Pith. sign in

REVIEW 3 major objections 5 minor 2 cited by

CENSOR: Defense Against Gradient Inversion via Orthogonal Subspace Bayesian Sampling

T0 review · 3 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read CENSOR sends federated updates orthogonal to the true gradient, aiming to block inversion attacks while keeping model accuracy.

desk verdict CENSOR's empirical defense against known gradient-inversion attacks is solid and worth publishing, but the paper's central privacy claim rests on a dimension-counting argument that ignores its own loss-based selection, so the guarantee is unproven. read the letter →

arxiv 2501.15718 v1 pith:JLG3Z3M7 submitted 2025-01-27 cs.LG cs.CR

Kaiyuan Zhang , Siyuan Cheng , Guangyu Shen , Bruno Ribeiro , Shengwei An , Pin-Yu Chen , Xiangyu Zhang , Ninghui Li This is my paper · ORCID
classification cs.LGcs.CR
keywords federatedlearninggradientinversionattacksprivacydefenseorthogonalsubspaceBayesianposteriorsamplingcoldposteriorsGAN-basedmodelutility
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes a client-side defense, CENSOR, for federated learning: instead of sending the true gradient, a client sends a vector sampled from the subspace orthogonal to that gradient, layer by layer, rescaled to the original gradient's norm, and chosen among several candidates by which one reduces the training loss the most. The claim is that such an orthogonal update carries almost no usable information about the private data, so gradient-inversion attacks, including state-of-the-art GAN-based ones, cannot recover the image or its label, while model convergence is preserved. The paper reports that CENSOR outperforms noise, clipping, sparsification, and Soteria on most attack and dataset combinations, especially against GAN-based inversion, and that a hostile server using expectation over transformation still cannot reconstruct the private image. A sympathetic reader would take the central finding to be a new way to decouple a useful update for the model from a gradient that leaks the data.

What carries the argument

The central mechanism is the layer-wise orthogonal projection of a sampled random gradient: for a layer gradient $g_l$ and a random vector $g_r$, the candidate is $g^o_l = g_r - \langle g_r, g_l\rangle / \langle g_l, g_l\rangle \cdot g_l$, so $g^o_l \perp g_l$, followed by normalization $\tilde{g}^o_l = g^o_l \cdot \|g_l\|_2 / \|g^o_l\|_2$. Repeating this for every layer yields an update orthogonal to the client's true gradient; selecting among $T$ such candidates by smallest loss is the cold-posterior element that keeps utility. The paper's privacy argument leans on the size of the orthogonal subspace, roughly $m-1$ dimensions when the batch holds one example, making the transmitted vector, it claims, negligibly informative when $m \gg k$.

What would settle it

Take one victim image from a public dataset, compute its true gradient, run CENSOR to obtain the defended orthogonal vector, then run an adaptive inversion that optimizes inside a pretrained GAN's latent space with the objective of minimizing the angle between the synthetic gradient and the defended vector (not the true gradient), using the same normalization the defense applies; if recognizable images or correct labels emerge with fidelity comparable to no-defense baselines, the paper's central privacy claim is refuted.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that the high dimensionality of a neural network's parameter space gives a practical privacy mechanism for free: a gradient of a model with m parameters has an (m-1)-dimensional orthogonal complement, and sending a vector from that complement hides the true gradient. CENSOR operationalizes this by Gram-Schmidt projection: for each layer it draws random vectors, removes the component parallel to the true layer gradient, normalizes the remainder to the layer's original norm, tests the resulting full-model update on the client's loss, and returns the candidate that lowers the loss the most, typically within 20 trials. The paper argues that this is a form of cold-posterior sampling over an orthogonal subspace, and that because the transmitted vector is not a gradient of any training input, inversion attacks that match candidate gradients to the received vector have nothing to match. Empirically it reports inversion metrics (MSE, LPIPS, PSNR, SSIM) that are far from the no-defense values and better than the compared defenses in most settings, at negligible computational overhead.

Load-bearing premise

The privacy guarantee rests on the assumption that an adversary cannot find a private-looking input whose gradient is orthogonal to the transmitted vector, purely because the orthogonal subspace is high-dimensional; the paper offers this as intuition and reports no proof or lower bound for the difficulty of that search.

