Pith. sign in

REVIEW 5 major objections 5 minor 99 references

Just a Simple Transformation is Enough for Data Protection in Vertical Federated Learning

T0 review · 5 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that feature reconstruction attacks in split learning cannot succeed without a prior distribution on the data, and that MLP-based client architectures stop the state-of-the-art attacks without any defense mechanism.

desk verdict Useful empirical observation about dense-layer clients resisting UnSplit/FSHA, but the headline theoretical claim is false as stated; needs a major rewrite around the black-box setting. read the letter →

arxiv 2412.11689 v1 pith:6YXG7LDV submitted 2024-12-16 cs.LG cs.CR

Andrei Semenov , Philip Zmushko , Alexander Pichugin , Aleksandr Beznosikov This is my paper · ORCID
classification cs.LGcs.CR
keywords verticalfederatedlearningsplitfeaturereconstructionattackmodelinversionfeature-spacehijackingMLPprivacyorthogonaltransformationFréchetinceptiondistance
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Vertical federated learning protects raw data by having each client send only intermediate activations to the server. This paper argues that those activations are safe from feature reconstruction attacks unless the attacker already knows the data distribution. The argument turns on a symmetry: for a one-layer linear client, replacing the data $X$ by $XU$ and the weights $W$ by $U^\top W$ produces exactly the same training protocol, so infinitely many distinct datasets look identical to the server. The paper then shows experimentally that replacing CNN clients with MLP-based clients makes the UnSplit and Feature-space Hijacking attacks fail on MNIST, Fashion-MNIST, and CIFAR-10, while model accuracy stays roughly the same. If the claim is right, architectural choice alone, with no added noise, obfuscation, or cryptography, can protect client features in split learning.

What carries the argument

The load-bearing object is the orthogonal-transformation equivalence class $\{XU, U^\top W\}$: rotating the client data and correspondingly rotating the weight initialization, or applying a non-trainable orthogonal pre-multiplication before the first layer, leaves the transmitted activations $H = XW$ invariant under GD and SGD updates. This makes the server unable to distinguish among a continuum of datasets, so reconstruction without a prior distribution is impossible. For Adam-like optimizers the exact invariance breaks, but the paper proves convergence to the same optimal value under a Polyak-\Lojasiewicz condition. In the experimental setting, dense layers before the cut layer instantiate the relevant non-invertibility: unlike a convolution, a dense linear map's weight matrix can absorb a general orthogonal factor, so the mapping from data to activations is not invertible from activations alone.

What would settle it

Run the one-layer linear client setup with no secret orthogonal pre-transformation, hand the server the trained first-layer weight matrix $W$ after training, and have it compute $X = H W^{-1}$ from the transmitted activations; exact recovery of the original images would falsify the paper's unconditional no-prior claim. A second falsifier is any feature reconstruction attack that succeeds against an MLP-based client while knowing no prior on the data.

Watch

Extended reading notes

Core claim

The paper's central claim is that feature reconstruction attacks in two-party split learning cannot succeed without prior knowledge of the data distribution, and that a simple architectural choice, using dense (MLP) layers rather than convolutional layers on the client side, is enough to block the current state-of-the-art attacks. The theoretical core is Lemma 1: for a one-layer linear client model updated by GD or SGD, every orthogonal transformation of the data and the matching rotation of the weight initialization yield identical activations at every training step. Hence the server sees exactly the same protocol for infinitely many datasets and cannot single out the real $X$. A Cut Layer Lemma extends the indistinguishability to activations before the cut layer. Experimentally, the paper reports that UnSplit and Feature-space Hijacking fail on MNIST, Fashion-MNIST, and CIFAR-10 when the client is an MLP or MLP-Mixer, with near-identical activations in the hidden space but unusable reconstructions in image space, while accuracy remains close to the CNN baseline.

Load-bearing premise

The result depends on the attacker not knowing the client's first-layer weights; if the attacker learns those weights and they form an invertible matrix, it can recover the data directly from the activations, so the no-prior claim no longer holds.

Editorial extensions

If this is right

  • Switching client-side CNNs to MLP-based architectures should neutralize UnSplit and Feature-space Hijacking attacks in split learning without degrading the main-task accuracy.
  • A server with no prior on the client's data distribution cannot recover original features from cut-layer activations, even for a single-layer linear client, because orthogonal rotations of data and weights are indistinguishable.
  • The same reasoning protects pre-cut-layer activations: even if the server has a prior on the raw data, it can at best recover activations up to an orthogonal transformation.
  • The exact training-protocol invariance holds for GD and SGD, while Adam-like optimizers converge to the same optimum under a PL condition, so the protection is not tied to one optimizer.
  • Reconstruction quality should be evaluated with FID rather than MSE, since MSE can be lower for worse reconstructions, as observed on Fashion-MNIST.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The guarantee is equivalence-class privacy rather than absolute secrecy: if the server ever learns the client's first-layer weight matrix $W$ and $W$ is invertible, it can compute $X = H W^{-1}$ directly, so the no-prior claim implicitly assumes $W$ stays hidden or that a secret orthogonal pre-transformation is applied.
  • A practical, testable extension suggested by the argument is to prepend a fixed random orthogonal matrix to a dense client layer; because the server cannot separate $X$ from $XU$, this could harden even CNN-based clients at the cost of a few extra parameters.
  • Re-running existing attack and defense comparisons with FID instead of MSE could change reported privacy rankings, since the paper shows that MSE can understate or overstate reconstruction quality in opposite directions.
  • The argument implies that any client architecture beginning with dense layers, such as transformers or MLP-Mixers, should inherit the protection for continuous-input tasks, though the authors note their continuous-input argument does not directly transfer to discrete NLP inputs.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper studies feature reconstruction attacks in vertical federated learning (specifically two-party split learning) and argues that MLP-based client architectures are resistant to state-of-the-art attacks (UnSplit model inversion and Feature-space Hijacking) without any additional defense, while preserving model accuracy. The theoretical part claims that, absent a prior on the data distribution, the server cannot reconstruct client features; the argument is based on orthogonal transformations of data and weights producing identical activations (Lemma 1), with extensions to known first-layer weights (Corollary 1), malicious servers (Lemma 2), and activations before the cut layer (Lemma 3). The experimental part compares CNN-based and MLP-based clients on MNIST, F-MNIST, and CIFAR-10 under the UnSplit and FSHA attacks, reporting MSE, FID, and accuracy.

