Pith. sign in

REVIEW 4 major objections 5 minor 53 references

Key Protected Classification for Collaborative Learning

T0 review · 4 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper proposes making collaborative-learning classifiers resistant to GAN-based data reconstruction by replacing the final softmax layer with class-specific private random keys, so no participant can compute the scores of another…

desk verdict The key-protection idea is novel and the math is clean, but the paper's central security claim collapses for an adversary with a public sample of the target class. read the letter →

arxiv 1908.10172 v2 pith:R445KWQA submitted 2019-08-27 cs.LG cs.CVstat.ML

Mert Bülent Sar{i}y{i}ld{i}z , Ramazan Gökberk Cinbiş , Erman Ayday This is my paper · ORCID
classification cs.LGcs.CVstat.ML
keywords privacy-preservingmachinelearningcollaborativeGANattackclasskeysscoreprotectionembeddingnormalizationmodelinversiondefensekey-basedclassification
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that the GAN attack on collaborative learning succeeds only because every participant can see the classification scores for all classes, and it proposes a classifier that removes that access by construction. In the proposed key-protected model the shared network outputs a normalized embedding rather than class probabilities, and the score of a class is the dot product between that embedding and a random key that the owning participant generates privately and never shares. Training uses a regression-like objective, derived by generalizing softmax to infinitely many classes, that maximizes correlation between embeddings and the correct key. If the claim is right, an active malicious participant can no longer choose a victim class to attack and cannot extract recognizable training samples, without the accuracy-versus-privacy trade-off that noise-based defenses require.

What carries the argument

The central object is the class key: a fixed, randomly generated, $\ell^2$-normalized vector $\psi_c\in\mathbb{R}^{d_{\text{key}}}$ that each participant creates privately for each class it hosts, and keeps secret during training. The classifier is reparameterized so that the network $\phi_\theta$ maps inputs to $\ell^2$-normalized embeddings and the score for class $c$ is the dot product $\langle \phi_\theta(x),\psi_c\rangle$, replacing the usual softmax layer whose outputs are visible to everyone. This machinery carries the argument because it makes the victim's class scores uncomputable without the key; the training objective is derived from a softmax over infinitely many classes, and a randomly initialized, frozen dense layer maps embeddings into a much higher-dimensional space so that independently generated keys are nearly orthogonal without increasing model complexity.

What would settle it

Take any class held by a victim, forward one public image of that class through the shared key-protected model, normalize the resulting embedding to unit length, and use that vector as the attack key in the GAN attack pipeline. If the generator then produces recognizable reconstructions of the victim's training images, the central claim that class scores are inaccessible to the adversary is false.

Watch

Extended reading notes

Core claim

The central discovery is that class-score secrecy is sufficient to break the GAN attack: the attack is driven by optimizing a generator against the victim class's scores, so a participant that does not hold the private key $\psi_c$ cannot compute the score $\langle \phi_\theta(x), \psi_c\rangle$ and therefore cannot run the attack. The paper derives a training scheme for this setup in which each participant knows only its own keys, by replacing the softmax denominator with an expectation over normally distributed keys; the expectation evaluates to $\exp(0.5\|\phi(x)\|^2)$, which turns the objective into maximizing the dot product between embeddings and the correct keys. It then shows that high-dimensional keys make random key guessing progressively less likely to succeed, and introduces a frozen random projection layer so key dimensionality can be increased without adding trainable parameters. The authors verify experimentally that when the attacker uses random keys the generator collapses into noise, whereas when the exact key is leaked the attack succeeds, confirming that key secrecy is the load-bearing element.

Load-bearing premise

The whole defense rests on the assumption that no participant ever obtains or approximates another participant's private class key; if an adversary can recover or estimate a victim key from public images, shared updates, or any side channel, the protected model becomes as vulnerable as the original one.

