention attack on ViTs, and the noise needed to push the fully connected attack below 80% success costs at least 20% accuracy on CIFAR10.","For generalized random response the lower bound specializes to $(e^\\varepsilon - n)/(e^\\varepsilon + |\\mathcal{X}| - 1)$, so the protection erodes as the number of clients $n$ grows and vanishes once $n$ reaches $e^\\varepsilon$.","The box term in Eq. (6) predicts a cliff: at the noise level where protected embeddings start clustering near their mean, both the attack advantage and the model's utility drop together, so the privacy-utility tradeoff cannot be dodged by raising the embedding dimension."],"supporting_citations":[{"why":"Supplies the two adversary constructions (fully connected and attention based) whose vulnerability analyses this paper extends from unprotected data to LDP-protected data.","marker":"Vu et al., 2024"},{"why":"Defines the active membership inference threat model and the ExpAMI_LDP security game under LDP that the paper's theorems analyze.","marker":"Nguyen et al., 2023"},{"why":"Provides the Hopfield interpretation of self-attention with exponentially small retrieval error and the Jacobian bound that Lemma 1, Lemma 2, and the proof of Theorem 3 rest on.","marker":"Ramsauer et al., 2021"},{"why":"Generalized randomized response, the classical LDP mechanism whose specialized lower bound is stated in Theorem 4 and used as an experimental baseline.","marker":"Warner, 1965"},{"why":"RAPPOR, one of the four LDP mechanisms tested in the experiments and the example behind the binary-alphabet remark.","marker":"Erlingsson et al., 2014"},{"why":"dBitFlipPM, an LDP mechanism tested in the experiments against both adversaries.","marker":"Ding et al., 2017"},{"why":"BitRand, the bit-flipping LDP mechanism whose CIFAR10 experiments show the utility collapse that motivates the paper's privacy-utility tradeoff conclusions.","marker":"Jiang et al., 2022"},{"why":"Defines the Vision Transformer architecture whose patch embeddings the attention attack targets in the continuous image domain.","marker":"Dosovitskiy et al., 2021"}],"fun_headline_variants":["LDP fails to stop membership inference in federated vision","Theoretical bounds: LDP still leaks client membership","Membership leaks persist under LDP, theory and tests show","Even with LDP, federated models leak membership: proofs","Noise that saves privacy kills model utility, study finds"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attention-attack theorem assumes the LDP noise leaves the protected patterns still $\\Delta^\\varepsilon$-separated and confined to a bounded noise norm $R_\\varepsilon$, but the paper only argues the expected separation grows with noise, never proving the minimum separation $\\Delta^\\varepsilon \\geq \\Delta$ that condition (5) actually uses, and mechanisms with unbounded noise fall outside the bound entirely.","fun_headline_variants_meta":{"raw":{"variants":["LDP fails to stop membership inference in federated vision","Theoretical bounds: LDP still leaks client membership","Membership leaks persist under LDP, theory and tests show","Even with LDP, federated models leak membership: proofs","Noise that saves privacy kills model utility, study finds"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00027,"raw_usage":{"total_tokens":1675,"prompt_tokens":1046,"completion_tokens":629,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":662,"completion_tokens_details":{"reasoning_tokens":547}},"tokens_in":662,"tokens_out":629,"duration_ms":7181,"temperature":1.0,"reasoning_tokens":547,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T00:24:30.564442+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Measure, for a concrete mechanism such as BitRand or GRR applied to CIFAR10 embeddings, the empirical minimum pairwise separation $\\Delta^\\varepsilon$ of the protected patterns across privacy budgets and check whether $\\Delta^\\varepsilon \\geq \\Delta$ holds whenever condition (5) is satisfied; finding a budget where the minimum separation drops below the unperturbed value, or where the measured attention-attack advantage falls short of Eq. (6), would pinpoint the theorem's premise as the failing link.","supporting_citations":[{"cited_title":"K., Klambauer, G., Brandstetter, J., and Hochreiter, S","cited_arxiv_id":null,"evidence_quote":"Provides the Hopfield interpretation of self-attention with exponentially small retrieval error and the Jacobian bound that Lemma 1, Lemma 2, and the proof of Theorem 3 rest on."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Generalized randomized response, the classical LDP mechanism whose specialized lower bound is stated in Theorem 4 and used as an experimental baseline."},{"cited_title":"Rappor: Randomized aggregatable privacy-preserving ordinal response","cited_arxiv_id":null,"evidence_quote":"RAPPOR, one of the four LDP mechanisms tested in the experiments and the example behind the binary-alphabet remark."},{"cited_title":"Collecting telemetry data privately","cited_arxiv_id":null,"evidence_quote":"dBitFlipPM, an LDP mechanism tested in the experiments against both adversaries."},{"cited_title":"D., Chen, A., Shila, D","cited_arxiv_id":null,"evidence_quote":"BitRand, the bit-flipping LDP mechanism whose CIFAR10 experiments show the utility collapse that motivates the paper's privacy-utility tradeoff conclusions."}],"review_version":1}