Editorial extensions

If this is right

  • Clients can send updates that are not gradients of their private data at all, so reconstruction attacks that optimize a dummy input to match the received vector lose their objective.
  • GAN-based attacks that rely on label inference, such as GGL, are blocked because the orthogonal vector does not carry the sign and structure pattern of the true gradient from which labels are read.
  • The defense preserves federated convergence: in the paper's non-i.i.d. CIFAR-10 experiment, both vanilla and CENSOR-trained models reach roughly 86% test accuracy after 2,000 rounds.
  • The technique remains effective under an adaptive expectation-over-transformation attack that averages many orthogonal-gradient samples, and its computational overhead is reported as about 0.00236%.
  • The defense generalizes to batches larger than one, e.g., batch size 4, and continues to outperform the compared defenses on the metrics the paper reports.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the privacy guarantee is only as strong as the difficulty of a search problem, and an adversary who knows the sent vector is orthogonal to the true gradient could try to find any public-domain input whose gradient is nearly orthogonal to it; the paper provides intuition but no complexity lower bound.
  • Editorial inference: because the defense hides the gradient direction but not its norm, and layer-wise norms are preserved, a server that aggregates many rounds could potentially estimate the true gradient's magnitude or direction from the convergence trajectory; combining CENSOR with secure aggregation or differential privacy would close that side channel.
  • Editorial inference: the same orthogonal-projection recipe should transfer to non-image federated settings such as text, tabular, and graph data, since the mechanism is agnostic to data modality.
  • Editorial inference: a natural stress test is to let the adversary optimize in the orthogonal complement itself, for example by starting from a GAN latent that already produces an image whose gradient is orthogonal to all sent vectors, which would directly probe whether high-dimensional is the same as unsearchable.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes CENSOR, a defense against gradient inversion attacks in federated learning. A client computes its original gradient, then samples T random per-layer perturbations, projects each layer's perturbation onto the subspace orthogonal to that layer's original gradient, normalizes to the original gradient's scale, and selects the candidate that minimizes the loss on the client's private data before sending it to the server. The authors argue that because the transmitted update is orthogonal to the true gradient and lies in a high-dimensional subspace, inversion becomes difficult while utility is preserved. The method is evaluated against five attacks (IG, GI, GGL, GIAS, GIFD) on ImageNet, FFHQ, and CIFAR-10, compared with four existing defenses, and accompanied by a convergence study on non-i.i.d. CIFAR-10 reaching about 86% accuracy, plus an EOT-based adaptive attack evaluation.

Significance. If the central privacy claim were established, CENSOR would be a practical, low-overhead defense (claimed overhead ~0.002%) with broad empirical support, including released code and a large evaluation suite. The convergence study indicates that utility is largely preserved. However, the paper's main theoretical justification—that orthogonality to the true gradient by itself makes leakage negligible—is not formalized, and the provided adaptive attack does not exercise the actual selection mechanism that produces the transmitted gradient. The value of the contribution therefore hinges on a load-bearing assumption that is not currently supported.

major comments (3)
  1. [Section I, Section V.D, Algorithm 1 (Lines 15–19)] The privacy claim rests on a dimension-counting argument: since the orthogonal subspace has dimension m−1, the transmitted gradient is 'chosen from that high dimension' and cannot be mapped back to the original gradient. This argument is not valid as stated because Algorithm 1's Phase 3 selects G* = argmax over T candidates by evaluating the loss on the private data D_k. The selected gradient is therefore a data-dependent point in the orthogonal subspace, not a uniform random vector. Orthogonality removes only the first-order term of the loss; higher-order curvature information about D_k can survive the argmax selection. No bound is given on the information leakage, and m >> k does not address this because the selection operates on the orthogonal sphere, not the full gradient space. The claim 'the potential leakage of the original gradients is negligible if m >> k' (Section I) is thus unsupported and needs either a formal information-theoretic analysis or a significantly tempered statement.
  2. [Section V.D (Adaptive Attack)] The EOT attack described in Section V.D does not actually attack the CENSOR mechanism. It has the attacker generate its own orthogonal gradients (using the same sampling and normalization) and then average them, rather than inverting by maximizing the likelihood or matching the observed G* under the true CENSOR selection rule. Because the adversary is assumed to know the defense algorithm, a proper adaptive attack should model the conditional distribution of the transmitted gradient given the private data—e.g., by differentiating through the selection or using a distribution-matching objective—and attempt to recover the private input from that model. The current evaluation therefore only demonstrates robustness against non-adaptive attacks, which is a substantial gap for a defense paper.
  3. [Section III (Observation 2) and Section V] The paper identifies label leakage as a persistent threat (GGL reveals label information) and claims that CENSOR 'renders GGL unable to precisely infer the label information.' However, no experiment measures label-inference accuracy on defended gradients. Given that the loss-based selection in Algorithm 1 depends on the private label, the authors should at least evaluate whether the correct label can be recovered from the transmitted update. This is a missing evaluation for a claim that is part of the defense's core motivation.
minor comments (5)
  1. [Section III vs. Section V and Table I] The attack name is spelled 'GIDF' in Section III but 'GIFD' elsewhere; please unify the notation.
  2. [Appendix A, Table IV] The entry for 'M' reads 'Temperature paramete'; the 'r' is missing in 'parameter'.
  3. [Section IV-A] The paper introduces a Metropolis-Hastings acceptance probability and then switches to argmax selection over T samples, but the relationship between the cold-posterior formulation and the implemented algorithm is not formally spelled out. Consider clarifying whether Algorithm 1 is meant as a heuristic approximation or an exact sampling procedure.
  4. [Section IV] Despite the heading 'theoretical analysis,' Section IV contains no theorems or quantitative bounds. Renaming the section to 'Design Rationale' or adding formal statements would make the paper's claims more precise.
  5. [Appendix B] The overhead measurement reports only a single percentage without specifying the hardware, timing methodology, or number of runs; additional detail would improve reproducibility.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: CENSOR's defense is a constructive procedure tested against external attacks; its weak privacy argument is an unproven premise, not a circular derivation.