Editorial extensions

If this is right

  • An adversary who can only guess keys at random cannot steer the shared model toward any particular victim class, and the GAN generators collapse into unrecognizable modes for sufficiently large key dimensionality.
  • If a class key is ever leaked, the GAN attack succeeds on the key-protected model as well, so the scheme converts the attack problem into a key-secrecy problem rather than eliminating reconstruction risk entirely.
  • Key dimensionality can be raised to tens of thousands through a frozen random projection layer, improving resistance to random-key attacks while keeping the number of trainable parameters roughly constant.
  • Participants may host the same class with different private keys: high-dimensional random keys are nearly orthogonal, so the shared embedding can correlate with all copies of a class key while staying uncorrelated with other classes.
  • The key-based regression objective performs comparably to cross-entropy on centralized image classification, so the formulation is not only a privacy device but a usable training loss.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the shared model is trained to map images of a class near that class's key, an adversary who possesses any public image of the victim class can approximate the key by forwarding that image through the model and normalizing the embedding; the paper does not analyze this route to key recovery.
  • The local updates in the training formulation are linear in the key vectors, so a malicious parameter server or an observer of shared gradients may be able to infer or constrain the keys from the updates; the paper only evaluates adversaries that generate keys at random.
  • A direct test of both routes would be to measure GAN reconstruction quality as a function of the distance between the attacker's approximate key and the true key; the paper's own experiments show a sharp success threshold around $\delta = 0.5$ on handwritten digits, suggesting that a close approximation may be enough for a successful attack.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes a key-protected classification scheme for collaborative learning, intended to prevent the Hitaj et al. GAN attack by design. Instead of a standard softmax classifier, participants train an embedding network whose class scores are dot products between L2-normalized embeddings and class-specific private random keys (Eq. 9). The authors derive a regression-like loss from a softmax-over-infinite-classes formulation, introduce a fixed random projection layer to support high-dimensional keys, and report experiments on MNIST, Olivetti Faces, and CIFAR showing that the approach trains effectively and that attacks with random keys fail. The central security claim is that a participant cannot compute class scores for victim classes without knowing the class keys.

Significance. The loss derivation in Section 4.2 and Appendix A is mathematically sound, the code is available, and the experimental evaluation of training accuracy is reasonably thorough. If the security claim held, the method would be a useful contribution to privacy-preserving collaborative learning, avoiding the utility trade-offs of differential privacy. However, the security claim is the main contribution, and it is not supported for realistic adversaries: the paper evaluates only random-key attackers and an attacker with the exact key, while ignoring that the shared model itself can be used by any participant to build approximate keys from public samples. This undermines the 'by design' guarantee and leaves the paper's core thesis unsubstantiated.