Significance. If the main claim were correct, the paper would identify a simple, utility-preserving architectural defense against two important black-box feature reconstruction attacks, and its proposal to evaluate reconstruction quality with FID rather than MSE is a useful methodological point. The paper also deserves credit for releasing code, testing standard attack implementations, and including additional ablations (SmallMLP and class-wise MSE) in the appendix. However, the central theoretical statement is substantially overclaimed as written: the no-prior impossibility result does not hold in the stated generality, the proof of Corollary 1 is internally inconsistent, and the experimental evidence on CIFAR-10 partially points against the paper's narrative. The empirical phenomenon may still hold under a more carefully stated threat model, but the current version does not establish the advertised result.

major comments (5)
  1. [Section 3.2, Corollary 1 (also abstract and Contribution 1)] Corollary 1 is false as stated. If the server knows the first-layer weight matrix W1 and W1 is invertible, then from the transmitted activations H1 = X W1 it computes X_hat = H1 W1^{-1} = X exactly, with no data prior. The proof's 'client performs an orthogonal transformation leading to tilde X' changes the data without the corresponding weight rotation from Lemma 1; under the Lemma 1 pair (tilde X = XU, tilde W1 = U^T W1), the same computation recovers X because tilde X tilde W1 = X W1. Thus the non-recoverability claim holds only under Lemma 2's additional assumption that the client secretly applies an orthogonal transformation before W1, an assumption absent from the abstract and Contribution 1. This is load-bearing: the headline 'cannot succeed without knowledge of the prior' is not supported.
  2. [Section 3.2, Lemma 2 and Remark 3] Lemma 2's positive result depends crucially on the client inserting a non-trainable secret orthogonal matrix before W1. With that assumption, the server knowing W1 can recover only XU, i.e., the data up to an unknown orthogonal transformation. This is an active defense mechanism and a change of threat model, not merely a consequence of using a dense layer. The abstract and Section 3.3 nevertheless state the conclusion as 'MLP-based models are resistant' without this precondition. The experiments never let the server know W1, so they do not test the Corollary 1 scenario; this gap should be acknowledged and the theoretical claims restated to match the assumptions actually used.
  3. [Section 4, Table 1] The CIFAR-10 row contradicts the resistance narrative under the paper's preferred metric. The MLP-Mixer client has FID 423 versus 455 for the CNN client; since lower FID means closer to the real data distribution, the reconstructed CIFAR-10 images are at least as good for the MLP-Mixer as for the CNN, even though the MSE in image space is much higher (1.398 vs 0.056). On F-MNIST, the CNN has lower MSE (0.37 vs 0.19) and much lower FID (169 vs 361), so those two metrics agree there, but on CIFAR-10 they disagree sharply. The paper should report reconstructions and per-class FID values for CIFAR-10 and explain how the MLP-Mixer result supports the claim that the attack fails.
  4. [Section 4.1 and Appendix C] There is an inconsistency between the main text and the appendix about the architectures used in the headline experiments. Section 4.1 states that 'the client's part holds only one-layer model,' while Appendix C states that the MLP used for MNIST and F-MNIST is a four-layer MLP with ReLU activations. Since Lemma 1 applies only to a one-layer linear model and Lemma 3 applies to general networks with a linear cut layer, it matters which theoretical result is being tested by which experiment. The paper should report the exact client architectures used for each figure and table, and clarify which rows of Table 1 correspond to one-layer versus multi-layer clients. This is also relevant to the utility claim, because the SmallMLP one-layer client achieves much lower accuracy (92.6% vs 98.5% on MNIST), so the utility-preservation argument relies on the deeper MLP.
  5. [Contribution 1 and Appendix A.4.1] Contribution 1 states that orthogonal transformations 'do not affect convergence for Adam-like algorithms,' but Section 3.2 and Example 1 in Appendix A.4.1 explicitly show that Adam can converge to a local minimum after an orthogonal transformation for a non-convex function. The convergence result in Lemmas 4-6 is proved only under the PL condition together with L-smoothness and bounded-gradient assumptions. The contribution should be restated to say that convergence is preserved under those conditions, not unconditionally.
minor comments (5)
  1. [Throughout] The paper contains several typos: 'continually many' should be 'continuum many' in Lemmas 1 and 3; 'tif' appears in Lemma 2; 'descrepancy' in Appendix A.4.2; 'isotopic' should be 'isotropic' in Appendix A.5; 'MNSIT' in Appendix C; and 'depence' in the caption of Figure 7.
  2. [Section 3.2, Lemma 1 proof] The notation in the proof has minor issues: the base case writes H1 = X1W1 = X1U U^T W1 = tilde X1 tilde W1, but the order of U and U^T should be checked; more importantly, the proof should state whether the same mini-batch indices are used for Xk and tilde Xk at every step, since SGD with random reshuffling could break the inductive coupling.
  3. [Section 3.3, Lemma 3 proof] The Cut Layer Lemma proof demonstrates equality of transmitted activations for the first two iterations and then concludes the proof. For a fully rigorous statement, an induction step for all k should be written out, and the argument that the gradient with respect to the preceding-layer parameters theta remains identical should be presented more explicitly.
  4. [Section 4.1, UnSplit setup] The paper mentions that the original UnSplit reconstruction degraded for deeper cut layers and that comparisons were therefore run with cut layer = 1, but it does not report how many hidden layers the client-side model has in that setting. Please state clearly whether the four-layer MLP's cut layer is after the first layer or after all four layers, since this affects the relevance of Lemma 3.
  5. [Section 4.2, FSHA experiments] The FSHA figures show reconstructed images but no quantitative FID or MSE for the FSHA attack in the main text; Table 1 only covers UnSplit. Adding FSHA-specific numbers would make the resistance claim easier to verify.