full rationale

Walking CENSOR's derivation chain, the defended gradient is produced by Algorithm 1 as an argmax over T normalized orthogonal projections of random vectors onto the orthogonal complement of the original gradient (Line 13 via Eq. 12, Line 14 via Lines 31-36, and Lines 15-19). This is a construction, not a fit-then-predict loop: no parameter is fitted to the inversion benchmark and then reported as a prediction; the defended gradient is computed from the same private batch and the empirical claims are checked against external attacks (IG, GI, GGL, GIAS, GIFD) and independent defense baselines. The statement that 'the resulting orthogonal gradient is chosen from that high dimension' (Section V.D) is a heuristic dimension-counting argument, not a circular one: orthogonality is imposed by construction, but the conclusion that mapping back to the original gradient is very challenging is an unproven assumption, and the EOT attack does not exercise the argmax selection mechanism. Those are correctness and attack-completeness risks, not cases where a claimed result is equivalent to its own input by definition. The only self-citations ([65], [67], [74]) appear in related-work contexts (physical attacks, Byzantine aggregation) and are not load-bearing for CENSOR's privacy claim. The core derivation is therefore self-contained and does not reduce to its inputs.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The central claim rests on two unproven domain assumptions: the privacy of the orthogonal subspace and the utility of loss-based selection. The algorithm has two hand-chosen hyperparameters (T and the sampling distribution) plus an unused temperature parameter.

free parameters (2)
  • Number of trials T = 20 (default)
    Number of random orthogonal gradients sampled per layer. Chosen by hand; ablation in Section V-E shows 20 is sufficient, but no theory determines the value.
  • Noise distribution N = Standard normal (default)
    Distribution used to sample random gradients before projection and normalization. Chosen by hand; Section V-E also explores sampling from public images.
assumptions (3)
  • domain assumption High-dimensional orthogonality implies negligible leakage
    The paper assumes that if the model has m parameters and the orthogonal subspace has dimension m-k, then an attacker cannot reconstruct the original gradient or data. Stated in Section I and Section IV without proof.
  • domain assumption Loss-based selection among random orthogonal directions preserves utility
    The defense assumes that picking the direction that most reduces loss on private data is enough to maintain global model accuracy; shown empirically on one dataset (CIFAR-10) only.
  • domain assumption Threat model: honest-but-curious server cannot modify model or gradients
    The defense inherits the standard FL threat model (Section I) and does not protect against malicious servers that alter the global model, which could break the orthogonal projection.

how reviews work

0 comments
Cite this review

Pith. "Pith review of CENSOR: Defense Against Gradient Inversion via Orthogonal Subspace Bayesian Sampling." pith.science (2026). https://pith.science/paper/JLG3Z3M7

@misc{pith2026250115718,
  author       = {Pith},
  title        = {Pith review of: CENSOR: Defense Against Gradient Inversion via Orthogonal Subspace Bayesian Sampling},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JLG3Z3M7}},
  note         = {Machine review of arXiv:2501.15718}
}
read the original abstract

Federated learning collaboratively trains a neural network on a global server, where each local client receives the current global model weights and sends back parameter updates (gradients) based on its local private data. The process of sending these model updates may leak client's private data information. Existing gradient inversion attacks can exploit this vulnerability to recover private training instances from a client's gradient vectors. Recently, researchers have proposed advanced gradient inversion techniques that existing defenses struggle to handle effectively. In this work, we present a novel defense tailored for large neural network models. Our defense capitalizes on the high dimensionality of the model parameters to perturb gradients within a subspace orthogonal to the original gradient. By leveraging cold posteriors over orthogonal subspaces, our defense implements a refined gradient update mechanism. This enables the selection of an optimal gradient that not only safeguards against gradient inversion attacks but also maintains model utility. We conduct comprehensive experiments across three different datasets and evaluate our defense against various state-of-the-art attacks and defenses. Code is available at https://censor-gradient.github.io.

Figures

Figures reproduced from arXiv: 2501.15718 by the authors.