major comments (4)
  1. [Section 4.1, Eq. (9) and Section 5.3, Experiment II] The central claim that 'a participant does not have access to the class scores that are necessary by definition for the GAN attack' (Section 4.1) is not valid under the stated threat model. The shared model parameters are available to every participant, and the training objective in Eq. (9) drives embeddings of class c toward the private key ψ_c. An adversary holding any public example of the attacked class (e.g., a public MNIST digit) can compute a proxy key ψ_hat = φ_θ(x_pub) in one forward pass and then run the original GAN attack using this proxy. This is exactly the setting of Experiment II, where the attack succeeds when the attack key is within Euclidean distance δ of the true key, with a sharp threshold near δ = 0.5 on MNIST. The paper provides no argument or experiment showing that proxy keys obtained from public samples lie outside this threshold; indeed, the training objective suggests the opposite. Thus the 'by design' prevention claim is unsupported.
  2. [Section 4.3] The statement that 'there is no supervisory signal that the attacker can utilize to guess private class keys better than random' is contradicted by the paper's own formulation. The shared embedding network φ_θ is a public function whose outputs are trained to align with the class keys, so every public sample of a class provides a supervisory signal for that class's key. Furthermore, the paper does not analyze whether the proxy-key distance δ satisfies the attack threshold identified in Experiment II. Without such analysis, the robustness claim in Experiment III (random keys only) cannot be extrapolated to an adversary with access to public samples.
  3. [Algorithm 1 and Eq. (9)] A second key-leakage channel is the parameter updates themselves. The gradients of the loss in Eq. (9) with respect to the embedding parameters are linear in the key vectors ψ_c, and Algorithm 1 requires participants to upload local model updates to the parameter server. An adversarial participant observing these updates can potentially solve for or constrain the victim's class keys, yet the paper provides no analysis of this channel. This is a load-bearing omission: the security argument assumes keys remain private during training, but the very updates that implement the protocol may reveal them.
  4. [Section 5.3] The experimental evaluation only considers three adversary types: exact-key, random-key-with-known-distance δ, and purely random key. Missing is the natural realistic adversary who uses a public sample of the target class as a proxy key, or who uses shared gradients to estimate keys. Adding such experiments would be necessary to support the claimed resilience 'against such attacks by design.' As it stands, the experiments demonstrate only that random-key GAN attacks fail, which is a much weaker statement than the paper's abstract and conclusion claim.
minor comments (5)
  1. [Section 5.2, Figure 3 caption] The caption says 'The dashed lines in the MNIST figures indicate that there are fixed layers,' but the figure does not clearly label which lines are dashed; please clarify or increase line-style visibility.
  2. [Section 5.3, Experiment III] In Figures 6 and 7 the text writes 'dkey = 16834' and 'dkey = 16834' in captions; this appears to be a typo for 16384.
  3. [Section 4.3] The phrase 'to a large-extend' should read 'to a large extent.'
  4. [Section 5.5, Table 1] The comparison of key-based regression and cross entropy on CIFAR reports small margins (94.8% vs. 94.0% on CIFAR-10 and 73.6% vs. 74.2% on CIFAR-100) but no standard deviations or significance tests; please report whether the differences are stable across runs.
  5. [General] The paper repeatedly states that keys are 'made public' after training (Section 4.1) but also discusses leaving them private (Section 4.5); the implications for the threat model during and after training should be stated more precisely.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the loss derivation is self-contained and the security claims are evaluated by independent attack experiments.

full rationale

The paper's main derivation chain is self-contained. In Section 4.2, the generalized softmax in Eq. 6 leads to Eq. 7, and the Gaussian expectation is computed explicitly in Appendix A, giving exp(0.5||phi(x)||^2); with the L2-normalization layer this becomes a constant and the objective reduces to Eq. 9. No step in this chain assumes the conclusion it is meant to establish. The security evaluation is likewise based on externally defined attack experiments: the adversary is given the exact key, keys at controlled distances delta, or random keys, and success is measured by visual quality and a pre-trained MNIST classifier's accuracy. These are independent empirical tests, not fitted quantities renamed as predictions. The statement that a participant cannot access class scores without the private keys is a direct design property of the score definition g_theta(x, psi_c) = <phi_theta(x), psi_c>, not a circular inference. The paper relies on existing external work (Hitaj et al. GAN attack, Shokri et al. collaborative learning) rather than on load-bearing self-citations. Any concern that an adversary could approximate a key from a public sample of the target class is a threat-model completeness issue, not circularity, and the paper does not claim to analyze that attack channel. Overall, there is no self-definitional reduction, no fitted input called prediction, and no self-citation chain forcing the central result.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The central method introduces class keys as fixed random vectors. The main unstated assumption is that keys remain secret even though the shared model maps public class samples near the keys and participants share parameter updates computed from the keys. The loss derivation itself is self-contained and uses standard Gaussian integration.