Circularity Check

1 steps flagged · score 6.0 of 10

The central no-prior claim is built into Corollary 1: it lets the server observe ~XW1 instead of the Lemma 1 activation XW1, so knowing W1 cannot help; the conclusion is an artifact of the construction.

  1. self definitional [Section 3.2, Corollary 1 (proof paragraph following the corollary)]
    "Corollary 1. Under the conditions of Lemma 1, assume that server knows the first layer W1 of f, and let this layer be an invertible matrix. Then, the label party cannot reconstruct the initial data X (only up to an arbitrary orthogonal transformation). Indeed, the activations send to the server in the first step: H1 = XW 1, but if the client performs an orthogonal transformation leading to ˜X, then, server can recover only ˜H1W −1 1 , where ˜H1 = ˜XW 1."

    Lemma 1 defines the indistinguishable pairs as {XU, U^T W0}, so the transmitted activation is unchanged: ~X ~W1 = XU U^T W1 = XW1. A server that knows invertible W1 can therefore compute H1 W1^{-1} = X exactly, with no data prior needed. The corollary instead computes with ~H1 = ~X W1, i.e., it applies the orthogonal rotation to the data but not to the weight matrix the server knows. That is not the SL activation from Lemma 1 and silently reintroduces the secret-rotation setting of Lemma 2. The non-recoverability conclusion is thus built into the modified observation model rather than derived from the defined protocol.

full rationale

Lemma 1 establishes a genuine indistinguishability result: for {X,W0} and {XU,U^T W0} the transmitted activations are identical, so with unknown weights X is identifiable only up to an orthogonal transformation. That is not circular; it is a standard non-identifiability argument. The problem is the paper's headline extension. Remark 1 and the abstract convert the unknown-W non-identifiability into a categorical 'no prior' claim, and Corollary 1 then claims the same even when the server knows W1. The corollary's proof is self-definitional: under Lemma 1's own pair the server receives H1=XW1 and, knowing invertible W1, computes H1 W1^{-1}=X; the corollary instead lets the server see only ~H1=~XW1, which amounts to assuming the client rotated data without correspondingly rotating its weights. Non-recoverability is therefore not derived from the protocol but inserted into the observation model. The MLP experiments are independent empirical evidence, tested against the public UnSplit and FSHA code, and do not reduce to a fit; they survive as supporting content even though the theoretical motivation overreaches. The citation to [63] (co-authored by A. Beznosikov) is not load-bearing since Lemmas 4-6 are proved in Appendix A.4 and [63] is used only as an analogy for assumptions. Overall score 6: one central theoretical 'prediction' reduces by construction, but independent experimental content remains.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The central analysis introduces no new physical entities or fitted constants in the main body. The free parameters are attack/defense hyperparameters, not fitted to the data. The key axioms are the prior-free threat model, the secret orthogonal transformation needed to support the weight-knowledge claim, and standard optimization assumptions.

free parameters (2)
  • TV regularization weight lambda (UnSplit attack) = increased up to 100
    The paper manually increased lambda to strengthen the image prior while testing MLP clients; it is a hand-chosen attack hyperparameter rather than a fitted model parameter.
  • DP noise scale sigma for CIFAR-10 = 0.25 (theoretical value 7.1 lowered)
    In the differential privacy appendix, the noise scale is set below the theoretical value because of neural network learning issues, a post-hoc adjustment.
assumptions (4)
  • domain assumption The server has no prior knowledge of the client data distribution.
    This is the core threat-model assumption stated in the abstract and Section 2, and it is necessary for the claimed impossibility.
  • ad hoc to paper The client is allowed to apply a secret orthogonal transformation to its data before the first layer (Lemma 2, Corollary 1).
    This assumption is introduced to make the 'even knowledge of weights does not help' claim true; without it, an invertible known weight matrix would allow exact reconstruction.
  • standard math PL-condition, L-smoothness, and bounded gradients hold for the loss under all data transformations (Appendix A.4).
    These are standard optimization assumptions used to prove Adam convergence preservation under orthogonal transformations.
  • domain assumption A dense layer 'smashes' data more than a convolutional layer because convolution weight matrices are structured and non-invertible in general.
    This assumption motivates Hypothesis 1 but is not rigorously proven; it is a structural claim about linear algebra and network architectures.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Just a Simple Transformation is Enough for Data Protection in Vertical Federated Learning." pith.science (2026). https://pith.science/paper/6YXG7LDV

@misc{pith2026241211689,
  author       = {Pith},
  title        = {Pith review of: Just a Simple Transformation is Enough for Data Protection in Vertical Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6YXG7LDV}},
  note         = {Machine review of arXiv:2412.11689}
}
read the original abstract

Vertical Federated Learning (VFL) aims to enable collaborative training of deep learning models while maintaining privacy protection. However, the VFL procedure still has components that are vulnerable to attacks by malicious parties. In our work, we consider feature reconstruction attacks, a common risk targeting input data compromise. We theoretically claim that feature reconstruction attacks cannot succeed without knowledge of the prior distribution on data. Consequently, we demonstrate that even simple model architecture transformations can significantly impact the protection of input data during VFL. Confirming these findings with experimental results, we show that MLP-based models are resistant to state-of-the-art feature reconstruction attacks.

Figures

Figures reproduced from arXiv: 2412.11689 by the authors.