Figure 1
Figure 1. Intuition of cold Bayesian posteriors sampling over [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Results of SOTA attacks inversions (batch size equals [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. GGL consistently inverts similar images across [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (6 more)
Figure 5
Figure 5. Figure 5: Orthogonal projection. the learning rate, and R is the total number of training rounds. At each round τ , the global model will randomly select a set of K clients for training. Line 2 introduces the local client’s input. It has its own local dataset Dk and optimizes th…
Figure 6
Figure 6. Figure 6: Qualitative evaluation of various attack inversions under existing defenses. [PITH_FULL_IMAGE:figures/full_fig_p011_6.png]
Figure 8
Figure 8. Figure 8: Testing loss on CIFAR-10. Table III: Adaptive attack with EOT. Dataset EOT MSE ↑ LPIPS ↑ PSNR ↓ SSIM ↓ ImageNet w/o 0.0507 0.7610 13.32 0.0094 w/. 0.0518 0.7668 13.39 0.0087 FFHQ w/o 0.1037 0.8097 9.90 0.0195 w/. 0.1098 0.8340 9.82 0.0195 an effective strategy to mitig…
Figure 7
Figure 7. Figure 7: Testing accuracy on CIFAR-10. orthogonal gradient selection process [PITH_FULL_IMAGE:figures/full_fig_p012_7.png]
Figure 10
Figure 10. Figure 10: Gradient inversion under CENSOR, with random gradient vectors constructed from “Black grouse” images. their high-dimensional parameter spaces. These subspaces are defined as the set of parameter configurations near the current parameters that still achieve similar per…
Figure 11
Figure 11. Figure 11: Trials examples on GIAS. Effect of Applying Layer-wise Operation. We explore the impact of applying the layer-wise operation of CENSOR. The experiment, conducted on ImageNet using the GIFD attack, is detailed in Table VII. We assess the inversion performance of the at…

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Images in Motion?: A First Look into Video Leakage in Collaborative Deep Learning

    cs.CV 2025-09 conditional novelty 6.0 of 10

    Gradient inversion recovers low-resolution frames from single-sample video gradients in federated learning, and super-resolution modestly improves fidelity against originals, while feature extractors resist the attack...

  2. Shadow defense against gradient inversion attack in federated learning

    cs.LG 2025-05 conditional novelty 5.0 of 10

    A shadow-model-based defense adds sample-specific noise to medical images in federated learning, weakening gradient inversion attacks while keeping model accuracy near baseline.

Reference graph

Works this paper leans on

77 extracted references · 38 canonical work pages · cited by 2 Pith papers

  1. [1]

    Communication-efficient learning of deep networks from decentralized data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Artificial intelligence and statistics . PMLR, 2017, pp. 1273– 1282

    2017

  2. [2]

    Secureboost: A lossless federated learning framework,

    K. Cheng, T. Fan, Y . Jin, Y . Liu, T. Chen, D. Papadopoulos, and Q. Yang, “Secureboost: A lossless federated learning framework,” IEEE Intelligent Systems, vol. 36, no. 6, pp. 87–98, 2021

    work page 2021

  3. [3]

    Federated learning for ultra-reliable low-latency v2v communications,

    S. Samarakoon, M. Bennis, W. Saad, and M. Debbah, “Federated learning for ultra-reliable low-latency v2v communications,” in 2018 IEEE Global Communications Conference (GLOBECOM) . IEEE, 2018, pp. 1–7

    work page 2018

  4. [4]

    Gifd: A generative gradient inversion method with feature domain optimization,

    H. Fang, B. Chen, X. Wang, Z. Wang, and S.-T. Xia, “Gifd: A generative gradient inversion method with feature domain optimization,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2023, pp. 4967–4976

    2023

  5. [5]

    Inverting gradients-how easy is it to break privacy in federated learning?

    J. Geiping, H. Bauermeister, H. Dr ¨oge, and M. Moeller, “Inverting gradients-how easy is it to break privacy in federated learning?” Advances in Neural Information Processing Systems , vol. 33, pp. 16 937–16 947, 2020

    2020

  6. [6]

    Gradient inversion with generative image prior,

    J. Jeon, K. Lee, S. Oh, J. Ok et al., “Gradient inversion with generative image prior,” Advances in neural information processing systems , vol. 34, pp. 29 898–29 908, 2021

    2021

  7. [7]

    Cafe: Catas- trophic data leakage in vertical federated learning,

    X. Jin, P.-Y . Chen, C.-Y . Hsu, C.-M. Yu, and T. Chen, “Cafe: Catas- trophic data leakage in vertical federated learning,” Advances in Neural Information Processing Systems , vol. 34, pp. 994–1006, 2021

    2021

  8. [8]

    Auditing privacy defenses in federated learning via generative gradient leakage,

    Z. Li, J. Zhang, L. Liu, and J. Liu, “Auditing privacy defenses in federated learning via generative gradient leakage,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2022, pp. 10 132–10 142

    2022

Show all 77 references
  1. [9]

    See through gradients: Image batch recovery via gradinversion,

    H. Yin, A. Mallya, A. Vahdat, J. M. Alvarez, J. Kautz, and P. Molchanov, “See through gradients: Image batch recovery via gradinversion,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2021, pp. 16 337–16 346