free parameters (2)
  • Key dimensionality dkey = 128, 1024, 4096, 16384 in experiments; tuned per architecture
    Controls both security against random-key attacks and training accuracy; the paper states dkey should be treated as a hyperparameter tuned on a held-out public dataset (Section 5.1).
  • Regularization weight lambda = not reported; tuned on validation
    Appears in the final objective Eq. 9; value is chosen by hand, and the paper does not report the chosen values.
assumptions (4)
  • domain assumption Class keys are sampled independently from a multivariate standard normal distribution and kept private by each participant.
    Underlies the derivation of the loss in Section 4.2 and the security argument in Section 4.3.
  • domain assumption The adversary has no access to any sample from the target class, including public data, and cannot infer keys from shared model updates.
    The paper assumes in Section 3.3 that the adversary works only on its privacy attack with no real data, and never analyzes key leakage through the public model or the shared gradients (Eq. 9, Algorithm 1).
  • standard math High-dimensional L2-normalized random vectors are nearly orthogonal with high probability.
    Used to justify that random attack keys are unlikely to correlate with real class keys (Section 4.3, Figure 2).
  • standard math The expectation of exp(g) over standard normal keys equals exp(0.5 * ||phi(x)||^2).
    Derived in Appendix A by Gaussian integration; this yields the regression-like loss in Eq. 9.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Key Protected Classification for Collaborative Learning." pith.science (2026). https://pith.science/paper/R445KWQA

@misc{pith2026190810172,
  author       = {Pith},
  title        = {Pith review of: Key Protected Classification for Collaborative Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/R445KWQA}},
  note         = {Machine review of arXiv:1908.10172}
}
read the original abstract

Large-scale datasets play a fundamental role in training deep learning models. However, dataset collection is difficult in domains that involve sensitive information. Collaborative learning techniques provide a privacy-preserving solution, by enabling training over a number of private datasets that are not shared by their owners. However, recently, it has been shown that the existing collaborative learning frameworks are vulnerable to an active adversary that runs a generative adversarial network (GAN) attack. In this work, we propose a novel classification model that is resilient against such attacks by design. More specifically, we introduce a key-based classification model and a principled training scheme that protects class scores by using class-specific private keys, which effectively hide the information necessary for a GAN attack. We additionally show how to utilize high dimensional keys to improve the robustness against attacks without increasing the model complexity. Our detailed experiments demonstrate the effectiveness of the proposed technique. Source code is available at https://github.com/mbsariyildiz/key-protected-classification.

Figures

Figures reproduced from arXiv: 1908.10172 by the authors.

Figure 1
Figure 1. The comparison of the compute chains constructed during the vanilla (left, a) and the modified key-protected [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. The correlation between two random vectors [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Mean participant accuracies obtained in collaborative learning with 2, 3, and 5 participants over the MNIST [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Demonstrations of GAN attacks i) in the vanilla classification model where all class logits are seen by the [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]
Figure 5
Figure 5. Figure 5: We approximate the maximum Euclidean distance between any class key and [PITH_FULL_IMAGE:figures/full_fig_p012_5.png]
Figure 6
Figure 6. Figure 6: GAN attack results on the MNIST dataset using random attack keys. We split MNIST among 5 participants [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]
Figure 7
Figure 7. Figure 7: GAN attack results on the Olivetti Faces dataset using random attack keys. From left to right, reconstructions [PITH_FULL_IMAGE:figures/full_fig_p013_7.png]
Figure 8
Figure 8. Figure 8: (Left) We randomly generate `2 normalized ψ i c , ψj c , φ(x c ) ∈ R dkey for dkey ∈ {64, 128, 1024, 4096, 16384}. Then we find the opti￾mal φ(x c ) such that its dot product with ψ i c and ψ j c are maximized. Bars indicate that as we increase the dimensionality, ψ i …

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

53 extracted references · 45 canonical work pages

  1. [1]

    J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, L. Fei-Fei, Im- ageNet: A Large-Scale Hierarchical Image Database, in: Proc. CVPR, 2009

    work page 2009

  2. [2]

    Y. Guo, L. Zhang, Y. Hu, X. He, J. Gao, MS-Celeb-1M: A datasetand benchmarkforlargescaleface recognition, in: Proc. ECCV, 2016

    work page 2016

  3. [3]

    Abu-El-Haija, N

    S. Abu-El-Haija, N. Kothari, J. Lee, P. Natsev, G. Toderici, B. Varadarajan, S. Vijayanarasimhan, Youtube-8m: A large- scale video classification benchmark, arXiv:1609.08675 (2016)

    arXiv 2016

  4. [4]