Figure 3
Figure 3. Results of FSHA attack on MNIST. (Top): Original images. (Middle): CNN-based client model. (Bottom): MLP-based client model [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figure 5
Figure 5. Encoder-decoder error and Reconstruction error for FSHA attack [PITH_FULL_IMAGE:figures/full_fig_p009_5.png] view at source ↗
Figure 7
Figure 7. While optimizing the non-convex function [PITH_FULL_IMAGE:figures/full_fig_p020_7.png] view at source ↗
Figures from the paper (2 more)
Figure 10
Figure 10. Figure 10: Results of UnSplit attack on F-MNIST. (Top): Original images. (Middle): CNN-based client model. (Bottom): SmallMLP client model [PITH_FULL_IMAGE:figures/full_fig_p028_10.png]
Figure 11
Figure 11. Figure 11: Results of FSHA attack on MNIST. (Top): Original images. (Middle): CNN-based client model. (Bottom): SmallMLP client model [PITH_FULL_IMAGE:figures/full_fig_p028_11.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

99 extracted references · 56 canonical work pages

  1. [84]

    Feature reconstruction attacks and countermeasures of dnn training in vertical federated learning, 2022

    Peng Ye, Zhifeng Jiang, Wei Wang, Bo Li, and Baochun Li. Feature reconstruction attacks and countermeasures of dnn training in vertical federated learning, 2022

    work page 2022

  2. [1]

    Improving the gaussian mechanism for differential privacy: Analytical calibration and optimal denoising

    Borja Balle and Yu-Xiang Wang. Improving the gaussian mechanism for differential privacy: Analytical calibration and optimal denoising. In International Conference on Machine Learning, pages 394–403. PMLR, 2018

    2018

  3. [2]

    McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth

    Kallista Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H. McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth. Practical secure aggregation for privacy- preserving machine learning. In Practical Secure Aggregation for Privacy-Preserving Machine Learning, pages 1175–1191, 10 2017. doi: 10.1145/3133956.3133982

    arXiv 2017

  4. [3]

    Secureboost: A lossless federated learning framework, 2021

    Kewei Cheng, Tao Fan, Yilun Jin, Yang Liu, Tianjian Chen, Dimitrios Papadopoulos, and Qiang Yang. Secureboost: A lossless federated learning framework, 2021

    2021

  5. [4]

    An image is worth 16x16 words: Transformers for image recognition at scale, 2021

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale, 2021

    2021

  6. [5]

    Local model reconstruction attacks in federated learning and their uses, 2023

    Ilias Driouich, Chuan Xu, Giovanni Neglia, Frederic Giroire, and Eoin Thomas. Local model reconstruction attacks in federated learning and their uses, 2023

    2023

  7. [6]

    The algorithmic foundations of differential privacy

    Cynthia Dwork and Aaron Roth. The algorithmic foundations of differential privacy. Found. Trends Theor. Comput. Sci., 9:211–407, 2014. URL https://api.semanticscholar.org/ CorpusID:207178262

    2014

  8. [7]

    Calibrating noise to sensitivity in private data analysis

    Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of Cryptography: Third Theory of Cryptography Conference, TCC 2006, New York, NY, USA, March 4-7, 2006. Proceedings 3, pages 265–284. Springer, 2006. 10

    2006

Show all 99 references
  1. [8]

    A simple convergence proof of adam and adagrad, 2022

    Alexandre Défossez, Léon Bottou, Francis Bach, and Nicolas Usunier. A simple convergence proof of adam and adagrad, 2022

    2022

  2. [9]

    Splitguard: Detecting and mitigating training-hijacking attacks in split learning

    Ege Erdogan, Alptekin Küpçü, and A Ercument Cicek. Splitguard: Detecting and mitigating training-hijacking attacks in split learning. In Proceedings of the 21st Workshop on Privacy in the Electronic Society, pages 125–137, 2022

    2022

  3. [10]

    Ercument Ci- cek

    Ege Erdogan, Unat Teksen, Mehmet Salih Celiktenyildiz, Alptekin Kupcu, and A. Ercument Ci- cek. Splitout: Out-of-the-box training-hijacking detection in split learning via outlier detection, 2023

    2023

  4. [11]

    Ercüment Çiçek

    Ege Erdo˘gan, Alptekin Küpçü, and A. Ercüment Çiçek. Unsplit: Data-oblivious model inversion, model stealing, and label inference attacks against split learning. In Proceedings of the 21st Workshop on Privacy in the Electronic Society, CCS ’22. ACM, November 2022. doi: 10.1145...

    2022

  5. [12]

    Model inversion attacks that ex- ploit confidence information and basic countermeasures

    Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that ex- ploit confidence information and basic countermeasures. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security , 2015. URL https: //api.semanticscholar.org/Corpu...

    2015

  6. [13]

    Zhu, Pingyi Hu, Ruixin Zhao, Yaru Jia, Peng Xu, Hai Jin, and Dongmei Zhang

    Jiayun Fu, Xiaojing Ma, Bin B. Zhu, Pingyi Hu, Ruixin Zhao, Yaru Jia, Peng Xu, Hai Jin, and Dongmei Zhang. Focusing on pinocchio’s nose: A gradients scrutinizer to thwart split-learning hijacking attacks using intrinsic attributes. In 30th Annual Network and Distributed System...

    2023

  7. [14]

    Gunter, and Nikita Borisov

    Karan Ganju, Qi Wang, Wei Yang, Carl.A. Gunter, and Nikita Borisov. Property inference attacks on fully connected neural networks using permutation invariant representations. In Property Inference Attacks on Fully Connected Neural Networks using Permutation Invariant Represent...

    2018

  8. [15]

    PCAT: Functionality and data stealing from split learning by Pseudo-Client attack

    Xinben Gao and Lan Zhang. PCAT: Functionality and data stealing from split learning by Pseudo-Client attack. In 32nd USENIX Security Symposium (USENIX Security 23) , pages 5271–5288, Anaheim, CA, August 2023. USENIX Association. ISBN 978-1-939133-37-3. URL https://www.usenix.o...