    2021

  2. [10]

    idlg: Improved deep leakage from gradients,

    B. Zhao, K. R. Mopuri, and H. Bilen, “idlg: Improved deep leakage from gradients,” arXiv preprint arXiv:2001.02610 , 2020

    2001 arXiv

  3. [11]

    Deep leakage from gradients,

    L. Zhu, Z. Liu, and S. Han, “Deep leakage from gradients,” Advances in neural information processing systems , vol. 32, 2019

    2019

  4. [12]

    Privacy- preserving deep learning: Revisited and enhanced,

    L. T. Phong, Y . Aono, T. Hayashi, L. Wang, and S. Moriai, “Privacy- preserving deep learning: Revisited and enhanced,” in Applications and Techniques in Information Security: 8th International Conference, ATIS 2017, Auckland, New Zealand, July 6–7, 2017, Proceedings . Springe...

    2017

  5. [13]

    Differentially private federated learning: A client level perspective,

    R. C. Geyer, T. Klein, and M. Nabi, “Differentially private federated learning: A client level perspective,” arXiv preprint arXiv:1712.07557 , 2017

    2017 arXiv

  6. [14]

    Gradient-leakage resilient federated learning,

    W. Wei, L. Liu, Y . Wu, G. Su, and A. Iyengar, “Gradient-leakage resilient federated learning,” in 2021 IEEE 41st International Conference on Distributed Computing Systems (ICDCS) . IEEE, 2021, pp. 797–807

    2021

  7. [15]

    Sparse communication for distributed gradient descent,

    A. F. Aji and K. Heafield, “Sparse communication for distributed gradient descent,” in Proceedings of the 2017 Conference on Empirical Methods in Natural Language Processing . Association for Computational Linguistics, 2017, pp. 440–445

    2017

  8. [16]

    Soteria: Provable defense against privacy leakage in federated learning from representation perspective,

    J. Sun, A. Li, B. Wang, H. Yang, H. Li, and Y . Chen, “Soteria: Provable defense against privacy leakage in federated learning from representation perspective,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2021, pp. 9311–9319

    2021

  9. [17]

    Continual learning in low-rank orthogonal subspaces,

    A. Chaudhry, N. Khan, P. Dokania, and P. Torr, “Continual learning in low-rank orthogonal subspaces,” Advances in Neural Information Processing Systems, vol. 33, pp. 9900–9911, 2020

    2020

  10. [18]

    Learning neural network subspaces,

    M. Wortsman, M. C. Horton, C. Guestrin, A. Farhadi, and M. Rastegari, “Learning neural network subspaces,” in International Conference on Machine Learning. PMLR, 2021, pp. 11 217–11 227

    2021

  11. [19]

    What are bayesian neural network posteriors really like?

    P. Izmailov, S. Vikram, M. D. Hoffman, and A. G. G. Wilson, “What are bayesian neural network posteriors really like?” in International conference on machine learning . PMLR, 2021, pp. 4629–4640

    2021

  12. [20]

    R. M. Neal, Bayesian learning for neural networks . Springer Science & Business Media, 2012, vol. 118

    2012

  13. [21]

    Robbing the fed: Directly obtaining private data in federated learning with modified models,

    L. Fowl, J. Geiping, W. Czaja, M. Goldblum, and T. Goldstein, “Robbing the fed: Directly obtaining private data in federated learning with modified models,” arXiv preprint arXiv:2110.13057 , 2021

    2021 arXiv

  14. [22]

    Fishing for user data in large-batch federated learning via gradient magnification,

    Y . Wen, J. Geiping, L. Fowl, M. Goldblum, and T. Goldstein, “Fishing for user data in large-batch federated learning via gradient magnification,” arXiv preprint arXiv:2202.00580 , 2022

    2022 arXiv

  15. [23]

    Gan inversion: A survey,

    W. Xia, Y . Zhang, Y . Yang, J.-H. Xue, B. Zhou, and M.-H. Yang, “Gan inversion: A survey,” IEEE transactions on pattern analysis and machine intelligence, vol. 45, no. 3, pp. 3121–3138, 2022

    2022

  16. [24]

    Generative adversarial nets,

    I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y . Bengio, “Generative adversarial nets,” Advances in neural information processing systems , vol. 27, 2014

    2014

  17. [25]

    Gradvit: Gradient inversion of vision transformers,

    A. Hatamizadeh, H. Yin, H. R. Roth, W. Li, J. Kautz, D. Xu, and P. Molchanov, “Gradvit: Gradient inversion of vision transformers,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022, pp. 10 021–10 030

    2022

  18. [26]

    Intermediate layer optimization for inverse problems using deep generative models,

    G. Daras, J. Dean, A. Jalal, and A. G. Dimakis, “Intermediate layer optimization for inverse problems using deep generative models,” arXiv preprint arXiv:2102.07364, 2021

    2021 arXiv

  19. [27]

    User- level privacy-preserving federated learning: Analysis and performance optimization,