    Shokri, V

    R. Shokri, V. Shmatikov, Privacy-preserving deep learning, in: ACM SIGSAC Conference on Computer and Communications Security, 2015. 13

    work page 2015

  5. [5]

    AISTATS, 2017

    H.B.McMahan, E.Moore, D.Ramage, S.Hampson, B.A.yAr- cas, Communication-efficient learning of deep networks from de- centralized data, in: Proc. AISTATS, 2017

    work page 2017

  6. [6]

    Bellet, R

    A. Bellet, R. Guerraoui, M. Taziki, M. Tommasi, Personalized and private peer-to-peer machine learning, in: Proc. AISTATS, 2018

    work page 2018

  7. [7]

    Vanhaesebrouck, A

    P. Vanhaesebrouck, A. Bellet, M. Tommasi, Decentralized Col- laborative Learning of Personalized Models over Networks, in: Proc. AISTATS, 2017

    work page 2017

  8. [8]

    Fredrikson, S

    M. Fredrikson, S. Jha, T. Ristenpart, Model inversion attacks that exploit confidence information and basic countermeasures, in: ACM SIGSAC Conference on Computer and Communica- tions Security, 2015

    work page 2015

Show all 53 references
  1. [9]

    Chaudhuri, C

    K. Chaudhuri, C. Monteleoni, A. D. Sarwate, Differentially pri- vate empirical risk minimization, Journal of Machine Learning Research 12 (2011)

    2011

  2. [10]

    Dwork, Differential privacy, in: Encyclopedia of Cryptogra- phy and Security, 2011

    C. Dwork, Differential privacy, in: Encyclopedia of Cryptogra- phy and Security, 2011

    2011

  3. [11]

    N. Phan, Y. Wang, X. Wu, D. Dou, Differential privacy preser- vation for deep auto-encoders: an application of human behav- ior prediction, in: AAAI Conference on Artificial Intelligence, 2016

    2016

  4. [12]

    Abadi, A

    M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, L. Zhang, Deep learning with differential privacy, in: ACM SIGSAC Conference on Computer and Communications Security, 2016

    2016

  5. [13]

    Papernot, M

    N. Papernot, M. Abadi, U. Erlingsson, I. Goodfellow, K. Tal- war, Semi-supervised knowledge transfer for deep learning from private training data, in: Proc. ICLR, 2016

    2016

  6. [14]

    Hitaj, G

    B. Hitaj, G. Ateniese, F. Perez-Cruz, Deep models under the gan: Information leakage from collaborative deep learning, in: ACM SIGSAC Conference on Computer and Communications Security, 2017

    2017

  7. [15]

    Goodfellow, J

    I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde- Farley, S. Ozair, A. Courville, Y. Bengio, Generative adversarial nets, in: Proc. NeurIPS, 2014

    2014

  8. [16]

    LeCun, L

    Y. LeCun, L. Bottou, Y. Bengio, P. Haffner, Gradient-based learning applied to document recognition, in: Proceedings of the IEEE, 1998

    1998

  9. [17]

    F. S. Samaria, A. C. Harter, Parameterisation of a stochastic model for human face identification, in: IEEE Workshop on Applications of Computer Vision, IEEE, 1994

    1994

  10. [18]

    Krizhevsky, Learning multiple layers of features from tiny images, Tech

    A. Krizhevsky, Learning multiple layers of features from tiny images, Tech. rep. (2009)

    2009

  11. [19]

    Chakraborty, M

    A. Chakraborty, M. Alam, V. Dey, A. Chattopadhyay, D. Mukhopadhyay, Adversarial attacks and defences: A survey, arXiv preprint arXiv:1810.00069 (2018)

    2018 arXiv

  12. [20]

    Melis, C

    L. Melis, C. Song, E. D. Cristofaro, V. Shmatikov, Exploiting unintended feature leakage in collaborative learning, in: IEEE Symposium on Security and Privacy, 2019