    2023

  9. [16]

    Inverting gradients – how easy is it to break privacy in federated learning?, 2020

    Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller. Inverting gradients – how easy is it to break privacy in federated learning?, 2020

    2020

  10. [17]

    Deep learning with label differential privacy, 2021

    Badih Ghazi, Noah Golowich, Ravi Kumar, Pasin Manurangsi, and Chiyuan Zhang. Deep learning with label differential privacy, 2021

    2021

  11. [18]

    Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio

    Ian J. Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial networks, 2014

    2014

  12. [19]

    Generating sequences with recurrent neural networks, 2014

    Alex Graves. Generating sequences with recurrent neural networks, 2014

    2014

  13. [20]

    Federated doubly stochastic kernel learning for vertically partitioned data, 2020

    Bin Gu, Zhiyuan Dang, Xiang Li, and Heng Huang. Federated doubly stochastic kernel learning for vertically partitioned data, 2020

    2020

  14. [21]

    Fedpass: Privacy-preserving vertical federated deep learning with adaptive obfuscation, 2023

    Hanlin Gu, Jiahuan Luo, Yan Kang, Lixin Fan, and Qiang Yang. Fedpass: Privacy-preserving vertical federated deep learning with adaptive obfuscation, 2023

    2023

  15. [22]

    Distributed learning of deep neural network over multiple agents, 2018

    Otkrist Gupta and Ramesh Raskar. Distributed learning of deep neural network over multiple agents, 2018

    2018

  16. [23]

    Recov- ering private text in federated learning of language models, 2022

    Samyak Gupta, Yangsibo Huang, Zexuan Zhong, Tianyu Gao, Kai Li, and Danqi Chen. Recov- ering private text in federated learning of language models, 2022

    2022

  17. [24]

    Private federated learning on vertically partitioned data via entity resolution and additively homomorphic encryption, 2017

    Stephen Hardy, Wilko Henecka, Hamish Ivey-Law, Richard Nock, Giorgio Patrini, Guillaume Smith, and Brian Thorne. Private federated learning on vertically partitioned data via entity resolution and additively homomorphic encryption, 2017. 11

    2017

  18. [25]

    Deep residual learning for image recognition, 2015

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition, 2015

    2015

  19. [26]

    Zecheng He, Tianwei Zhang, and Ruby B. Lee. Model inversion attacks against collaborative inference. Proceedings of the 35th Annual Computer Security Applications Conference, 2019. URL https://api.semanticscholar.org/CorpusID:208277767

    2019

  20. [27]

    Zecheng He, Tianwei Zhang, and Ruby B. Lee. Attacking and protecting data privacy in edge–cloud collaborative inference systems. IEEE Internet of Things Journal, 8:9706–9716,

  21. [28]

    Gans trained by a two time-scale update rule converge to a local nash equilibrium

    Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochre- iter. Gans trained by a two time-scale update rule converge to a local nash equilibrium. In Neural Information Processing Systems, 2017. URL https://api.semanticscholar.org/ CorpusID:326772

    2017

  22. [29]

    Is vertical logistic regression privacy-preserving? a comprehensive privacy analysis and beyond, 2022

    Yuzheng Hu, Tianle Cai, Jinyong Shan, Shange Tang, Chaochao Cai, Ethan Song, Bo Li, and Dawn Song. Is vertical logistic regression privacy-preserving? a comprehensive privacy analysis and beyond, 2022

    2022

  23. [30]

    Scope of validity of psnr in image/video quality assessment

    Quan Huynh-Thu and Mohammed Ghanbari. Scope of validity of psnr in image/video quality assessment. Electronics Letters, 44:800–801, 2008. URL https://api.semanticscholar. org/CorpusID:62732555

    2008

  24. [31]

    Rethinking fid: Towards a better evaluation metric for image generation,

    Sadeep Jayasumana, Srikumar Ramalingam, Andreas Veit, Daniel Glasner, Ayan Chakrabarti, and Sanjiv Kumar. Rethinking fid: Towards a better evaluation metric for image generation,

  25. [32]

    Cafe: Catastrophic data leakage in vertical federated learning, 2022

    Xiao Jin, Pin-Yu Chen, Chia-Yi Hsu, Chia-Mu Yu, and Tianyi Chen. Cafe: Catastrophic data leakage in vertical federated learning, 2022

    2022

  26. [33]

    Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Bennis, Ar- jun Nitin Bhagoji, Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, Rafael G

    Peter Kairouz, H. Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Bennis, Ar- jun Nitin Bhagoji, Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, Rafael G. L. D’Oliveira, Hubert Eichner, Salim El Rouayheb, David Evans, Josh Gardner, Zachary Garrett, ...

    2021

  27. [34]

    Exploit: Extracting private labels in split learning, 2022

    Sanjay Kariyappa and Moinuddin K Qureshi. Exploit: Extracting private labels in split learning, 2022

    2022

  28. [35]

    Vertical federated learning: A structured literature review, 2023

    Afsana Khan, Marijn ten Thij, and Anna Wilbik. Vertical federated learning: A structured literature review, 2023

    2023

  29. [36]

    Kingma and Jimmy Ba

    Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization, 2017

    2017

  30. [37]

    Brendan McMahan, Felix X

    Jakub Koneˇcný, H. Brendan McMahan, Felix X. Yu, Peter Richtárik, Ananda Theertha Suresh, and Dave Bacon. Federated learning: Strategies for improving communication efficiency, 2017

    2017

  31. [38]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky. Learning multiple layers of features from tiny images. In Learning Multiple Layers of Features from Tiny Images, 2009. URL https://api.semanticscholar.org/ CorpusID:18268744

    2009

  32. [39]

    Lecun, L

    Y . Lecun, L. Bottou, Y . Bengio, and P. Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(11):2278–2324, 1998. doi: 10.1109/5.726791

    1998 doi

  33. [40]

    Ressfl: A resistance transfer framework for defending model inversion attack in split federated learning

    Jingtao Li, Adnan Siraj Rakin, Xing Chen, Zhezhi He, Deliang Fan, and Chaitali Chakrabarti. Ressfl: A resistance transfer framework for defending model inversion attack in split federated learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recogn...