    K. Wei, J. Li, M. Ding, C. Ma, H. Su, B. Zhang, and H. V . Poor, “User- level privacy-preserving federated learning: Analysis and performance optimization,” IEEE Transactions on Mobile Computing , vol. 21, no. 9, pp. 3388–3401, 2021

    2021

  20. [28]

    Deep learning with differential privacy,

    M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” in Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, 2016, pp. 308–318

    2016

  21. [29]

    Evaluating gradient inversion attacks and defenses in federated learning,

    Y . Huang, S. Gupta, Z. Song, K. Li, and S. Arora, “Evaluating gradient inversion attacks and defenses in federated learning,” Advances in Neural Information Processing Systems , vol. 34, pp. 7232–7241, 2021

    2021

  22. [30]

    Pattern recognition and machine learning,

    C. M. Bishop, “Pattern recognition and machine learning,” Springer google schola, vol. 2, pp. 645–678, 2006

    2006

  23. [31]

    A practical bayesian framework for backpropagation networks,

    D. J. MacKay, “A practical bayesian framework for backpropagation networks,” Neural computation, vol. 4, no. 3, pp. 448–472, 1992

    1992

  24. [32]

    Cyclical stochastic gradient mcmc for bayesian deep learning,

    R. Zhang, C. Li, J. Zhang, C. Chen, and A. G. Wilson, “Cyclical stochastic gradient mcmc for bayesian deep learning,” arXiv preprint arXiv:1902.03932, 2019

    1902 arXiv

  25. [33]

    Orthogonal gradient descent for continual learning,

    M. Farajtabar, N. Azizan, A. Mott, and A. Li, “Orthogonal gradient descent for continual learning,” in International Conference on Artificial Intelligence and Statistics . PMLR, 2020, pp. 3762–3773

    2020

  26. [34]

    A theoretical analysis of catastrophic forgetting through the ntk overlap matrix,

    T. Doan, M. A. Bennani, B. Mazoure, G. Rabusseau, and P. Alquier, “A theoretical analysis of catastrophic forgetting through the ntk overlap matrix,” in International Conference on Artificial Intelligence and Statistics. PMLR, 2021, pp. 1072–1080

    2021

  27. [35]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in CVPR, 2016

    2016

  28. [36]

    Imagenet: A large-scale hierarchical image database,

    J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “Imagenet: A large-scale hierarchical image database,” in 2009 IEEE conference on computer vision and pattern recognition . Ieee, 2009, pp. 248–255

    2009

  29. [37]

    A style-based generator architecture for generative adversarial networks,

    T. Karras, S. Laine, and T. Aila, “A style-based generator architecture for generative adversarial networks,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2019, pp. 4401– 4410

    2019

  30. [38]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky, G. Hinton et al., “Learning multiple layers of features from tiny images,” 2009

    2009

  31. [39]

    Large scale gan training for high fidelity natural image synthesis,

    A. Brock, J. Donahue, and K. Simonyan, “Large scale gan training for high fidelity natural image synthesis,” arXiv preprint arXiv:1809.11096 , 2018

    2018 arXiv

  32. [40]

    Dodge,The concise encyclopedia of statistics

    Y . Dodge,The concise encyclopedia of statistics . Springer Science & Business Media, 2008

    2008

  33. [41]

    The unreasonable effectiveness of deep features as a perceptual metric,

    R. Zhang, P. Isola, A. A. Efros, E. Shechtman, and O. Wang, “The unreasonable effectiveness of deep features as a perceptual metric,” in 14 Proceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 586–595

    2018

  34. [42]

    Visual distortion gauge based on discrimination of noticeable contrast changes,

    W. Lin, L. Dong, and P. Xue, “Visual distortion gauge based on discrimination of noticeable contrast changes,” IEEE transactions on circuits and systems for video technology , vol. 15, no. 7, pp. 900–909, 2005

    2005

  35. [43]

    Multiscale structural similarity for image quality assessment,

    Z. Wang, E. P. Simoncelli, and A. C. Bovik, “Multiscale structural similarity for image quality assessment,” in The Thrity-Seventh Asilomar Conference on Signals, Systems & Computers, 2003 , vol. 2. Ieee, 2003, pp. 1398–1402

    2003

  36. [44]

    How to backdoor federated learning,

    E. Bagdasaryan, A. Veit, Y . Hua, D. Estrin, and V . Shmatikov, “How to backdoor federated learning,” in International conference on artificial intelligence and statistics . PMLR, 2020, pp. 2938–2948

    2020

  37. [45]

    Estimating a dirichlet distribution,

    T. Minka, “Estimating a dirichlet distribution,” 2000

    2000

  38. [46]

    Synthesizing robust adversarial examples,

    A. Athalye, L. Engstrom, A. Ilyas, and K. Kwok, “Synthesizing robust adversarial examples,” in International conference on machine learning . PMLR, 2018, pp. 284–293

    2018

  39. [47]

    Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples,

    A. Athalye, N. Carlini, and D. Wagner, “Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples,” in International conference on machine learning . PMLR, 2018, pp. 274–283