    2019

  13. [21]

    Z. Wang, M. Song, Z. Zhang, Y. Song, Q. Wang, H. Qi, Beyond inferring class representatives: User-level privacy leakage from federated learning, in: IEEE Conference on Computer Commu- nications, 2019

    2019

  14. [22]

    Dwork, Differential privacy, in: Automata, Languages and Programming, 2006

    C. Dwork, Differential privacy, in: Automata, Languages and Programming, 2006

    2006

  15. [23]

    Chaudhuri, C

    K. Chaudhuri, C. Monteleoni, Privacy-preserving logistic re- gression, in: Proc. NeurIPS, 2009

    2009

  16. [24]

    S. Song, K. Chaudhuri, A. D. Sarwate, Stochastic gradient de- scent with differentially private updates, in: IEEE Global Con- ference on Signal and Information Processing, 2013

    2013

  17. [25]

    S. Song, K. Chaudhuri, A. Sarwate, Learning from data with heterogeneous noise using sgd, in: Proc. AISTATS, 2015

    2015

  18. [26]

    Rajkumar, S

    A. Rajkumar, S. Agarwal, A differentially private stochas- tic gradient descent algorithm for multiparty classification, in: Proc. AISTATS, 2012

    2012

  19. [27]

    Hynes, R

    N. Hynes, R. Cheng, D. Song, Efficient deep learning on multi- source private data, arXiv preprint arXiv:1807.06689 (2018)

    2018 arXiv

  20. [28]

    Zhang, Z

    T. Zhang, Z. He, R. B. Lee, Privacy-preserving machine learn- ing through data obfuscation, arXiv preprint arXiv:1807.01860 (2018)

    2018 arXiv

  21. [29]

    J. Hamm, Y. Cao, M. Belkin, Learning privately from multi- party data, in: Proc. ICML, 2016

    2016

  22. [30]

    Pathak, S

    M. Pathak, S. Rane, B. Raj, Multiparty Differential Privacy via Aggregation of Locally Trained Classifiers, in: Proc. NeurIPS, 2010

    2010

  23. [31]

    Mohassel, Y

    P. Mohassel, Y. Zhang, SecureML: A system for scalable privacy-preserving machine learning, in: IEEE Symposium on Security and Privacy, 2017

    2017

  24. [32]

    Bonawitz, V

    K. Bonawitz, V. Ivanov, B. Kreuter, A. Marcedone, H. B. McMahan, S. Patel, D. Ramage, A. Segal, K. Seth, Practical secure aggregation for privacy-preserving machine learning, in: ACM SIGSAC Conference on Computer and Communications Security, 2017

    2017

  25. [33]

    González-Serrano, Á

    F.-J. González-Serrano, Á. Navia-Vázquez, A. Amor-Martín, Training support vector machines with privacy-protected data, Pattern Recognition 72 (2017)

    2017

  26. [34]

    Gomez-Barrero, E

    M. Gomez-Barrero, E. Maiorana, J. Galbally, P. Campisi, J. Fierrez, Multi-biometric template protection based on ho- momorphic encryption, Pattern Recognition 67 (2017)

    2017

  27. [35]

    S. Wang, J. Hu, Design of alignment-free cancelable fingerprint templates via curtailed circular convolution, Pattern Recogni- tion 47 (2014)

    2014

  28. [36]

    Anees, Y.-P

    A. Anees, Y.-P. P. Chen, Discriminative binary feature learning and quantization in biometric key generation, Pattern Recogni- tion 77 (2018)

    2018

  29. [37]

    Cancellable speech template via random binary orthogonal ma- trices projection hashing, Pattern Recognition 76 (2018)

    2018

  30. [38]

    L. Xie, K. Lin, S. Wang, F. Wang, J. Zhou, Differen- tially private generative adversarial network, arXiv preprint arXiv:1802.06739 (2018)

    2018 arXiv

  31. [39]