    2022

  34. [41]

    Model extraction attacks on split federated learning, 2023

    Jingtao Li, Adnan Siraj Rakin, Xing Chen, Li Yang, Zhezhi He, Deliang Fan, and Chaitali Chakrabarti. Model extraction attacks on split federated learning, 2023

    2023

  35. [42]

    Label leakage and protection in two-party split learning, 2022

    Oscar Li, Jiankai Sun, Xin Yang, Weihao Gao, Hongyi Zhang, Junyuan Xie, Virginia Smith, and Chong Wang. Label leakage and protection in two-party split learning, 2022

    2022

  36. [43]

    Federated optimization in heterogeneous networks, 2020

    Tian Li, Anit Kumar Sahu, Manzil Zaheer, Maziar Sanjabi, Ameet Talwalkar, and Virginia Smith. Federated optimization in heterogeneous networks, 2020

    2020

  37. [44]

    Page: A simple and optimal probabilistic gradient estimator for nonconvex optimization, 2021

    Zhize Li, Hongyan Bao, Xiangliang Zhang, and Peter Richtárik. Page: A simple and optimal probabilistic gradient estimator for nonconvex optimization, 2021. URL https://arxiv. org/abs/2008.10898

    2021 arXiv

  38. [45]

    Differentially private vertical federated clustering

    Zitao Li, Tianhao Wang, and Ninghui Li. Differentially private vertical federated clustering. Proc. VLDB Endow., 16:1277–1290, 2022. URL https://api.semanticscholar.org/ CorpusID:251280212

    2022

  39. [46]

    Loss landscapes and optimization in over- parameterized non-linear systems and neural networks, 2021

    Chaoyue Liu, Libin Zhu, and Mikhail Belkin. Loss landscapes and optimization in over- parameterized non-linear systems and neural networks, 2021. URL https://arxiv.org/ abs/2003.00307

    2021 arXiv

  40. [47]

    Similarity-based label inference attack against training and inference of split learning

    Junlin Liu, Xinchen Lyu, Qimei Cui, and Xiaofeng Tao. Similarity-based label inference attack against training and inference of split learning. IEEE Transactions on Information Forensics and Security, 19:2881–2895, 2024. ISSN 1556-6021. doi: 10.1109/tifs.2024.3356821. URL http...

    2024

  41. [48]

    Batch label inference and replacement attacks in black-boxed vertical federated learning, 2022

    Yang Liu, Tianyuan Zou, Yan Kang, Wenhan Liu, Yuanqin He, Zhihao Yi, and Qiang Yang. Batch label inference and replacement attacks in black-boxed vertical federated learning, 2022

    2022

  42. [49]

    Vertical federated learning: Concepts, advances, and challenges

    Yang Liu, Yan Kang, Tianyuan Zou, Yanhong Pu, Yuanqin He, Xiaozhou Ye, Ye Ouyang, Ya-Qin Zhang, and Qiang Yang. Vertical federated learning: Concepts, advances, and challenges. IEEE Transactions on Knowledge and Data Engineering, page 1–20, 2024. ISSN 2326-3865. doi: 10.1109/t...

    2024

  43. [50]

    Feature inference attack on model predictions in vertical federated learning

    Xinjian Luo, Yuncheng Wu, Xiaokui Xiao, and Beng Chin Ooi. Feature inference attack on model predictions in vertical federated learning. In 2021 IEEE 37th International Conference on Data Engineering (ICDE), pages 181–192, 2021. doi: 10.1109/ICDE51399.2021.00023

    2021

  44. [51]

    Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Agüera y Arcas

    H. Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Agüera y Arcas. Communication-efficient learning of deep networks from decentralized data, 2023

    2023

  45. [52]

    Flexible differentially private vertical federated learning with adaptive feature embeddings

    Yuxi Mi, Hongquan Liu, Yewei Xia, Yiheng Sun, Jihong Guan, and Shuigeng Zhou. Flexible differentially private vertical federated learning with adaptive feature embeddings. ArXiv, abs/2308.02362, 2023. URL https://api.semanticscholar.org/CorpusID: 260611110

    2023 arXiv

  46. [53]

    Label-only model inversion attacks via knowledge transfer, 2023

    Ngoc-Bao Nguyen, Keshigeyan Chandrasegaran, Milad Abdollahzadeh, and Ngai-Man Cheung. Label-only model inversion attacks via knowledge transfer, 2023

    2023

  47. [54]

    Re-thinking model inversion attacks against deep neural networks, 2023

    Ngoc-Bao Nguyen, Keshigeyan Chandrasegaran, Milad Abdollahzadeh, and Ngai-Man Cheung. Re-thinking model inversion attacks against deep neural networks, 2023

    2023

  48. [55]

    Pham, Khoa Doan, and Kok-Seng Wong

    Thuy Dung Nguyen, Tuan Nguyen, Phi Le Nguyen, Hieu H. Pham, Khoa Doan, and Kok-Seng Wong. Backdoor attacks and defenses in federated learning: Survey, challenges and future research directions, 2023

    2023

  49. [56]

    Unleashing the tiger: Inference attacks on split learning, 2021

    Dario Pasquini, Giuseppe Ateniese, and Massimo Bernaschi. Unleashing the tiger: Inference attacks on split learning, 2021

    2021

  50. [57]

    Pytorch: An imperative style, high-performance deep learning library, 2019

    Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, Alban Desmaison, Andreas Köpf, Edward Yang, Zach DeVito, Martin Raison, Alykhan Tejani, Sasank Chilamkurthy, Benoit Steiner, Lu Fan...

    2019 arXiv

  51. [58]

    Full-Reference Image Quality Metrics

    Marius Pedersen and Jon Yngve Hardeberg. Full-Reference Image Quality Metrics . 10.1561/0600000037, 2012. doi: 10.1561/0600000037

    2012 doi

  52. [59]

    Evaluating privacy leakage in split learning, 2024

    Xinchi Qiu, Ilias Leontiadis, Luca Melis, Alex Sablayrolles, and Pierre Stock. Evaluating privacy leakage in split learning, 2024

    2024

  53. [60]

    Xinchi Qiu, Heng Pan, Wanru Zhao, Yan Gao, Pedro P. B. Gusmao, William F. Shen, Chenyang Ma, and Nicholas D. Lane. Secure vertical federated learning under unreliable connectivity, 2024

    2024

  54. [61]

    Victoria Luzón, Francisco Herrera, and Eugenio Martínez-Cámara

    Nuria Rodríguez-Barroso, Daniel Jiménez-López, M. Victoria Luzón, Francisco Herrera, and Eugenio Martínez-Cámara. Survey on federated learning threats: Concepts, taxonomy on attacks and defences, experimental study and challenges. Information Fusion, 90:148–173, February 2023....