    2018

  40. [48]

    On adaptive attacks to adversarial example defenses,

    F. Tramer, N. Carlini, W. Brendel, and A. Madry, “On adaptive attacks to adversarial example defenses,” Advances in neural information processing systems, vol. 33, pp. 1633–1645, 2020

    2020

  41. [49]

    Visualizing the loss landscape of neural nets,

    H. Li, Z. Xu, G. Taylor, C. Studer, and T. Goldstein, “Visualizing the loss landscape of neural nets,” Advances in neural information processing systems, vol. 31, 2018

    2018

  42. [50]

    Loss surfaces, mode connectivity, and fast ensembling of dnns,

    T. Garipov, P. Izmailov, D. Podoprikhin, D. P. Vetrov, and A. G. Wilson, “Loss surfaces, mode connectivity, and fast ensembling of dnns,”Advances in neural information processing systems , vol. 31, 2018

    2018

  43. [51]

    Qualitatively characterizing neural network optimization problems,

    I. J. Goodfellow, O. Vinyals, and A. M. Saxe, “Qualitatively characterizing neural network optimization problems,” arXiv preprint arXiv:1412.6544 , 2014

    2014 arXiv

  44. [52]

    Subspace inference for bayesian deep learning,

    P. Izmailov, W. J. Maddox, P. Kirichenko, T. Garipov, D. Vetrov, and A. G. Wilson, “Subspace inference for bayesian deep learning,” in Uncertainty in Artificial Intelligence . PMLR, 2020, pp. 1169–1179

    2020

  45. [53]

    Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning,

    M. Nasr, R. Shokri, and A. Houmansadr, “Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning,” in 2019 IEEE symposium on security and privacy (SP) . IEEE, 2019, pp. 739–753

    2019

  46. [54]

    Membership inference attacks against machine learning models,

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Membership inference attacks against machine learning models,” in 2017 IEEE symposium on security and privacy (SP) . IEEE, 2017, pp. 3–18

    2017

  47. [55]

    Membership inference attacks from first principles,

    N. Carlini, S. Chien, M. Nasr, S. Song, A. Terzis, and F. Tramer, “Membership inference attacks from first principles,” in 2022 IEEE Symposium on Security and Privacy (SP) . IEEE, 2022, pp. 1897–1914

    2022

  48. [56]

    Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models,

    A. Salem, Y . Zhang, M. Humbert, P. Berrang, M. Fritz, and M. Backes, “Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models,” arXiv preprint arXiv:1806.01246, 2018

    2018 arXiv

  49. [57]

    Membership leakage in label-only exposures,

    Z. Li and Y . Zhang, “Membership leakage in label-only exposures,” in Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, 2021, pp. 880–895

    2021

  50. [58]

    Membership privacy: a unifying framework for privacy definitions,

    N. Li, W. Qardaji, D. Su, Y . Wu, and W. Yang, “Membership privacy: a unifying framework for privacy definitions,” in Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security, ser. CCS ’13. New York, NY , USA: Association for Computing Machinery, 201...

    2013

  51. [59]

    Property inference attacks on fully connected neural networks using permutation invariant representations,

    K. Ganju, Q. Wang, W. Yang, C. A. Gunter, and N. Borisov, “Property inference attacks on fully connected neural networks using permutation invariant representations,” in Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security , ser. CCS ’18. New Y...

    2018

  52. [60]

    Exploiting unintended feature leakage in collaborative learning,

    L. Melis, C. Song, E. De Cristofaro, and V . Shmatikov, “Exploiting unintended feature leakage in collaborative learning,” in 2019 IEEE symposium on security and privacy (SP) . IEEE, 2019, pp. 691–706

    2019

  53. [61]

    Model inversion attacks that exploit confidence information and basic countermeasures,

    M. Fredrikson, S. Jha, and T. Ristenpart, “Model inversion attacks that exploit confidence information and basic countermeasures,” in Proceedings of the 22nd ACM SIGSAC conference on computer and communications security, 2015, pp. 1322–1333

    2015

  54. [62]

    The secret revealer: Generative model-inversion attacks against deep neural networks,

    Y . Zhang, R. Jia, H. Pei, W. Wang, B. Li, and D. Song, “The secret revealer: Generative model-inversion attacks against deep neural networks,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2020, pp. 253–261

    2020

  55. [63]

    Neural network inversion in adversarial setting via background knowledge alignment,

    Z. Yang, J. Zhang, E.-C. Chang, and Z. Liang, “Neural network inversion in adversarial setting via background knowledge alignment,” in Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, 2019, pp. 225–240

    2019

  56. [64]

    Dreaming to distill: Data-free knowledge transfer via deepinversion,

    H. Yin, P. Molchanov, J. M. Alvarez, Z. Li, A. Mallya, D. Hoiem, N. K. Jha, and J. Kautz, “Dreaming to distill: Data-free knowledge transfer via deepinversion,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2020, pp. 8715–8724