    C. Xu, J. Ren, D. Zhang, Y. Zhang, Z. Qin, K. Ren, GANobfus- cator: Mitigating information leakage under gan via differential privacy, IEEE Transactions on Information Forensics and Secu- rity 14 (2019)

    2019

  32. [40]

    Zhang, T

    H. Zhang, T. Xu, H. Li, S. Zhang, X. Wang, X. Huang, D. N. Metaxas, StackGAN: Text to photo-realistic image synthesis with stacked generative adversarial networks, in: Proc. ICCV, 2017

    2017

  33. [41]

    R. A. Yeh, C. Chen, T. Yian Lim, A. G. Schwing, M. Hasegawa- Johnson, M. N. Do, Semantic image inpainting with deep gen- erative models, in: Proc. CVPR, 2017

    2017

  34. [42]

    Salimans, I

    T. Salimans, I. Goodfellow, W. Zaremba, V. Cheung, A. Rad- ford, X. Chen, X. Chen, Improved techniques for training gans, in: Proc. NeurIPS, 2016

    2016

  35. [43]

    Mirza, S

    M. Mirza, S. Osindero, Conditional generative adversarial nets, arXiv preprint arXiv:1411.1784 (2014)

    2014 arXiv

  36. [44]

    I. O. Tolstikhin, S. Gelly, O. Bousquet, C.-J. Simon-Gabriel, B. Schölkopf, AdaGAN: Boosting generative models, in: Proc. NeurIPS, 2017

    2017

  37. [45]

    T. Che, Y. Li, A. P. Jacob, Y. Bengio, W. Li, Mode regularized generative adversarial networks, in: Proc. ICLR, 2017

    2017

  38. [46]

    Goodfellow, Neurips 2016 tutorial: Generative adversarial networks, arXiv preprint arXiv:1701.00160 (2016)

    I. Goodfellow, Neurips 2016 tutorial: Generative adversarial networks, arXiv preprint arXiv:1701.00160 (2016)

    2016 arXiv

  39. [47]

    A. L. Maas, A. Y. Hannun, A. Y. Ng, Rectifier nonlinearities improve neural network acoustic models, in: ICML Workshop on Deep Learning for Audio, Speech and Language Processing, 2013

    2013

  40. [48]

    S. Ioffe, C. Szegedy, Batch normalization: Accelerating deep network training by reducing internal covariate shift, in: Proc. ICML, 2015

    2015

  41. [49]

    J. L. Ba, J. R. Kiros, G. E. Hinton, Layer normalization, arXiv preprint arXiv:1607.06450 (2016)

    2016 arXiv

  42. [50]

    Abadi, A

    M. Abadi, A. Agarwal, P. Barham, E. Brevdo, Z. Chen, C. Citro, G. S. Corrado, A. Davis, J. Dean, M. Devin, S. Ghemawat, I. Goodfellow, A. Harp, G. Irving, M. Isard, Y. Jia, R. Jozefowicz, L. Kaiser, M. Kudlur, J. Levenberg, D. Mané, R. Monga, S. Moore, D. Murray, C. Olah, M. S...

  43. [51]

    Paszke, S

    A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G.Chanan, T.Killeen, Z.Lin, N.Gimelshein, L.Antiga, A.Des- maison, A. Kopf, E. Yang, Z. DeVito, M. Raison, A. Tejani, S. Chilamkurthy, B. Steiner, L. Fang, J. Bai, S. Chintala, Py- torch: An imperative style, high-performan...

    2019

  44. [52]

    Hitaj, G

    B. Hitaj, G. Ateniese, F. Pérez-Cruz, Deep models under the gan: information leakage from collaborative deep learning, in: ACM SIGSAC Conference on Computer and Communications Security, ACM, 2017

    2017

  45. [53]

    K. He, X. Zhang, S. Ren, J. Sun, Deep residual learning for image recognition, in: Proc. CVPR, 2016. 15 Appendix A. Softmax Over Infinitely-many Classes In this section, we show the detailed derivation of our softmax generalization to infinitely-many classes. Below, we use the s...

    2016

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.