    2023 doi

  55. [62]

    Rudin, Stanley Osher, and Emad Fatemi

    Leonid I. Rudin, Stanley Osher, and Emad Fatemi. Nonlinear total variation based noise removal algorithms. Physica D Nonlinear Phenomena, 60(1-4):259–268, November 1992. doi: 10.1016/0167-2789(92)90242-F

    1992 doi

  56. [63]

    Stochastic gradient methods with preconditioned updates

    Abdurakhmon Sadiev, Aleksandr Beznosikov, Abdulla Jasem Almansoori, Dmitry Kamzolov, Rachael Tappenden, and Martin Taká ˇc. Stochastic gradient methods with preconditioned updates. Journal of Optimization Theory and Applications , 201(2):471–489, March 2024. ISSN 1573-2878. do...

    2024 doi

  57. [64]

    Image quality assessment through fsim, ssim, mse and psnr—a comparative study

    Umme Sara, Morium Akter, and Mohammad Shorif Uddin. Image quality assessment through fsim, ssim, mse and psnr—a comparative study. Journal of Computer and Communications,

  58. [65]

    Membership inference attacks against machine learning models, 2017

    Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models, 2017

    2017

  59. [66]

    Smith, Shuang Song, and Abhradeep Thakurta

    Adam D. Smith, Shuang Song, and Abhradeep Thakurta. The flajolet-martin sketch itself pre- serves differential privacy: Private counting with minimal space. InNeural Information Process- ing Systems, 2020. URL https://api.semanticscholar.org/CorpusID:227276564

    2020

  60. [67]

    Defending against reconstruction attack in vertical federated learning, 2021

    Jiankai Sun, Yuanshun Yao, Weihao Gao, Junyuan Xie, and Chong Wang. Defending against reconstruction attack in vertical federated learning, 2021

    2021

  61. [68]

    Label leakage and protection from forward embedding in vertical federated learning, 2022

    Jiankai Sun, Xin Yang, Yuanshun Yao, and Chong Wang. Label leakage and protection from forward embedding in vertical federated learning, 2022

    2022

  62. [69]

    Privacy assessment on reconstructed images: Are existing evaluation metrics faithful to human perception?, 2023

    Xiaoxiao Sun, Nidham Gazagnadou, Vivek Sharma, Lingjuan Lyu, Hongdong Li, and Liang Zheng. Privacy assessment on reconstructed images: Are existing evaluation metrics faithful to human perception?, 2023

    2023

  63. [70]

    Chandra Thapa, M. A. P. Chamikara, Seyit Camtepe, and Lichao Sun. Splitfed: When federated learning meets split learning, 2022

    2022

  64. [71]

    Mlp-mixer: An all-mlp architecture for vision, 2021

    Ilya Tolstikhin, Neil Houlsby, Alexander Kolesnikov, Lucas Beyer, Xiaohua Zhai, Thomas Unterthiner, Jessica Yung, Andreas Steiner, Daniel Keysers, Jakob Uszkoreit, Mario Lucic, and Alexey Dosovitskiy. Mlp-mixer: An all-mlp architecture for vision, 2021

    2021

  65. [72]

    Federated or split? a performance and privacy analysis of hybrid split and federated learning architectures

    Valeria Turina, Zongshun Zhang, Flavio Esposito, and Ibrahim Matta. Federated or split? a performance and privacy analysis of hybrid split and federated learning architectures. In 2021 IEEE 14th International Conference on Cloud Computing (CLOUD) , pages 250–260, 2021. doi: 10...

    2021

  66. [73]

    Nopeek: Informa- tion leakage reduction to share activations in distributed deep learning, 2020

    Praneeth Vepakomma, Abhishek Singh, Otkrist Gupta, and Ramesh Raskar. Nopeek: Informa- tion leakage reduction to share activations in distributed deep learning, 2020

    2020

  67. [74]

    Feverless: Fast and secure vertical federated learning based on xgboost for decentralized labels

    Rui Wang, O˘guzhan Ersoy, Hangyu Zhu, Yaochu Jin, and Kaitai Liang. Feverless: Fast and secure vertical federated learning based on xgboost for decentralized labels. IEEE Transactions on Big Data, pages 1–15, 2022. doi: 10.1109/TBDATA.2022.3227326. 14

    2022

  68. [75]

    Vincent Poor

    Yulong Wang, Tong Sun, Shenghong Li, Xin Yuan, Wei Ni, Ekram Hossain, and H. Vincent Poor. Adversarial attacks and defenses in machine learning-powered networks: A contemporary survey, 2023

    2023

  69. [76]

    A universal image quality index

    Zhou Wang and Alan Conrad Bovik. A universal image quality index. IEEE Signal Processing Letters, 9:81–84, 2002. URL https://api.semanticscholar.org/CorpusID:14488670

    2002

  70. [77]

    Vertical federated learning: Challenges, methodologies and experiments, 2022

    Kang Wei, Jun Li, Chuan Ma, Ming Ding, Sha Wei, Fan Wu, Guihai Chen, and Thilina Ranbaduge. Vertical federated learning: Challenges, methodologies and experiments, 2022

    2022

  71. [78]

    Stephen J. Wright. Coordinate descent algorithms, 2015

    2015

  72. [79]

    Naughton

    Xi Wu, Matt Fredrikson, Somesh Jha, and Jeffrey F. Naughton. A methodology for formalizing model-inversion attacks. 2016 IEEE 29th Computer Security Foundations Symposium (CSF), pages 355–370, 2016. URL https://api.semanticscholar.org/CorpusID:5921778