    2020

  57. [65]

    Imu: Physical impersonating attack for face recognition system with natural style changes,

    S. An, Y . Yao, Q. Xu, S. Ma, G. Tao, S. Cheng, K. Zhang, Y . Liu, G. Shen, I. Kelk et al. , “Imu: Physical impersonating attack for face recognition system with natural style changes,” in 2023 IEEE Symposium on Security and Privacy (SP) . IEEE, 2023, pp. 899–916

    2023

  58. [66]

    Robust physical-world attacks on deep learning visual classification,

    K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, C. Xiao, A. Prakash, T. Kohno, and D. Song, “Robust physical-world attacks on deep learning visual classification,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2018, pp. 1625–1634

    2018

  59. [67]

    Rethinking the invisible protection against unauthorized image usage in stable diffusion,

    S. An, L. Yan, S. Cheng, G. Shen, K. Zhang, Q. Xu, G. Tao, and X. Zhang, “Rethinking the invisible protection against unauthorized image usage in stable diffusion,” in 33rd USENIX Security Symposium (USENIX Security 24), 2024, pp. 3621–3638

    2024

  60. [68]

    Privacy risk in machine learning: Analyzing the connection to overfitting,

    S. Yeom, I. Giacomelli, M. Fredrikson, and S. Jha, “Privacy risk in machine learning: Analyzing the connection to overfitting,” in 2018 IEEE 31st computer security foundations symposium (CSF) . IEEE, 2018, pp. 268–282

    2018

  61. [69]

    Practical blind membership inference attack via differential comparisons,

    B. Hui, Y . Yang, H. Yuan, P. Burlina, N. Z. Gong, and Y . Cao, “Practical blind membership inference attack via differential comparisons,” arXiv preprint arXiv:2101.01341, 2021

    2021 arXiv

  62. [70]

    Memguard: Defending against black-box membership inference attacks via adversarial examples,

    J. Jia, A. Salem, M. Backes, Y . Zhang, and N. Z. Gong, “Memguard: Defending against black-box membership inference attacks via adversarial examples,” in Proceedings of the 2019 ACM SIGSAC conference on computer and communications security , 2019, pp. 259–274

    2019

  63. [71]

    Practical secure aggregation for privacy-preserving machine learning,

    K. Bonawitz, V . Ivanov, B. Kreuter, A. Marcedone, H. B. McMahan, S. Patel, D. Ramage, A. Segal, and K. Seth, “Practical secure aggregation for privacy-preserving machine learning,” in proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security , 2017...

    2017

  64. [72]

    Privacy-preserving machine learning using federated learning and secure aggregation,

    D. Lia and M. Togan, “Privacy-preserving machine learning using federated learning and secure aggregation,” in 2020 12th International Conference on Electronics, Computers and Artificial Intelligence (ECAI) . IEEE, 2020, pp. 1–6

    2020

  65. [73]

    Siren: Byzantine-robust federated learning via proactive alarming,

    H. Guo, H. Wang, T. Song, Y . Hua, Z. Lv, X. Jin, Z. Xue, R. Ma, and H. Guan, “Siren: Byzantine-robust federated learning via proactive alarming,” in Proceedings of the ACM Symposium on Cloud Computing , 2021, pp. 47–60

    2021

  66. [74]

    FLIP: A provable defense framework for backdoor mitigation in federated learning,

    K. Zhang, G. Tao, Q. Xu, S. Cheng, S. An, Y . Liu, S. Feng, G. Shen, P.-Y . Chen, S. Ma, and X. Zhang, “FLIP: A provable defense framework for backdoor mitigation in federated learning,” in The Eleventh International Conference on Learning Representations , 2023. [Online]. Ava...

    2023

  67. [75]

    Siren+: Robust federated learning with proactive alarming and differential privacy,

    H. Guo, H. Wang, T. Song, Y . H. R. Ma, X. Jin, Z. Xue, and H. Guan, “Siren+: Robust federated learning with proactive alarming and differential privacy,”IEEE Transactions on Dependable and Secure Computing, 2024

    2024

  68. [76]

    Privacy-preserving deep learning via additively homomorphic encryption,

    Y . Aono, T. Hayashi, L. Wang, S. Moriai et al., “Privacy-preserving deep learning via additively homomorphic encryption,” IEEE transactions on information forensics and security , vol. 13, no. 5, pp. 1333–1345, 2017

    2017

  69. [77]

    Efficient privacy-preserving matrix factorization for recommendation via fully homomorphic encryption,

    J. Kim, D. Koo, Y . Kim, H. Yoon, J. Shin, and S. Kim, “Efficient privacy-preserving matrix factorization for recommendation via fully homomorphic encryption,” ACM Transactions on Privacy and Security (TOPS), vol. 21, no. 4, pp. 1–30, 2018. 15 APPENDIX A. Summary of Symbols We...

    2018

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.