    2016

  73. [80]

    Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms, 2017

    Han Xiao, Kashif Rasul, and Roland V ollgraf. Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms, 2017

    2017

  74. [81]

    A survey on vertical federated learning: From a layered perspective, 2023

    Liu Yang, Di Chai, Junxue Zhang, Yilun Jin, Leye Wang, Hao Liu, Han Tian, Qian Xu, and Kai Chen. A survey on vertical federated learning: From a layered perspective, 2023

    2023

  75. [82]

    Federated machine learning: Concept and applications, 2019

    Qiang Yang, Yang Liu, Tianjian Chen, and Yongxin Tong. Federated machine learning: Concept and applications, 2019

    2019

  76. [83]

    Adversarial neural network inversion via auxiliary knowledge alignment, 2019

    Ziqi Yang, Ee-Chien Chang, and Zhenkai Liang. Adversarial neural network inversion via auxiliary knowledge alignment, 2019

    2019

  77. [85]

    How to backdoor split learning

    Fangchao Yu, Lina Wang, Bo Zeng, Kai Zhao, Zhi Pang, and Tian Wu. How to backdoor split learning. Neural Netw., 168(C):326–336, nov 2023. ISSN 0893-6080. doi: 10.1016/j.neunet. 2023.09.037. URL https://doi.org/10.1016/j.neunet.2023.09.037

    2023 doi

  78. [86]

    A survey of privacy threats and defense in vertical federated learning: From model life cycle perspective, 2024

    Lei Yu, Meng Han, Yiming Li, Changting Lin, Yao Zhang, Mingyang Zhang, Yan Liu, Haiqin Weng, Yuseok Jeon, Ka-Ho Chow, and Stacy Patterson. A survey of privacy threats and defense in vertical federated learning: From model life cycle perspective, 2024

    2024

  79. [87]

    Efros, Eli Shechtman, and Oliver Wang

    Richard Zhang, Phillip Isola, Alexei A. Efros, Eli Shechtman, and Oliver Wang. The unreason- able effectiveness of deep features as a perceptual metric, 2018

    2018

  80. [88]

    idlg: Improved deep leakage from gradients, 2020

    Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. idlg: Improved deep leakage from gradients, 2020

    2020

  81. [89]

    Deep leakage from gradients, 2019

    Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients, 2019

    2019

  82. [90]

    Defending batch-level label inference and replacement attacks in vertical federated learning

    Tianyuan Zou, Yang Liu, Yan Kang, Wenhan Liu, Yuanqin He, Zhihao Yi, Qiang Yang, and Ya- Qin Zhang. Defending batch-level label inference and replacement attacks in vertical federated learning. IEEE Transactions on Big Data, pages 1–12, 2022. doi: 10.1109/TBDATA.2022. 3192121

    2022 doi

  83. [91]

    Mutual information regularization for vertical federated learning, 2023

    Tianyuan Zou, Yang Liu, and Ya-Qin Zhang. Mutual information regularization for vertical federated learning, 2023. A Appendix / supplemental material A.1 Orthogonal matrices give identical training for different data distributions The proof of Lemma 1. 15 Proof. To proof this ...

    2023

  84. [95]

    Base case, k = 1: H1 = X1W1 = X1U U⊤W1 = ˜X1 ˜W1 = ˜H1

  85. [96]

    kX i=1 Gfake i # . Hk+1 = XW k+1 = XW 1 − γXX ⊤

    Induction step, k + 1 > 1: Let Hk = ˜Hk by induction hypothesis. Then ∂L/∂Hk = ∂L/∂ ˜Hk = Gk ∈ Rn×dh. Recall, that ∂L ∂Wk = ∂L ∂Hk ∂Hk ∂Wk = X ⊤ k ∂L ∂Hk = X ⊤ k Gk. Then the step of GD for the pairs {X , W1} and { ˜X , ˜W1} returns Wk+1 = Wk − γX ⊤ k Gk and ˜Wk+1 = ˜Wk − γ ˜X...

  86. [97]

    Base case, k = 0: Using the structure of diag ∇g( ˜W1) ⊙ ∇g( ˜W1) , we obtain: ∥ ˆD2 0∥∞ = diag ∇g( ˜W1) ⊙ ∇g( ˜W1) ∞ = diag U ∇g(U ⊤W1) ⊙ U ∇g(U ⊤W1) ∞ = U ∇g(U ⊤W1) 2 ∞ ≤ U ∇g(U ⊤W1) 2 2 = ∇g(U ⊤W1) 2 2 ≤ Γ2

  87. [98]

    neighbouring

    Induction step, k > 0: Let ˆDk−1 ≼ ΓI by induction hypothesis. Then, ∥ ˆD2 k∥∞ = β2 ˆD2 k−1 + (1 − β2) diag (∇g(Wk−1) ⊙ ∇g(Wk−1)) ∞ ≤ β2 ˆD2 k−1 + (1 − β2) diag (∇g(Wk−1) ⊙ ∇g(Wk−1)) 2 ≤ β2 ˆD2 k−1 2 + ∥(1 − β2) diag (∇g(Wk−1) ⊙ ∇g(Wk−1))∥2 ≤ β2 ˆD2 k−1 2 + ∥diag (∇g(Wk−1) ⊙ ∇...

  88. [99]

    All CNN-based models are listed in the original UnSplit and FSHA papers’ repositories 4 and 5

    MLP-Mixer implementation from 3 repository. All CNN-based models are listed in the original UnSplit and FSHA papers’ repositories 4 and 5. Nevertheless, we should stress that the main findings of our paper are independent of any specific architecture and work with any MLP-base...

  89. [2019]

    URL https://api.semanticscholar.org/CorpusID:104425037

  90. [2021]

    URL https://api.semanticscholar.org/CorpusID:226478768

  91. [2024]

    URL https://arxiv.org/abs/2401.09603

    arXiv

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.